Salesforce MCP Server

official

Salesforce integration using OAuth2. Write operations disabled by default per integration. 700+ tools covering SOQL, SOSL, REST, and CRUD, individually selectable. Requires a DataGrout account.

View on datagrout.aiTry this MCPSponsored

What can you do with Salesforce MCP?

  • Query CRM records with SOQL — ask your assistant to run a salesforce@v1/soql@v1 SELECT query to retrieve leads, opportunities, cases, or campaigns.
  • Call any Salesforce REST endpoint — instruct your assistant to use salesforce@v1/rest@v1 to GET data from a specific REST API endpoint.
  • Search across objects with SOSL — have your assistant perform a text-based search across multiple CRM objects using one of the enabled SOSL tools.
  • Perform CRUD operations on CRM objects — once write access is explicitly enabled per tool, your assistant can create, update, or delete records via the appropriate CRUD tools.

Documentation

DataGrout's Salesforce MCP Server connects AI agents to Salesforce through OAuth2, using DataGrout's application credentials or your own. Write operations are disabled by default and require explicit configuration per integration. 700+ tools cover CRM objects — leads, opportunities, cases, campaigns — via SOQL, SOSL, REST, and CRUD, individually selectable rather than exposed as one fixed set.

Setup using CLI:

Go to the DataGrout GitHub and set up using command line interface - https://github.com/DataGrout/conduit-sdk

Setup using DataGrout Portal:

1. Sign up for a DataGrout account
Go to https://app.datagrout.ai/ and create an account.

2. Create a server

  • Click the server dropdown in the top-left of the dashboard.

  • Select Create New Server.

  • Enter a name (required) and an optional description.

  • Click Create Server.

  • Your server is assigned a UUID and generates an MCP endpoint: https://gateway.datagrout.ai/servers/{your-uuid}/mcp

  • You can retrieve this URL any time later under Settings > Server Info.

3. Create an access token

  • Open the server dropdown and click the Settings icon.

  • Go to the Authentication tab.

  • Click Create Access Token.

  • Give it a name, or leave it blank for an auto-generated one.

  • Copy the token immediately — it is shown only once and cannot be retrieved again later.

4. Add the Salesforce integration

  • Go to the Home page — this is the integrations marketplace.

  • Find Salesforce in the list and click Add.

  • You'll be redirected to the Salesforce integration detail page to complete setup.

5. Configure authentication

  • Choose authentication type: OAuth2.

  • Choose whether to use DataGrout's application credentials or your own.

  • Choose environment: Production or Sandbox.

6. Authorize the connection

  • Click Connect.

  • You're redirected to Salesforce's own hosted login/authorization screen to sign in and grant access.

  • Once authorized, you're returned to the DataGrout dashboard.

7. Configure tools and policy

  • On the integration's detail page, select which of the 700+ available tools to expose for this integration.

  • Open the Policy tab to review or adjust the security policy. This inherits from the parent Hub Server's policy and can only be tightened, never loosened — write access must be explicitly enabled per tool if you want it, since it's disabled by default.

MCP Client Configuration:

DataGrout runs one MCP endpoint per server — the same URL and token work across every connected client, and every integration you add (Salesforce included) becomes available through it. No separate config is needed per integration.

{
  "mcpServers": {
    "DataGrout": {
      "url": "https://gateway.datagrout.ai/servers/YOUR_UUID/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_TOKEN"
      }
    }
  }
}

Use this same block for Claude Desktop, Claude Code, Cursor, and Windsurf. VS Code's MCP config may use "servers" instead of "mcpServers" — check your version.

Two other authentication options are available for this endpoint: mutual TLS (production/enterprise agents) and OAuth 2.1 (user-facing apps, via Client Credentials or Authorization Code + PKCE).

Configuration reference:

SettingValuesDefault
Auth typeOAuth2, mTLS, or Bearer token—
CredentialsDataGrout app credentials or user-provided—
EnvironmentProduction or Sandboxuser-selected at setup
Tool exposureIndividually selectable from 700+ toolsnone enabled until selected
Write accessEnabled per tool, per integrationdisabled
PolicyInherits from parent Hub Server; can be tightened, not loosenedinherited

Tools:

  • salesforce@v1/rest@v1 — calls a specified REST endpoint and HTTP method. GET always allowed; other methods depend on policy.

  • salesforce@v1/soql@v1 — runs a SOQL query. SELECT only, no DML. Results paginated and cached.

  • 700+ additional tools for CRM objects via SOQL, SOSL, REST, and CRUD, individually enabled or disabled per integration.

Interaction settings:

  • Cost estimate shown before a tool executes

  • Execution receipt confirming a tool ran

  • Execution summary after completion

Links: