Salesforce

Salesforce

This connector reads and writes your Salesforce org through the Salesforce REST API v67.0 (Summer '26) on your org's own address, https://<My Domain>.my.salesforce.com/services/data/v67.0. Every call runs as the Salesforce user who authorized the connector: that user's profile, permission sets and sharing rules decide which objects, fields and records the AI can see and change.

Who can use it: API access is included in Enterprise, Unlimited, Performance and Developer Edition. Professional Edition needs the API add-on from Salesforce; without it every call answers API_DISABLED_FOR_ORG. The user also needs the API Enabled permission (on by default for the standard profiles of those editions). A free Developer Edition org from https://developer.salesforce.com/signup is the quickest way to try it.

Setup (one-time, about 10 minutes, needs a Salesforce admin) Since Spring '26 Salesforce no longer lets orgs create new Connected Apps unless Support re-enables it; their replacement is the External Client App. An existing Connected App with the same settings works too.

1. In Salesforce: Setup, type App Manager in Quick Find, then New External Client App. Name it (e.g. "AnythingMCP"), enter a contact email and keep Distribution State: Local.
2. Open API (Enable OAuth Settings) and tick Enable OAuth.
3. Callback URL: https://cloud.anythingmcp.com/api/mcp-oauth/callback on AnythingMCP Cloud, or <your AnythingMCP URL>/api/mcp-oauth/callback when you host AnythingMCP yourself. It must match character for character (redirect_uri_mismatch otherwise).
4. OAuth Scopes: add Manage user data via APIs (api) and Perform requests at any time (refresh_token, offline_access). Without the second one Salesforce issues no refresh token and the connector stops when the session expires.
5. Security: tick Require Proof Key for Code Exchange (PKCE) extension for Supported Authorization Flows (AnythingMCP always sends a PKCE challenge) and keep Require secret for Web Server Flow and Require secret for Refresh Token Flow ticked: AnythingMCP is a server-side client and keeps the secret encrypted. Leave the client credentials, JWT bearer and device flows off. Click Create.
6. Back in External Client App Manager, open the app → Settings tab → OAuth Settings → Consumer Key and Secret (Salesforce may ask for a verification code). Paste the Consumer Key into SALESFORCE_CLIENT_ID and the Consumer Secret into SALESFORCE_CLIENT_SECRET.
7. Set SALESFORCE_MY_DOMAIN to the first part of your org's address (Setup → My Domain): acme for acme.my.salesforce.com. A pasted full address such as https://acme.my.salesforce.com/lightning/page/home is shortened to it when saved. The address must end in .my.salesforce.com; the Lightning address acme.lightning.force.com is not the API host.
8. On the connector page click Authorize with Provider, log in as the Salesforce user the AI should act as and click Allow. The refresh token is stored encrypted and access tokens are renewed automatically.

Sandboxes, Developer Edition, scratch orgs: each org has its own My Domain and needs its own connector, with an External Client App that exists in that org. Enter everything before .my.salesforce.com: acme--uat.sandbox for the sandbox acme--uat.sandbox.my.salesforce.com, acme-dev-ed.develop for a Developer Edition org. Sign-in and token renewal use the same My Domain, so the old test.salesforce.com login host is never involved.

Access policies: by default the app lets every user authorize it themselves (Policies → OAuth Policies → Permitted Users: all users can self-authorize). If your admin set it to Admin approved users are pre-authorized, assign the user's profile or a permission set to the app first. If the user's profile has Login IP Ranges, either relax IP restrictions in the app's OAuth policies or allow the AnythingMCP server's address. Refresh tokens stay valid until revoked unless the app's policy sets an expiry; after it the connector answers 401 and needs Authorize with Provider again.

How to work with the data

• Start with salesforce_list_objects to see the objects of the org (standard and custom, custom ones end in __c), then salesforce_describe_object for the API field names, types, required fields, picklist values and relationship names of one object. Field and object names in queries and writes are API names (AnnualRevenue, Region__c), never labels.
• salesforce_query runs SOQL, the read workhorse: SELECT Id, Name, Industry FROM Account WHERE Industry = 'Banking' ORDER BY Name LIMIT 50. Strings use single quotes; dates and date-times are unquoted (CloseDate >= 2026-01-01, CreatedDate = LAST_N_DAYS:30, THIS_QUARTER); LIKE 'Acme%' matches text; parent fields use the relationship name (Account.Name from Contact, Owner.Name), child records a subquery (SELECT Name, (SELECT LastName FROM Contacts) FROM Account); aggregates with COUNT(), SUM(Amount) and GROUP BY. There is no SELECT *: list the fields, or use FIELDS(STANDARD) (with LIMIT 200 at most for FIELDS(ALL) and FIELDS(CUSTOM)).
• Paging: a query returns up to 2,000 records per page. When the answer has "done": false, it carries nextRecordsUrl, e.g. /services/data/v67.0/query/01gRO0000016PIAYA2-500; pass its last part (01gRO0000016PIAYA2-500) to salesforce_query_more and repeat until done is true. totalSize is the full count. For a count only, SELECT COUNT() FROM Lead WHERE IsConverted = false returns totalSize without records.
• salesforce_search_text finds a word or name across objects without writing SOSL; salesforce_search_sosl takes a full SOSL statement (FIND {Acme*} IN NAME FIELDS RETURNING Account(Id, Name), Contact(Id, Name, Email) LIMIT 20). Search uses the search index, so a record created a moment ago may not be found yet; SOQL sees it at once.
• salesforce_list_recently_viewed, salesforce_list_list_views and salesforce_get_list_view_results show what the user works with in the Salesforce UI.
• Writes: salesforce_create_record and salesforce_update_record take a fields object with API names, e.g. {"LastName": "Rossi", "Email": "[email protected]", "AccountId": "001..."}. An update changes only the fields sent and answers with no content (HTTP 204) when it worked. Picklist fields take the picklist value, lookups take a record ID, dates YYYY-MM-DD, date-times ISO 8601 in UTC. Validation rules, required fields, duplicate rules, flows and triggers of the org apply as in the UI. salesforce_create_record_tree creates up to 200 records, or an account with its contacts and opportunities, in one all-or-nothing call. Deleting records is not part of this connector.
• Record IDs are 15 or 18 characters; their first three characters name the object (001 Account, 003 Contact, 00Q Lead, 006 Opportunity, 500 Case; keyPrefix in salesforce_list_objects).

API limits: every call counts against the org's rolling 24-hour API request allowance, shared by all integrations. salesforce_get_org_limits shows the remaining calls (DailyApiRequests) and storage; it needs the View Setup and Configuration permission.

Common errors

• 401 INVALID_SESSION_ID ("Session expired or invalid"): the access token expired. AnythingMCP renews it with the refresh token and retries once by itself. If it still fails, the refresh token was revoked (the app's refresh token policy, or an admin revoking access under Setup → Connected Apps OAuth Usage): click Authorize with Provider again.
• 400 MALFORMED_QUERY: a SOQL syntax error, e.g. double quotes around a string, a quoted date, a missing FROM or a LIMIT above what the clause allows. The message names the position.
• 400 INVALID_FIELD / INVALID_TYPE: a field or object name does not exist, is spelled as a label, lacks the __c suffix, or is hidden from this user by field-level security. Check it with salesforce_describe_object.
• 400 REQUIRED_FIELD_MISSING, FIELD_CUSTOM_VALIDATION_EXCEPTION, INVALID_OR_NULL_FOR_RESTRICTED_PICKLIST, DUPLICATES_DETECTED: the org refused a write; the message says which field and why.
• 403 REQUEST_LIMIT_EXCEEDED: the org used up its daily API allowance (or too many long-running requests run at once). Wait, or ask Salesforce for more.
• API_DISABLED_FOR_ORG: the org's edition has no API access (Professional without the API add-on). A user without the API Enabled permission is refused as well.
• 404 NOT_FOUND: the record ID does not exist, was deleted, or is not shared with this user.
• At sign-in: redirect_uri_mismatch (callback URL differs), invalid_client_id (consumer key wrong, or the app was created minutes ago and is not active yet), or a message that the user is not approved for the app (see Access policies).

Out of scope here: deleting records, Bulk API jobs, Apex, Metadata and Tooling API, reports and dashboards, files and attachments.