salesforce-mcp-server

# Salesforce MCP Server Connects Claude to Horizon Partners' Salesforce org, letting you query records, run SOSL searches, describe objects, manage fields, and execute Apex — all directly from Claude Code. Powered by [`@tsmztech/mcp-server-salesforce`](https://www.npmjs.com/package/@tsmztech/mcp-server-salesforce). ## What you can do | Tool | Description | |---|---| | Query records | Run SOQL queries against any object | | Search all | SOSL search across multiple objects at once | | Describe object | Inspect fields, relationships, and metadata | | DML records | Insert, update, upsert, delete records | | Manage fields | Create or update custom fields | | Read/Write Apex | View and edit Apex classes and triggers | | Execute anonymous | Run Apex code on demand | | Debug logs | Manage and read debug logs | ## Prerequisites - [Node.js](https://nodejs.org/) v18+ (for `npx`) - Claude Code installed - The shared **Consumer Key** and **Consumer Secret** — get these from your Salesforce admin. No Salesforce access of your own is required. --- ## Setup > **Note for admins:** Only one person needs to create the External Client App. Everyone else just uses the shared credentials. Skip to [Step 2](#step-2--register-the-mcp-server-with-claude-code) if you already have the credentials. ### Step 1 — Create the External Client App (admins only, one-time) External Client Apps are Salesforce's modern replacement for Connected Apps. One app, one set of credentials, shared by the whole team. 1. Go to **Setup → App Manager → New External Client App** 2. Fill in a name (e.g. `Claude MCP Server`) and your contact email 3. Under **OAuth Settings**: - Check **Enable OAuth Settings** - **Callback URL:** `https://login.salesforce.com/services/oauth2/success` - **Scopes:** Add `Full access (full)` or at minimum `API` - Check **Enable Client Credentials Flow** 4. Save the app 5. Go to **Manage → Edit Policies** and configure: - **Permitted Users:** `Admin approved users are pre-authorized` ← required for team sharing - **Client Credentials Flow → Run As:** assign a dedicated service account / integration user (this is who all API calls will run as — choose a user with the right data permissions) - Save 6. Click **Manage Consumer Details** (requires MFA) to reveal the **Consumer Key** and **Consumer Secret** 7. Share these two values with your team via your password manager or internal secrets tool (e.g. 1Password, Bitwarden) > **Why a dedicated Run As user?** All calls from the team route through this one user. Using a dedicated service account (rather than a personal account) keeps permissions predictable and avoids disruption if someone leaves the org. ### Step 2 — Register the MCP server with Claude Code Run this command with the shared credentials (get them from your Salesforce admin): ```bash claude mcp add salesforce \ --env SALESFORCE_CONNECTION_TYPE=OAuth_2.0_Client_Credentials \ --env SALESFORCE_CLIENT_ID=<consumer-key> \ --env SALESFORCE_CLIENT_SECRET=<consumer-secret> \ --env SALESFORCE_INSTANCE_URL=https://horizon-partners.my.salesforce.com \ -- npx -y @tsmztech/mcp-server-salesforce ``` ### Step 3 — Restart Claude Code After running the command, restart Claude Code. The Salesforce tools will be available automatically. --- ## Verification Ask Claude: *"Query the 10 most recently modified Accounts in Salesforce"* --- ## Usage examples - *"Find all open Opportunities closing this quarter"* - *"Show me the fields on the Contact object"* - *"Search for any record mentioning Acme Corp"* - *"Create a new Account named Test Co in Salesforce"* - *"Run this Apex: System.debug('hello');"* --- ## Troubleshooting **Authentication errors** — Double-check the Consumer Key/Secret with your admin. Confirm the Client Credentials flow is enabled and has a Run As user assigned under Manage Policies. **"npx not found"** — Install Node.js from [nodejs.org](https://nodejs.org/). **No data returned** — The Run As service account may be missing object/field permissions. Contact your Salesforce admin. **Access denied errors** — The External Client App policy may not be set to "Admin approved users are pre-authorized". Ask your admin to check Manage Policies.