Back to Browse
Free
Server data from the Official MCP Registry
MCP server for Salesforce CRM — Accounts, Contacts, Opportunities, Leads, Cases.
About
MCP server for Salesforce CRM — Accounts, Contacts, Opportunities, Leads, Cases.
Security Report
7.2
Moderate7.2Low RiskThis is a well-architected MCP server for Salesforce CRM with intentional scope discipline and strong credential handling practices. The per-request stateless design in gateway mode eliminates persistent secret storage, and credentials are validated before use. Minor code quality issues around error handling breadth and input validation do not significantly impact security given the server's focused toolset and appropriate permissions. Supply chain analysis found 1 known vulnerability in dependencies (0 critical, 1 high severity).
7 files analyzed · 5 issues found
Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.
Permissions Required
This plugin requests these system permissions. Most are normal for its category.
What You'll Need
Set these up before or after installing:
Credential source: 'env' reads vars locally, 'gateway' expects header injection from the WYRE MCP Gateway. Set to 'env' for stdio/local use.
Environment variable: AUTH_MODE
Salesforce auth flow: 'client_credentials' (default, requires a Connected App with Client Credentials Flow enabled) or 'username_password' (fallback).
Environment variable: SALESFORCE_AUTH_FLOW
Connected App consumer key. Required when SALESFORCE_AUTH_FLOW=client_credentials.
Environment variable: SALESFORCE_CLIENT_ID
Connected App consumer secret. Required when SALESFORCE_AUTH_FLOW=client_credentials.Required
Environment variable: SALESFORCE_CLIENT_SECRET
Salesforce org's My Domain URL (e.g. https://yourorg.my.salesforce.com). Required when SALESFORCE_AUTH_FLOW=client_credentials.
Environment variable: SALESFORCE_INSTANCE_URL
Salesforce username. Only used when SALESFORCE_AUTH_FLOW=username_password.
Environment variable: SALESFORCE_USERNAME
Salesforce password. Only used when SALESFORCE_AUTH_FLOW=username_password.Required
Environment variable: SALESFORCE_PASSWORD
Salesforce security token. Only used when SALESFORCE_AUTH_FLOW=username_password; optional if the org has IP allowlisting configured instead.Required
Environment variable: SALESFORCE_TOKEN
Transport mode for the server. Set to 'stdio' for local CLI use; the image defaults to 'http' for gateway hosting.
Environment variable: MCP_TRANSPORT
Log verbosity: debug, info, warn, error
Environment variable: LOG_LEVEL
How to Install
Add this to your MCP configuration file:
{
"mcpServers": {
"io-github-wyre-technology-salesforce-mcp": {
"env": {
"AUTH_MODE": "your-auth-mode-here",
"LOG_LEVEL": "your-log-level-here",
"MCP_TRANSPORT": "your-mcp-transport-here",
"SALESFORCE_TOKEN": "your-salesforce-token-here",
"SALESFORCE_PASSWORD": "your-salesforce-password-here",
"SALESFORCE_USERNAME": "your-salesforce-username-here",
"SALESFORCE_AUTH_FLOW": "your-salesforce-auth-flow-here",
"SALESFORCE_CLIENT_ID": "your-salesforce-client-id-here",
"SALESFORCE_INSTANCE_URL": "your-salesforce-instance-url-here",
"SALESFORCE_CLIENT_SECRET": "your-salesforce-client-secret-here"
},
"args": [
"-y",
"salesforce-mcp"
],
"command": "npx"
}
}
}Documentation
View on GitHubFrom the project's GitHub README.
salesforce-mcp
MCP (Model Context Protocol) server for Salesforce CRM, scoped to the WYRE Gateway BYOC use case.
A focused HTTP MCP server that exposes a Salesforce org's CRM data surface to Claude (and other MCP clients) through the WYRE MCP Gateway. Built for the multi-tenant gateway pattern: credentials are injected per-request via HTTP headers, no startup secrets are baked into the container.
Scope discipline
This package intentionally ships a narrow tool surface — six CRM data tools — and deliberately omits the Apex code-management / custom-object-creation / EXECUTE_ANONYMOUS surfaces that broader Salesforce MCP servers include. The use case is read/write access to standard CRM objects (Accounts, Contacts, Opportunities, Leads, Cases). Customers who need DX or admin tooling should use the official @salesforce/mcp package instead.
Tools
| Tool | Purpose |
|---|---|
salesforce_search_objects | Find standard + custom objects by partial name. |
salesforce_describe_object | Full schema (fields, picklists, relationships) for an object. |
salesforce_query_records | Execute SOQL with relationship traversal. |
salesforce_aggregate_query | SOQL GROUP BY / COUNT / SUM / AVG / MIN / MAX. |
salesforce_dml_records | Insert / update / delete / upsert records. |
salesforce_search_all | Cross-object SOSL search. |
Run modes
http(default): listens on:8080, exposes/mcp(JSON-RPC) +/health. Per-request credentials fromX-Salesforce-*headers. This is the gateway deployment shape.stdio: traditional MCP client transport (Claude Desktop / Cursor). Credentials read once from env. Useful for local testing.
# HTTP mode (gateway default)
PORT=8080 MCP_TRANSPORT=http AUTH_MODE=gateway npm start
# stdio mode (env-baked, local testing)
MCP_TRANSPORT=stdio \
SALESFORCE_AUTH_FLOW=client_credentials \
SALESFORCE_CLIENT_ID=... SALESFORCE_CLIENT_SECRET=... \
SALESFORCE_INSTANCE_URL=https://yourorg.my.salesforce.com \
node dist/entry.js
Header contract (gateway mode)
| Header | Required? | Notes |
|---|---|---|
X-Salesforce-Auth-Mode | optional | client_credentials (default) or username_password. |
X-Salesforce-Client-Id | for client_credentials | Connected App consumer key. |
X-Salesforce-Client-Secret | for client_credentials | Connected App consumer secret. |
X-Salesforce-Instance-Url | for client_credentials | Customer's My Domain URL (e.g. https://acmecorp.my.salesforce.com). |
X-Salesforce-Username | for username_password | Salesforce user. |
X-Salesforce-Password | for username_password | Salesforce password. |
X-Salesforce-Token | for username_password | Security token (required unless IP allowlisted). |
Per-request authentication means the same container instance can service many customers without restart — each MCP tools/call builds a fresh jsforce.Connection from the headers on that request.
Salesforce Connected App setup
For Client Credentials flow (the recommended path):
- Salesforce Setup → App Manager → New Connected App.
- Under API (Enable OAuth Settings): turn on Enable OAuth Settings and Enable Client Credentials Flow.
- Save, wait ~5 minutes for propagation.
- Manage → Edit Policies → Client Credentials Flow → set a Run As user (the API calls run with that user's permissions).
- Copy the Consumer Key and Consumer Secret from the Connected App into the gateway BYOC fields as
clientIdandclientSecret. - Set
instanceUrlto the customer's My Domain URL (Setup → My Domain).
Build
npm install
npm run build
Container
docker build -t salesforce-mcp:dev .
docker run --rm -p 8080:8080 -e MCP_TRANSPORT=http salesforce-mcp:dev
curl -s http://localhost:8080/health
The published image lives at ghcr.io/wyre-technology/salesforce-mcp with :latest, :sha-<short_sha>, and :v<version> tags.
License
Apache-2.0.
Reviews
No reviews yet
Be the first to review this server!
More Business Tools MCP Servers
Toleno
Freeby Toleno · Developer Tools
Toleno Network MCP Server — Manage your Toleno mining account with Claude AI using natural language.
137
Stars
549
Installs
8.0
Security
4.8
Local
mcp-creator-python
Freeby mcp-marketplace · Developer Tools
Create, build, and publish Python MCP servers to PyPI — conversationally.
-
Stars
84
Installs
10.0
Security
4.6
Local
MarkItDown
Freeby Microsoft · Content & Media
Convert files (PDF, Word, Excel, images, audio) to Markdown for LLM consumption
156.1K
Stars
57
Installs
4.2
Security
5.0
Local