Salesforce MCP

Activate the Salesforce MCP server

In Salesforce, open Setup.

1. In Quick Find, search for MCP Servers.
2. Open MCP Servers under API Catalog.
3. Enable the server you want to use. For first setup, enable platform/sobject-reads.
4. Wait up to 2 minutes for the server to become active.

If you plan to use the full-access example, enable platform/sobject-all instead.

Create an External Client App

In Salesforce Setup:

1. In Quick Find, search for External Client App Manager.
2. Click New External Client App.
3. Fill out the basic app information. Use a clear name, such as LibreChat Salesforce MCP.
4. Expand API (Enable OAuth Settings) and enable OAuth.
5. Add the LibreChat callback URL.

For local development:

http://localhost:3080/api/mcp/salesforce/oauth/callback

For production, replace the base URL with your public LibreChat URL:

https://chat.example.com/api/mcp/salesforce/oauth/callback

Configure OAuth scopes and security

In the External Client App OAuth settings, add these scopes:

mcp_api
refresh_token

Do not use the standard Salesforce api scope for Hosted MCP servers. The MCP server expects the mcp_api scope.

In the External Client App security settings:

• Select Issue JSON Web Token (JWT)-based access tokens for named users.
• Select Require Proof Key for Code Exchange (PKCE) extension for Supported Authorization Flows.
• Leave Require Secret for Web Server Flow disabled for the basic setup in this guide.
• Leave Require Secret for Refresh Token Flow disabled for the basic setup in this guide.

Click Create, then open the app settings and copy the Consumer Key. Salesforce says a new External Client App can take up to 30 minutes to become available.

Add the Salesforce client ID to .env

Add the External Client App consumer key to your LibreChat .env file:

SALESFORCE_MCP_CLIENT_ID=your-salesforce-consumer-key

If you enabled Require Secret for Web Server Flow, also add:

SALESFORCE_MCP_CLIENT_SECRET=your-salesforce-client-secret

Add Salesforce MCP to librechat.yaml

This example configures the read-only SObject server for a production or Developer Edition org:

mcpServers:
  salesforce:
    type: streamable-http
    url: 'https://api.salesforce.com/platform/mcp/v1/platform/sobject-reads'
    timeout: 90000
    initTimeout: 150000
    requiresOAuth: true
    startup: false
    oauth:
      authorization_url: 'https://login.salesforce.com/services/oauth2/authorize'
      token_url: 'https://login.salesforce.com/services/oauth2/token'
      client_id: '${SALESFORCE_MCP_CLIENT_ID}'
      scope: 'mcp_api refresh_token'
      redirect_uri: 'http://localhost:3080/api/mcp/salesforce/oauth/callback'

For a sandbox or scratch org, use the sandbox MCP URL and Salesforce sandbox OAuth endpoints:

mcpServers:
  salesforce:
    type: streamable-http
    url: 'https://api.salesforce.com/platform/mcp/v1/sandbox/platform/sobject-reads'
    timeout: 90000
    initTimeout: 150000
    requiresOAuth: true
    startup: false
    oauth:
      authorization_url: 'https://test.salesforce.com/services/oauth2/authorize'
      token_url: 'https://test.salesforce.com/services/oauth2/token'
      client_id: '${SALESFORCE_MCP_CLIENT_ID}'
      scope: 'mcp_api refresh_token'
      redirect_uri: 'http://localhost:3080/api/mcp/salesforce/oauth/callback'

If your External Client App requires a client secret, add these fields inside oauth:

oauth:
  client_secret: '${SALESFORCE_MCP_CLIENT_SECRET}'
  token_exchange_method: default_post
  token_endpoint_auth_methods_supported: ['client_secret_post']

If LibreChat is deployed at a public URL, update redirect_uri to match the exact callback URL registered in Salesforce.

Switch to full Salesforce access, if needed

After the read-only server works, you can switch to another activated Salesforce server by changing the url.

For full SObject access in a production or Developer Edition org:

url: 'https://api.salesforce.com/platform/mcp/v1/platform/sobject-all'

For full SObject access in a sandbox or scratch org:

url: 'https://api.salesforce.com/platform/mcp/v1/sandbox/platform/sobject-all'

Only expose mutation or delete-capable servers to users who should be allowed to create, update, or delete Salesforce records through an assistant.

Restart LibreChat

Restart LibreChat so it reloads .env and librechat.yaml.

To confirm the server loaded in Docker, check the API logs:

docker logs LibreChat --tail 200 | grep MCP

Connect Salesforce in LibreChat

Open LibreChat, then open MCP Settings or the MCP Servers dropdown in the chat input.

1. Click Connect for the Salesforce server.
2. Complete the Salesforce OAuth flow.
3. Review the requested mcp_api and refresh_token scopes.
4. Return to LibreChat after the OAuth success page closes.

After OAuth succeeds and the MCP connection initializes, Salesforce tools become available in chat and in the Agent Builder.