Configure Salesforce for the AI Gateway

To allow your users to securely query Salesforce data and automation using their AI clients, you can configure a Salesforce Hosted Model Context Protocol (MCP) server within the JumpCloud AI Gateway.

Prerequisites

• Before configuring specific enterprise applications, we recommend reviewing the Get Started: AI Gateway guide to familiarize yourself with the gateway architecture and core AI concepts (such as MCP servers and AI clients).

• Salesforce Administrator access to enable Hosted MCP Servers and create an External Client App.

Completing Application Setup

Enable the Hosted MCP Servers you want to use, then create an External Client App for OAuth authentication. See Salesforce’s Set Up Your Org and Create an External Client App.

Configure the following in the External Client App:

• Callback URL: Add the JumpCloud AI Gateway Redirect URL for your region:
  • US: https://console.jumpcloud.com/userconsole/mcp/servers/callback
  • EU: https://console.eu.jumpcloud.com/userconsole/mcp/servers/callback
  • IN: https://console.in.jumpcloud.com/userconsole/mcp/servers/callback
• OAuth Scopes: Select Access MCP servers (mcp_api) and Perform requests at any time (refresh_token).
• Security: Select Issue JSON Web Token (JWT)-based access tokens for named users. Follow Salesforce’s setup guide for the other security settings.
• Consumer Key: Copy the Consumer Key from Settings > OAuth Settings > Consumer Key and Secret. Use it as the Client ID in JumpCloud.
• Consumer Secret: If Require Secret for Web Server Flow is enabled, also copy the Consumer Secret.

note

Salesforce states that a new External Client App can take up to 30 minutes to become available.

Configuring the Server in JumpCloud

See Adding MCP Servers in Configure AI Gateway Integrations and use the following values to configure this server:

• App: Select Salesforce (if you have an existing SSO application or bookmark), or + Add App to create it
• Name: Enter a name, for example Salesforce
• Prefix: Enter a value to prepend to MCP tool names
  • Note: Prefixes must be unique. Maximum 8 characters, letters and numbers only
• URL: Enter the Salesforce Hosted MCP server URL, replacing <SERVER-NAME> with the complete server path, such as platform/sobject-all. See Salesforce’s Standard MCP Servers Reference for available server names:
  • Production orgs: https://api.salesforce.com/platform/mcp/v1/<SERVER-NAME>
  • Sandbox or scratch orgs: https://api.salesforce.com/platform/mcp/v1/sandbox/<SERVER-NAME>
• MCP Authentication method: Select OAuth
• Advanced fields: Enter the following:
  • Client ID: Your External Client App’s Consumer Key
  • Client Secret: Your Consumer Secret, if Require Secret for Web Server Flow is enabled
  • Scope: mcp_api refresh_token

Your users will now see Salesforce listed as an available application when they authenticate their AI clients through the JumpCloud AI Gateway.