authenticate_passwordLABSCO SUMMARY
An agent can query and change Salesforce data without the UI.
It covers both halves of an org integration: read, through SOQL and SOSL with the object metadata needed to write them correctly, and write, through record CRUD plus the Tooling and Apex escape hatches when the standard calls fall short.
What it is
A TypeScript Salesforce connector. It authenticates with the OAuth password flow against a connected app, then exposes SOQL, SOSL, object metadata, record CRUD, and the Tooling and Apex REST APIs. Tokens refresh themselves so long sessions do not drop.
What you get
- SOQL queries and SOSL searches run against the org
- An object's field metadata — labels and types — read back
- Records fetched by id, created, updated and deleted
- Tooling API requests executed
- Apex REST requests executed
- Username-and-password authentication over OAuth, with automatic token refresh
Requirements
A connected app in Salesforce with OAuth enabled and the api and refresh_token scopes, its consumer key and secret, plus your username, password and security token. Runs from the published Docker image with all of those as environment variables.
Setup effort
One command plus credentials — docker pull steffensbola/salesforce-mcp-ts:latest, then supply credentials
USE CASES
Pulling a list out of the org
Authenticate once, then run the SOQL and take the rows back into the conversation instead of exporting a report.
Finding a record when you only know a phrase
Search across objects with SOSL, then open the record the search found.
Writing a query against an object you do not know
Read the object's fields — API names, labels and types — then write the SOQL against real field names rather than guesses.
Fixing data one record at a time
Fetch the record by id, see what it holds, and update only the fields that are wrong.
Loading records straight out of a conversation
Create the record from what was just agreed and read it back to confirm the values landed.
Reaching something the standard API does not cover
Go through the Tooling API for metadata work, or call an Apex REST endpoint when the logic lives in the org.
11 tools
Listed in project docs. Your client may show a different list.
run_soql_queryrun_sosl_searchget_object_fieldsget_recordcreate_recordupdate_recorddelete_recordtooling_executeapex_executerestfulBEFORE YOU INSTALL
What to know first
Tools you get
11 tools named in the project's documentation.
Requires
- docker on PATH
- SALESFORCE_CLIENT_ID in your environment
- SALESFORCE_CLIENT_SECRET in your environment
- SALESFORCE_PASSWORD in your environment
- SALESFORCE_SECURITY_TOKEN in your environment
- SALESFORCE_USERNAME in your environment
Where it runs
All 3 documented setups run the server on your machine.
INSTALLATION
Connect your client
Server setup
docker pull steffensbola/salesforce-mcp-ts:latestMCP Clients
VS Code — env vars
{
"servers": {
"salesforce": {
"command": "docker",
"args": [
"run",
"--rm",
"-i",
"-e",
"SALESFORCE_CLIENT_ID=<YOUR_SALESFORCE_CLIENT_ID>",
"-e",
"SALESFORCE_CLIENT_SECRET=<YOUR_SALESFORCE_CLIENT_SECRET>",
"-e",
"SALESFORCE_USERNAME=<YOUR_SALESFORCE_USERNAME>",
"-e",
"SALESFORCE_PASSWORD=<YOUR_SALESFORCE_PASSWORD>",
"-e",
"SALESFORCE_SECURITY_TOKEN=<YOUR_SALESFORCE_SECURITY_TOKEN>",
"-e",
"SALESFORCE_SANDBOX=true",
"steffensbola/salesforce-mcp-ts:latest"
]
}
}
}VS Code — mounted .env
{
"servers": {
"salesforce": {
"command": "docker",
"args": [
"run",
"--rm",
"-i",
"-v",
"${workspaceFolder}/.env:/app/.env",
"steffensbola/salesforce-mcp-ts:latest"
]
}
}
}Claude Desktop
{
"mcpServers": {
"salesforce": {
"command": "docker",
"args": [
"run",
"--rm",
"-i",
"-e",
"SALESFORCE_CLIENT_ID=<YOUR_SALESFORCE_CLIENT_ID>",
"-e",
"SALESFORCE_CLIENT_SECRET=<YOUR_SALESFORCE_CLIENT_SECRET>",
"-e",
"SALESFORCE_USERNAME=<YOUR_SALESFORCE_USERNAME>",
"-e",
"SALESFORCE_PASSWORD=<YOUR_SALESFORCE_PASSWORD>",
"-e",
"SALESFORCE_SECURITY_TOKEN=<YOUR_SALESFORCE_SECURITY_TOKEN>",
"-e",
"SALESFORCE_SANDBOX=true",
"steffensbola/salesforce-mcp-ts:latest"
]
}
}
}