Install Salesforce from the connector catalog

Harriet's Salesforce connector catalog entry installs a version-pinned sandboxed npx server — the official Salesforce DX MCP server (@salesforce/mcp@0.30.15, from salesforcecli/mcp) — that runs inside Harriet's isolated sandbox. Each user connects their own Salesforce account, and every tool call runs under that user's Salesforce profile and permission sets.

The enabled toolsets are data (read-only SOQL queries), orgs (org context), and users (user and permission-set tools). The data toolset has no record create/update/delete or Apex-execution tools — it is query-only.

Before you install from the catalog

1. Create a Connected App in Salesforce Setup

The exact type of app to create is a Connected App (or its successor, an External Client App, if your org has the newer framework enabled — the settings are the same). Do not use Canvas apps, Named Credentials, or External Services for this.

1. In Salesforce, go to Setup → App Manager → New Connected App (or Setup → External Client Apps → New External Client App).
2. Fill in name (e.g. "Harriet Salesforce MCP"), API name, and contact email.
3. Check Enable OAuth Settings.
4. Callback URL: your Harriet workspace's MCP OAuth callback:
   https://<your-harriet-host>/bots/integrations/mcp/oauth/callback/
   (The exact URL for your workspace is shown on the catalog install step and on the connector after install.)
5. Selected OAuth Scopes — add exactly these three:
   • Manage user data via APIs (api)
   • Access the identity URL service (id, profile, email, address, phone)
   • Perform requests at any time (refresh_token, offline_access)
6. Leave Require Secret for Web Server Flow and Require Secret for Refresh Token Flow checked — Harriet is a confidential client and stores the secret encrypted.
7. Save. Salesforce can take up to 10 minutes to propagate a new Connected App.
8. Copy the Consumer Key (client ID) and Consumer Secret (click Manage Consumer Details).

2. Set OAuth policies and user access

1. Under the app's Manage → OAuth Policies: set Permitted Users ("All users may self-authorize" for the simplest rollout, or "Admin approved users are pre-authorized" plus profile/permission-set assignment for tighter control) and your IP Relaxation policy.
2. Every user who will connect needs the API Enabled system permission (profile or permission set).

Install from the catalog

1. Go to Company settings → Integrations → Catalog → Salesforce → Install.
2. Enter:
   • OAuth client ID — the Connected App's Consumer Key.
   • OAuth client secret — the Consumer Secret.
   • Login host (optional) — leave blank for login.salesforce.com. Enter test.salesforce.com for sandbox orgs, or your My Domain host (e.g. acme.my.salesforce.com) if your org blocks logins from the generic domain.
3. Create the paired Salesforce skill from a use case ("Look up org data", "User and permission admin", or from scratch). The skill teaches the assistant to resolve the org first (list_all_orgs, get_username), use the read-only run_soql_query for data questions, and confirm before permission-set changes.

After install

• Users connect their own account under Profile → Integrations — each person signs in to Salesforce once and Harriet stores their credential encrypted.
• Sync tools on the connector, set tool permissions, and attach the connector to skills.
• Tool calls run as the connected user: Salesforce object, field, and record access follows their own profile and permission sets. A user who hasn't connected is prompted to do so before tools run.

How it runs (and security notes)

• Harriet runs the pinned official package (@salesforce/mcp@0.30.15) with npx in an isolated per-user sandbox session. Inside the session, Harriet materialises a private Salesforce CLI-style credential store for that one user; sessions are never shared between users, and the server's org allowlist can only ever see that user's org.
• This is Salesforce's official server (Apache-2.0, actively released). Tool calls go through Salesforce's supported Node libraries — tool arguments are not interpolated into shell commands, avoiding the command-injection surface some community Salesforce MCP servers have.
• The data toolset is query-only; there are no DML or anonymous-Apex tools in the enabled set. Telemetry is disabled (--no-telemetry).
• Upgrades are deliberate: the package version is pinned in the catalog and bumped by Harriet after review, so the executed code doesn't change without re-review.

See also Set up OAuth for a sandboxed MCP connector and How to create an MCP connector for the general mechanics of sandboxed connectors and per-user OAuth.