Loading
Important Advisory: iOS Update Impacting CG Mobile ApplicationRead More
Extend Salesforce with Clicks, Not Code
Register External MCP Servers in API Catalog

You are here:

  1. Salesforce Help
  2. Docs
  3. Extend Salesforce with Clicks, Not Code

Register External MCP Servers in API Catalog

Register external MCP servers manually in API Catalog to make their tools available for use in Agentforce agents. Create connections to authorize the servers in Salesforce and specify the tools they can access. You can also view MCP servers installed from AgentExchange. Then, add tools the servers can use.

Required Editions

Available in: Lightning Experience
Available in: Developer, Enterprise, Performance, and Unlimited Editions
A flowchart that shows steps for registering and managing an external MCP server in API Catalog.

When you register or edit an external MCP server or add its tools, Salesforce scans the server or tools and assigns a risk score. The score lets you know the level of assessed risk that the server or tool might contain tool poisoning attacks. Examples of tool poisoning attacks include malicious instructions in tool descriptions that can manipulate Agentforce into exfiltrating data, escalating privileges, or ignoring safety guardrails. Review the risk score at each stage and confirm that you understand the risk before proceeding. See MCP Risk Score.

To register and create a connection for an external MCP server, use these steps.

  1. From Setup, in the Quick Find box, enter API Catalog, and then select MCP Servers.
  2. Select the External Servers tab.
  3. Click Add MCP Server and select Register External MCP Server.
  4. Enter a unique name and description for the server.
  5. Enter the server URL. This URL is the HTTPS endpoint for your external MCP server.
  6. Select an authentication method.
    • For No Authentication, skip to the next step.
    • For OAuth 2.0, fill in these fields:
      • Identity Provider URL: The authorization server endpoint for authentication requests. Pre-filled and read-only for servers registered from AppExchange.
      • Scope (optional): Comma-separated list of permissions the server requires to access tools and APIs. Pre-filled and read-only for servers registered from AppExchange.
      • Client ID: The unique ID of the MCP server, used to request access via the authorization server.
      • Client Secret: The MCP server and the authorization servers share the password. Keep this value secure.
  7. Click Create and Continue.

    Salesforce creates a connection with the server and sends a ping to validate it. To authenticate with your server, Salesforce also creates a named credential, external credential, and permission set. Salesforce automatically assigns the ServerName permission set to you so you can manage the server. Your agent doesn't require this permission set on users or the agent's user record to use your server tools. See Named Credentials Schema.

    Note
    Note If you delete the permission set or remove it from your user record, you can't manage your server.
  8. Review the Risk Assessment panel for the server.
    • Low: No action is required. Salesforce found no risks during registration.
    • Medium or High: Review the flagged tool descriptions. Check the box to accept the risk and click Save. See MCP Risk Score.

Manage External MCP Server Tools in API Catalog

Add and remove tools that a manually registered external MCP server can use.

  1. From Setup, in the Quick Find box, enter API Catalog, and then select MCP Servers.
  2. Select the External Servers tab.
  3. Select a manual external MCP server.
  4. Select the Tools tab and click Manage Tools.
  5. To add or remove a tool, switch between Add Tool and Added.
  6. Review the Risk Assessment panel for each tool.
    • Low: No action is required. Salesforce found no risks during registration.
    • Medium or High: Review the flagged tool descriptions. Check the box to accept the risk and click Save. See MCP Risk Score.

See Also

 
Loading
Salesforce Help | Article