Manage External MCP Servers in API Catalog
Register external MCP servers manually in API Catalog to make their tools available for use in Agentforce agents. Create connections to authorize the servers in Salesforce and specify the tools they can access. You can also view MCP servers installed from AgentExchange. Then, add tools the servers can use.
Required Editions
| Available in: Lightning Experience |
| Available in: Developer, Enterprise, Performance, and Unlimited Editions |
- From Setup, in the Quick Find box, enter API Catalog, and then select MCP Servers.
- Select the External Servers tab.
- Click Add MCP Server and select Register External MCP Server.
- Enter a unique name and description for the server.
- Enter the server URL. This URL is the HTTPS endpoint for your external Model Context Protocol server.
-
Select an authentication method.
- For No Authentication, skip to the next step.
- For OAuth 2.0, fill in these fields:
- Identity Provider URL: The authorization server endpoint for authentication requests. Pre-filled and read-only for servers registered from AppExchange.
- Scope (optional): Comma-separated list of permissions the server requires to access tools and APIs. Pre-filled and read-only for servers registered from AppExchange.
- Client ID: The unique ID of the Model Context Protocol server, used to request access via the authorization server.
- Client Secret: The MCP server and the authorization server share the password. Keep this value secure.
- For advanced authentication that uses OAuth 2.1, set up the server in Agentforce Registry. See Extend Your Agentforce Implementation.
-
Click Create and Continue.
Salesforce creates a connection with the server and sends a ping to validate it. To authenticate with your server, Salesforce also creates a named credential, external credential, and permission set. Salesforce automatically assigns the ServerName permission set to you so you can manage the server. Your agent doesn't require this permission set on users or the agent's user record to use your server tools. See Named Credentials Schema.
Note If you delete the permission set or remove it from your user record, you can't manage your server.
| EXAMPLE: OAuth 2.0 |
|---|
PayPal's MCP server uses OAuth 2.0 to establish a secure connection between an MCP client and PayPal's MCP server. In the OAuth 2.0 protocol, the client exchanges their client ID and client secret for an access token.
|
Manage External MCP Server Tools in API Catalog
Add and remove tools that a manually registered external MCP server can use.
- From Setup, in the Quick Find box, enter API Catalog, and then select MCP Servers.
- Select the External Servers tab.
- Select a manual external MCP server.
- Select the Tools tab and click Manage Tools.
- To add or remove a tool, switch between Add Tool and Added.

