Yogi

Posted on Jun 24

How I Connected Claude Desktop to Live Salesforce CRM Data Using MCP

#mcp #ai #claude #security

I recently deployed a real-time integration between Claude Desktop and Salesforce CRM using Model Context Protocol (MCP) — and it changed how I think about AI in enterprise operations.

Here's a practical walkthrough of what I built, the security architecture behind it, and what I learned along the way.

The problem I was trying to solve

As part of my work, I was spending too much time manually navigating Salesforce to answer questions

Every answer required logging into Salesforce, running a report, cross-referencing opportunities, and building a mental model of the data. I wanted to just ask the question in plain English and get the answer — against live CRM data, not a stale export.

Enter Model Context Protocol (MCP).

What is MCP?

MCP (Model Context Protocol) is an open standard from Anthropic that lets AI models like Claude connect to external data sources and tools through a standardized interface.

Instead of building custom APIs for every data source, MCP defines:

A server (the data source, in this case Salesforce)
A client (Claude Desktop)
A protocol for tool discovery, invocation, and response

Salesforce now ships a Hosted MCP Server, which means the connection layer is managed for you — you just need to configure authentication and define your connected app.

Architecture overview

The integration has three layers:

Request flow

You type a natural language question in Claude Desktop
Claude identifies the right MCP tool to call (e.g. query_opportunities)
The MCP client translates the request into a Salesforce API call
The Salesforce Hosted MCP Server executes the query via SOQL
Results return to Claude, which synthesizes a natural language answer

The security architecture — OAuth 2.0 + PKCE

This is where most guides gloss over the hard part. Getting enterprise AI-to-CRM security right requires careful attention to token flows, scopes, and least-privilege access — especially when an AI model has live read access to customer data.

Why PKCE matters

PKCE (Proof Key for Code Exchange) is essential for public client integrations where you cannot safely store a client secret. Claude Desktop running locally is a public client — there's no server-side secret storage. PKCE solves this by:

Generating a random code_verifier on the client at the start of each auth flow
Hashing it to create a code_challenge sent with the authorization request
Sending the original code_verifier when exchanging the authorization code for tokens
The auth server verifies the hash matches — proving the token request came from the same client that initiated the flow

Without PKCE, an intercepted authorization code could be exchanged for tokens by a different client. With PKCE, the code is useless without the verifier that only the originating client holds.

Salesforce Connected App setup

# Create Connected App in Salesforce Setup with:
# - OAuth 2.0 enabled
# - PKCE required
# - Callback URL: http://localhost:{PORT}/callback
# - Scopes: api, refresh_token (principle of least privilege)
# - No client secret (public client flow)

MCP server configuration (claude_desktop_config.json)

json{
  "mcpServers": {
    "salesforce": {
      "command": "sf",
      "args": ["mcp", "start"],
      "env": {
        "SALESFORCE_ORG_ALIAS": "your-org-alias",
        "MCP_AUTH_TYPE": "oauth2-pkce"
      }
    }
  }
}

Authentication flow

What it enables

Claude queries the live data, reasons over it, and gives you a synthesized answer — no manual report-building required.

Key learnings

MCP is becoming the standard for enterprise AI integration

The pattern MCP establishes — standardized tool definitions, structured request/response, discoverable capabilities — is exactly what enterprise AI needs. It's analogous to how REST APIs standardized web service integration in the 2000s.

Least-privilege access is non-negotiable

Only grant the scopes your use case requires. For read-only pipeline reviews, api scope with read-only profiles is sufficient. Don't grant write access unless you specifically need it — an AI with write access to your CRM is a very different risk profile.

Token lifecycle management matters

Refresh token rotation, expiry handling, and re-authentication flows need to be part of your implementation plan. Salesforce's default refresh token expiry is org-configurable — make sure it aligns with your operational workflow.

SFDX CLI session management simplifies operations

Using sf org login web to establish authenticated sessions and letting the MCP server inherit those sessions reduces the auth complexity significantly compared to managing tokens directly.

Follow for more posts on enterprise AI integration, MCP, and operational AI tooling.

DEV Community