I recently deployed a real-time integration between Claude Desktop and Salesforce CRM using Model Context Protocol (MCP) — and it changed how I think about AI in enterprise operations.
Here's a practical walkthrough of what I built, the security architecture behind it, and what I learned along the way.
The problem I was trying to solve
As part of my work, I was spending too much time manually navigating Salesforce to answer questions
Every answer required logging into Salesforce, running a report, cross-referencing opportunities, and building a mental model of the data. I wanted to just ask the question in plain English and get the answer — against live CRM data, not a stale export.
Enter Model Context Protocol (MCP).
What is MCP?
MCP (Model Context Protocol) is an open standard from Anthropic that lets AI models like Claude connect to external data sources and tools through a standardized interface.
Instead of building custom APIs for every data source, MCP defines:
- A server (the data source, in this case Salesforce)
- A client (Claude Desktop)
- A protocol for tool discovery, invocation, and response
Salesforce now ships a Hosted MCP Server, which means the connection layer is managed for you — you just need to configure authentication and define your connected app.
Architecture overview
The integration has three layers:
┌─────────────────────────────────────────────┐
│ AI Layer │
│ Claude Desktop → MCP Client → SFDX CLI │
└──────────────────┬──────────────────────────┘
│ tool calls
┌──────────────────▼──────────────────────────┐
│ Auth Layer — OAuth 2.0 / PKCE │
│ Auth Server → Salesforce Hosted MCP Server │
│ → Connected App (scopes) │
└──────────────────┬──────────────────────────┘
│ REST API
┌──────────────────▼──────────────────────────┐
│ Data Layer — Salesforce CRM │
│ Opportunities · Accounts · Reports · SOQL │
└─────────────────────────────────────────────┘
Request flow
- You type a natural language question in Claude Desktop
- Claude identifies the right MCP tool to call (e.g. query_opportunities)
- The MCP client translates the request into a Salesforce API call
- The Salesforce Hosted MCP Server executes the query via SOQL
- Results return to Claude, which synthesizes a natural language answer
The security architecture — OAuth 2.0 + PKCE
This is where most guides gloss over the hard part. Getting enterprise AI-to-CRM security right requires careful attention to token flows, scopes, and least-privilege access — especially when an AI model has live read access to customer data.
Why PKCE matters
PKCE (Proof Key for Code Exchange) is essential for public client integrations where you cannot safely store a client secret. Claude Desktop running locally is a public client — there's no server-side secret storage. PKCE solves this by:
Generating a random code_verifier on the client at the start of each auth flow
Hashing it to create a code_challenge sent with the authorization request
Sending the original code_verifier when exchanging the authorization code for tokens
The auth server verifies the hash matches — proving the token request came from the same client that initiated the flow
Without PKCE, an intercepted authorization code could be exchanged for tokens by a different client. With PKCE, the code is useless without the verifier that only the originating client holds.
Salesforce Connected App setup
`bash# Create Connected App in Salesforce Setup with:
- OAuth 2.0 enabled
- PKCE required
- Callback URL: http://localhost:{PORT}/callback
- Scopes: api, refresh_token (principle of least privilege)
- No client secret (public client flow)`
MCP server configuration (claude_desktop_config.json)
json{
"mcpServers": {
"salesforce": {
"command": "sf",
"args": ["mcp", "start"],
"env": {
"SALESFORCE_ORG_ALIAS": "your-org-alias",
"MCP_AUTH_TYPE": "oauth2-pkce"
}
}
}
}
Authentication flow
Claude Desktop Auth Server Salesforce
│ │ │
│── generate code_verifier ──▶│ │
│── code_challenge (S256) ───▶│ │
│ │── validate ───────────▶│
│◀─── authorization code ─────│ │
│── code_verifier + code ─────▶│ │
│◀─── access token ───────────│ │
│ │
│── REST API calls with Bearer token ──────────────────▶│
│◀── SOQL query results ────────────────────────────────│
What it enables
Claude queries the live data, reasons over it, and gives you a synthesized answer — no manual report-building required.
Key learnings
- MCP is becoming the standard for enterprise AI integration
The pattern MCP establishes — standardized tool definitions, structured request/response, discoverable capabilities — is exactly what enterprise AI needs. It's analogous to how REST APIs standardized web service integration in the 2000s.
- Least-privilege access is non-negotiable
Only grant the scopes your use case requires. For read-only pipeline reviews, api scope with read-only profiles is sufficient. Don't grant write access unless you specifically need it — an AI with write access to your CRM is a very different risk profile.
- Token lifecycle management matters
Refresh token rotation, expiry handling, and re-authentication flows need to be part of your implementation plan. Salesforce's default refresh token expiry is org-configurable — make sure it aligns with your operational workflow.
- SFDX CLI session management simplifies operations
Using sf org login web to establish authenticated sessions and letting the MCP server inherit those sessions reduces the auth complexity significantly compared to managing tokens directly.
Follow for more posts on enterprise AI integration, MCP, and operational AI tooling.