---
name: iblai-connect-salesforce
description: "Read and write Salesforce data through the Salesforce REST API, Bulk API 2.0 and expose it to an ibl.ai agent as an MCP tool. Use when the user asks an agent to work with Salesforce data, or to set up a Salesforce MCP connection on ibl.ai."
metadata:
  kind: guide
---

# Salesforce connector for AI agents

> A starting point maintained on ibl.ai at https://ibl.ai/developer/connectors/salesforce — not part of the iblai/vibe repository. Checked against Salesforce, Inc.'s documentation on October 20, 2026; test it against your own Salesforce setup before you rely on it.

Salesforce (Sales Cloud, Service Cloud) is a CRM platform. An org stores standard and custom objects such as accounts, contacts, leads, opportunities and cases, plus the automation (Flows, Apex) built on them.

## Auth & conventions

- **API:** Salesforce REST API, Bulk API 2.0 (REST). REST API gives CRUD on standard and custom objects (sObjects), object metadata, SOQL query and search, and org limits. Bulk API 2.0 runs asynchronous CSV insert, upsert, update, delete and query jobs for large datasets.
- **Base URL:** https://{MyDomainName}.my.salesforce.com/services/data/v{XX.X}/
- **Access:** Issued by your administrator. Needs an org edition with API access and a user with the API Enabled permission. An admin registers an External Client App for OAuth; new connected apps are restricted as of Spring '26, existing ones keep working.
- **Auth:** OAuth 2.0 via an External Client App (or existing connected app); OAuth 2.0 authorization code with PKCE (Hosted MCP Servers). Requests carry an OAuth 2.0 access token as Authorization: Bearer. The OAuth flow is chosen on the External Client App. Hosted MCP Servers use per-user OAuth 2.0 with PKCE and cannot use connected apps.
- **Limits:** Enterprise Edition: 100,000 calls per 24h plus 1,000 per Salesforce license (Unlimited/Performance: 5,000 per license). Production orgs allow 25 concurrent requests running 20s or longer. REST call timeout is 10 minutes.
- Keep Salesforce credentials in environment variables or the ibl.ai credential store. Never print a token in chat and never commit one to a file.
- Destructive or outward-facing calls are marked **Confirm with the user first** — do.

## Reads

- **Records (any sObject)** — Read accounts, contacts, opportunities, cases and custom objects via sObject resources under /services/data/vXX.X/.
- **SOQL query results** — Query and search records; Bulk API 2.0 query jobs handle result sets of 2,000 records or more asynchronously.
- **Object metadata** — Describe objects and fields to learn the org's schema before reading or writing.
- **Org limits** — The /limits resource reports remaining API allocation; REST responses include a Sforce-Limit-Info header.

## Writes

- **Create or update records** — POST/PATCH on sObject resources; field-level security and sharing rules apply.
- **Bulk ingest jobs** — Bulk API 2.0 insert, upsert or update jobs from CSV for large datasets.
- **Delete records** — DELETE on an sObject record, or a Bulk API 2.0 delete job. **Confirm with the user first.**

## Expose it to an ibl.ai agent (MCP)

Salesforce, Inc. publishes an official MCP server, Salesforce Hosted MCP Servers (https://developer.salesforce.com/docs/platform/hosted-mcp-servers/guide/hosted-mcp-servers-overview.html). Register it below as-is, or host your own server that wraps the calls in this skill.

First install the ibl.ai platform skills and connect your organization (writes `IBLAI_ORG`, `IBLAI_USERNAME` and `IBLAI_API_KEY` to `.env`):

```bash
npx skills add iblai/vibe --all
# then, in your coding agent:
/iblai-api-login
```

Every call below sends `Authorization: Api-Token $IBLAI_API_KEY`.

1. **Register the server** — `POST https://api.iblai.app/dm/api/ai-mentor/orgs/$IBLAI_ORG/users/$IBLAI_USERNAME/mcp-servers/` with `name`, `url`, `transport` (`sse` | `websocket` | `streamable_http`) and `auth_type` (`none` | `token` | `oauth2`). Capture the returned `id`.
   - Salesforce supports per-user OAuth: `auth_type=oauth2` with `auth_scope=user` and a linked `oauth_service` makes each person connect their own account in the chat. It needs an `auth_{provider}` credential in the organization's credential store first.
2. **Create the connection** — `POST https://api.iblai.app/dm/api/ai-mentor/orgs/$IBLAI_ORG/users/$IBLAI_USERNAME/mcp-server-connections/` with `server`, `scope` (`platform` | `mentor` | `user`), `auth_type`, and either `credentials` + `authorization_scheme` or a `connected_service` id for OAuth. Credentials are masked on read; never send a masked value back.
3. **Enable it on the agent** — `GET https://api.iblai.app/dm/api/ai-mentor/orgs/$IBLAI_ORG/users/$IBLAI_USERNAME/mentors/{agent_id}/settings/`, add `mcp-tool` to `tool_slugs` and the server id to `mcp_servers`, then `PATCH` the full lists back. They are replaced, not merged.

Full reference: https://ibl.ai/developer/platform/mcp/mcp-connections and the `/iblai-api-agent-mcp` skill.

## Example prompts

- "List my open opportunities closing this quarter over $50,000, sorted by amount"
- "Summarize every case logged for Acme Corp in the last 30 days"
- "Update the stage on opportunity 006XXXXXXXXXXXX to Negotiation and add a next step"
- "How many API calls does our org have left today?"

## Guardrails

- CRM records hold personal data about customers and prospects (names, emails, phone numbers) plus deal and case history. Treat as confidential business data and personal data under privacy law.
- Request the narrowest Salesforce scopes or role the task needs, and prefer a read-only credential for agents that only answer questions.
- Return the fields the user asked for, not whole records; do not paste personal data into chat that the user did not request.
- Before any write, show the user exactly what will change and wait for a yes.
- Respect the documented limits above: page through results and back off on rate-limit responses instead of retrying in a loop.

## References

- REST API Developer Guide: https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/intro_rest.htm
- Hosted MCP Servers: Get Started: https://developer.salesforce.com/docs/platform/hosted-mcp-servers/guide/hosted-mcp-servers-overview.html
- API Request Limits and Allocations: https://developer.salesforce.com/docs/atlas.en-us.salesforce_app_limits_cheatsheet.meta/salesforce_app_limits_cheatsheet/salesforce_app_limits_platform_api.htm
- Salesforce Hosted MCP Servers: https://developer.salesforce.com/docs/platform/hosted-mcp-servers/guide/hosted-mcp-servers-overview.html
- This connector on ibl.ai: https://ibl.ai/developer/connectors/salesforce
- ibl.ai MCP server connections: https://ibl.ai/developer/platform/mcp/mcp-connections