alice.mosphere.at / cursor-plugins
Cursor plugin specification and official plugins
Star
Fork 0
Watch
cursor-plugins third_party salesforce
2 folders · 4 files
.cursor-plugin
assets
CHANGELOG.md
LICENSE
mcp.json
README.md
README.md

Salesforce #

Cursor plugin that connects agents to Salesforce through Salesforce Hosted MCP, Salesforce's first-party Model Context Protocol service.

Run SOQL and SOSL, inspect object schemas, traverse relationships, and create, update, or delete records — all under the signed-in user's own permissions and field-level security.

Install #

  1. Open Cursor Settings → Plugins.
  2. Search for Salesforce.
  3. Click Install, then set the server URL and consumer key (below) and complete the Salesforce sign-in prompt.

Or run /add-plugin salesforce in chat.

MCP #

{
  "mcpServers": {
    "salesforce": {
      "type": "http",
      "url": "${SALESFORCE_MCP_URL}",
      "auth": {
        "CLIENT_ID": "${CLIENT_ID}",
        "scopes": ["mcp_api", "refresh_token"]
      }
    }
  }
}

Setup #

Salesforce Hosted MCP requires an External Client App in your org. Connected Apps are not supported.

1. Create the External Client App #

From Setup, go to External Client App Manager → New External Client App, fill in the basics, then expand API (Enable OAuth Settings) and check Enable OAuth.

Add every callback URL you need — Cursor uses different ones per surface:

Surface Callback URL
Desktop http://localhost:8787/callback
Web and Cloud Agents https://www.cursor.com/agents/mcp/oauth/callback
Older desktop builds cursor://anysphere.cursor-mcp/oauth/callback

Under OAuth Scopes, select exactly these two and nothing broader:

  • Access Salesforce hosted MCP servers (mcp_api)
  • Perform requests at any time (refresh_token, offline_access)

The second one is easy to miss because the picker labels scopes by description rather than by value. Without it the plugin cannot refresh, and every user has to re-authenticate when their access token expires. Do not add Full access (full) — Hosted MCP does not need it.

Under Security, select Issue JSON Web Token (JWT)-based access tokens for named users. This is required: without it Salesforce issues opaque tokens and every tool call fails with JWT Token is required. Leave Require Secret for Web Server Flow off — Cursor authenticates as a public client using PKCE, so no client secret is involved. Do not enable the JWT Bearer Flow, which is a different feature and needs a certificate.

Finally, copy the Consumer Key from Settings → Consumer Key and Secret.

A new External Client App can take up to 30 minutes to propagate. Until it does, authentication fails with invalid_client_id; wait rather than recreating the app.

2. Activate a server and copy its URL #

In Setup, open MCP Servers, activate the server you want, and copy its Server URL. The URL encodes both the org type and the server:

Org type Standard server Custom server
Production, Developer, Enterprise https://api.salesforce.com/platform/mcp/v1/platform/sobject-all https://api.salesforce.com/platform/mcp/v1/custom/myserver
Sandbox or scratch https://api.salesforce.com/platform/mcp/v1/sandbox/platform/sobject-all https://api.salesforce.com/platform/mcp/v1/sandbox/custom/myserver

Salesforce ships several standard servers with different blast radii — sobject-reads for read-only access, sobject-mutations for reads plus create and update, sobject-deletes, and sobject-all for everything. Point the plugin at the narrowest one that does the job.

3. Configure the plugin #

In Dashboard → Plugins → Configure, set Salesforce MCP server URL and Salesforce Consumer Key, then complete the Salesforce login when Cursor prompts.

On a team marketplace an admin sets both values once. Each member still authenticates individually, so tools run with that member's own object and field permissions.

Troubleshooting #

Symptom Cause
invalid_client_id The External Client App has not finished propagating. Wait up to 30 minutes.
invalid_scope The app is missing Access Salesforce hosted MCP servers or Perform requests at any time.
JWT Token is required or Invalid token after a successful login Issue JSON Web Token (JWT)-based access tokens for named users is not enabled.
Auth succeeds but the server 404s The MCP server is not activated in Setup, or the URL's org type does not match the org you logged into.

Docs #

License #

MIT