Skip to main content
Glama
semwalajay83-sem

salesforce-metadata-mcp

Create External Client App (OAuth) — recommended over Connected App

sf_create_external_client_app
Idempotent

Create an External Client App (ECA) for OAuth authentication and server-to-server integrations, with configurable Client Credentials Flow and Agent API scopes, deployed via Metadata API in a single call.

Instructions

Creates an External Client App (ECA), Salesforce's newer replacement for Connected Apps, for OAuth authentication and server-to-server integrations. Prefer this over sf_create_connected_app: on ECAs, Client Credentials Flow — including which user it runs as — is fully configurable via this tool (enableClientCredentialsFlow + clientCredentialsFlowUser), whereas on classic Connected Apps that same setting can only be picked in Setup UI. Deploys all 3 underlying metadata records (ExternalClientApplication, ExtlClntAppOauthSettings, ExtlClntAppOauthConfigurablePolicies) in one call. Use 'Chatbot' and/or 'SFApiPlatform' scopes for any app that needs to call the Salesforce Agent API (e.g. testing an Agentforce agent's conversation flow) or a bot's Messaging API. NOTE: the Consumer Key/Secret this app needs to actually mint a token can still only be viewed once in Setup → External Client Apps → [name] → Settings → OAuth Settings — no Salesforce API exposes it, for either app type.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
labelYesDisplay label
scopesYesOAuth scopes to request, using Salesforce's exact enum literals (PascalCase — this is the ExtlClntAppOauthSettings.commaSeparatedOauthScopes enum, unrelated to the lowercase OAuth2 scope-string convention). 'Chatbot' and/or 'SFApiPlatform' are what an Agent API caller needs. 'Api' covers general REST/SOQL access. 'RefreshToken' is required for any non-client-credentials flow to get a refresh token.
fullNameYesExternal Client App API name, e.g. 'My_External_App'. Used for all three underlying metadata records (ExternalClientApplication, ExtlClntAppOauthSettings, ExtlClntAppOauthConfigurablePolicies) — this tool creates all three in one call.
descriptionNoDescription
contactEmailYesContact email for the app
ipRelaxationPolicyTypeNoIP restriction enforcement for this app's OAuth tokens.
refreshTokenPolicyTypeNoRefresh token expiry strategy.
permittedUsersPolicyTypeNoWho can authorize this app. AdminApprovedPreAuthorized (recommended for Client Credentials Flow) restricts use to explicitly pre-authorized profiles/permission sets. Defaults to Salesforce's own default (AllSelfAuthorized) if omitted.
clientCredentialsFlowUserNoUsername to run Client Credentials Flow requests as (e.g. 'admin@myorg.com'). Required by Salesforce if enableClientCredentialsFlow is true. This IS settable via the Metadata API for External Client Apps — unlike classic Connected Apps, where the same 'Run As' user can only be picked in Setup UI.
enableClientCredentialsFlowNoSets isClientCredentialsFlowEnabled=true on ExtlClntAppOauthConfigurablePolicies.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description goes far beyond annotations by disclosing that the tool deploys 'all 3 underlying metadata records' in one call, revealing atomicity. It also warns about an important limitation: 'the Consumer Key/Secret ... can still only be viewed once in Setup ... no Salesforce API exposes it.' This is critical behavioral context not conveyed by the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is fairly long but front-loaded with the core purpose and followed by a clear comparison, deployment detail, scope guidance, and a crucial limitation note. No sentence is redundant; each adds meaningful context. It earns a 4 rather than 5 because it is on the longer side, though every part contributes.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

This is a complex creation tool with no output schema, so the description carries the burden of explaining what happens and what is needed after creation. It covers the created record types, the key configuration options (client credentials flow, scopes), and the consumer secret retrieval limitation. This is sufficient for a model to invoke and reason about the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds value by highlighting which parameters matter most: 'enableClientCredentialsFlow + clientCredentialsFlowUser' are called out as fully configurable for ECA, and the 'Chatbot'/'SFApiPlatform' scopes are connected to a specific use case. This contextual grouping helps a model reason about parameter choices beyond the individual schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Creates an External Client App (ECA), Salesforce's newer replacement for Connected Apps, for OAuth authentication and server-to-server integrations.' It further distinguishes itself from the sibling sf_create_connected_app by explicitly recommending this tool over the alternative. This is a clear, non-tautological purpose statement.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit guidance is provided: 'Prefer this over sf_create_connected_app' with a concrete reason (full configurability of Client Credentials Flow including the run-as user via this tool, unlike the Setup-UI-only configuration on Connected Apps). Additionally, scope selection advice is given for Agent API usage: 'Use Chatbot and/or SFApiPlatform scopes.' This tells a model exactly when to use this tool and what parameters to choose.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/semwalajay83-sem/salesforce-metadata-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server