Before you begin

You need Agentforce enabled in your Salesforce org, permission to manage Agentforce Registry and Agentforce Builder, and an MCP credential from Create and Manage MCP Credentials. Register the server in each Salesforce org where an agent uses CloudFiles. A sandbox needs its own credential and its own registration. See Production, Sandbox and Regions. Every user who works with the CloudFiles tools through an agent needs the permission set that Salesforce creates for the registration, as described in Step 4.

Step 1: Create an MCP credential

In the CloudFiles app, create an MCP credential and keep the Server URL, Identity Provider URL, Client ID and Client Secret it shows. See Create and Manage MCP Credentials.

Step 2: Register the CloudFiles MCP server

  1. In Salesforce Setup, enter Agentforce Registry in Quick Find and select Registered MCP Servers.
  2. Click New and select Register MCP Server.

Agentforce Registry in Setup, with the New menu open on Register MCP Server.
Agentforce Registry in Setup, with the New menu open on Register MCP Server.

  1. In Create Connection, enter an MCP Server Name, for example CloudFiles. The name can contain only letters and numbers, and it must be unique in the org.
  2. In Server URL, enter the Server URL from your MCP credential.
  3. Leave Authentication Method set to OAuth 2.0.
  4. Enter the Identity Provider URL, Client ID and Client Secret from your MCP credential. Leave Scope empty.
  5. Click Create and Continue. Salesforce creates the connection, checks it with the credential and reads the list of CloudFiles tools.

The Create Connection step with the MCP Server Name, Server URL, OAuth 2.0 authentication, Identity Provider URL, Client ID and Client Secret filled in.
The Create Connection step with the MCP Server Name, Server URL, OAuth 2.0 authentication, Identity Provider URL, Client ID and Client Secret filled in.

Step 3: Allow the CloudFiles tools

Salesforce shows the MCP Server Allowlist with a risk assessment and the CloudFiles tools. Expand a tool to see its description and the schema of its inputs and outputs.

  1. Click Select All to give agents every CloudFiles tool, or click Add Tool next to each tool your agents may use.
  2. Click Allow and Continue.

The MCP Server Allowlist with the CloudFiles tools added and the Allow and Continue button.
The MCP Server Allowlist with the CloudFiles tools added and the Allow and Continue button.

A tool you do not allow here cannot be used by any agent in the org.

Step 4: Give users access

In Grant Access to Users, Salesforce creates a permission set named after the server, <MCP Server Name>_Perm_Set, for example CloudFiles_Perm_Set, and assigns it to you. Every user who works with the CloudFiles tools through an agent needs this permission set.

  1. Click Manage User Assignments and assign the permission set to the users who will use the agent.
  2. Click Next.
  3. In Apply Policies, select any policies you want to apply to the server. Policies are optional.
  4. Click Save.

The Grant Access to Users step, naming the server's permission set and the Manage User Assignments button.
The Grant Access to Users step, naming the server's permission set and the Manage User Assignments button.

You can assign the permission set later as well. Open the server in Agentforce Registry. Its Details tab names the permission set under Permissions.

Step 5: Add the tools to an agent

  1. Open Agentforce Builder.
  2. Open the agent that should work with CloudFiles.
  3. Add a subagent for CloudFiles, for example named CloudFiles, with a description that tells the agent when to use it.
  4. Add the CloudFiles tools to the subagent from the Agentforce Asset Library. Each tool appears as an action.
  5. Add instructions to the subagent. You can start from the example below.
  6. Click Save.

Use the CloudFiles tools for any request about CloudFiles.
When the user asks which CloudFiles account is connected, call get-connection.
Before you run a tool that sends anything to people outside the company, show the user what will be sent and to whom, and wait for them to confirm.
When a tool answers that it could not complete a request, pass its message to the user as it is.
Agentforce Builder showing an agent with a CloudFiles subagent and the CloudFiles tools as its actions.
Agentforce Builder showing an agent with a CloudFiles subagent and the CloudFiles tools as its actions.

Step 6: Test the agent

In Agentforce Builder, open Preview and ask: Which CloudFiles account are you connected to? The agent calls get-connection and answers with your CloudFiles account name and the user it acts as.

The Agentforce Builder Preview, with the agent answering which CloudFiles account it is connected to.
The Agentforce Builder Preview, with the agent answering which CloudFiles account it is connected to.

Verify the setup

The agent names your CloudFiles account in Preview, and the credential's Last Used time on the MCP Credentials page updates. To ask the agent for CloudFiles work, see the tools for each product in Tools.

What the agent can reach

Agentforce agents act as your CloudFiles account's system user, so they can reach what your account's connections can reach. Use the tools you allow in Step 3, the permission set in Step 4 and the subagent's instructions to decide what agents may do. See Who the Agent Acts As.

When CloudFiles updates a tool

When CloudFiles changes a tool, for example its description or the information it takes, Agentforce Registry marks the tool Out of Sync and notifies an admin. Agents cannot use an out-of-sync tool until it is synced.

  1. In Setup, open Agentforce Registry and select your CloudFiles server.
  2. Open the Tools tab and click Manage Tools.
  3. Click Sync on each tool marked Out of Sync.
  4. Click Save. Connection Health shows Connected again.

Nothing in the agent needs to change. Start a new conversation to use the updated tools.