Salesforce MCP

Salesforce gives admins two separate IP-based restriction layers: org-wide Network Access trusted ranges under Setup, and per-Connected-App IP relaxation settings. QuotaGuard has provided static IPs for cloud infrastructure since 2013.

An MCP server calling the Salesforce API from Lambda, Cloud Run, Render, or any container platform gets a rotating egress IP that fails either restriction layer, regardless of how valid the Connected App's OAuth token is.

• Two-Minute Setup: Set your QuotaGuard proxy URL as the environment variable your MCP server's HTTP client reads for outbound calls, then add both static IPs to Network Access trusted ranges and the Connected App's allowed IP list.
• Two Restriction Layers, One Fix: Network Access and Connected App IP relaxation are independent settings that can each block an MCP server on their own. A fixed pair of static IPs clears both at once.
• No Activation-Code Workaround Needed: Salesforce's activation code flow for unrecognized IPs assumes an interactive human session and doesn't fit unattended, repeated MCP server calls. A static IP avoids the workaround entirely.
• Production-Grade Reliability: A load-balanced pair of static IPs with automated failover. Both IPs go on Network Access and the Connected App allowlist, and traffic routes through whichever responds first.
• Shield for Regulated Salesforce Data: For PHI, payment data, or HIPAA/PCI/SOC 2-bound records, QuotaGuard Shield uses SSL passthrough so QuotaGuard never decrypts the data flowing between your MCP server and Salesforce.

Restriction-layer nuance: Network Access and Connected App IP relaxation are independent settings. An org can have permissive Network Access but still block a specific Connected App if that app's own IP restriction is set to enforce, so both settings need the same two IPs registered.