The Challenge

Salesforce is the most powerful CRM on the market. For lean, highly active sales teams, it is also one of the most time-consuming platforms to operate at speed. Even in a well-governed org, standard Sales Cloud workflows carry real UI overhead: updating an Opportunity Stage, logging a completed call, and creating a follow-up Task requires navigating three separate Lightning record pages — each with its own page layout and save action.

Enriching a prospect means leaving Salesforce entirely, pulling intelligence from a third-party tool, and manually copying fields one at a time with no guarantee of field mapping consistency. A pipeline review requires opening the Opportunities list view, applying IsClosed = false filters, sorting by LastActivityDate, and mentally cross-referencing CloseDate and Amount fields before a single strategic decision can be made.

The Solution

CRM Infusion designed a custom Node.js MCP server that exposes Salesforce and Apollo.io as AI-callable tools directly inside Claude’s interface. The server authenticates to Salesforce via the OAuth 2.0 JWT Bearer Flow — generating a signed JWT assertion using an RS256 private key, exchanging it at the Salesforce token endpoint for a session-scoped access token. No stored passwords. No manual re-authentication. No OAuth redirect callbacks.

Every tool call is a fresh, stateless authentication event. The JWT assertion is valid for 300 seconds — long enough to complete a complex multi-step workflow, short enough that a compromised token has a minimal blast radius.

The architecture exposes 13 purpose-built tools across four capability areas:

Technical Highlights

• OAuth 2.0 JWT Bearer AuthRS256-signed assertions, 300-second token TTL, zero stored credentials or redirect flows
• Multi-Machine DeploymentOne shared index.js on an SMB network volume. Custom ESM resolver handles module path differences per machine — zero drift between users.
• Full Salesforce Security ComplianceOLS, FLS, and sharing rules enforced on every API call. Server operates as a credentialed user — no permission bypass, no elevated access.
• End-to-End Enrichment Pipelineenrich_company → get_decision_makers → match_person → create_lead. Zero manual data transfer, all in one conversation thread.