Pega & Salesforce MCP Integration: Architecture & Implementation

[RameshSangili]

Enjoyed this article? See more similar articles in Pega Gen AI Cookbook - Recipes series

Pega & Salesforce MCP Integration: Architecture & Implementation

Pega AI agents can now natively invoke Salesforce capabilities through the Model Context Protocol (MCP). By combining Pega Connect MCP with the Salesforce MCP Server, organizations can seamlessly extend AI-driven workflows with real-time access to Salesforce data and operations. For this proof of concept, I implemented a lightweight proxy-based architecture on Google Cloud Run that provided a integration layer for authentication coordination, communication management, and tool optimization. The proxy served as a flexible architectural pattern for this POC, while also demonstrating how Pega and Salesforce can work together seamlessly through MCP.

Why a Proxy?

For this proof of concept, the proxy provided a convenient integration layer that enabled:

• Centralized authentication and token management
• Streamlined MCP communication handling
• Optimized tool discovery and consumption
• A clean, maintainable, and reusable integration architecture

---

Configurations

Salesforce Setup

1. Create an External Client App

   • In Salesforce Setup, create a new Connected App (Setup → Apps → App Manager → New Connected App)
   • OAuth scopes required: mcp_api, api, refresh_token, offline_access
   • Note the Consumer Key and Consumer Secret

2. Enable JWT-Based Access Tokens

   • Under OAuth Policies on the same Connected App, enable JWT Bearer Token Auth (allow JWT-based OAuth flows)

3. Obtain Refresh Token

   • Have an administrator run a one-time OAuth Authorization Code flow to generate a refresh token
   • Store this securely in Cloud Run Secret Manager
   • The proxy will use this to automatically obtain fresh access tokens for all subsequent calls

Google Cloud Run Deployment

1. Set Up Secrets

   • Create three secrets in Cloud Run Secret Manager:
     • sf-client-secret — your Salesforce Connected App Consumer Secret
     • sf-refresh-token — your Salesforce refresh token (must start with eyJ...)

2. Deploy the Proxy Application

   • Deploy a FastAPI Python application to Cloud Run
   • Bind the twp secrets to environment variables
   • Configure the following non-negotiable settings:
     • Minimum instances: 1 — SSE requires stateful, persistent connections. Scale-to-zero destroys in-memory session queues
     • Request timeout: 3600 seconds — Agent conversations can last many minutes; default 300-second timeout closes the SSE stream mid-conversation
     • Single worker — All tool calls for a session must route to the same Cloud Run instance

3. Note the Cloud Run URL

   • You’ll use this URL when configuring Pega

Pega Configuration

1. Create a Connect MCP Rule

   • In Designer Studio, create a new Connect MCP rule
   • Point it to your Cloud Run proxy URL
   • Set protocol version to 2025-03-26

2. Discover and Import Tools

   • Use the Discover Tools action on the Connect MCP rule
   • This returns the normalized tool schemas (camelCase parameters, no body wrapper)
   • Import the tools you want: soqlQuery, getSobjectRecord, createSobjectRecord, updateSobjectRecord, deleteSobjectRecord

3. Update Agent Instructions

   • Include explicit instructions in the agent’s system prompt about how to query, create, update, and delete Salesforce records
   • Provide example field names for common objects (Contact, Account, Opportunity, etc.)
   • The more specific the instructions, the more reliably the LLM constructs correct tool calls

---