AI assistant access (MCP)

Pinion ships a native Salesforce Hosted MCP server so an AI assistant — Claude in particular — can answer questions about your deals (“why is this price what it is?”, “what’s pending my approval?”) and take a few tightly scoped actions (approve or reject a request, submit one for approval). Every tool runs as the signed-in user and enforces that user’s CRUD and FLS — the assistant never sees or does more than the person driving it.

1. Activate the Pinion MCP server

Setup → MCP Servers → Pinion MCP → Activate. Confirm the tool list renders (Explain Price, Renewal Forecast, Get My Approvals, Decide Approval, and the rest). A package upgrade can leave the server de-registered — if the tools don’t appear after an upgrade, re-activate here.

Warning

The packaged Pinion MCP server is a reference starting point, not a finished production configuration. As shipped it exposes the full tool set — including the state-changing action tools (Submit / Decide approval, Create renewal / amendment, Generate PDF, Log a follow-up) and the paid, tier-zero Configure & Price (Save & Sync) write tool. Anyone you grant access to (step 3) can then drive every one of those tools from their assistant. Each tool still runs as the signed-in user and enforces that user’s CRUD and FLS — but that is a permission floor, not a scoping decision, and it does not stop, say, a rep from deciding approvals or writing line items through an assistant if the packaged server exposes those tools to them.

For production, compose one or more servers scoped to your business — expose only the tools each audience needs, and gate each server to the matching permission set — rather than granting the all-tools server to everyone. See Composing MCP Servers for the least-privilege pattern (Insights / Operate / Author rings) and Creating MCP Servers & Client Apps for building scoped servers.

2. Configure the packaged External Client App

An AI client signs in to your org through an External Client App (ECA). Pinion ships one — Pinion MCP — already scoped to the least-privilege OAuth scopes the tools need (“Access MCP servers” plus a refresh token, and nothing else — never api, full, or web). You do not create an app or choose scopes; that work is done.

What you do set are the few values that are specific to your org and your chosen AI tool, and therefore can’t be baked into the package:

Setting	Where	Value
Callback URL	ECA → OAuth settings	Your AI tool’s MCP-connector redirect URL — each tool publishes its own; check its docs
JWT-based access tokens	ECA → Policies → OAuth Policies	On
IP restrictions	ECA → Policies → OAuth Policies	Relaxed
Consumer Key	ECA → OAuth settings	Copy it — this is the Client ID you paste into the AI tool

3. Gate who can connect

Out of the box, any user in the org could point an AI client at your Pinion tools. Restrict it to a chosen few: create (or reuse) a permission set — e.g. Pinion MCP Users — assign the Pinion MCP ECA to that permission set, and give the permission set only to the people allowed to connect.

Let the Setup Wizard track it for you

You don’t have to hold all of this in your head. The Pinion Setup Wizard (Pinion Admin → Setup) includes a guided Connect Hosted MCP (Pinion+) step that read-only-detects what’s already done — the packaged app, its OAuth policy and scopes, the PinionMcpUser permission-set assignment, and the MCP server plus its tools — and links you straight to the Setup screens for whatever’s left. One value it can’t read back is the JWT-based-access-tokens policy, so the wizard surfaces that as a manual check rather than a green tick.

The click-by-click walkthrough, with screenshots and the exact callback and scope values, lives in the user guide under MCP → Set up.

User Guide — MCP → Set up — the click-by-click walkthrough with screenshots.
User Guide — MCP → Overview — what the tools do and the security model.