Self-Hosted Pardot MCP

Configuration status

• ✓ SetSALESFORCE_CLIENT_ID— Salesforce Connected App client id
• ✓ SetSALESFORCE_CLIENT_SECRET— Salesforce Connected App client secret
• ✓ SetTOKEN_ENC_KEY— Encryption key for the OAuth bridge
• ✓ SetPARDOT_BUSINESS_UNIT_ID— Account Engagement Business Unit id

All required configuration is present.

How to configure it

1. Create a Salesforce Connected App with OAuth enabled and scopes pardot_api, api, refresh_token, offline_access, openid. PKCE must be allowed.
2. Register this server’s callback on the Connected App: https://<your-domain>/api/oauth/callback.
3. Set SALESFORCE_CLIENT_ID and SALESFORCE_CLIENT_SECRET from the Connected App.
4. Generate an encryption key and set TOKEN_ENC_KEY: openssl rand -base64 32.
5. Set PARDOT_BUSINESS_UNIT_ID to your Account Engagement Business Unit id (Setup → Account Engagement Settings in Salesforce).
6. Restart the server with the new environment variables set.

Connecting your assistant

ChatGPT

1. Turn on Developer mode / custom MCP apps first, if you haven’t — ask your ChatGPT workspace admin if you can’t find it.
2. Settings → Apps → Create (workspace admins: Workspace settings → Apps → Create).
3. Choose OAuth as the authentication method — never an API-key or bearer-token setup. There is no key to paste in, only sign-in.
4. Paste this server’s /api/mcp address, then select Scan Tools.
5. ChatGPT opens a Salesforce sign-in window. Complete that sign-in and approval yourself, in that window.
6. Back in ChatGPT, wait for the scan to finish and select Create.

Claude

1. Settings → Connectors → Add custom connector.
2. Paste the same address.

Either way, you’ll be asked to sign in to Salesforce the first time it connects, and again any time your assistant later asks you to reauthenticate. That’s what keeps the address alone from granting anyone access. Do that sign-in yourself, in a real browser window — if your assistant tries to complete it automatically in the background, open the link it shows you directly instead.