MCP Admin1
Onboard a consultant in one sentence. Answer “why can’t they see it?” in seconds.
MCP Admin1 gives your AI the Klient administrator’s toolkit — provisioning people and diagnosing access — work that otherwise means clicking through Salesforce Setup. It’s the headless admin: your AI acting on the org directly, no Setup screens.
Runs under your own Salesforce login, with your permissions and audit trail. Diagnosis is read-only; provisioning asks before it writes.
Setting up a person in Klient is a five-object chore. Access questions are worse.
A new consultant needs a User, a Project Resource, a Work Schedule, and the right permission sets — created in the right order, or it breaks. And “why can’t Marc see the Gantt?” means hopping across profiles, permission sets, object and field permissions, and licenses. Both are slow, error-prone, and beneath what your admin should spend time on.
“Onboarding and access debugging are the admin’s two biggest time sinks. MCP Admin1 makes them one sentence each.”
One install. Your AI. Klient administration.
sf org login web$ sf org login web
// 2. point your MCP client at the local server
{
"command": "node",
"args": ["~/mcp-admin1/server.mjs"],
"env": {
"KLIENT_MCP_ORG": "your-org-alias"
}
}
onboardUserCreates (or links) the User, the Project Resource, the Work Schedule, and grants permission sets — in the correct order, with the setup/data DML split handled. Idempotent per step; resolves roles and departments by name.
diagnoseAccess · read-onlyExplains a user’s access by joining active status, permission-set assignments, and object/field permissions server-side — and names the fix.
assignPermissionSet · listKlientPermissionSetsList the Klient permission sets (and who holds each), then grant one to a user — duplicate-checked.
What MCP Admin1 covers
What you need to run it
All required — the server won’t start without them. No license key to paste; access is granted at download from the Klient Customers community.
sf org login web — no password or token to manage.4 tools — and not one of them can delete.
No delete operations anywhere. Every write asks for confirmation, runs as your authenticated Salesforce user (your sharing rules and field-level security apply), and is fully auditable.
See all 4 tools ▾
onboardUser | Create/link User + Project Resource + Work Schedule + grant permission sets, in the correct order |
diagnoseAccess | “Why can’t user X see/do Y?” — joins active status, Apex-class access, object access; names the fixing permission set (read-only) |
assignPermissionSet | Grant a permission set to a user (duplicate-checked) |
listKlientPermissionSets | List the Klient permission sets and who holds each |
Built to be safe in your org
diagnoseAccess and the list tools never write.One-time. Per company. No subscription.
Questions, answered
MCP for Salesforce PSA is an open Model Context Protocol server that lets any AI client (Claude, Cursor, Copilot) act directly on your Klient PSA org in Salesforce, under your own login. MCP Admin1 is Klient’s MCP server for administration — onboarding people and diagnosing access.
Yes — with confirmation, under your admin user’s permissions. It can also onboard an existing user into Klient without creating a new one.
Yes — it’s fully read-only.
No — local, under your Salesforce login.
No — attended admin copilot, not an autonomous agent.
One-time, perpetual, per company. No subscription.