SalesforceSAFE
Salesforce MCP Server
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://securityscorecards.dev/viewer/?uri=github.com/tsmztech/mcp-server-salesforce)
An MCP (Model Context Protocol) server implementation that integrates Claude with Salesforce, enabling natural language interactions with your Salesforce data and metadata. This server allows Claude to query, modify, and manage your Salesforce objects and records using everyday language.
Features
- Object and Field Management: Create and modify custom objects and fields using natural language
- Smart Object Search: Find Salesforce objects using partial name matches
- Detailed Schema Information: Get comprehensive field and relationship details for any object
- Flexible Data Queries: Query records with relationship support and complex filters
- Data Manipulation: Insert, update, delete, and upsert records with ease
- Cross-Object Search: Search across multiple objects using SOSL
- Apex Code Management: Read, create, and update Apex classes and triggers
- Intuitive Error Handling: Clear feedback with Salesforce-specific error details
- Switchable Authentication: Supports multiple orgs. Easily switch your active Salesforce org based on the default org configured in your VS Code workspace (use Salesforce_CLI authentication for this feature).
Installation
Requirements
- Node.js 22+ (jsforce 3.10.17 and later depend on undici 8, which needs Node 22; on Node 20 the server fails at startup). The server must run under Node — bun is not supported: jsforce's HTTP transport hangs under bun, so authentication appears to succeed but every Salesforce API call stalls until the MCP host times out (see [#118](https://github.co
15c5634eb707OBSERVED · 2026-10-06Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add mcp-server-salesforce --env SALESFORCE_ACCESS_TOKEN=${SALESFORCE_ACCESS_TOKEN} --env SALESFORCE_CLIENT_SECRET=${SALESFORCE_CLIENT_SECRET} --env SALESFORCE_PASSWORD=${SALESFORCE_PASSWORD} --env SALESFORCE_TOKEN=${SALESFORCE_TOKEN} -- npx -y @tsmztech/[email protected]{
"mcpServers": {
"mcp-server-salesforce": {
"command": "npx",
"args": [
"-y",
"@tsmztech/[email protected]"
],
"env": {
"SALESFORCE_ACCESS_TOKEN": "${SALESFORCE_ACCESS_TOKEN}",
"SALESFORCE_CLIENT_SECRET": "${SALESFORCE_CLIENT_SECRET}",
"SALESFORCE_PASSWORD": "${SALESFORCE_PASSWORD}",
"SALESFORCE_TOKEN": "${SALESFORCE_TOKEN}"
}
}
}
}Exposed tools (9)
4 read · 5 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
salesforce_describe_object | read | Get detailed schema metadata including all fields, relationships, and field properties of any Salesforce object. Examples: |
salesforce_execute_anonymous | write | Execute anonymous Apex code in Salesforce. Examples: 1. Execute simple Apex code: { |
salesforce_manage_debug_logs | write | Manage debug logs for Salesforce users - enable, disable, or retrieve logs. Examples: 1. Enable debug logs for a user: { |
salesforce_read_apex | read | Read Apex classes from Salesforce. Examples: 1. Read a specific Apex class by name: { |
salesforce_read_apex_trigger | write | Read Apex triggers from Salesforce. Examples: 1. Read a specific Apex trigger by name: { |
salesforce_search_all | read | Search across multiple Salesforce objects using SOSL (Salesforce Object Search Language). Examples: 1. Basic search across all objects: { |
salesforce_search_objects | read | Search for Salesforce standard and custom objects by name pattern. Examples: |
salesforce_write_apex | write | Create or update Apex classes in Salesforce. Examples: 1. Create a new Apex class: { |
salesforce_write_apex_trigger | write | Create or update Apex triggers in Salesforce. Examples: 1. Create a new Apex trigger: { |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (1 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (2)
salesforce-mcp-extension.dxt
jsforce, @types/node, typescript, shx
Gates applied: no_behavioural_pass.
15c5634eb707full audit observations/trust-audit/mcp-server/tsmztech__salesforce.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-06 | 15c5634eb707 | SAFE | B | 89 | first audit |
Questions
What is the Salesforce MCP server?
Salesforce MCP Server
What tools does Salesforce expose?
9 in total: 4 read-only, 5 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Salesforce safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does Salesforce need?
It reads SALESFORCE_ACCESS_TOKEN, SALESFORCE_CLIENT_SECRET, SALESFORCE_PASSWORD and SALESFORCE_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Salesforce run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as @tsmztech/mcp-server-salesforce at 0.0.8.
How current is this page?
The grade is for one exact copy of the source (15c5634eb707), read on 2026-10-06. The repository is watched and re-audited when it changes.