Salesforce MCP Server
Connects Salesforce CRM with Claude, enabling CRUD operations, SOQL/SOSL queries, metadata extraction, and sandbox management through natural language.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
sunny980123
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
salesforce_deploy_metadatasalesforce_retrieve_metadatasalesforce_describe_objectGet metadata for a Salesforce object: field names, types, labels, and whether fields are required/editable. Use this to discover what fields are available before writing SOQL queries or creating/updating records. Args: - object_type (string): The Salesforce object API name (e.g., 'Account', 'Con…
salesforce_list_objectsList all available Salesforce objects (standard and custom) in the org. Use this to discover what objects exist before querying or manipulating data. Args: - filter (string): Optional text to filter object names/labels (case-insensitive) - queryable_only (boolean): If true, only return objects…
salesforce_queryExecute a SOQL (Salesforce Object Query Language) query to retrieve records from Salesforce. SOQL is similar to SQL. Example queries: - SELECT Id, Name, Industry FROM Account WHERE Industry = 'Technology' LIMIT 10 - SELECT Id, Name, Email FROM Contact WHERE AccountId = '001xx000...' - SELECT Id, Na…
salesforce_searchSearch across multiple Salesforce objects using SOSL (Salesforce Object Search Language). Use SOSL when you want to search across multiple object types at once or do full-text search. Example SOSL queries: - FIND {Acme} IN ALL FIELDS RETURNING Account(Id, Name), Contact(Id, Name) - FIND {john@exam…
salesforce_metadata_queryExecute a SOQL query using the Salesforce Tooling API to access metadata objects not available via standard SOQL. Use for: ValidationRule, Flow/FlowVersionView, ApexClass/ApexTrigger, WorkflowRule, FieldDefinition. Examples: - SELECT Id, ValidationName, Active, EntityDefinitionId FROM ValidationRu…
salesforce_get_recordRetrieve a single Salesforce record by its ID. Args: - object_type (string): The Salesforce object type (e.g., 'Account', 'Contact', 'Opportunity') - record_id (string): The 15 or 18-character Salesforce record ID - fields (string[]): Optional list of specific fields to retrieve. If empty, re…
salesforce_create_recordCreate a new record in Salesforce. Args: - object_type (string): The Salesforce object type (e.g., 'Account', 'Contact', 'Lead') - fields (object): Key-value pairs of field API names and their values Returns: { id: string, success: boolean } - The new record ID on success. Common required f…
salesforce_update_recordUpdate fields on an existing Salesforce record. Args: - object_type (string): The Salesforce object type (e.g., 'Account', 'Contact') - record_id (string): The 15 or 18-character Salesforce record ID - fields (object): Key-value pairs of field API names and their new values Returns: Confir…
salesforce_delete_recordPermanently delete a Salesforce record. This action cannot be undone (record goes to Recycle Bin). Args: - object_type (string): The Salesforce object type (e.g., 'Account', 'Lead') - record_id (string): The 15 or 18-character Salesforce record ID to delete Returns: Confirmation message on s…
salesforce_get_limitsCheck your Salesforce org's current API usage and remaining limits. Returns: Key limits including: - DailyApiRequests: Daily REST API call quota (Max and Remaining) - DailyBulkApiRequests: Bulk API limits - Other org limits Use this to monitor API consumption before running large batch ope…
salesforce_list_sandboxesList all sandboxes registered under the production org via Tooling API SandboxInfo. Shows both existing sandboxes and in-progress creations. For status of an in-progress creation, also check SandboxProcess records (use salesforce_metadata_query). Args: - include_in_progress (bool): include Sandb…
salesforce_create_sandboxCreate a new sandbox via Tooling API SandboxInfo. Requires Manage Sandboxes permission. Creation is asynchronous and can take minutes (Developer) to hours (Full). After creation, a SandboxProcess record tracks progress — use salesforce_list_sandboxes with include_in_progress=true to monitor. Args:…
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig
SALESFORCE_ACCESS_TOKENSALESFORCE_API_VERSIONSALESFORCE_CLIENT_IDSALESFORCE_CLIENT_SECRETSALESFORCE_INSTANCE_URLSALESFORCE_LOGIN_URLSALESFORCE_NO_DELETEclaude mcp add -s user salesforce -e SALESFORCE_SF_CLI_USERNAME=본인이메일@channel.io -e PATH=/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin -e =true -- npx -y github:sunny980123/Salesforce-MCP-ServerSALESFORCE_PASSWORDSALESFORCE_PRIVATE_KEY_PATHSALESFORCE_READONLY➖ true 시 모든 쓰기 차단 (조회만)SALESFORCE_SF_CLI_USERNAMEclaude mcp add -s user salesforce -e =본인이메일@channel.io -e PATH=/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin -e SALESFORCE_NO_DELETE=true -- npx -y github:sunny980123/Salesforce-MCP-ServerSALESFORCE_USERNAMELicense file
No license file
Add a LICENSE file (MIT, Apache-2.0, etc.).
Tests exist
No test files found
Add tests that exercise each declared tool.
Production dependencies are patched
0 critical, 16 high severity in production deps — @modelcontextprotocol/sdk@1.6.1 (high), @modelcontextprotocol/sdk@1.6.1 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/sunny980123/salesforce-mcp-server)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check