A lite, single-org Salesforce MCP server built on jsforce. Bring-your-own OAuth token — no credentials stored server-side. Runs over stdio (Claude Code) or as a dedicated streamable-HTTP server.
Server has 9 well-named tools with consistent verb_noun patterns (salesforce_query, salesforce_create_record, etc.). All tools have descriptions (avg ~80 chars, within baseline 34-392). Input schemas are present and typed via Zod. However, parameter descriptions are sparse or generic: 'Field API name → value map' lacks constraints; 'The Id of the record' lacks format guidance (15 vs 18 char). Output schemas are not documented, LLMs cannot predict response structure. Error handling returns redacted messages but lacks recovery guidance (no 'try X next' hints). No tool annotations (readOnlyHint, destructiveHint) despite clear risk levels. Missing pagination guidance for list_objects and query results. Per-request _sfAuth injection is well-designed for multi-tenant gateways but underdocumented in tool descriptions.
Create a new record on the given object.
Delete a record by Id.
Describe an sObject: its fields, types, picklist values, and references (trimmed payload).
Retrieve a single record by Id, optionally limited to specific fields.
Return the identity (user, org, instance) of the supplied token. Use this to confirm the connection is authenticated.
List all sObjects available in the org with their key metadata.
Output schemas not documented. LLMs cannot predict response structure for any tool. Baseline requires 100% of A+ tools to have documented return types.
No tool annotations (readOnlyHint, destructiveHint, idempotentHint). Tools marked READ_ONLY or WRITE/DESTRUCTIVE in code but not exposed to LLM via schema annotations.
Parameter 'data' in create_record and update_record lacks constraints. Description 'Field API name → value map' does not specify required fields, valid types, or format. LLMs cannot validate input.
Inferred effective spec: 2026-07-28+.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 57 | 2026-07-28+ | v2 |
Run a SOQL query and return matching records.
Run a SOSL full-text search across objects.
Update fields on an existing record.
No pagination or result limits documented. salesforce_query and salesforce_search may return large result sets. Baseline requires limit/offset params and total count or next_cursor.
Error handling returns redacted messages but lacks recovery guidance. No 'try X next' hints or error classification (retryable vs user-fixable vs fatal).