Headless CRM demo — MCP reads + REST write-back. Express-based web application that integrates with Salesforce via MCP (Model Context Protocol) for reading data and REST API for writing updates.
Two tools with minimal schema documentation and weak descriptions. soqlQuery has a basic string parameter but no output schema documented. updateSobjectRecord has three parameters (sobject-name, id, body) with descriptions present but lacks output schema. Neither tool description explains what data is returned, when to use each tool, or error recovery paths. No parameter constraints (enums, ranges, patterns). No idempotency hints despite updateSobjectRecord being a write operation. Descriptions are functional but generic (72-85 chars), below the 194-char baseline for production tools. No evidence of input validation, error categorization, or recovery guidance in the source code.
Execute a SOQL (Salesforce Object Query Language) query and return records
Update a Salesforce SObject record with new field values
No output schemas documented for either tool. LLMs cannot plan downstream calls or extract required fields (e.g., record IDs for chaining). soqlQuery should document returned record structure; updateSobjectRecord should document success response and updated field values.
updateSobjectRecord lacks idempotency and confirmation semantics. A write operation modifying Salesforce records should either support dry-run/confirmation or explicitly document idempotency guarantees. Currently, an agent retry could apply the same update twice.
No error handling guidance. Neither tool description explains what happens on failure (invalid SOQL, record not found, permission denied). LLMs receive raw errors with no recovery path.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 41 | 2026-07-28+ | v2 |
Parameter 'body' in updateSobjectRecord is typed as 'object' with no schema constraints. LLMs cannot infer valid field names or types. Should document expected Salesforce field structure or provide an enum of common fields.
soqlQuery accepts free-form SOQL strings with no validation hints. Description should warn about common mistakes (missing LIMIT, invalid field names) and suggest calling a discovery tool first if available.