Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

io.github.semwalajay83-sem/salesforce-metadata-mcp

NPM · SALESFORCE-METADATA-MCP

The only Salesforce MCP with Agentforce, OmniStudio & DevOps Center tools — 228 total.

+1 this week 77 Trust /100

Last scanned (20 hours ago)

Scores higher than 55% of npm servers

Category CRM and Sales

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security80
  • No malware found by supply-chain analysis.Pass
  • CVE check failed: a known high-severity CVE affects @modelcontextprotocol/sdk 1.30.0, a direct dependency. A fixed version is available. View diagnostics → Fail
  • No install/post-install scripts declared.Pass
  • 39 of 105 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency48
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 41 days ago).Pass
  • Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability66
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 4760 tokens (~238/item across 20 items; 20 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
  • No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Tool Safety88
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • 2 of 4 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "sf_check_deploy_status" implies "deploy" and declares readOnlyHint instead, contradicting what its own name says it does. See how to fix → Partial
  • An AI judge read all 20 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 3 Nov 26 +1
    • Security disclosure: unverified → pass ▲ functional
  • 1 Nov 26 −1
    • Security disclosure: pass → unverified ▼ functional
  • 29 Oct 26 +1
    • Stability: 0.97 → pass security
  • 28 Oct 26 −1
    • GHSA-f897-62hf-6gxq affects this package: high ▼ security
    • Stability: pass → 0.97 functional
  • 24 Oct 26 0
    • CVE-2023-54404 affects this package: high ▼ security
  • 21 Oct 26 0
    • CVE-2026-111771 affects this package: high ▼ security
    • CVE-2026-111768 affects this package: high ▼ security
    • CVE-2026-111769 affects this package: high ▼ security
    • CVE-2026-111767 affects this package: high ▼ security
  • 16 Oct 26 +1
    • Stability: 0.97 → pass security
  • 14 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 4 Nov 2026 · Analysed npm/salesforce-metadata-mcp@3.2.0

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem npm

Background: How many MCP packages publish verified provenance →

Vulnerabilities 7 findings
ID CVE Severity Vector Fix available
GHSA-22jm-h49p-29qw CVE-2026-111767 high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L yes
GHSA-46jr-4wx8-v453 CVE-2026-111768 high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yes
GHSA-6prh-2h8m-c8cw CVE-2026-111769 medium CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N yes
GHSA-6qxp-vccf-f47h CVE-2026-104850 high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N yes
GHSA-f897-62hf-6gxq high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yes
GHSA-rvq5-wwqv-78pq CVE-2026-111771 medium CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N yes
GHSA-mrhx-c7xc-m3w5 CVE-2023-54404 high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yes

Background: What a vulnerability scan can and cannot prove →

Dependencies 105 packages
Packages resolved 105
Stale 39
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 20 exposed · ~4,760 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
sf_add_picklist_values ~92

Adds new picklist values to an existing Picklist or MultiselectPicklist field without removing existing values. Use when a user wants to add new options to a dropdown.

NameTypeReqDescription
objectFieldFullNamestringyesFull API name of the picklist field, e.g. 'Invoice__c.Status__c'
valuesarrayyesNew picklist values to add (existing values are preserved)

No output schema declared.

No examples provided.

sf_call_tool ~149

Invokes any of this server's 228 tools by name, including tools whose toolset is not loaded and tools that do not appear in your tool list. Use this whenever a Salesforce tool you need is not directly callable — it works even on clients that do not refresh their tool list after sf_load_toolset. Get the argument shape first with sf_tool_schema or sf_find_tool. Arguments are validated and permission-checked exactly as they are on a direct call.

NameTypeReqDescription
argumentsobject–Arguments object for that tool, matching its inputSchema. Omit for a tool that takes none.
toolstringyesExact tool name, e.g. "sf_execute_anonymous_apex".

No output schema declared.

No examples provided.

sf_check_deploy_status ~84

Checks the status of an in-progress or recently completed metadata deployment by async job ID. Returns the status (Pending, InProgress, Succeeded, Failed, Canceled), component successes, failures, and test results. Use with the deploy ID returned from sf_deploy_metadata.

NameTypeReqDescription
deployIdstringyesDeploy async job ID returned from sf_deploy_metadata

No output schema declared.

No examples provided.

sf_create_approval_process ~301

Creates or updates a Salesforce Approval Process via the Metadata API. Define who can submit, approval steps with approvers, entry criteria, and what happens on approval or rejection.

NameTypeReqDescription
activeboolean–Activate immediately (warning: cannot change steps after activation)
allowRecallboolean–Allow submitters to recall approval requests
allowedSubmittersarrayyesWho can submit: [{type:'owner'}] or [{type:'role', submitter:'SalesRep'}]
approvalStepsarrayyesOrdered list of approval steps
descriptionstring–Description of the approval process
emailTemplatestring–Email template for approval notifications, e.g. 'unfiled$public/ApprovalEmail'
entryFilterCriteriaarray–Filter criteria alternative to entryFormula
entryFormulastring–Formula records must satisfy to enter this process
finalApprovalLockboolean–Lock record after final approval
finalRejectionLockboolean–Lock record after final rejection
labelstringyesHuman-readable label, e.g. 'Large Deal Approval Process'
objectNamestringyesObject API name, e.g. 'Opportunity' or 'Leave_Request__c'
processNamestringyesAPI name of the process, e.g. 'Large_Deal_Approval'
recordEditabilitystring–Who can edit locked records during approval

No output schema declared.

No examples provided.

sf_create_custom_field ~451

Creates a new custom field on an existing Salesforce object. The field API name must end with '__c'. Supports all field types: Text, Number, Picklist, Lookup, etc.

NameTypeReqDescription
defaultValueboolean|string–Default value for the field. Use true/false for Checkbox fields.
deleteConstraintstring–Delete behaviour for Lookup fields: 'Cascade', 'Restrict', or 'SetNull'
descriptionstring–Optional description for the field
externalIdboolean–Whether this field is an external ID
fieldNamestringyesAPI name of the field, e.g. 'Status__c'
labelstringyesDisplay label for the field, e.g. 'Status'
lengthinteger–Max length. Text/TextArea: 1–255 (default 255). LongTextArea/Html (Text Area Long / Rich Text Area): 256–131072 (default 32768).
objectNamestringyesAPI name of the parent object, e.g. 'Account' or 'Invoice__c'
picklistValues––Picklist values. Either a plain list (['Draft','Open']) or the full { restricted, sorted, values } object. Required for Picklist / MultiselectPicklist types.
precisioninteger–Total digits for Number/Currency/Percent (1–18)
referenceTostring–Target object API name for Lookup/MasterDetail, e.g. 'Account'
relationshipLabelstring–Label for the relationship on the related object
relationshipNamestring–API name for the relationship (no spaces)
requiredboolean–Whether the field is required on page layouts
scaleinteger–Decimal places for Number/Currency/Percent (0–17)
typestringyesSalesforce field type
uniqueboolean–Whether values must be unique (Text, Number, Email)
visibleLinesinteger–Visible lines. Required for LongTextArea and Html (Text Area Long / Rich Text Area) — default 10. Also used for MultiselectPicklist.

No output schema declared.

No examples provided.

sf_create_custom_object ~288

Creates a new Salesforce Custom Object using the Metadata API. The object name must end with '__c'. Use this when a user asks to create a new object, entity, or table in Salesforce.

NameTypeReqDescription
autoNumberFormatstring–Format for AutoNumber name field, e.g. 'INV-{0000}'. Required when nameFieldType is AutoNumber.
deploymentStatusstring–Deployment status of the object
descriptionstring–Optional description for the object
enableActivitiesboolean–Allow activities (tasks/events) on this object
enableHistoryboolean–Enable field history tracking
enableReportsboolean–Make the object available for reports
enableSearchboolean–Enable search on this object
fullNamestringyesAPI name of the custom object, e.g. 'Invoice__c'
labelstringyesSingular label shown in the UI, e.g. 'Invoice'
nameFieldLabelstring–Label for the standard Name field, e.g. 'Invoice Name'
nameFieldTypestring–Type of Name field: 'Text' (free-form) or 'AutoNumber' (auto-increment)
pluralLabelstringyesPlural label, e.g. 'Invoices'
sharingModelstring–OWD sharing model for the object

No output schema declared.

No examples provided.

sf_create_formula_field ~399

Creates a formula field on any Salesforce object. Supports all return types (Text, Number, Currency, Date, DateTime, Checkbox, Percent) and the full Salesforce formula language: IF/AND/OR/NOT, BLANKVALUE, TEXT, VALUE, DATE, DATEVALUE, TODAY, NOW, date functions (MONTH/YEAR/DAY), math (FLOOR/CEILING/MOD), string functions (LEN/LEFT/RIGHT/MID/TRIM/UPPER/LOWER/CONTAINS/BEGINS), record type and picklist functions (ISPICKVAL, ISNULL, ISBLANK), cross-object field references (e.g. Account.Owner.Name), and VLOOKUP. Complex multi-line formulas are fully supported.

NameTypeReqDescription
descriptionstring–Field description
fieldNamestringyesField name without __c suffix
formulastringyesSalesforce formula expression. Supports all Salesforce formula functions: IF, AND, OR, NOT, BLANKVALUE, TEXT, VALUE, DATE, DATEVALUE, TODAY, NOW, MONTH, YEAR, DAY, FLOOR, CEILING, MOD, LEN, LEFT, RIG…
formulaTreatBlanksAsstring–How to treat blank fields in the formula. Defaults to BlankAsZero for numeric types, BlankAsLogicalFalse for Checkbox.
labelstringyesField label
objectApiNamestringyesObject API name, e.g. 'Opportunity'
precisioninteger–Total number of digits for Number/Currency/Percent return types (default 18)
returnTypestringyesFormula return type
scaleinteger–Decimal places for Number/Currency/Percent return types

No output schema declared.

No examples provided.

sf_create_validation_rule ~201

Creates or updates a Salesforce Validation Rule on any object via the Metadata API. The errorConditionFormula returns TRUE when data is INVALID. Use for data quality enforcement.

NameTypeReqDescription
activeboolean–Whether the rule is active
descriptionstring–Description of this validation rule
errorConditionFormulastringyesFormula returning TRUE when data is INVALID, e.g. "AND(ISPICKVAL(StageName,'Closed Won'),ISBLANK(CloseDate))"
errorDisplayFieldstring–Field API name to display error next to, e.g. 'CloseDate'. Blank = top of page.
errorMessagestringyesError shown to user when validation fails (max 255 chars)
objectNamestringyesObject API name, e.g. 'Account', 'Opportunity', 'Invoice__c'
ruleNamestringyesAPI name for the rule, e.g. 'Require_Close_Date'

No output schema declared.

No examples provided.

sf_create_workflow_field_update ~185

Creates a Workflow Field Update action that can be referenced by Approval Processes, Workflow Rules, or Flows. Sets a field to a literal value, formula result, or null.

NameTypeReqDescription
actionNamestringyesAPI name of the action, e.g. 'Set_Stage_Closed_Won'
fieldstringyesField API name to update, e.g. 'StageName'
formulastring–Formula for the new value, e.g. 'TODAY()'
labelstringyesHuman-readable label
literalValuestring–Literal string/picklist value to set
notifyAssigneeboolean–Notify owner/assignee after update
nullValueboolean–Set the field to null/blank
objectNamestringyesObject API name, e.g. 'Opportunity'

No output schema declared.

No examples provided.

sf_delete_metadata ~289

Permanently deletes one or more metadata components of a given type via the Metadata API's deleteMetadata call — works for CustomObject, CustomField, Flow, GenAiFunction, GenAiPlugin, GenAiPlannerBundle, Bot, ApexClass, and most other metadata types. There was previously no way to remove anything created by this MCP server (sf_deploy_metadata only supports adding/updating components, not destructiveChanges) — diagnostic or abandoned metadata had nowhere to go. Deletes each fullName independently: check the response's deleted/errors lists rather than assuming all all-or-nothing. Some types have dependency order requirements (e.g. delete a Bot's GenAiFunction/GenAiPlugin/GenAiPlannerBundle before the Bot itself, delete CustomField before its parent CustomObject) — Salesforce will reject a delete that still has dependents, naming them in the error.

NameTypeReqDescription
fullNamesarrayyesFull names of the components to delete, e.g. ['My_Object__c'] or ['My_Object__c.My_Field__c']. Deletes each independently — some may succeed while others fail; check the response's deleted/errors lis…
metadataTypestringyesMetadata type to delete, e.g. 'CustomObject', 'CustomField', 'Flow', 'GenAiFunction', 'GenAiPlugin', 'GenAiPlannerBundle', 'Bot'

No output schema declared.

No examples provided.

sf_deploy_metadata ~255

Deploys a set of metadata components directly to the org using the Metadata API SOAP deploy operation. Builds a package.xml and deployment zip in memory. Supports validate-only (checkOnly:true) for pre-deployment validation without making changes. Specify runTests to execute test classes during deployment (required for production). Polls until complete or timeout.

NameTypeReqDescription
checkOnlyboolean–Validate only, do not actually deploy
componentsarray–Metadata components to include in the deployment package. These reference components already in the org. Can be empty when using componentsXml to deploy new/updated components with inline XML.
componentsXmlarray–Optional inline XML components to deploy. Each entry provides the complete XML definition (type, name, xml). The file path is inferred from type/name. When provided alongside components, both are dep…
rollbackOnErrorboolean–Roll back all changes if any component fails
runTestsarray–Test classes to run during deployment
testLevelstring–Test level: NoTestRun, RunSpecifiedTests, RunLocalTests, or RunAllTestsInOrg
waitMinutesinteger–Max minutes to wait for deploy to complete

No output schema declared.

No examples provided.

sf_describe_object ~453

Retrieves schema metadata for a Salesforce object via the REST Describe API: fields (name, label, type, required, picklist values, length, references), child relationships, and record type info. Call this before querying or creating records on an unfamiliar object, or when a user asks what fields exist on an object. objectApiName: SObject API name, e.g. 'Account', 'My_Object__c' fieldsOnly: set true for a smaller/faster response with just the field list, omitting child relationships and record types waitForFields: field API names to poll for after a sf_create_custom_field call — Salesforce's own REST describe/SOQL schema cache can lag several minutes behind the Metadata API on some orgs even though the field is fully deployed; this retries so you don't have to. Not caused by this MCP server and not fixable here — it's Salesforce-side. timeoutSeconds: max time to poll when waitForFields is set (default 60, max 300)

NameTypeReqDescription
fieldsOnlyboolean–If true, returns only the field list (name, label, type, required, picklist values) and omits child relationships/record type info — use for a smaller, faster response when you only need field names/…
objectApiNamestringyesSObject API name to describe, e.g. 'Account', 'My_Object__c'
timeoutSecondsinteger–Max time to poll when waitForFields is set. Ignored otherwise.
waitForFieldsarray–Field API names to wait for. Salesforce's own REST describe/SOQL schema cache can lag several minutes behind a metadata deploy on some orgs (confirmed live 2026-07-31: a field visible via Tooling API…

No output schema declared.

No examples provided.

sf_find_tool ~145

Searches all 228 Salesforce tools by name — including tools in toolsets that are not loaded — and by default loads whichever toolsets contain the matches, so you can call them immediately. Use this whenever a tool you expect does not appear in the tool list, or when you do not know which toolset a capability lives in. Example queries: "flow", "permission set", "agent", "omniscript", "debug log".

NameTypeReqDescription
autoLoadboolean–Load the toolsets containing the matches so they become callable straight away. Default true.
querystringyesWhat you are looking for, e.g. "validation rule" or "create flow".

No output schema declared.

No examples provided.

sf_get_metadata_dependencies ~335

Answers "what breaks if I change this?" for any metadata component. Read-only — it changes nothing. Returns every component that REFERENCES the target (Apex classes, triggers, flows, validation rules, layouts, report types, formulas), grouped by type. For custom fields it also reports how many records currently hold a value, which is usually the deciding factor in whether a change is safe. componentType + componentName: e.g. CustomField + 'Account.Revenue__c', or ApexClass + 'AccountService' componentId: alternatively pass the Salesforce Id directly (needed for types outside the supported list) includeUses: also return what the component itself depends on Run this BEFORE deleting or reshaping anything that holds data. Note the blindSpots list returned with every response: this API cannot see dynamic SOQL, string-built field names, managed-package internals, or external integrations, so an empty result means "nothing found", never "safe to change".

NameTypeReqDescription
componentIdstring–Salesforce Id of the component, as an alternative to type+name (required for types not in the supported list).
componentNamestring–Component API name. For CustomField use 'Object.Field__c', e.g. 'Account.Revenue__c'.
componentTypestring–Metadata type: CustomField, CustomObject, ApexClass, ApexTrigger, Flow, ValidationRule, Layout, PermissionSet, LightningComponentBundle, AuraDefinitionBundle, StaticResource, ApexPage, ApexComponent
includeUsesboolean–Also return what this component itself depends on (the reverse direction).

No output schema declared.

No examples provided.

sf_list_objects ~283

Finds Salesforce objects by PARTIAL name or label — the discovery step before sf_describe_object, which needs an exact API name you may not know yet. Use this whenever the user refers to objects loosely ("what objects handle cases?", "is there a custom object for invoices?", "show me the custom objects") rather than by exact API name. searchTerm: partial API name or label, case-insensitive. Omit to list every object in the org. objectType: 'all' (default), 'custom' (only __c), or 'standard' queryableOnly: true to hide objects that cannot be queried with SOQL limit: max results (default 50) Results rank exact matches first, then prefix matches, then substring matches, so a search for "Account" returns Account before AccountBrandShare. Returns name, label, keyPrefix and CRUD-ability per object; call sf_describe_object with an exact name for full field detail.

NameTypeReqDescription
limitinteger–Maximum objects to return
objectTypestring–Restrict to custom or standard objects
queryableOnlyboolean–Only return objects that support SOQL queries
searchTermstring–Partial API name or label to match, case-insensitive. Omit to list everything. Results rank exact matches first, then prefix, then substring.

No output schema declared.

No examples provided.

sf_list_toolsets ~75

Lists every available Salesforce toolset, how many tools each contains, and which are currently loaded. This server keeps most of its 228 tools unloaded to save context; unloaded tools do not appear in the tool list until you load their toolset with sf_load_toolset. Call this when you need a capability you cannot see.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

sf_load_toolset ~224

Loads one or more Salesforce toolsets, making their tools callable and visible in the tool list. Available toolsets: core, metadata, objects, data, flows, automation, security, apex, lwc, ui, pages, actions, agentforce, omnistudio, omnichannel, devops, deployment, integrations, identity, reports, experience, admin, monitoring, audit, einstein, knowledge, cpq, sandbox, streaming, visualforce, aura, comms, mcp, i18n. Call sf_list_toolsets for descriptions and tool counts.

NameTypeReqDescription
toolsetsarrayyesToolset names to load. One or more of: core, metadata, objects, data, flows, automation, security, apex, lwc, ui, pages, actions, agentforce, omnistudio, omnichannel, devops, deployment, integrations…

No output schema declared.

No examples provided.

sf_query_records ~283

Executes a SOQL query against the org and returns matching records. Provide the full SOQL string in the query param. Use for reading data, checking existing records before creating, or verifying changes. Supports aggregate queries — GROUP BY with COUNT(), SUM(), AVG(), MAX(), MIN(), e.g.: 'SELECT StageName, COUNT(Id), SUM(Amount) FROM Opportunity GROUP BY StageName' Aggregate results come back as regular records with the aggregate expressions as field keys (e.g. "expr0"). Row cap: 'limit' defaults to 200 and is a ceiling, not a hint. If the SOQL carries its own LIMIT the smaller of the two applies, so a LIMIT in the query can tighten the cap but never raise it. When rows are cut off the response sets truncated: true and reports appliedLimit and limitSource, so a capped result is never mistaken for a complete one.

NameTypeReqDescription
limitinteger–Maximum records to return (default 200). Acts as a ceiling: if the SOQL contains its own LIMIT, the smaller of the two wins, so a LIMIT in the query can tighten this but never raise it. The response…
querystringyesFull SOQL query string, e.g. 'SELECT Id, Name FROM Account WHERE Industry = \'Technology\' LIMIT 10'

No output schema declared.

No examples provided.

sf_retrieve_metadata ~184

Retrieves metadata components from the org and returns their actual file contents. Use this to read existing configuration before making changes, to back up metadata, or to check what is really deployed rather than what you think is deployed. Waits for the async retrieve to finish and unpacks the resulting zip, returning each file's path and source. Large files are truncated. Accepts 'components' (array), or 'metadataType'+'componentName' as a single-item shortcut, or a raw 'packageXml' document — provide exactly one form.

NameTypeReqDescription
componentNamestring–Single component name (used with metadataType)
componentsarray–Metadata components to retrieve
metadataTypestring–Single metadata type (alternative to components array)
packageXmlstring–Raw package.xml content for selective retrieve. If provided, components list is ignored.

No output schema declared.

No examples provided.

sf_tool_schema ~84

Returns the input schema, title and description of any of this server's 228 tools, whether or not its toolset is loaded. Use this to find out what arguments a tool takes when it is not in your tool list, then invoke it with sf_call_tool.

NameTypeReqDescription
toolstringyesExact tool name, e.g. "sf_execute_anonymous_apex".

No output schema declared.

No examples provided.

Install

How do I install the io.github.semwalajay83-sem/salesforce-metadata-mcp server?

io.github.semwalajay83-sem/salesforce-metadata-mcp runs locally as an npm package, launched with npx -y salesforce-metadata-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · salesforce-metadata-mcp

# add to Claude Code
claude mcp add semwalajay83-sem-salesforce-metadata-mcp -- npx -y salesforce-metadata-mcp
Common questions

What is the io.github.semwalajay83-sem/salesforce-metadata-mcp server?

io.github.semwalajay83-sem/salesforce-metadata-mcp is listed in the public MCP registry as io.github.semwalajay83-sem/salesforce-metadata-mcp. The only Salesforce MCP with Agentforce, OmniStudio & DevOps Center tools, 228 total. This page covers its npm package (salesforce-metadata-mcp).

Is the io.github.semwalajay83-sem/salesforce-metadata-mcp server safe to use?

io.github.semwalajay83-sem/salesforce-metadata-mcp scores 77 out of 100 on VerifyMCP. We recorded 7 known advisories against it as of 4 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the io.github.semwalajay83-sem/salesforce-metadata-mcp server expose?

io.github.semwalajay83-sem/salesforce-metadata-mcp exposes 20 tools: sf_create_custom_object, sf_create_custom_field, sf_add_picklist_values, sf_create_approval_process, sf_create_validation_rule, and 15 more. Their descriptions and schemas cost roughly 4,760 tokens of context every time the server is loaded.

Is the io.github.semwalajay83-sem/salesforce-metadata-mcp server still maintained?

io.github.semwalajay83-sem/salesforce-metadata-mcp is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the io.github.semwalajay83-sem/salesforce-metadata-mcp server under?

io.github.semwalajay83-sem/salesforce-metadata-mcp declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.