Associated company landscape
Salesforce intelligence →
Association is based on retained identity fields; it does not by itself prove first-party publication.
MCP server intelligence profile
wso2-bi-salesforce-mcp-server MCP Server
Enables AI assistants to set up, run, and manage Ballerina + Salesforce integrations inside a WSO2 Integrator workspace, providing 18 tools for OAuth2 token acquisition, project scaffolding, building, deploying, and stopping the integration service
1Distribution channel
20Independently observed tools
0Linked remote endpoints
AvailableVersion intelligence
Detailed security scan evidence is not public for this MCP yet. Public identity, registry metadata, and independently observed protocol inventory remain available.
Install and connect
Installation and connection instructions are shown only when supported by retained package, repository, or endpoint evidence.
No verified installation or connection method is available in the retained evidence yet.
Identity
| Canonical slug | wso2-bi-salesforce-mcp-server-2aecf3c5 | Deployment | Local Only |
|---|---|---|---|
| Canonical package | — | Repository | PasinduGunarathne/wso2-bi-salesforce-mcp-server |
| First published | — | Latest release | — |
| Last security verification | — | Classification confidence | 90% |
| Publication | Draft | Official distribution | Not verified |
Distributions
| Channel | Identifier | Current version | Versions | Source |
|---|---|---|---|---|
| source_git | pasindugunarathne/wso2-bi-salesforce-mcp-server | 9ba8cab82b94118c2596c82024c8b1ebf642cd86 | 1 | Repository |
Current release
| Package | Version | Published / observed | Inventory | Security scan |
|---|---|---|---|---|
| source_gitpasindugunarathne/wso2-bi-salesforce-mcp-server | 9ba8cab82b94118c2596c82024c8b1ebf642cd86Current | Aug 25, 2026 | 20 toolsSucceeded · 0 resources · 0 prompts | Evidence restricted |
Enterprise protection
Continuously monitor this MCP for security risk
Independently scan the exact version your agents use, receive alerts when its risk changes, and investigate every finding with retained version evidence.
- Independent exact-version security scans
- Continuous release and vulnerability monitoring
- Risk-change alerts with capability context
- Historical evidence and API exports
Custom pricingContact salesTailored to your organization, integrations, data needs, and support requirements.
Current version evidence
No public current-version evidence is available yet.
Current protocol inventory
2025-06-18Negotiated protocol
ballerina-salesforce-mcp-serverServer-reported name
1Capability groups
Aug 25, 2026Observed
Tools 20
| Tool | Category | Annotations | Risk |
|---|---|---|---|
sf_add_cdc_listenerAdds an event-driven listener to an existing scaffolded project.
A Salesforce listener can subscribe to:
- Object CDC: /data/<SObjectName>ChangeEvent (set 'sobject')
- All CDC events: /data/ChangeEvents (set 'all_changes': true)
- Platform events: /event/<Name>__e (set 'platform_event')
CDC listeners get onCreate/onUpdate/onDelete/onRestore stubs (you can narrow
this via 'events'). Platform-event listeners get onMessage.
The listener reuses the OAuth2 credentials already configured in main.bal —
no extra Config.toml entries required.Input schema{
"type": "object",
"properties": {
"project_path": {
"type": "string",
"minLength": 1,
"description": "Path to the existing Ballerina project"
},
"listener": {
"type": "object",
"properties": {
"sobject": {
"type": "string",
"minLength": 1,
"pattern": "^[A-Za-z][A-Za-z0-9_]*$",
"description": "SObject API name for object-scoped CDC (e.g. 'Account'). Generates channel /data/AccountChangeEvent."
},
"all_changes": {
"type": "boolean",
"description": "Listen on /data/ChangeEvents for all CDC-enabled objects in the org."
},
"platform_event": {
"type": "string",
"pattern": "^[A-Za-z][A-Za-z0-9_]*__e$",
"description": "Platform event API name ending in __e (e.g. 'MyEvent__e')."
},
"events": {
"type": "array",
"items": {
"type": "string",
"enum": [
"onCreate",
"onUpdate",
"onDelete",
"onRestore"
]
},
"description": "CDC callbacks to scaffold (default: all four). Ignored for platform events."
}
},
"additionalProperties": false
}
},
"required": [
"project_path",
"listener"
],
"additionalProperties": false,
"$schema": "http://json-schema.org/draft-07/schema#"
}Annotations{
"readOnlyHint": false,
"destructiveHint": false,
"idempotentHint": false,
"openWorldHint": false
} | — | WritesNon-destructiveNon-idempotentClosed world | — |
sf_add_custom_objectAdds a new SObject to an already-scaffolded project.
For standard SObjects: creates a .bal file that uses the pre-built type
from ballerinax/salesforce.types (no types.bal change needed).
For custom (__c) objects: also appends a typed record to types.bal.
Returns the resource-route snippet to paste into main.bal.Input schema{
"type": "object",
"properties": {
"project_path": {
"type": "string",
"minLength": 1,
"description": "Path to the existing Ballerina project"
},
"sf_client_id": {
"type": "string",
"minLength": 1,
"description": "Salesforce Connected App Consumer Key (Client ID)"
},
"sf_client_secret": {
"type": "string",
"minLength": 1,
"description": "Salesforce Connected App Consumer Secret (Client Secret)"
},
"sf_refresh_token": {
"type": "string",
"minLength": 1,
"description": "Salesforce OAuth2 Refresh Token obtained after authorization"
},
"sf_base_url": {
"type": "string",
"format": "uri",
"description": "Salesforce org instance URL, e.g. https://myorg.my.salesforce.com (sandbox auto-detected from hostname)"
},
"object_name": {
"type": "string",
"minLength": 1,
"pattern": "^[A-Za-z][A-Za-z0-9_]*$",
"description": "SObject API name to add, e.g. 'My_Custom__c'"
}
},
"required": [
"project_path",
"sf_client_id",
"sf_client_secret",
"sf_refresh_token",
"sf_base_url",
"object_name"
],
"additionalProperties": false,
"$schema": "http://json-schema.org/draft-07/schema#"
}Annotations{
"readOnlyHint": false,
"destructiveHint": false,
"idempotentHint": false,
"openWorldHint": true
} | — | WritesNon-destructiveNon-idempotentOpen world | — |
sf_build_projectRuns 'bal build' inside the project directory and reports the result.Input schema{
"type": "object",
"properties": {
"project_path": {
"type": "string",
"minLength": 1,
"description": "Path to the Ballerina project to build"
}
},
"required": [
"project_path"
],
"additionalProperties": false,
"$schema": "http://json-schema.org/draft-07/schema#"
}Annotations{
"readOnlyHint": false,
"destructiveHint": false,
"idempotentHint": true,
"openWorldHint": false
} | — | WritesNon-destructiveIdempotentClosed world | — |
sf_check_prerequisitesVerifies that the 'bal' CLI is installed and reports its version.
Run this first to catch missing prerequisites before scaffolding.Input schema{
"$schema": "http://json-schema.org/draft-07/schema#",
"type": "object",
"properties": {}
}Annotations{
"readOnlyHint": true,
"destructiveHint": false,
"idempotentHint": true,
"openWorldHint": false
} | — | Read onlyNon-destructiveIdempotentClosed world | — |
sf_deploy_projectStarts the Ballerina service in the background via 'bal run'.
The port is passed through as a Ballerina configurable override so the
reported service_url matches the actual listener.
Returns started=true when the listener has actually come up, plus a PID you
can pass to sf_stop_project to terminate the service later.Input schema{
"type": "object",
"properties": {
"project_path": {
"type": "string",
"minLength": 1,
"description": "Path to the Ballerina project to deploy"
},
"port": {
"type": "integer",
"minimum": 1024,
"maximum": 65535,
"default": 9090,
"description": "HTTP listener port (default: 9090)"
}
},
"required": [
"project_path"
],
"additionalProperties": false,
"$schema": "http://json-schema.org/draft-07/schema#"
}Annotations{
"readOnlyHint": false,
"destructiveHint": false,
"idempotentHint": false,
"openWorldHint": false
} | — | WritesNon-destructiveNon-idempotentClosed world | — |
sf_describe_sobjectReturns full field-level metadata for a specific SObject.
Use this to inspect available fields, their types, and relationships before
generating typed Ballerina record definitions.
Errors:
- "NOT_FOUND": Object does not exist or is not accessible to this userInput schema{
"type": "object",
"properties": {
"sf_client_id": {
"type": "string",
"minLength": 1,
"description": "Salesforce Connected App Consumer Key (Client ID)"
},
"sf_client_secret": {
"type": "string",
"minLength": 1,
"description": "Salesforce Connected App Consumer Secret (Client Secret)"
},
"sf_refresh_token": {
"type": "string",
"minLength": 1,
"description": "Salesforce OAuth2 Refresh Token obtained after authorization"
},
"sf_base_url": {
"type": "string",
"format": "uri",
"description": "Salesforce org instance URL, e.g. https://myorg.my.salesforce.com (sandbox auto-detected from hostname)"
},
"object_name": {
"type": "string",
"minLength": 1,
"pattern": "^[A-Za-z][A-Za-z0-9_]*$",
"description": "SObject API name to describe, e.g. 'Account' or 'My_Custom__c'"
}
},
"required": [
"sf_client_id",
"sf_client_secret",
"sf_refresh_token",
"sf_base_url",
"object_name"
],
"additionalProperties": false,
"$schema": "http://json-schema.org/draft-07/schema#"
}Annotations{
"readOnlyHint": true,
"destructiveHint": false,
"idempotentHint": true,
"openWorldHint": true
} | — | Read onlyNon-destructiveIdempotentOpen world | — |
sf_exchange_oauth_codeExchanges an OAuth2 authorization code for tokens.
Set sandbox=true if the code was obtained from test.salesforce.com.
Returns the refresh_token (save this — it's long-lived!) and instance_url.
The short-lived access_token is intentionally masked in the output to keep it
out of MCP transcripts; you don't need it directly — pass refresh_token to the
other tools and they obtain fresh access tokens on demand.
Error Handling:
- "invalid_grant": code expired or already used — re-run sf_get_oauth_auth_url
- "invalid_client": wrong client_id / client_secret (or Connected App still
activating; wait 2-10 min after creating it)Input schema{
"type": "object",
"properties": {
"sf_client_id": {
"type": "string",
"minLength": 1,
"description": "Salesforce Connected App Consumer Key (Client ID)"
},
"sf_client_secret": {
"type": "string",
"minLength": 1,
"description": "Salesforce Connected App Consumer Secret (Client Secret)"
},
"code": {
"type": "string",
"minLength": 1,
"description": "Authorization code from the OAuth redirect"
},
"sf_base_url": {
"type": "string",
"format": "uri",
"description": "Your org instance / My Domain URL. Recommended: a code issued by a My Domain authorize endpoint must be exchanged at the same host. Pass the same value used in sf_get_oauth_auth_url. When omitted, falls back to login/test.salesforce.com."
},
"redirect_uri": {
"type": "string",
"format": "uri",
"default": "https://login.salesforce.com/services/oauth2/success",
"description": "Same redirect URI returned by sf_get_oauth_auth_url"
},
"sandbox": {
"type": "boolean",
"default": false,
"description": "Exchange against test.salesforce.com (sandbox) instead of login.salesforce.com. Ignored when sf_base_url is set."
}
},
"required": [
"sf_client_id",
"sf_client_secret",
"code"
],
"additionalProperties": false,
"$schema": "http://json-schema.org/draft-07/schema#"
}Annotations{
"readOnlyHint": false,
"destructiveHint": false,
"idempotentHint": false,
"openWorldHint": true
} | — | WritesNon-destructiveNon-idempotentOpen world | — |
sf_generate_postman_collectionCreates a complete, import-ready Postman collection for your Salesforce org:
1. Auto-obtains a refresh token using the username+password flow (no browser).
2. Bakes ALL credentials into the collection (collection variables + OAuth2 config).
3. Saves the .postman_collection.json to disk.
4. Returns a ready_for_quickstart block — call sf_quickstart immediately after,
or save the file path and use sf_import_postman_credentials any time later.
The generated collection includes:
• Password flow, auth-code flow (Steps 1–3), and refresh-token requests
• Test scripts that auto-save tokens to collection variables on every response
• Salesforce REST API folder (validate, list SObjects, SOQL, create Account)
• Ballerina service folder (health check, Account CRUD via local service)
This is the recommended first step — run it once, reuse the collection forever.Input schema{
"type": "object",
"properties": {
"sf_client_id": {
"type": "string",
"minLength": 1,
"description": "Salesforce Connected App Consumer Key (Client ID)"
},
"sf_client_secret": {
"type": "string",
"minLength": 1,
"description": "Salesforce Connected App Consumer Secret (Client Secret)"
},
"sf_base_url": {
"type": "string",
"format": "uri",
"description": "Salesforce org instance URL, e.g. https://myorg.my.salesforce.com (sandbox auto-detected from hostname)"
},
"username": {
"type": "string",
"minLength": 1,
"description": "Salesforce username (email). Used to auto-obtain a refresh token via the password flow."
},
"password": {
"type": "string",
"minLength": 1,
"description": "Salesforce password. Append your security token if required: myPassword + ABC123 → myPasswordABC123"
},
"redirect_uri": {
"type": "string",
"format": "uri",
"default": "https://login.salesforce.com/services/oauth2/success",
"description": "Redirect URI registered in your Connected App (also written into the collection)."
},
"collection_name": {
"type": "string",
"minLength": 1,
"default": "Salesforce Integration",
"description": "Display name for the Postman collection (default: 'Salesforce Integration')."
},
"output_path": {
"type": "string",
"description": "Where to save the .postman_collection.json. Defaults to ~/WSO2Integrator/<collection_name>.postman_collection.json"
}
},
"required": [
"sf_client_id",
"sf_client_secret",
"sf_base_url",
"username",
"password"
],
"additionalProperties": false,
"$schema": "http://json-schema.org/draft-07/schema#"
}Annotations{
"readOnlyHint": false,
"destructiveHint": false,
"idempotentHint": false,
"openWorldHint": true
} | — | WritesNon-destructiveNon-idempotentOpen world | — |
sf_get_oauth_auth_urlGenerates the Salesforce OAuth2 authorization URL for a Connected App.
Open the returned URL in a browser to approve access. After approving, Salesforce
redirects to the redirect_uri with a 'code' query parameter — pass that code to
sf_exchange_oauth_code to obtain your refresh token.
Recommended: pass sf_base_url (your org / My Domain URL). The authorize URL is then
built against your org's own host (e.g. https://myorg.my.salesforce.com/services/oauth2/authorize),
which is the correct host for My Domain orgs. When sf_base_url is omitted, set sandbox=true
to use test.salesforce.com instead of login.salesforce.com.Input schema{
"type": "object",
"properties": {
"sf_client_id": {
"type": "string",
"minLength": 1,
"description": "Salesforce Connected App Consumer Key (Client ID)"
},
"sf_base_url": {
"type": "string",
"format": "uri",
"description": "Your org instance / My Domain URL, e.g. https://myorg.my.salesforce.com. Recommended: when set, the authorize URL is built against your org's own host (required for My Domain orgs). When omitted, falls back to login/test.salesforce.com."
},
"redirect_uri": {
"type": "string",
"format": "uri",
"default": "https://login.salesforce.com/services/oauth2/success",
"description": "Redirect URI registered in your Connected App. If you pass sf_base_url and leave this at the default, it is automatically aligned to your org host's /services/oauth2/success."
},
"sandbox": {
"type": "boolean",
"default": false,
"description": "Use sandbox login server (test.salesforce.com) instead of login.salesforce.com. Ignored when sf_base_url is set."
}
},
"required": [
"sf_client_id"
],
"additionalProperties": false,
"$schema": "http://json-schema.org/draft-07/schema#"
}Annotations{
"readOnlyHint": true,
"destructiveHint": false,
"idempotentHint": true,
"openWorldHint": false
} | — | Read onlyNon-destructiveIdempotentClosed world | — |
sf_get_project_logsReturns the most recent log lines from a running Ballerina project started by sf_deploy_project.
Logs are written to a temp file while the process runs. Pass the PID from sf_deploy_project or sf_list_live_projects.Input schema{
"type": "object",
"properties": {
"pid": {
"type": "integer",
"exclusiveMinimum": 0,
"description": "PID returned by sf_deploy_project."
},
"lines": {
"type": "integer",
"exclusiveMinimum": 0,
"default": 100,
"description": "Number of tail lines to return (default 100)."
}
},
"required": [
"pid"
],
"additionalProperties": false,
"$schema": "http://json-schema.org/draft-07/schema#"
}Annotations{
"readOnlyHint": true,
"destructiveHint": false,
"idempotentHint": true,
"openWorldHint": false
} | — | Read onlyNon-destructiveIdempotentClosed world | — |
sf_get_token_password_flowObtains Salesforce OAuth2 tokens using the username+password grant —
no browser, no auth-code redirect required.
Requirements on the Connected App (one-time Salesforce Setup):
1. Scope: "Perform requests at any time (refresh_token, offline_access)"
2. Setup → Identity → OAuth and OpenID Connect Settings →
"Allow OAuth Username-Password Flows" = ON
Append security token to password if required: myPasswordABC123
Returns refresh_token and a ready_for_quickstart block for sf_quickstart.Input schema{
"type": "object",
"properties": {
"sf_client_id": {
"type": "string",
"minLength": 1,
"description": "Salesforce Connected App Consumer Key (Client ID)"
},
"sf_client_secret": {
"type": "string",
"minLength": 1,
"description": "Salesforce Connected App Consumer Secret (Client Secret)"
},
"username": {
"type": "string",
"minLength": 1,
"description": "Salesforce username (email), e.g. me@myorg.com"
},
"password": {
"type": "string",
"minLength": 1,
"description": "Salesforce password. If your org uses a security token, append it directly: password+securitytoken"
},
"sf_base_url": {
"type": "string",
"format": "uri",
"description": "Salesforce org instance URL, e.g. https://myorg.my.salesforce.com (sandbox auto-detected from hostname)"
}
},
"required": [
"sf_client_id",
"sf_client_secret",
"username",
"password",
"sf_base_url"
],
"additionalProperties": false,
"$schema": "http://json-schema.org/draft-07/schema#"
}Annotations{
"readOnlyHint": false,
"destructiveHint": false,
"idempotentHint": false,
"openWorldHint": true
} | — | WritesNon-destructiveNon-idempotentOpen world | — |
sf_import_postman_credentialsReads a Postman collection (.postman_collection.json) — including ones generated
by sf_generate_postman_collection — and extracts Salesforce OAuth2 credentials
(clientId, clientSecret, refreshToken, instanceUrl, username, password) so you
don't have to type them out manually.
If a refresh_token is found it is returned immediately (no browser auth needed).
If only username + password are found, tells you to call sf_get_token_password_flow.
Returns a ready_for_quickstart block to pass directly to sf_quickstart.Input schema{
"type": "object",
"properties": {
"postman_file": {
"type": "string",
"minLength": 1,
"description": "Absolute or ~-relative path to a .postman_collection.json file. The tool extracts Salesforce credentials and returns them ready for sf_quickstart."
},
"validate": {
"type": "boolean",
"default": true,
"description": "Make a live Salesforce API call to confirm the extracted credentials work (default: true)."
}
},
"required": [
"postman_file"
],
"additionalProperties": false,
"$schema": "http://json-schema.org/draft-07/schema#"
}Annotations{
"readOnlyHint": true,
"destructiveHint": false,
"idempotentHint": true,
"openWorldHint": false
} | — | Read onlyNon-destructiveIdempotentClosed world | — |
sf_list_sobjectsLists SObjects (standard and/or custom) available in the org.
Supports filtering and pagination.
Returns JSON with: total, count, offset, has_more, next_offset (when more), sobjects[].Input schema{
"type": "object",
"properties": {
"sf_client_id": {
"type": "string",
"minLength": 1,
"description": "Salesforce Connected App Consumer Key (Client ID)"
},
"sf_client_secret": {
"type": "string",
"minLength": 1,
"description": "Salesforce Connected App Consumer Secret (Client Secret)"
},
"sf_refresh_token": {
"type": "string",
"minLength": 1,
"description": "Salesforce OAuth2 Refresh Token obtained after authorization"
},
"sf_base_url": {
"type": "string",
"format": "uri",
"description": "Salesforce org instance URL, e.g. https://myorg.my.salesforce.com (sandbox auto-detected from hostname)"
},
"include_custom": {
"type": "boolean",
"default": true,
"description": "Include custom (__c) objects"
},
"filter": {
"type": "string",
"description": "Substring filter on object name/label"
},
"limit": {
"type": "integer",
"minimum": 1,
"maximum": 200,
"default": 50,
"description": "Max objects to return"
},
"offset": {
"type": "integer",
"minimum": 0,
"default": 0,
"description": "Pagination offset"
}
},
"required": [
"sf_client_id",
"sf_client_secret",
"sf_refresh_token",
"sf_base_url"
],
"additionalProperties": false,
"$schema": "http://json-schema.org/draft-07/schema#"
}Annotations{
"readOnlyHint": true,
"destructiveHint": false,
"idempotentHint": true,
"openWorldHint": true
} | — | Read onlyNon-destructiveIdempotentOpen world | — |
sf_quickstartEnd-to-end setup in a single call:
1. Validates your Salesforce credentials.
2. Auto-detects sandbox vs. production from sf_base_url hostname.
3. Scaffolds a Ballerina project in your WSO2 BI workspace.
- Standard SObjects use pre-built types from ballerinax/salesforce.types
(no describe API calls, no generated boilerplate).
- Custom (__c) objects are described and typed automatically.
4. Optionally runs 'bal build' to verify compilation.
This is the recommended entry point — most users only need to call this tool.
If you don't yet have credentials, call `sf_setup_guide` first.
All inputs except the 4 credential fields have sensible defaults:
- project_name: salesforce_integration
- org_name: wso2bi
- bi_path: ~/WSO2Integrator (mac/linux) or %USERPROFILE%\WSO2Integrator
- target_objects: ["Account", "Contact", "Lead", "Opportunity"]
- port: 9090
- build: false (set true to compile after scaffolding)Input schema{
"type": "object",
"properties": {
"sf_client_id": {
"type": "string",
"minLength": 1,
"description": "Salesforce Connected App Consumer Key (Client ID)"
},
"sf_client_secret": {
"type": "string",
"minLength": 1,
"description": "Salesforce Connected App Consumer Secret (Client Secret)"
},
"sf_refresh_token": {
"type": "string",
"minLength": 1,
"description": "Salesforce OAuth2 Refresh Token obtained after authorization"
},
"sf_base_url": {
"type": "string",
"format": "uri",
"description": "Salesforce org instance URL, e.g. https://myorg.my.salesforce.com (sandbox auto-detected from hostname)"
},
"project_name": {
"type": "string",
"pattern": "^[a-z][a-z0-9_]*$",
"default": "salesforce_integration",
"description": "Ballerina package name (default: salesforce_integration)"
},
"org_name": {
"type": "string",
"pattern": "^[a-z][a-z0-9_]*$",
"default": "wso2bi",
"description": "Ballerina org name (default: wso2bi)"
},
"bi_path": {
"type": "string",
"minLength": 1,
"default": "~/WSO2Integrator",
"description": "WSO2 BI workspace path (default: ~/WSO2Integrator)"
},
"target_objects": {
"type": "array",
"items": {
"type": "string",
"minLength": 1,
"pattern": "^[A-Za-z][A-Za-z0-9_]*$"
},
"minItems": 1,
"default": [
"Account",
"Contact",
"Lead",
"Opportunity"
],
"description": "SObject API names (default: Account, Contact, Lead, Opportunity)"
},
"build": {
"type": "boolean",
"default": false,
"description": "Run 'bal build' after scaffolding to verify the project compiles. Adds 30-90s but catches credential or version mismatches early."
},
"run": {
"type": "boolean",
"default": true,
"description": "Start 'bal run' in the background after scaffolding (default: true). No new terminal window is opened — the service runs as a tracked child process. Tail logs with sf_get_project_logs and stop it with sf_stop_project (both take the returned PID)."
},
"cdc_listeners": {
"type": "array",
"items": {
"type": "object",
"properties": {
"sobject": {
"$ref": "#/properties/target_objects/items",
"description": "SObject API name for object-scoped CDC (e.g. 'Account'). Generates channel /data/AccountChangeEvent."
},
"all_changes": {
"type": "boolean",
"description": "Listen on /data/ChangeEvents for all CDC-enabled objects in the org."
},
"platform_event": {
"type": "string",
"pattern": "^[A-Za-z][A-Za-z0-9_]*__e$",
"description": "Platform event API name ending in __e (e.g. 'MyEvent__e')."
},
"events": {
"type": "array",
"items": {
"type": "string",
"enum": [
"onCreate",
"onUpdate",
"onDelete",
"onRestore"
]
},
"description": "CDC callbacks to scaffold (default: all four). Ignored for platform events."
}
},
"additionalProperties": false
},
"description": "Optional CDC / Platform Event listeners to scaffold alongside the REST service."
},
"port": {
"type": "integer",
"minimum": 1024,
"maximum": 65535,
"default": 9090,
"description": "HTTP listener port (default: 9090)"
},
"rest_api": {
"type": "boolean",
"default": false,
"description": "Generate an HTTP REST API (health + CRUD routes) bound to `port` (default: FALSE = CDC-only, no port bound, no port-collision failure mode; requires at least one cdc_listener). Set true ONLY if you need HTTP CRUD/health endpoints — ask the user first."
},
"sandbox": {
"type": "boolean",
"description": "Force sandbox mode (test.salesforce.com). Usually inferred from sf_base_url, set this only to override detection."
}
},
"required": [
"sf_client_id",
"sf_client_secret",
"sf_refresh_token",
"sf_base_url"
],
"additionalProperties": false,
"$schema": "http://json-schema.org/draft-07/schema#"
}Annotations{
"readOnlyHint": false,
"destructiveHint": false,
"idempotentHint": false,
"openWorldHint": true
} | — | WritesNon-destructiveNon-idempotentOpen world | — |
sf_reauth_projectExchanges a Salesforce OAuth2 authorization code for a new refresh token
and immediately patches Config.toml in the target project — fixing an
expired/revoked token in a single step.
Use this when a running Ballerina project logs:
"Token refresh failed" / "invalid_grant" / "expired access/refresh token"
Workflow:
1. Run sf_get_oauth_auth_url (or open the Connected App's auth URL manually).
2. Log in and approve — copy the 'code' value from the redirect URL.
3. Call sf_reauth_project with that code and the project path.
The tool exchanges the code, extracts orgName/packageName from Ballerina.toml,
preserves the existing servicePort, and overwrites Config.toml (mode 0600).
4. Restart the project (sf_deploy_project or bal run) to apply the new token.
Error hints:
- "invalid_grant": code expired (codes are single-use, ~10 min TTL) — re-run step 1.
- "invalid_client": wrong client_id/secret, or Connected App still activating.Input schema{
"type": "object",
"properties": {
"project_path": {
"type": "string",
"minLength": 1,
"description": "Absolute or ~-relative path to the existing Ballerina project to update"
},
"sf_client_id": {
"type": "string",
"minLength": 1,
"description": "Salesforce Connected App Consumer Key (Client ID)"
},
"sf_client_secret": {
"type": "string",
"minLength": 1,
"description": "Salesforce Connected App Consumer Secret (Client Secret)"
},
"sf_base_url": {
"type": "string",
"format": "uri",
"description": "Your Salesforce org instance URL, e.g. https://myorg.my.salesforce.com. The token exchange POST is sent to this host's /services/oauth2/token endpoint."
},
"code": {
"type": "string",
"minLength": 1,
"description": "Authorization code from the OAuth redirect — the 'code' query parameter in the browser's redirect URL"
},
"redirect_uri": {
"type": "string",
"format": "uri",
"default": "https://login.salesforce.com/services/oauth2/success",
"description": "Redirect URI registered in your Connected App. Must exactly match the value used when the auth URL was generated."
}
},
"required": [
"project_path",
"sf_client_id",
"sf_client_secret",
"sf_base_url",
"code"
],
"additionalProperties": false,
"$schema": "http://json-schema.org/draft-07/schema#"
}Annotations{
"readOnlyHint": false,
"destructiveHint": false,
"idempotentHint": false,
"openWorldHint": true
} | — | WritesNon-destructiveNon-idempotentOpen world | — |
sf_scaffold_projectCreates a Ballerina integration project in your WSO2 Integrator (BI) workspace.
For most users, prefer 'sf_quickstart' — it wraps this plus credential
validation and an optional build step.
Standard SObjects use pre-built types from ballerinax/salesforce.types (no
describe call needed). Custom (__c) objects are described from your org and
typed in types.bal.
Pre-conditions:
- 'bal' CLI installed (sf_check_prerequisites)
- target_objects exist in your org (custom objects fail loudly if missing)Input schema{
"type": "object",
"properties": {
"project_name": {
"type": "string",
"pattern": "^[a-z][a-z0-9_]*$",
"default": "salesforce_integration",
"description": "Ballerina package name (default: salesforce_integration)"
},
"org_name": {
"type": "string",
"pattern": "^[a-z][a-z0-9_]*$",
"default": "wso2bi",
"description": "Ballerina org name written to Ballerina.toml (default: wso2bi)"
},
"bi_path": {
"type": "string",
"minLength": 1,
"default": "~/WSO2Integrator",
"description": "Path to your WSO2 Integrator (BI) workspace. Defaults to ~/WSO2Integrator."
},
"sf_client_id": {
"type": "string",
"minLength": 1,
"description": "Salesforce Connected App Consumer Key (Client ID)"
},
"sf_client_secret": {
"type": "string",
"minLength": 1,
"description": "Salesforce Connected App Consumer Secret (Client Secret)"
},
"sf_refresh_token": {
"type": "string",
"minLength": 1,
"description": "Salesforce OAuth2 Refresh Token obtained after authorization"
},
"sf_base_url": {
"type": "string",
"format": "uri",
"description": "Salesforce org instance URL, e.g. https://myorg.my.salesforce.com (sandbox auto-detected from hostname)"
},
"target_objects": {
"type": "array",
"items": {
"type": "string",
"minLength": 1,
"pattern": "^[A-Za-z][A-Za-z0-9_]*$"
},
"minItems": 1,
"default": [
"Account",
"Contact",
"Lead",
"Opportunity"
],
"description": "SObject API names to scaffold (default: Account, Contact, Lead, Opportunity). Standard SObjects use pre-built types from ballerinax/salesforce.types — no describe call required."
},
"cdc_listeners": {
"type": "array",
"items": {
"type": "object",
"properties": {
"sobject": {
"$ref": "#/properties/target_objects/items",
"description": "SObject API name for object-scoped CDC (e.g. 'Account'). Generates channel /data/AccountChangeEvent."
},
"all_changes": {
"type": "boolean",
"description": "Listen on /data/ChangeEvents for all CDC-enabled objects in the org."
},
"platform_event": {
"type": "string",
"pattern": "^[A-Za-z][A-Za-z0-9_]*__e$",
"description": "Platform event API name ending in __e (e.g. 'MyEvent__e')."
},
"events": {
"type": "array",
"items": {
"type": "string",
"enum": [
"onCreate",
"onUpdate",
"onDelete",
"onRestore"
]
},
"description": "CDC callbacks to scaffold (default: all four). Ignored for platform events."
}
},
"additionalProperties": false
},
"description": "Optional CDC / Platform Event listeners to scaffold alongside the REST service. Each entry generates a salesforce:Listener bound to a channel, with onCreate/onUpdate/onDelete/onRestore stubs for CDC or onMessage for platform events."
},
"port": {
"type": "integer",
"minimum": 1024,
"maximum": 65535,
"default": 9090,
"description": "HTTP listener port baked into the generated service (default: 9090)"
},
"rest_api": {
"type": "boolean",
"default": false,
"description": "Generate an HTTP REST API (health + CRUD routes) bound to `port` (default: FALSE). Default false = CDC-only project: no http:Listener is created, so NO port is bound and the 'Address already in use' failure mode is impossible (requires at least one cdc_listener). Set true ONLY if you want HTTP CRUD/health endpoints in addition to (or instead of) CDC. CometD/CDC is an outbound connection and needs no inbound port — ask the user whether they actually need the REST API before enabling it."
},
"sandbox": {
"type": "boolean",
"description": "Force sandbox mode (test.salesforce.com). Usually inferred from sf_base_url, set this only to override detection."
}
},
"required": [
"sf_client_id",
"sf_client_secret",
"sf_refresh_token",
"sf_base_url"
],
"additionalProperties": false,
"$schema": "http://json-schema.org/draft-07/schema#"
}Annotations{
"readOnlyHint": false,
"destructiveHint": false,
"idempotentHint": false,
"openWorldHint": false
} | — | WritesNon-destructiveNon-idempotentClosed world | — |
sf_setup_guideReturns a step-by-step guide for first-time users:
how to create a Salesforce Connected App, where to find the Consumer Key/Secret,
how to get a refresh token via sf_get_oauth_auth_url + sf_exchange_oauth_code,
and which tool to call next. Call this when the user says "I'm new" / "where do
I start" / "how do I get credentials".Input schema{
"type": "object",
"properties": {
"sandbox": {
"type": "boolean",
"default": false,
"description": "Generate the sandbox (test.salesforce.com) variant of the guide."
}
},
"additionalProperties": false,
"$schema": "http://json-schema.org/draft-07/schema#"
}Annotations{
"readOnlyHint": true,
"destructiveHint": false,
"idempotentHint": true,
"openWorldHint": false
} | — | Read onlyNon-destructiveIdempotentClosed world | — |
sf_stop_projectStops a 'bal run' process previously started by sf_deploy_project.
Only PIDs tracked by this server (started via sf_deploy_project during the
current session) can be stopped — for safety we won't kill arbitrary host PIDs.Input schema{
"type": "object",
"properties": {
"pid": {
"type": "integer",
"exclusiveMinimum": 0,
"description": "PID returned by sf_deploy_project. Only processes started by this server can be stopped."
}
},
"required": [
"pid"
],
"additionalProperties": false,
"$schema": "http://json-schema.org/draft-07/schema#"
}Annotations{
"readOnlyHint": false,
"destructiveHint": true,
"idempotentHint": true,
"openWorldHint": false
} | — | WritesDestructiveIdempotentClosed world | — |
sf_validate_connectionTests that the provided Salesforce credentials are valid by making a
live API call to the org. Use this before scaffolding a project to confirm
credentials work.
Returns:
- connected: boolean
- org_id: Salesforce Org ID
- username: Authenticated username
- instance_url: Confirmed org URLInput schema{
"type": "object",
"properties": {
"sf_client_id": {
"type": "string",
"minLength": 1,
"description": "Salesforce Connected App Consumer Key (Client ID)"
},
"sf_client_secret": {
"type": "string",
"minLength": 1,
"description": "Salesforce Connected App Consumer Secret (Client Secret)"
},
"sf_refresh_token": {
"type": "string",
"minLength": 1,
"description": "Salesforce OAuth2 Refresh Token obtained after authorization"
},
"sf_base_url": {
"type": "string",
"format": "uri",
"description": "Salesforce org instance URL, e.g. https://myorg.my.salesforce.com (sandbox auto-detected from hostname)"
}
},
"required": [
"sf_client_id",
"sf_client_secret",
"sf_refresh_token",
"sf_base_url"
],
"additionalProperties": false,
"$schema": "http://json-schema.org/draft-07/schema#"
}Annotations{
"readOnlyHint": true,
"destructiveHint": false,
"idempotentHint": true,
"openWorldHint": true
} | — | Read onlyNon-destructiveIdempotentOpen world | — |
sf_write_config_tomlOverwrites Config.toml in an existing Ballerina project with fresh
Salesforce OAuth2 credentials. Useful for rotation. Sandbox is auto-detected
from sf_base_url. File is written with mode 0600 (owner read/write only).Input schema{
"type": "object",
"properties": {
"project_path": {
"type": "string",
"minLength": 1,
"description": "Path to the Ballerina project directory"
},
"sf_client_id": {
"type": "string",
"minLength": 1,
"description": "Salesforce Connected App Consumer Key (Client ID)"
},
"sf_client_secret": {
"type": "string",
"minLength": 1,
"description": "Salesforce Connected App Consumer Secret (Client Secret)"
},
"sf_refresh_token": {
"type": "string",
"minLength": 1,
"description": "Salesforce OAuth2 Refresh Token obtained after authorization"
},
"sf_base_url": {
"type": "string",
"format": "uri",
"description": "Salesforce org instance URL, e.g. https://myorg.my.salesforce.com (sandbox auto-detected from hostname)"
}
},
"required": [
"project_path",
"sf_client_id",
"sf_client_secret",
"sf_refresh_token",
"sf_base_url"
],
"additionalProperties": false,
"$schema": "http://json-schema.org/draft-07/schema#"
}Annotations{
"readOnlyHint": false,
"destructiveHint": false,
"idempotentHint": true,
"openWorldHint": false
} | — | WritesNon-destructiveIdempotentClosed world | — |
Resources 0
- None observed.
Resource templates 0
- None observed.
Prompts 0
- None observed.
Remote endpoints
| Endpoint | Transport | Authentication | Health | Observed |
|---|---|---|---|---|
| No verified remote endpoint is linked. | ||||
wso2-bi-salesforce-mcp-server MCP Server questions
How do I install wso2-bi-salesforce-mcp-server MCP Server?
No verified package installation command is available in the retained catalog evidence.
What tools does wso2-bi-salesforce-mcp-server MCP Server provide?
wso2-bi-salesforce-mcp-server MCP Server exposed 20 tools during independent protocol observation, including sf_add_cdc_listener, sf_add_custom_object, sf_build_project, sf_check_prerequisites, sf_deploy_project, sf_describe_sobject, sf_exchange_oauth_code, sf_generate_postman_collection, and others.
Is wso2-bi-salesforce-mcp-server MCP Server secure?
The selected current version does not yet have completed public verification. Unknown does not mean clean or vulnerable.
Company and product intelligence
These internal links are derived from strong identity fields such as the implementation name, package, repository, vendor, and listing name—not generic description prose.
Explore related MCP server guides
Curated product and capability guides containing this catalog record.