← wso2-bi-salesforce-mcp-server

wso2-bi-salesforce-mcp-server 9ba8cab82b94118c2596c82024c8b1ebf642cd86

source_git · pasindugunarathne/wso2-bi-salesforce-mcp-server · current release

20
Tools
0
Resources
0
Templates
0
Prompts

Observation

Observed 2026-08-25T23:16:46.899Z using mcpSecurity-inventory. Status: succeeded. Negotiated protocol: 2025-06-18.

Server capabilities
{
  "tools": {
    "listChanged": true
  }
}

Tools 20

ToolCategoryAnnotationsRisk
sf_add_cdc_listenerAdds an event-driven listener to an existing scaffolded project. A Salesforce listener can subscribe to: - Object CDC: /data/<SObjectName>ChangeEvent (set 'sobject') - All CDC events: /data/ChangeEvents (set 'all_changes': true) - Platform events: /event/<Name>__e (set 'platform_event') CDC listeners get onCreate/onUpdate/onDelete/onRestore stubs (you can narrow this via 'events'). Platform-event listeners get onMessage. The listener reuses the OAuth2 credentials already configured in main.bal — no extra Config.toml entries required.
Input schema
{
  "type": "object",
  "properties": {
    "project_path": {
      "type": "string",
      "minLength": 1,
      "description": "Path to the existing Ballerina project"
    },
    "listener": {
      "type": "object",
      "properties": {
        "sobject": {
          "type": "string",
          "minLength": 1,
          "pattern": "^[A-Za-z][A-Za-z0-9_]*$",
          "description": "SObject API name for object-scoped CDC (e.g. 'Account'). Generates channel /data/AccountChangeEvent."
        },
        "all_changes": {
          "type": "boolean",
          "description": "Listen on /data/ChangeEvents for all CDC-enabled objects in the org."
        },
        "platform_event": {
          "type": "string",
          "pattern": "^[A-Za-z][A-Za-z0-9_]*__e$",
          "description": "Platform event API name ending in __e (e.g. 'MyEvent__e')."
        },
        "events": {
          "type": "array",
          "items": {
            "type": "string",
            "enum": [
              "onCreate",
              "onUpdate",
              "onDelete",
              "onRestore"
            ]
          },
          "description": "CDC callbacks to scaffold (default: all four). Ignored for platform events."
        }
      },
      "additionalProperties": false
    }
  },
  "required": [
    "project_path",
    "listener"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
Annotations
{
  "readOnlyHint": false,
  "destructiveHint": false,
  "idempotentHint": false,
  "openWorldHint": false
}
—Writes · Non-destructive—
sf_add_custom_objectAdds a new SObject to an already-scaffolded project. For standard SObjects: creates a .bal file that uses the pre-built type from ballerinax/salesforce.types (no types.bal change needed). For custom (__c) objects: also appends a typed record to types.bal. Returns the resource-route snippet to paste into main.bal.
Input schema
{
  "type": "object",
  "properties": {
    "project_path": {
      "type": "string",
      "minLength": 1,
      "description": "Path to the existing Ballerina project"
    },
    "sf_client_id": {
      "type": "string",
      "minLength": 1,
      "description": "Salesforce Connected App Consumer Key (Client ID)"
    },
    "sf_client_secret": {
      "type": "string",
      "minLength": 1,
      "description": "Salesforce Connected App Consumer Secret (Client Secret)"
    },
    "sf_refresh_token": {
      "type": "string",
      "minLength": 1,
      "description": "Salesforce OAuth2 Refresh Token obtained after authorization"
    },
    "sf_base_url": {
      "type": "string",
      "format": "uri",
      "description": "Salesforce org instance URL, e.g. https://myorg.my.salesforce.com (sandbox auto-detected from hostname)"
    },
    "object_name": {
      "type": "string",
      "minLength": 1,
      "pattern": "^[A-Za-z][A-Za-z0-9_]*$",
      "description": "SObject API name to add, e.g. 'My_Custom__c'"
    }
  },
  "required": [
    "project_path",
    "sf_client_id",
    "sf_client_secret",
    "sf_refresh_token",
    "sf_base_url",
    "object_name"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
Annotations
{
  "readOnlyHint": false,
  "destructiveHint": false,
  "idempotentHint": false,
  "openWorldHint": true
}
—Writes · Non-destructive—
sf_build_projectRuns 'bal build' inside the project directory and reports the result.
Input schema
{
  "type": "object",
  "properties": {
    "project_path": {
      "type": "string",
      "minLength": 1,
      "description": "Path to the Ballerina project to build"
    }
  },
  "required": [
    "project_path"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
Annotations
{
  "readOnlyHint": false,
  "destructiveHint": false,
  "idempotentHint": true,
  "openWorldHint": false
}
—Writes · Non-destructive—
sf_check_prerequisitesVerifies that the 'bal' CLI is installed and reports its version. Run this first to catch missing prerequisites before scaffolding.
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {}
}
Annotations
{
  "readOnlyHint": true,
  "destructiveHint": false,
  "idempotentHint": true,
  "openWorldHint": false
}
—Read only · Non-destructive—
sf_deploy_projectStarts the Ballerina service in the background via 'bal run'. The port is passed through as a Ballerina configurable override so the reported service_url matches the actual listener. Returns started=true when the listener has actually come up, plus a PID you can pass to sf_stop_project to terminate the service later.
Input schema
{
  "type": "object",
  "properties": {
    "project_path": {
      "type": "string",
      "minLength": 1,
      "description": "Path to the Ballerina project to deploy"
    },
    "port": {
      "type": "integer",
      "minimum": 1024,
      "maximum": 65535,
      "default": 9090,
      "description": "HTTP listener port (default: 9090)"
    }
  },
  "required": [
    "project_path"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
Annotations
{
  "readOnlyHint": false,
  "destructiveHint": false,
  "idempotentHint": false,
  "openWorldHint": false
}
—Writes · Non-destructive—
sf_describe_sobjectReturns full field-level metadata for a specific SObject. Use this to inspect available fields, their types, and relationships before generating typed Ballerina record definitions. Errors: - "NOT_FOUND": Object does not exist or is not accessible to this user
Input schema
{
  "type": "object",
  "properties": {
    "sf_client_id": {
      "type": "string",
      "minLength": 1,
      "description": "Salesforce Connected App Consumer Key (Client ID)"
    },
    "sf_client_secret": {
      "type": "string",
      "minLength": 1,
      "description": "Salesforce Connected App Consumer Secret (Client Secret)"
    },
    "sf_refresh_token": {
      "type": "string",
      "minLength": 1,
      "description": "Salesforce OAuth2 Refresh Token obtained after authorization"
    },
    "sf_base_url": {
      "type": "string",
      "format": "uri",
      "description": "Salesforce org instance URL, e.g. https://myorg.my.salesforce.com (sandbox auto-detected from hostname)"
    },
    "object_name": {
      "type": "string",
      "minLength": 1,
      "pattern": "^[A-Za-z][A-Za-z0-9_]*$",
      "description": "SObject API name to describe, e.g. 'Account' or 'My_Custom__c'"
    }
  },
  "required": [
    "sf_client_id",
    "sf_client_secret",
    "sf_refresh_token",
    "sf_base_url",
    "object_name"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
Annotations
{
  "readOnlyHint": true,
  "destructiveHint": false,
  "idempotentHint": true,
  "openWorldHint": true
}
—Read only · Non-destructive—
sf_exchange_oauth_codeExchanges an OAuth2 authorization code for tokens. Set sandbox=true if the code was obtained from test.salesforce.com. Returns the refresh_token (save this — it's long-lived!) and instance_url. The short-lived access_token is intentionally masked in the output to keep it out of MCP transcripts; you don't need it directly — pass refresh_token to the other tools and they obtain fresh access tokens on demand. Error Handling: - "invalid_grant": code expired or already used — re-run sf_get_oauth_auth_url - "invalid_client": wrong client_id / client_secret (or Connected App still activating; wait 2-10 min after creating it)
Input schema
{
  "type": "object",
  "properties": {
    "sf_client_id": {
      "type": "string",
      "minLength": 1,
      "description": "Salesforce Connected App Consumer Key (Client ID)"
    },
    "sf_client_secret": {
      "type": "string",
      "minLength": 1,
      "description": "Salesforce Connected App Consumer Secret (Client Secret)"
    },
    "code": {
      "type": "string",
      "minLength": 1,
      "description": "Authorization code from the OAuth redirect"
    },
    "sf_base_url": {
      "type": "string",
      "format": "uri",
      "description": "Your org instance / My Domain URL. Recommended: a code issued by a My Domain authorize endpoint must be exchanged at the same host. Pass the same value used in sf_get_oauth_auth_url. When omitted, falls back to login/test.salesforce.com."
    },
    "redirect_uri": {
      "type": "string",
      "format": "uri",
      "default": "https://login.salesforce.com/services/oauth2/success",
      "description": "Same redirect URI returned by sf_get_oauth_auth_url"
    },
    "sandbox": {
      "type": "boolean",
      "default": false,
      "description": "Exchange against test.salesforce.com (sandbox) instead of login.salesforce.com. Ignored when sf_base_url is set."
    }
  },
  "required": [
    "sf_client_id",
    "sf_client_secret",
    "code"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
Annotations
{
  "readOnlyHint": false,
  "destructiveHint": false,
  "idempotentHint": false,
  "openWorldHint": true
}
—Writes · Non-destructive—
sf_generate_postman_collectionCreates a complete, import-ready Postman collection for your Salesforce org: 1. Auto-obtains a refresh token using the username+password flow (no browser). 2. Bakes ALL credentials into the collection (collection variables + OAuth2 config). 3. Saves the .postman_collection.json to disk. 4. Returns a ready_for_quickstart block — call sf_quickstart immediately after, or save the file path and use sf_import_postman_credentials any time later. The generated collection includes: • Password flow, auth-code flow (Steps 1–3), and refresh-token requests • Test scripts that auto-save tokens to collection variables on every response • Salesforce REST API folder (validate, list SObjects, SOQL, create Account) • Ballerina service folder (health check, Account CRUD via local service) This is the recommended first step — run it once, reuse the collection forever.
Input schema
{
  "type": "object",
  "properties": {
    "sf_client_id": {
      "type": "string",
      "minLength": 1,
      "description": "Salesforce Connected App Consumer Key (Client ID)"
    },
    "sf_client_secret": {
      "type": "string",
      "minLength": 1,
      "description": "Salesforce Connected App Consumer Secret (Client Secret)"
    },
    "sf_base_url": {
      "type": "string",
      "format": "uri",
      "description": "Salesforce org instance URL, e.g. https://myorg.my.salesforce.com (sandbox auto-detected from hostname)"
    },
    "username": {
      "type": "string",
      "minLength": 1,
      "description": "Salesforce username (email). Used to auto-obtain a refresh token via the password flow."
    },
    "password": {
      "type": "string",
      "minLength": 1,
      "description": "Salesforce password. Append your security token if required: myPassword + ABC123 → myPasswordABC123"
    },
    "redirect_uri": {
      "type": "string",
      "format": "uri",
      "default": "https://login.salesforce.com/services/oauth2/success",
      "description": "Redirect URI registered in your Connected App (also written into the collection)."
    },
    "collection_name": {
      "type": "string",
      "minLength": 1,
      "default": "Salesforce Integration",
      "description": "Display name for the Postman collection (default: 'Salesforce Integration')."
    },
    "output_path": {
      "type": "string",
      "description": "Where to save the .postman_collection.json. Defaults to ~/WSO2Integrator/<collection_name>.postman_collection.json"
    }
  },
  "required": [
    "sf_client_id",
    "sf_client_secret",
    "sf_base_url",
    "username",
    "password"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
Annotations
{
  "readOnlyHint": false,
  "destructiveHint": false,
  "idempotentHint": false,
  "openWorldHint": true
}
—Writes · Non-destructive—
sf_get_oauth_auth_urlGenerates the Salesforce OAuth2 authorization URL for a Connected App. Open the returned URL in a browser to approve access. After approving, Salesforce redirects to the redirect_uri with a 'code' query parameter — pass that code to sf_exchange_oauth_code to obtain your refresh token. Recommended: pass sf_base_url (your org / My Domain URL). The authorize URL is then built against your org's own host (e.g. https://myorg.my.salesforce.com/services/oauth2/authorize), which is the correct host for My Domain orgs. When sf_base_url is omitted, set sandbox=true to use test.salesforce.com instead of login.salesforce.com.
Input schema
{
  "type": "object",
  "properties": {
    "sf_client_id": {
      "type": "string",
      "minLength": 1,
      "description": "Salesforce Connected App Consumer Key (Client ID)"
    },
    "sf_base_url": {
      "type": "string",
      "format": "uri",
      "description": "Your org instance / My Domain URL, e.g. https://myorg.my.salesforce.com. Recommended: when set, the authorize URL is built against your org's own host (required for My Domain orgs). When omitted, falls back to login/test.salesforce.com."
    },
    "redirect_uri": {
      "type": "string",
      "format": "uri",
      "default": "https://login.salesforce.com/services/oauth2/success",
      "description": "Redirect URI registered in your Connected App. If you pass sf_base_url and leave this at the default, it is automatically aligned to your org host's /services/oauth2/success."
    },
    "sandbox": {
      "type": "boolean",
      "default": false,
      "description": "Use sandbox login server (test.salesforce.com) instead of login.salesforce.com. Ignored when sf_base_url is set."
    }
  },
  "required": [
    "sf_client_id"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
Annotations
{
  "readOnlyHint": true,
  "destructiveHint": false,
  "idempotentHint": true,
  "openWorldHint": false
}
—Read only · Non-destructive—
sf_get_project_logsReturns the most recent log lines from a running Ballerina project started by sf_deploy_project. Logs are written to a temp file while the process runs. Pass the PID from sf_deploy_project or sf_list_live_projects.
Input schema
{
  "type": "object",
  "properties": {
    "pid": {
      "type": "integer",
      "exclusiveMinimum": 0,
      "description": "PID returned by sf_deploy_project."
    },
    "lines": {
      "type": "integer",
      "exclusiveMinimum": 0,
      "default": 100,
      "description": "Number of tail lines to return (default 100)."
    }
  },
  "required": [
    "pid"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
Annotations
{
  "readOnlyHint": true,
  "destructiveHint": false,
  "idempotentHint": true,
  "openWorldHint": false
}
—Read only · Non-destructive—
sf_get_token_password_flowObtains Salesforce OAuth2 tokens using the username+password grant — no browser, no auth-code redirect required. Requirements on the Connected App (one-time Salesforce Setup): 1. Scope: "Perform requests at any time (refresh_token, offline_access)" 2. Setup → Identity → OAuth and OpenID Connect Settings → "Allow OAuth Username-Password Flows" = ON Append security token to password if required: myPasswordABC123 Returns refresh_token and a ready_for_quickstart block for sf_quickstart.
Input schema
{
  "type": "object",
  "properties": {
    "sf_client_id": {
      "type": "string",
      "minLength": 1,
      "description": "Salesforce Connected App Consumer Key (Client ID)"
    },
    "sf_client_secret": {
      "type": "string",
      "minLength": 1,
      "description": "Salesforce Connected App Consumer Secret (Client Secret)"
    },
    "username": {
      "type": "string",
      "minLength": 1,
      "description": "Salesforce username (email), e.g. me@myorg.com"
    },
    "password": {
      "type": "string",
      "minLength": 1,
      "description": "Salesforce password. If your org uses a security token, append it directly: password+securitytoken"
    },
    "sf_base_url": {
      "type": "string",
      "format": "uri",
      "description": "Salesforce org instance URL, e.g. https://myorg.my.salesforce.com (sandbox auto-detected from hostname)"
    }
  },
  "required": [
    "sf_client_id",
    "sf_client_secret",
    "username",
    "password",
    "sf_base_url"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
Annotations
{
  "readOnlyHint": false,
  "destructiveHint": false,
  "idempotentHint": false,
  "openWorldHint": true
}
—Writes · Non-destructive—
sf_import_postman_credentialsReads a Postman collection (.postman_collection.json) — including ones generated by sf_generate_postman_collection — and extracts Salesforce OAuth2 credentials (clientId, clientSecret, refreshToken, instanceUrl, username, password) so you don't have to type them out manually. If a refresh_token is found it is returned immediately (no browser auth needed). If only username + password are found, tells you to call sf_get_token_password_flow. Returns a ready_for_quickstart block to pass directly to sf_quickstart.
Input schema
{
  "type": "object",
  "properties": {
    "postman_file": {
      "type": "string",
      "minLength": 1,
      "description": "Absolute or ~-relative path to a .postman_collection.json file. The tool extracts Salesforce credentials and returns them ready for sf_quickstart."
    },
    "validate": {
      "type": "boolean",
      "default": true,
      "description": "Make a live Salesforce API call to confirm the extracted credentials work (default: true)."
    }
  },
  "required": [
    "postman_file"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
Annotations
{
  "readOnlyHint": true,
  "destructiveHint": false,
  "idempotentHint": true,
  "openWorldHint": false
}
—Read only · Non-destructive—
sf_list_sobjectsLists SObjects (standard and/or custom) available in the org. Supports filtering and pagination. Returns JSON with: total, count, offset, has_more, next_offset (when more), sobjects[].
Input schema
{
  "type": "object",
  "properties": {
    "sf_client_id": {
      "type": "string",
      "minLength": 1,
      "description": "Salesforce Connected App Consumer Key (Client ID)"
    },
    "sf_client_secret": {
      "type": "string",
      "minLength": 1,
      "description": "Salesforce Connected App Consumer Secret (Client Secret)"
    },
    "sf_refresh_token": {
      "type": "string",
      "minLength": 1,
      "description": "Salesforce OAuth2 Refresh Token obtained after authorization"
    },
    "sf_base_url": {
      "type": "string",
      "format": "uri",
      "description": "Salesforce org instance URL, e.g. https://myorg.my.salesforce.com (sandbox auto-detected from hostname)"
    },
    "include_custom": {
      "type": "boolean",
      "default": true,
      "description": "Include custom (__c) objects"
    },
    "filter": {
      "type": "string",
      "description": "Substring filter on object name/label"
    },
    "limit": {
      "type": "integer",
      "minimum": 1,
      "maximum": 200,
      "default": 50,
      "description": "Max objects to return"
    },
    "offset": {
      "type": "integer",
      "minimum": 0,
      "default": 0,
      "description": "Pagination offset"
    }
  },
  "required": [
    "sf_client_id",
    "sf_client_secret",
    "sf_refresh_token",
    "sf_base_url"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
Annotations
{
  "readOnlyHint": true,
  "destructiveHint": false,
  "idempotentHint": true,
  "openWorldHint": true
}
—Read only · Non-destructive—
sf_quickstartEnd-to-end setup in a single call: 1. Validates your Salesforce credentials. 2. Auto-detects sandbox vs. production from sf_base_url hostname. 3. Scaffolds a Ballerina project in your WSO2 BI workspace. - Standard SObjects use pre-built types from ballerinax/salesforce.types (no describe API calls, no generated boilerplate). - Custom (__c) objects are described and typed automatically. 4. Optionally runs 'bal build' to verify compilation. This is the recommended entry point — most users only need to call this tool. If you don't yet have credentials, call `sf_setup_guide` first. All inputs except the 4 credential fields have sensible defaults: - project_name: salesforce_integration - org_name: wso2bi - bi_path: ~/WSO2Integrator (mac/linux) or %USERPROFILE%\WSO2Integrator - target_objects: ["Account", "Contact", "Lead", "Opportunity"] - port: 9090 - build: false (set true to compile after scaffolding)
Input schema
{
  "type": "object",
  "properties": {
    "sf_client_id": {
      "type": "string",
      "minLength": 1,
      "description": "Salesforce Connected App Consumer Key (Client ID)"
    },
    "sf_client_secret": {
      "type": "string",
      "minLength": 1,
      "description": "Salesforce Connected App Consumer Secret (Client Secret)"
    },
    "sf_refresh_token": {
      "type": "string",
      "minLength": 1,
      "description": "Salesforce OAuth2 Refresh Token obtained after authorization"
    },
    "sf_base_url": {
      "type": "string",
      "format": "uri",
      "description": "Salesforce org instance URL, e.g. https://myorg.my.salesforce.com (sandbox auto-detected from hostname)"
    },
    "project_name": {
      "type": "string",
      "pattern": "^[a-z][a-z0-9_]*$",
      "default": "salesforce_integration",
      "description": "Ballerina package name (default: salesforce_integration)"
    },
    "org_name": {
      "type": "string",
      "pattern": "^[a-z][a-z0-9_]*$",
      "default": "wso2bi",
      "description": "Ballerina org name (default: wso2bi)"
    },
    "bi_path": {
      "type": "string",
      "minLength": 1,
      "default": "~/WSO2Integrator",
      "description": "WSO2 BI workspace path (default: ~/WSO2Integrator)"
    },
    "target_objects": {
      "type": "array",
      "items": {
        "type": "string",
        "minLength": 1,
        "pattern": "^[A-Za-z][A-Za-z0-9_]*$"
      },
      "minItems": 1,
      "default": [
        "Account",
        "Contact",
        "Lead",
        "Opportunity"
      ],
      "description": "SObject API names (default: Account, Contact, Lead, Opportunity)"
    },
    "build": {
      "type": "boolean",
      "default": false,
      "description": "Run 'bal build' after scaffolding to verify the project compiles. Adds 30-90s but catches credential or version mismatches early."
    },
    "run": {
      "type": "boolean",
      "default": true,
      "description": "Start 'bal run' in the background after scaffolding (default: true). No new terminal window is opened — the service runs as a tracked child process. Tail logs with sf_get_project_logs and stop it with sf_stop_project (both take the returned PID)."
    },
    "cdc_listeners": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "sobject": {
            "$ref": "#/properties/target_objects/items",
            "description": "SObject API name for object-scoped CDC (e.g. 'Account'). Generates channel /data/AccountChangeEvent."
          },
          "all_changes": {
            "type": "boolean",
            "description": "Listen on /data/ChangeEvents for all CDC-enabled objects in the org."
          },
          "platform_event": {
            "type": "string",
            "pattern": "^[A-Za-z][A-Za-z0-9_]*__e$",
            "description": "Platform event API name ending in __e (e.g. 'MyEvent__e')."
          },
          "events": {
            "type": "array",
            "items": {
              "type": "string",
              "enum": [
                "onCreate",
                "onUpdate",
                "onDelete",
                "onRestore"
              ]
            },
            "description": "CDC callbacks to scaffold (default: all four). Ignored for platform events."
          }
        },
        "additionalProperties": false
      },
      "description": "Optional CDC / Platform Event listeners to scaffold alongside the REST service."
    },
    "port": {
      "type": "integer",
      "minimum": 1024,
      "maximum": 65535,
      "default": 9090,
      "description": "HTTP listener port (default: 9090)"
    },
    "rest_api": {
      "type": "boolean",
      "default": false,
      "description": "Generate an HTTP REST API (health + CRUD routes) bound to `port` (default: FALSE = CDC-only, no port bound, no port-collision failure mode; requires at least one cdc_listener). Set true ONLY if you need HTTP CRUD/health endpoints — ask the user first."
    },
    "sandbox": {
      "type": "boolean",
      "description": "Force sandbox mode (test.salesforce.com). Usually inferred from sf_base_url, set this only to override detection."
    }
  },
  "required": [
    "sf_client_id",
    "sf_client_secret",
    "sf_refresh_token",
    "sf_base_url"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
Annotations
{
  "readOnlyHint": false,
  "destructiveHint": false,
  "idempotentHint": false,
  "openWorldHint": true
}
—Writes · Non-destructive—
sf_reauth_projectExchanges a Salesforce OAuth2 authorization code for a new refresh token and immediately patches Config.toml in the target project — fixing an expired/revoked token in a single step. Use this when a running Ballerina project logs: "Token refresh failed" / "invalid_grant" / "expired access/refresh token" Workflow: 1. Run sf_get_oauth_auth_url (or open the Connected App's auth URL manually). 2. Log in and approve — copy the 'code' value from the redirect URL. 3. Call sf_reauth_project with that code and the project path. The tool exchanges the code, extracts orgName/packageName from Ballerina.toml, preserves the existing servicePort, and overwrites Config.toml (mode 0600). 4. Restart the project (sf_deploy_project or bal run) to apply the new token. Error hints: - "invalid_grant": code expired (codes are single-use, ~10 min TTL) — re-run step 1. - "invalid_client": wrong client_id/secret, or Connected App still activating.
Input schema
{
  "type": "object",
  "properties": {
    "project_path": {
      "type": "string",
      "minLength": 1,
      "description": "Absolute or ~-relative path to the existing Ballerina project to update"
    },
    "sf_client_id": {
      "type": "string",
      "minLength": 1,
      "description": "Salesforce Connected App Consumer Key (Client ID)"
    },
    "sf_client_secret": {
      "type": "string",
      "minLength": 1,
      "description": "Salesforce Connected App Consumer Secret (Client Secret)"
    },
    "sf_base_url": {
      "type": "string",
      "format": "uri",
      "description": "Your Salesforce org instance URL, e.g. https://myorg.my.salesforce.com. The token exchange POST is sent to this host's /services/oauth2/token endpoint."
    },
    "code": {
      "type": "string",
      "minLength": 1,
      "description": "Authorization code from the OAuth redirect — the 'code' query parameter in the browser's redirect URL"
    },
    "redirect_uri": {
      "type": "string",
      "format": "uri",
      "default": "https://login.salesforce.com/services/oauth2/success",
      "description": "Redirect URI registered in your Connected App. Must exactly match the value used when the auth URL was generated."
    }
  },
  "required": [
    "project_path",
    "sf_client_id",
    "sf_client_secret",
    "sf_base_url",
    "code"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
Annotations
{
  "readOnlyHint": false,
  "destructiveHint": false,
  "idempotentHint": false,
  "openWorldHint": true
}
—Writes · Non-destructive—
sf_scaffold_projectCreates a Ballerina integration project in your WSO2 Integrator (BI) workspace. For most users, prefer 'sf_quickstart' — it wraps this plus credential validation and an optional build step. Standard SObjects use pre-built types from ballerinax/salesforce.types (no describe call needed). Custom (__c) objects are described from your org and typed in types.bal. Pre-conditions: - 'bal' CLI installed (sf_check_prerequisites) - target_objects exist in your org (custom objects fail loudly if missing)
Input schema
{
  "type": "object",
  "properties": {
    "project_name": {
      "type": "string",
      "pattern": "^[a-z][a-z0-9_]*$",
      "default": "salesforce_integration",
      "description": "Ballerina package name (default: salesforce_integration)"
    },
    "org_name": {
      "type": "string",
      "pattern": "^[a-z][a-z0-9_]*$",
      "default": "wso2bi",
      "description": "Ballerina org name written to Ballerina.toml (default: wso2bi)"
    },
    "bi_path": {
      "type": "string",
      "minLength": 1,
      "default": "~/WSO2Integrator",
      "description": "Path to your WSO2 Integrator (BI) workspace. Defaults to ~/WSO2Integrator."
    },
    "sf_client_id": {
      "type": "string",
      "minLength": 1,
      "description": "Salesforce Connected App Consumer Key (Client ID)"
    },
    "sf_client_secret": {
      "type": "string",
      "minLength": 1,
      "description": "Salesforce Connected App Consumer Secret (Client Secret)"
    },
    "sf_refresh_token": {
      "type": "string",
      "minLength": 1,
      "description": "Salesforce OAuth2 Refresh Token obtained after authorization"
    },
    "sf_base_url": {
      "type": "string",
      "format": "uri",
      "description": "Salesforce org instance URL, e.g. https://myorg.my.salesforce.com (sandbox auto-detected from hostname)"
    },
    "target_objects": {
      "type": "array",
      "items": {
        "type": "string",
        "minLength": 1,
        "pattern": "^[A-Za-z][A-Za-z0-9_]*$"
      },
      "minItems": 1,
      "default": [
        "Account",
        "Contact",
        "Lead",
        "Opportunity"
      ],
      "description": "SObject API names to scaffold (default: Account, Contact, Lead, Opportunity). Standard SObjects use pre-built types from ballerinax/salesforce.types — no describe call required."
    },
    "cdc_listeners": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "sobject": {
            "$ref": "#/properties/target_objects/items",
            "description": "SObject API name for object-scoped CDC (e.g. 'Account'). Generates channel /data/AccountChangeEvent."
          },
          "all_changes": {
            "type": "boolean",
            "description": "Listen on /data/ChangeEvents for all CDC-enabled objects in the org."
          },
          "platform_event": {
            "type": "string",
            "pattern": "^[A-Za-z][A-Za-z0-9_]*__e$",
            "description": "Platform event API name ending in __e (e.g. 'MyEvent__e')."
          },
          "events": {
            "type": "array",
            "items": {
              "type": "string",
              "enum": [
                "onCreate",
                "onUpdate",
                "onDelete",
                "onRestore"
              ]
            },
            "description": "CDC callbacks to scaffold (default: all four). Ignored for platform events."
          }
        },
        "additionalProperties": false
      },
      "description": "Optional CDC / Platform Event listeners to scaffold alongside the REST service. Each entry generates a salesforce:Listener bound to a channel, with onCreate/onUpdate/onDelete/onRestore stubs for CDC or onMessage for platform events."
    },
    "port": {
      "type": "integer",
      "minimum": 1024,
      "maximum": 65535,
      "default": 9090,
      "description": "HTTP listener port baked into the generated service (default: 9090)"
    },
    "rest_api": {
      "type": "boolean",
      "default": false,
      "description": "Generate an HTTP REST API (health + CRUD routes) bound to `port` (default: FALSE). Default false = CDC-only project: no http:Listener is created, so NO port is bound and the 'Address already in use' failure mode is impossible (requires at least one cdc_listener). Set true ONLY if you want HTTP CRUD/health endpoints in addition to (or instead of) CDC. CometD/CDC is an outbound connection and needs no inbound port — ask the user whether they actually need the REST API before enabling it."
    },
    "sandbox": {
      "type": "boolean",
      "description": "Force sandbox mode (test.salesforce.com). Usually inferred from sf_base_url, set this only to override detection."
    }
  },
  "required": [
    "sf_client_id",
    "sf_client_secret",
    "sf_refresh_token",
    "sf_base_url"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
Annotations
{
  "readOnlyHint": false,
  "destructiveHint": false,
  "idempotentHint": false,
  "openWorldHint": false
}
—Writes · Non-destructive—
sf_setup_guideReturns a step-by-step guide for first-time users: how to create a Salesforce Connected App, where to find the Consumer Key/Secret, how to get a refresh token via sf_get_oauth_auth_url + sf_exchange_oauth_code, and which tool to call next. Call this when the user says "I'm new" / "where do I start" / "how do I get credentials".
Input schema
{
  "type": "object",
  "properties": {
    "sandbox": {
      "type": "boolean",
      "default": false,
      "description": "Generate the sandbox (test.salesforce.com) variant of the guide."
    }
  },
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
Annotations
{
  "readOnlyHint": true,
  "destructiveHint": false,
  "idempotentHint": true,
  "openWorldHint": false
}
—Read only · Non-destructive—
sf_stop_projectStops a 'bal run' process previously started by sf_deploy_project. Only PIDs tracked by this server (started via sf_deploy_project during the current session) can be stopped — for safety we won't kill arbitrary host PIDs.
Input schema
{
  "type": "object",
  "properties": {
    "pid": {
      "type": "integer",
      "exclusiveMinimum": 0,
      "description": "PID returned by sf_deploy_project. Only processes started by this server can be stopped."
    }
  },
  "required": [
    "pid"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
Annotations
{
  "readOnlyHint": false,
  "destructiveHint": true,
  "idempotentHint": true,
  "openWorldHint": false
}
—Writes · Destructive—
sf_validate_connectionTests that the provided Salesforce credentials are valid by making a live API call to the org. Use this before scaffolding a project to confirm credentials work. Returns: - connected: boolean - org_id: Salesforce Org ID - username: Authenticated username - instance_url: Confirmed org URL
Input schema
{
  "type": "object",
  "properties": {
    "sf_client_id": {
      "type": "string",
      "minLength": 1,
      "description": "Salesforce Connected App Consumer Key (Client ID)"
    },
    "sf_client_secret": {
      "type": "string",
      "minLength": 1,
      "description": "Salesforce Connected App Consumer Secret (Client Secret)"
    },
    "sf_refresh_token": {
      "type": "string",
      "minLength": 1,
      "description": "Salesforce OAuth2 Refresh Token obtained after authorization"
    },
    "sf_base_url": {
      "type": "string",
      "format": "uri",
      "description": "Salesforce org instance URL, e.g. https://myorg.my.salesforce.com (sandbox auto-detected from hostname)"
    }
  },
  "required": [
    "sf_client_id",
    "sf_client_secret",
    "sf_refresh_token",
    "sf_base_url"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
Annotations
{
  "readOnlyHint": true,
  "destructiveHint": false,
  "idempotentHint": true,
  "openWorldHint": true
}
—Read only · Non-destructive—
sf_write_config_tomlOverwrites Config.toml in an existing Ballerina project with fresh Salesforce OAuth2 credentials. Useful for rotation. Sandbox is auto-detected from sf_base_url. File is written with mode 0600 (owner read/write only).
Input schema
{
  "type": "object",
  "properties": {
    "project_path": {
      "type": "string",
      "minLength": 1,
      "description": "Path to the Ballerina project directory"
    },
    "sf_client_id": {
      "type": "string",
      "minLength": 1,
      "description": "Salesforce Connected App Consumer Key (Client ID)"
    },
    "sf_client_secret": {
      "type": "string",
      "minLength": 1,
      "description": "Salesforce Connected App Consumer Secret (Client Secret)"
    },
    "sf_refresh_token": {
      "type": "string",
      "minLength": 1,
      "description": "Salesforce OAuth2 Refresh Token obtained after authorization"
    },
    "sf_base_url": {
      "type": "string",
      "format": "uri",
      "description": "Salesforce org instance URL, e.g. https://myorg.my.salesforce.com (sandbox auto-detected from hostname)"
    }
  },
  "required": [
    "project_path",
    "sf_client_id",
    "sf_client_secret",
    "sf_refresh_token",
    "sf_base_url"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
Annotations
{
  "readOnlyHint": false,
  "destructiveHint": false,
  "idempotentHint": true,
  "openWorldHint": false
}
—Writes · Non-destructive—

Resources 0

Resource templates 0

Prompts 0

Let’s talk about MCP security.

Share your details and our security team will contact you.