vulkro-sf cloud

Work your Vulkro Cloud workspace from the terminal. Every action runs as you, with your role and org access in the workspace.

This is workspace access only: it does not use or change your vulkro-sf licence, and nothing here changes a Salesforce org.

Connect

vulkro-sf cloud connect https://<name>.vulkro.com

vulkro-sf shows a short code and opens the workspace in your browser. Check the code matches, approve, and the terminal finishes on its own. The workspace token is stored in ~/.vulkro/sf-cloud.json (readable by you only), lasts 90 days, and stops working at once if you disconnect it in the workspace (My Account > Desktop and CLI Connections) or leave the workspace.

vulkro-sf cloud status
vulkro-sf cloud disconnect

For Pro Cloud (no workspace), sign in with vulkro-sf login and run vulkro-sf cloud connect --pro. Review, rules, custom rules, assign and tokens are workspace features and are refused there. See Connect the CLI.

Commands

Command	What it does
orgs	The orgs you can see, with their open, to-triage and pending counts.
todo [--view ...] [--severity ...] [--org ...]	What to fix: the issue list, most severe first. Views: to_triage, open, pending, suppressed, resolved, mine, all.
show <fp> [--evidence]	One issue, with the engine's evidence trail when you ask for it.
triage <fp> --state <state> [--reason ...] [--expires ...]	new, in_progress and fixed apply at once. false_positive and accepted_risk need a reason and wait for an approver.
assign <fp> <me|member id|none>	Assign an issue.
review [list|approve <id>|reject <id> --note ...]	The approval queue. You cannot approve your own proposal unless your workspace allows it.
rules [list|show <rule>|propose <rule> --mode ... --reason ...]	Rules and their policies. Propose advisory, off or enforced, a severity, and an org or file scope.
scan <org> [--wait]	Start a cloud scan of an org and follow it.
fix-plan <fp> [--path <project>]	Find the issue's file and line in your local SFDX project, with the evidence and the fix advice. For an org setting, the metadata change to make in your project.
verify <fp> [--path <project>] [--mark-fixed]	Re-scan your project and report whether the rule still fires in that file; --mark-fixed marks the issue fixed when it is gone. The next cloud scan confirms it.
triage-ai [--dry-run]	Ask your configured AI model (see vulkro-sf ai) for a verdict on each issue to triage. Verdicts are proposals marked AI and wait for a person to approve them.

Every command takes --json (or --format json) for scripts.

The fix loop

1. vulkro-sf cloud todo --view mine
2. vulkro-sf cloud fix-plan <fp> and change the code
3. vulkro-sf cloud verify <fp> --mark-fixed
4. The next cloud scan confirms the fix; if the issue is still there, it is reopened.

AI assistants (MCP)

vulkro-sf mcp serve exposes the same actions as fifteen tools: sf_cloud_connect_status, sf_cloud_orgs, sf_cloud_todo, sf_cloud_finding, sf_cloud_triage, sf_cloud_review, sf_cloud_assign, sf_cloud_rules, sf_cloud_rule_policy, sf_cloud_custom_rules, sf_cloud_settings, sf_cloud_scan, sf_cloud_fix_plan, sf_cloud_verify and sf_cloud_verify_org (start a workspace scan of the issue's org and report whether that one issue is still reported). An assistant marks its own verdicts as AI, and they wait for a person's approval. Inputs for each tool are on the vulkro-sf mcp serve page.

Environment

Variable	Use
VULKRO_SF_CLOUD_URL	The workspace address, instead of the saved connection (CI).
VULKRO_SF_CLOUD_TOKEN	A workspace token (vkws_...), instead of the saved one (CI).

The cloud commands use the network, so they are refused when VULKRO_OFFLINE is set.

Exit codes

Code	Meaning
0	The request succeeded (an empty list is still 0).
1	A gate found something: todo --fail-on found open issues at or above the severity, or verify found the issue still reported.
2	Error: not connected, refused by the workspace, network, bad arguments, or a scan --wait whose scan failed.