vulkro-sf entrypoints

List every externally reachable entry point in a Salesforce project.

Command reference

Generated from vulkro-sf entrypoints --help (vulkro-sf 0.28.0). Run scripts/gen-docs.sh in the product repository to refresh it; do not edit this section by hand.

List every externally reachable entry point in a Salesforce project.

vulkro-sf entrypoints [OPTIONS] [PATH]

Arguments

Argument	Description
[PATH]	Path to the SFDX project or retrieved metadata (defaults to the current directory) Default: ..

Options

Flag	Description
-f, --format <FORMAT>	Output format: table (default), json, or sarif. json is the complete, self-describing record and is the format an automated consumer should read. sarif emits ONLY the guest-reachable rows, because SARIF is a findings format and one result per door would bury a code-scanning dashboard. Default: table.
--guest-only	Report only entry points a guest profile or permission set grants. This is the only mode that can exit 1.
-v, --verbose...	Bump stderr log verbosity. -v enables debug-level tracing for the vulkro + vulkro_sf targets; -vv enables trace. Honoured only when RUST_LOG is unset (an explicit RUST_LOG always wins)
-q, --quiet	Print only warnings and errors on stderr: no progress, tips or next-step hints. Results on stdout and exit codes are unchanged.
--no-color	Turn off coloured output. Colour is also off when NO_COLOR is set to a non-empty value or TERM=dumb.
-h, --help	Print help (see a summary with '-h')

Full vulkro-sf entrypoints --help

List every externally reachable entry point in a Salesforce project.

Enumerate every externally reachable ENTRY POINT in a Salesforce project: the attack surface, as an inventory.

Lists `@AuraEnabled` methods (with `cacheable`), `@RestResource` classes and their HTTP verb methods, `@InvocableMethod` actions, `webservice` SOAP methods, `@RemoteAction` remoting endpoints, Visualforce and Aura controllers, Flows (with `<runInMode>`), Agentforce `GenAiFunction` doors, and custom MCP server definitions.

Every row carries the facts needed to triage it without re-deriving anything: the sharing keyword on the owning class, the resolved API version AND the metadata that resolved it, whether a guest profile or permission set grants the class AND which file grants it, the objects and custom fields the method touches, and any sink token appearing in the method body.

This is an INVENTORY, not a scan. A row is a door, not a defect, and nothing here is a verdict. Three fields are deliberately conservative: an unresolved API version is NEVER read as the newer secure-by-default (v67) semantics; `guest.reachable` describes metadata in this source tree and never a running org, so `false` means "no grant found here", not "unreachable"; and `sinks_in_method` is a same-method lexical observation, so `proof_chain` is always reported as `not_computed`. Run `vulkro-sf scan` for findings and proof.

Output is deterministic: two runs over the same tree produce byte-identical output, so the JSON is safe to commit and diff. The table leads with the rows worth reading first (guest-reachable, then `without sharing` or an undeclared keyword on a pre-v67 class, then an old or unresolved API version).

Exit codes: 0 = success (a plain inventory ALWAYS exits 0, however many rows it prints, because having entry points is what a project is for); 1 = `--guest-only` returned at least one guest-reachable entry point; 2 = error (unreadable path, or an unknown `--format`).

This command reads no environment variables and honours no `VULKRO_*` overrides: it never contacts an org and never reads the clock, which is what makes its output reproducible.

Usage: vulkro-sf entrypoints [OPTIONS] [PATH]

Arguments:
  [PATH]
          Path to the SFDX project or retrieved metadata (defaults to the current directory)
          
          [default: .]

Options:
  -f, --format <FORMAT>
          Output format: table (default), json, or sarif. `json` is the complete, self-describing record and is the format an automated consumer should read. `sarif` emits ONLY the guest-reachable rows, because SARIF is a findings format and one result per door would bury a code-scanning dashboard
          
          [default: table]

      --guest-only
          Report only entry points a guest profile or permission set grants. This is the only mode that can exit 1

  -v, --verbose...
          Bump stderr log verbosity. `-v` enables debug-level tracing for the `vulkro` + `vulkro_sf` targets; `-vv` enables trace. Honoured only when `RUST_LOG` is unset (an explicit `RUST_LOG` always wins)

  -q, --quiet
          Print only warnings and errors on stderr: no progress, tips or next-step hints. Results on stdout and exit codes are unchanged

      --no-color
          Turn off coloured output. Colour is also off when NO_COLOR is set to a non-empty value or TERM=dumb

  -h, --help
          Print help (see a summary with '-h')