vulkro-sf mcp serve
Runs Vulkro for Salesforce as a Model Context Protocol (MCP) server, so any MCP host (Claude Code, Cursor, Windsurf, VS Code and others) can call the scanner as a tool.
vulkro-sf mcp serve # stdio (default)
vulkro-sf mcp serve --port 9101 # SSE on http://127.0.0.1:9101/sse
| Flag | What it does |
|---|---|
--port <n> | Use an SSE transport on 127.0.0.1:<n> instead of stdio. Most hosts use stdio. |
Exit codes: 0 served and shut down cleanly, 2 error (bad transport, port in use).
Local tools never write to your code. The sf_org_* tools read the org through your own sf CLI login, and the token stays there. Only the sf_cloud_* tools leave the machine, to your Vulkro Cloud workspace. No tool changes source or org configuration.
Set up
Claude Code:
claude mcp add vulkro-sf -- vulkro-sf mcp serve
Cursor (~/.cursor/mcp.json) and most other hosts:
{ "mcpServers": { "vulkro-sf": { "command": "vulkro-sf", "args": ["mcp", "serve"] } } }
The VS Code extension registers this server for the editor's agent automatically, with VULKRO_OFFLINE=1, so the sf_cloud_* tools are refused there. Register the server yourself to use them.
Local tools
target_org is an org alias or username known to sf org login.
| Tool | What it does |
|---|---|
sf_scan_project | Full scan of an SFDX project or metadata folder, as vulkro-sf scan -f json. |
sf_scan_metadata_only | Metadata-only scan, for folders with no Apex source. |
sf_antipatterns | Well-Architected anti-pattern scan over Apex. |
sf_list_checks | The check catalogue (no scan, no network). |
sf_read_code | Read a file, one declaration or a line range, as numbered lines. |
sf_code_graph | Apex method graph: map, impact, callers, callees. |
sf_assess_change | Before an edit, a symbol's blast radius, tests and findings; after, a verdict on the diff. |
sf_check_change | After an edit: call sites on an old signature, removed names still used, findings on changed lines. |
sf_run_compliance_report | Roll findings up against a framework (pci, hipaa, soc2, nist-ssdf, nist-800-53, iso27001, cis-v8, cwe-top25, gdpr, owasp-asvs). |
sf_org_perms | Live org: over-privileged grants and dormant privileged accounts. |
sf_org_effective_perms | Live org: the object, field and permission-set access users hold now. |
sf_org_session | Live org: session timeout, IP lock and high-assurance step-up. |
sf_org_mfa | Live org: MFA enforcement, including the API and integration-user gap. |
sf_org_health_check | Live org: the Security Health Check score and failing controls. |
Without an active trial or Pro, a scan tool returns JSON-RPC error -32001 with reason: "license_required" and the next step, never an empty result.
Vulkro Cloud workspace tools
These work your Vulkro Cloud workspace through the connection vulkro-sf cloud connect saved (or VULKRO_SF_CLOUD_URL and VULKRO_SF_CLOUD_TOKEN). Your workspace role sets what you can do. They change triage state only, and are refused under VULKRO_OFFLINE. A finding is named by its fingerprint (fp_...) or issue key (VK-123).
| Tool | What it does |
|---|---|
sf_cloud_connect_status | Workspace URL, your sign-in and role. |
sf_cloud_orgs | The workspace's orgs with queue counts and last scan. |
sf_cloud_todo | The ranked triage queue (views to_triage, open, pending, mine and more). |
sf_cloud_finding | One finding with remediation, history and trace hops. |
sf_cloud_triage | Set a state; false_positive and accepted_risk go to a person for approval. |
sf_cloud_review | List, approve, reject or withdraw review proposals. |
sf_cloud_assign | Assign a finding to me, a member or none. |
sf_cloud_rules | List rules or get one with its findings (read-only). |
sf_cloud_rule_policy | Read or propose a rule's mode, severity and scope. |
sf_cloud_custom_rules | List, get, test, create or change custom rules (changes are proposals). |
sf_cloud_settings | The workspace triage settings (read-only). |
sf_cloud_scan | Start a cloud scan of an org, or read its status. |
sf_cloud_fix_plan | Map a finding to your local project: file, line, code and fix steps. |
sf_cloud_verify | Re-scan locally and report whether the finding is gone; can mark it fixed. |
sf_cloud_verify_org | Scan the org again and report whether the finding is still there. |
Set VULKRO_SF_MCP_LOG=1 for per-request trace lines on stderr.
See also: vulkro-sf cloud, vulkro mcp serve