High-risk tools in Salesforce Metadata Mcp
15 of the 213 tools in Salesforce Metadata Mcp are classified as high risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at high risk
-
sf_activate_omniscriptExecuteActivates an OmniScript so it can be launched from FlexCards, Experience Cloud, or standalone pages. Identified by Type + SubType + Language.
-
sf_create_apex_classExecuteCreates and deploys an Apex class to the Salesforce org using the Metadata API. Accepts the full Apex source code including the class declaration. Use for any type of Apex class...
-
sf_create_apex_test_classExecuteCreates and deploys an Apex Test Class (annotated with @isTest). Provide the full test class source code. Optionally run the tests immediately after deployment. Test classes are...
-
sf_create_apex_triggerExecuteCreates and deploys an Apex Trigger on any Salesforce object. Specify the trigger events (before insert, after update, etc.) and the trigger body code. The trigger declaration (...
-
sf_create_flowExecuteCreates or updates a Salesforce Flow via the Metadata API. Supports AutoLaunchedFlow (required for Agentforce actions), Screen Flow, RecordTriggeredFlow, and ScheduledFlow. Supp...
-
sf_create_scheduled_jobExecuteSchedules an Apex class that implements the Schedulable interface to run on a cron schedule. Use for batch processing, nightly data cleanup, report generation, or any periodic a...
-
sf_create_scratch_orgExecuteCreates a Salesforce scratch org using the SF CLI. Scratch orgs are temporary, configurable environments for development and testing. Requires a Dev Hub org to be authorized. d...
-
sf_deactivate_flowExecuteDeactivates the currently active version of a Flow via the Tooling API, setting its status to Draft. This stops the flow from being triggered. Use sf_activate_flow to re-activat...
-
sf_deploy_metadataExecuteDeploys a set of metadata components directly to the org using the Metadata API SOAP deploy operation. Builds a package.xml and deployment zip in memory. Supports validate-only ...
-
sf_devops_promote_work_itemExecutePromotes a DevOps Center work item to the next pipeline stage. Moving work items through the pipeline represents the progression of changes from development environments toward ...
-
sf_execute_anonymous_apexExecuteExecutes anonymous Apex code in the Salesforce org using the Tooling API executeAnonymous endpoint. Returns compile errors, runtime exceptions, and debug log output. Use for one...
-
sf_install_packageExecuteInstalls a package version into a target org using the SF CLI. Supports both managed and unlocked packages. Requires the package version ID (04t...) or an alias. packageId: pac...
-
sf_promote_devops_work_itemExecutePromotes a DevOps Center work item to a specific pipeline stage by ID. Use to move work items forward in the pipeline when you know the exact target stage. workItemId: DevOps C...
-
sf_run_apex_testsExecuteRuns one or more Apex test classes and returns pass/fail results with any error messages. Uses the Salesforce Tooling API runTestsAsynchronous endpoint and polls for results. Us...
-
sf_send_emailExecuteSends an email from Salesforce using the emailSimple invocable action. The email is sent from the running user
Attacks that target this class
High-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.