High-risk tools in Salesforce Cloud
2 of the 17 tools in Salesforce Cloud are classified as high risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at high risk
-
batchExecute 3/5Execute multiple operations in a single call with result references. Use $N.field to reference prior results (e.g., $0.id for the ID from operation 0). Destructive operations re...
-
execute_soqlExecute 4/5Execute a SOQL query. Supports querying both standard and custom fields (custom fields end with __c in their API names). Use describe_object first to discover available fields.
Attacks that target this class
High-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.
More on Salesforce Cloud
Enforce policy on Salesforce Cloud
One command generates a policy scaffold for every server in your MCP config.
npx -y @policylayer/intercept init