Add up to 200 Leads and/or Contacts to a Salesforce Campaign in a single API call. Pass arrays of leadIds and/or contactIds. All members are assigned the same initial Status. Returns success/failure counts and any per-record errors.
AI agents use sf_bulk_add_campaign_members to create or update resources in Salesforce Marketing — usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Salesforce Marketing environment.
| Parameter | Type | Required | Description |
|---|---|---|---|
status | string | — | |
leadIds | array | — | |
campaignId | string | Yes | |
contactIds | array | — |
Parameters from the server's own tool schema.
This tool creates or modifies campaign membership associations in Salesforce. While reversible (members can be removed), it modifies data state and could result in unwanted campaign enrollments, messaging, or data pollution if misused by an AI agent. The bulk nature (up to 200 records) increases blast radius to medium severity.
From the tool's definition Tool description explicitly states 'Add up to 200 Leads and/or Contacts to a Salesforce Campaign' and 'Returns success/failure counts', indicating creation/modification of campaign membership records.
Attacks that exploit this kind of access
Add up to 200 Leads and/or Contacts to a Salesforce Campaign in a single API call. Pass arrays of leadIds and/or contactIds. All members are assigned the same initial Status. Returns success/failure counts and any per-record errors. It is categorised as a Write tool in the Salesforce Marketing MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.
sf_bulk_add_campaign_members accepts 4 parameters: status, leadIds, campaignId, contactIds. Required: campaignId. The full parameter table on this page comes from the server's own tool schema.
Register the Salesforce Marketing MCP server in PolicyLayer and add a rule for sf_bulk_add_campaign_members: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Salesforce Marketing. Nothing to install.
sf_bulk_add_campaign_members is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.
Yes. Add a rate_limit block to the sf_bulk_add_campaign_members rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.
Set action: deny in the PolicyLayer policy for sf_bulk_add_campaign_members. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.
sf_bulk_add_campaign_members is provided by the Salesforce Marketing MCP server (salesforce-marketing-mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.
Every MCP server has a record like this.
Type a name, get the same breakdown: verified identity, auth posture, risk grade, capabilities, recommended policy.
Teams ship this data inside their own products. See what a licence covers →