@mindstone/mcp-server-salesforce 0.1.2 → 0.2.0

package/README.md

@@ -1,13 +1,117 @@
 # @mindstone/mcp-server-salesforce
 
+[![npm version](https://img.shields.io/npm/v/@mindstone/mcp-server-salesforce.svg)](https://www.npmjs.com/package/@mindstone/mcp-server-salesforce)
+[![License: FSL-1.1-MIT](https://img.shields.io/badge/License-FSL--1.1--MIT-blue.svg)](./LICENSE)
+
 Salesforce CRM MCP server — accounts, contacts, opportunities, leads, tasks, users, and custom objects via the Salesforce API.
 
-## Installation
+*Best when an MCP host needs a local, install-and-run CRM connector for everyday sales work rather than a Salesforce-hosted endpoint.*
+
+## Status
+
+- **Version:** [0.2.0](./CHANGELOG.md) · [npm](https://www.npmjs.com/package/@mindstone/mcp-server-salesforce)
+- **Auth:** OAuth (local 127.0.0.1 callback) or static access token ([`SALESFORCE_CLIENT_SECRET`](./server.json), [`SALESFORCE_ACCESS_TOKEN`](./server.json))
+- **Tools:** [37](./src/tools/) (accounts, contacts, opportunities, leads, tasks, cases, events, search, notes, campaigns, reports, query)
+- **Surface:** cloud-api
+- **Machine-readable:** [`STATUS.json`](./STATUS.json)
+
+## Why this exists
+
+Salesforce's own MCP options are the right starting point for many teams. This package is for teams that want a normal npm MCP server they can run locally in any stdio host.
+
+It gives an assistant focused access to the CRM work people actually ask for: finding accounts and contacts, updating leads, creating opportunities and tasks, running CRM searches, and working with custom objects. The benefit is a short path from a natural-language sales request to the right Salesforce records, with write actions kept visible to the host.
+
+## Example interaction
+
+> "Find Acme Corp in Salesforce, create a Q3 expansion opportunity for $75,000, and add a follow-up task for next Friday."
+
+Tools the host calls:
+1. `salesforce_get_accounts` — searches accounts by name and returns the matching account ID.
+2. `salesforce_create_opportunity` — creates the opportunity against that account.
+3. `salesforce_create_task` — adds a follow-up task related to the new opportunity.
+
+Response (trimmed):
+
+```json
+{
+  "account": { "id": "001xx000003DGbYAAW", "name": "Acme Corp" },
+  "opportunity": {
+    "id": "006xx000004TmiYAAS",
+    "name": "Q3 expansion",
+    "amount": 75000,
+    "stage": "Prospecting"
+  },
+  "task": {
+    "id": "00Txx000006rYxDEAU",
+    "subject": "Follow up on Q3 expansion"
+  }
+}
+```
+
+## Requirements
+
+- Node.js 20+
+- npm
+- A Salesforce Connected App for the OAuth path, or a valid access token plus instance URL for manual-token mode.
+
+<!-- BEGIN INSTALL_LINKS: do not edit by hand; regenerated by scripts/gen-install-links.mjs -->
+## One-click install
+
+[![Add to Cursor](https://img.shields.io/badge/Add_to_Cursor-black?style=for-the-badge&logo=cursor&logoColor=white)](cursor://anysphere.cursor-deeplink/mcp/install?name=Salesforce&config=eyJ0eXBlIjoic3RkaW8iLCJjb21tYW5kIjoibnB4IiwiYXJncyI6WyIteSIsIkBtaW5kc3RvbmUvbWNwLXNlcnZlci1zYWxlc2ZvcmNlIl0sImVudiI6eyJTQUxFU0ZPUkNFX0NMSUVOVF9JRCI6IiIsIlNBTEVTRk9SQ0VfQ0xJRU5UX1NFQ1JFVCI6IiIsIlNBTEVTRk9SQ0VfQUNDRVNTX1RPS0VOIjoiIiwiU0FMRVNGT1JDRV9DT05GSUdfRElSIjoifi8ubWNwL3NhbGVzZm9yY2UiLCJTQUxFU0ZPUkNFX09BVVRIX1BPUlQiOiIwIn19)
+[![Add to VS Code](https://img.shields.io/badge/Add_to_VS_Code-007ACC?style=for-the-badge&logo=visual-studio-code&logoColor=white)](vscode:mcp/install?%7B%22name%22%3A%22Salesforce%22%2C%22command%22%3A%22npx%22%2C%22args%22%3A%5B%22-y%22%2C%22%40mindstone%2Fmcp-server-salesforce%22%5D%2C%22env%22%3A%7B%22SALESFORCE_CLIENT_ID%22%3A%22%22%2C%22SALESFORCE_CLIENT_SECRET%22%3A%22%22%2C%22SALESFORCE_ACCESS_TOKEN%22%3A%22%22%2C%22SALESFORCE_CONFIG_DIR%22%3A%22%7E%2F.mcp%2Fsalesforce%22%2C%22SALESFORCE_OAUTH_PORT%22%3A%220%22%7D%7D)
+[![Add to VS Code Insiders](https://img.shields.io/badge/Add_to_VS_Code_Insiders-24bfa5?style=for-the-badge&logo=visual-studio-code&logoColor=white)](vscode-insiders:mcp/install?%7B%22name%22%3A%22Salesforce%22%2C%22command%22%3A%22npx%22%2C%22args%22%3A%5B%22-y%22%2C%22%40mindstone%2Fmcp-server-salesforce%22%5D%2C%22env%22%3A%7B%22SALESFORCE_CLIENT_ID%22%3A%22%22%2C%22SALESFORCE_CLIENT_SECRET%22%3A%22%22%2C%22SALESFORCE_ACCESS_TOKEN%22%3A%22%22%2C%22SALESFORCE_CONFIG_DIR%22%3A%22%7E%2F.mcp%2Fsalesforce%22%2C%22SALESFORCE_OAUTH_PORT%22%3A%220%22%7D%7D)
+
+After clicking the button, your host will prompt you to fill: `SALESFORCE_CLIENT_ID`, `SALESFORCE_CLIENT_SECRET`, `SALESFORCE_ACCESS_TOKEN`, `SALESFORCE_CONFIG_DIR`, `SALESFORCE_OAUTH_PORT`.
+
+<details>
+<summary>Manual config for Claude Desktop / Claude Code / Goose / Continue.dev (Salesforce)</summary>
+
+```json
+{
+  "mcpServers": {
+    "Salesforce": {
+      "command": "npx",
+      "args": [
+        "-y",
+        "@mindstone/mcp-server-salesforce"
+      ],
+      "env": {
+        "SALESFORCE_CLIENT_ID": "",
+        "SALESFORCE_CLIENT_SECRET": "",
+        "SALESFORCE_ACCESS_TOKEN": "",
+        "SALESFORCE_CONFIG_DIR": "~/.mcp/salesforce",
+        "SALESFORCE_OAUTH_PORT": "0"
+      }
+    }
+  }
+}
+```
+
+</details>
+<!-- END INSTALL_LINKS -->
+
+## Quick Start
+
+### Install & build
+
+```bash
+cd <path-to-repo>/connectors/salesforce
+npm install
+npm run build
+```
+
+### npx
 
 ```bash
 npx -y @mindstone/mcp-server-salesforce
 ```
 
+### Local
+
+```bash
+node dist/index.js
+```
+
 ## Configuration
 
 ### OAuth (Recommended)
@@ -28,8 +132,10 @@ Then call `salesforce_connect_account` to start the OAuth flow.
 ### Additional Options
 
 - `SALESFORCE_CONFIG_DIR` — Custom config directory (default: `~/.mcp/salesforce`)
+- `SALESFORCE_OAUTH_PORT` — OAuth callback port (`0` = OS-assigned; default: `0`)
+- `SALESFORCE_OAUTH_SCOPES` — Space-separated OAuth scopes. Leave unset to use the connector default.
 
-## Available Tools (26)
+## Available Tools (37)
 
 ### Account Management
 - `salesforce_connect_account` — Connect a Salesforce account via OAuth
@@ -62,6 +168,29 @@ Then call `salesforce_connect_account` to start the OAuth flow.
 - `salesforce_create_task` — Create a task
 - `salesforce_update_task` — Update a task
 
+### Cases
+- `salesforce_get_cases` — Get support cases with filters
+- `salesforce_create_case` — Create a support case
+- `salesforce_update_case` — Update a support case
+
+### Events
+- `salesforce_get_events` — Get calendar events with filters
+- `salesforce_create_event` — Create a calendar event
+
+### Search
+- `salesforce_search` — Cross-object full-text search (SOSL); the response's `truncated` flag tells you whether more matches exist beyond the limit
+
+### Notes
+- `salesforce_get_notes` — Get notes attached to a record
+- `salesforce_create_note` — Create a note, optionally attached to a record (a failed attach rolls the note back, or reports the orphaned note ID)
+
+### Campaigns
+- `salesforce_get_campaigns` — Get marketing campaigns with filters
+- `salesforce_get_campaign_members` — Get leads/contacts in a campaign
+
+### Reports
+- `salesforce_run_report` — Run an existing Salesforce report (Analytics REST API)
+
 ### Users
 - `salesforce_get_users` — Get Salesforce users
 
@@ -75,6 +204,15 @@ Then call `salesforce_connect_account` to start the OAuth flow.
 - `salesforce_update_record` — Update any Salesforce record
 - `salesforce_get_records` — Query any Salesforce object
 
-## License
+## Security notes
+
+- The standalone OAuth callback server binds to `127.0.0.1`; it does not honour environment overrides that would expose the callback beyond loopback.
+- OAuth credentials are stored under `SALESFORCE_CONFIG_DIR` (default `~/.mcp/salesforce`) with restrictive directory and file permissions.
+- Write and disconnect tools are marked so capable hosts can ask for confirmation before changing Salesforce data.
+- SOQL helper paths escape string and `LIKE` values, strip comments quote-safely before applying the query limit cap, and enforce a maximum of 200 records for raw SOQL queries.
+- Record text returned by read tools is wrapped in `<untrusted-content>` envelopes so Salesforce-authored field values are presented to the model as data, not instructions.
+- `salesforce_convert_lead` reports a conversion as failed when Salesforce rejects it at the record level (e.g. a validation rule), instead of claiming success; the org-authored error detail is enveloped the same way.
+
+## Licence
 
-FSL-1.1-MIT
+[FSL-1.1-MIT](./LICENSE) — Functional Source License, Version 1.1, with MIT future licence. The software converts to MIT licence on 2030-04-08.

package/dist/client.js

@@ -1,5 +1,5 @@
 import jsforce from 'jsforce';
-import { ConnectorError, } from './types.js';
+import { ConnectorError, SALESFORCE_API_VERSION, } from './types.js';
 import { getAuthMode, getActiveToken, loadAccounts, loadToken, saveToken, deleteToken, saveAccounts, } from './auth.js';
 // Connection cache per account
 const connections = new Map();
@@ -44,10 +44,19 @@ export async function getConnection(accountId) {
     const connectionConfig = {
         instanceUrl: tokenData.instance_url,
         accessToken: tokenData.access_token,
-        refreshToken: tokenData.refresh_token,
+        version: SALESFORCE_API_VERSION,
     };
+    // Only hand jsforce a refresh token when we can also give it a way to USE
+    // that token — i.e. the OAuth2 client info to build a refresh delegate.
+    // jsforce throws synchronously at construction otherwise:
+    // "Refresh token is specified without oauth2 client information or refresh function".
+    // This is the bridge-mode case: the host app owns OAuth and does not pass
+    // SALESFORCE_CLIENT_ID/SECRET into the connector, so we operate on the access
+    // token alone and surface SESSION_EXPIRED (-> reconnect) on expiry rather than
+    // crashing every tool call. (See docs/plans/260612_fix-salesforce-bridge-refresh-token/.)
     if (clientId && clientSecret && tokenData.refresh_token) {
         connectionConfig.oauth2 = { clientId, clientSecret, loginUrl };
+        connectionConfig.refreshToken = tokenData.refresh_token;
     }
     const conn = new jsforce.Connection(connectionConfig);
     conn.on('refresh', async (accessToken) => {

package/dist/server.js

@@ -1,7 +1,7 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { SERVER_NAME, SERVER_VERSION } from './types.js';
 import { resolveAuthMode } from './auth.js';
-import { registerAuthTools, registerAccountTools, registerContactTools, registerOpportunityTools, registerLeadTools, registerTaskTools, registerUserTools, registerQueryTools, } from './tools/index.js';
+import { registerAuthTools, registerAccountTools, registerContactTools, registerOpportunityTools, registerLeadTools, registerTaskTools, registerCaseTools, registerEventTools, registerSearchTools, registerNoteTools, registerCampaignTools, registerReportTools, registerUserTools, registerQueryTools, } from './tools/index.js';
 export function createServer() {
     resolveAuthMode();
     const server = new McpServer({
@@ -14,6 +14,12 @@ export function createServer() {
     registerOpportunityTools(server);
     registerLeadTools(server);
     registerTaskTools(server);
+    registerCaseTools(server);
+    registerEventTools(server);
+    registerSearchTools(server);
+    registerNoteTools(server);
+    registerCampaignTools(server);
+    registerReportTools(server);
     registerUserTools(server);
     registerQueryTools(server);
     return server;

package/dist/tools/accounts.js

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { withErrorHandling, escapeSOQL, escapeSOQLLike, validateFields, validateAndMergeCustomFields, checkSaveResult } from '../utils.js';
+import { withErrorHandling, escapeSOQL, escapeSOQLLike, validateFields, validateAndMergeCustomFields, checkSaveResult, formatVendorErrors, sanitizeRecords } from '../utils.js';
 import { withConnection } from '../client.js';
 export function registerAccountTools(server) {
     server.registerTool('salesforce_get_accounts', {
@@ -29,7 +29,7 @@ export function registerAccountTools(server) {
             const limit = Math.min(Math.max(1, args.limit ?? 50), 200);
             query += ` LIMIT ${limit}`;
             const result = await conn.query(query);
-            return JSON.stringify({ ok: true, records: result.records, totalSize: result.totalSize, done: result.done });
+            return JSON.stringify({ ok: true, records: sanitizeRecords(result.records, 'salesforce:get_accounts:records'), totalSize: result.totalSize, done: result.done });
         });
     }));
     server.registerTool('salesforce_create_account', {
@@ -43,7 +43,7 @@ export function registerAccountTools(server) {
             description: z.string().optional().describe('Account description'),
             fields: z.record(z.unknown()).optional().describe('Additional/custom fields as key-value pairs'),
         }),
-        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+        annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true },
     }, withErrorHandling(async (args) => {
         return withConnection(undefined, async (conn) => {
             const data = { Name: args.name };
@@ -62,7 +62,7 @@ export function registerAccountTools(server) {
             const result = await conn.sobject('Account').create(data);
             if (!result.success) {
                 const { ConnectorError } = await import('../types.js');
-                throw new ConnectorError('Failed to create account', 'CREATE_ERROR', JSON.stringify(result.errors));
+                throw new ConnectorError('Failed to create account', 'CREATE_ERROR', formatVendorErrors(result.errors));
             }
             return JSON.stringify({ ok: true, status: 'success', object: 'Account', id: result.id, name: args.name });
         });

package/dist/tools/campaigns.d.ts

@@ -0,0 +1,3 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export declare function registerCampaignTools(server: McpServer): void;
+//# sourceMappingURL=campaigns.d.ts.map

package/dist/tools/campaigns.js

@@ -0,0 +1,78 @@
+import { z } from 'zod';
+import { withErrorHandling, escapeSOQL, escapeSOQLLike, validateFields, formatSOQLDate, sanitizeRecords } from '../utils.js';
+import { withConnection } from '../client.js';
+export function registerCampaignTools(server) {
+    server.registerTool('salesforce_get_campaigns', {
+        description: `Get marketing campaigns. Filters: name_contains, campaign_type, status, is_active, start_date_from, start_date_to. Returns: Id, Name, Type, Status, IsActive, StartDate, EndDate, Description. Max 200 (default: 50).`,
+        inputSchema: z.object({
+            limit: z.number().int().min(1).max(200).optional().describe('Max results 1-200 (default: 50)'),
+            name_contains: z.string().optional().describe('Filter by name (case-insensitive)'),
+            campaign_type: z.string().optional().describe('Filter by type (Email, Webinar, Advertisement)'),
+            status: z.string().optional().describe('Filter by status (Planned, In Progress, Completed)'),
+            is_active: z.boolean().optional().describe('Filter by active status'),
+            start_date_from: z.string().optional().describe('Campaigns starting on/after date (YYYY-MM-DD)'),
+            start_date_to: z.string().optional().describe('Campaigns starting on/before date (YYYY-MM-DD)'),
+            fields: z.array(z.string()).optional().describe('Custom fields (must be valid API names)'),
+        }),
+        annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+    }, withErrorHandling(async (args) => {
+        return withConnection(undefined, async (conn) => {
+            const defaultFields = ['Id', 'Name', 'Type', 'Status', 'IsActive', 'StartDate', 'EndDate', 'Description'];
+            const fields = validateFields(args.fields || [], defaultFields);
+            let query = `SELECT ${fields.join(', ')} FROM Campaign`;
+            const conditions = [];
+            if (args.name_contains)
+                conditions.push(`Name LIKE '%${escapeSOQLLike(args.name_contains)}%'`);
+            if (args.campaign_type)
+                conditions.push(`Type = '${escapeSOQL(args.campaign_type)}'`);
+            if (args.status)
+                conditions.push(`Status = '${escapeSOQL(args.status)}'`);
+            if (args.is_active !== undefined)
+                conditions.push(`IsActive = ${args.is_active}`);
+            if (args.start_date_from)
+                conditions.push(`StartDate >= ${formatSOQLDate(args.start_date_from, 'start_date_from')}`);
+            if (args.start_date_to)
+                conditions.push(`StartDate <= ${formatSOQLDate(args.start_date_to, 'start_date_to')}`);
+            if (conditions.length > 0)
+                query += ` WHERE ${conditions.join(' AND ')}`;
+            const limit = Math.min(Math.max(1, args.limit ?? 50), 200);
+            query += ` LIMIT ${limit}`;
+            const result = await conn.query(query);
+            return JSON.stringify({ ok: true, records: sanitizeRecords(result.records, 'salesforce:get_campaigns:records'), totalSize: result.totalSize });
+        });
+    }));
+    server.registerTool('salesforce_get_campaign_members', {
+        description: `Get campaign members (leads/contacts in a campaign). Filters: campaign_id, lead_id, contact_id, status. Returns: Id, CampaignId, LeadId, ContactId, Status, CreatedDate. Max 200 (default: 50).`,
+        inputSchema: z.object({
+            limit: z.number().int().min(1).max(200).optional().describe('Max results 1-200 (default: 50)'),
+            campaign_id: z.string().optional().describe('Filter by Campaign ID'),
+            lead_id: z.string().optional().describe('Filter by Lead ID'),
+            contact_id: z.string().optional().describe('Filter by Contact ID'),
+            status: z.string().optional().describe('Filter by member status (Sent, Responded)'),
+            fields: z.array(z.string()).optional().describe('Custom fields (must be valid API names)'),
+        }),
+        annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+    }, withErrorHandling(async (args) => {
+        return withConnection(undefined, async (conn) => {
+            const defaultFields = ['Id', 'CampaignId', 'LeadId', 'ContactId', 'Status', 'CreatedDate'];
+            const fields = validateFields(args.fields || [], defaultFields);
+            let query = `SELECT ${fields.join(', ')} FROM CampaignMember`;
+            const conditions = [];
+            if (args.campaign_id)
+                conditions.push(`CampaignId = '${escapeSOQL(args.campaign_id)}'`);
+            if (args.lead_id)
+                conditions.push(`LeadId = '${escapeSOQL(args.lead_id)}'`);
+            if (args.contact_id)
+                conditions.push(`ContactId = '${escapeSOQL(args.contact_id)}'`);
+            if (args.status)
+                conditions.push(`Status = '${escapeSOQL(args.status)}'`);
+            if (conditions.length > 0)
+                query += ` WHERE ${conditions.join(' AND ')}`;
+            const limit = Math.min(Math.max(1, args.limit ?? 50), 200);
+            query += ` LIMIT ${limit}`;
+            const result = await conn.query(query);
+            return JSON.stringify({ ok: true, records: sanitizeRecords(result.records, 'salesforce:get_campaign_members:records'), totalSize: result.totalSize });
+        });
+    }));
+}
+//# sourceMappingURL=campaigns.js.map

package/dist/tools/cases.d.ts

@@ -0,0 +1,3 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export declare function registerCaseTools(server: McpServer): void;
+//# sourceMappingURL=cases.d.ts.map

package/dist/tools/cases.js

@@ -0,0 +1,121 @@
+import { z } from 'zod';
+import { withErrorHandling, escapeSOQL, escapeSOQLLike, validateFields, validateAndMergeCustomFields, checkSaveResult, formatVendorErrors, sanitizeRecords } from '../utils.js';
+import { withConnection } from '../client.js';
+import { ConnectorError } from '../types.js';
+export function registerCaseTools(server) {
+    server.registerTool('salesforce_get_cases', {
+        description: `Get support cases. Filters: subject_contains, status, priority, related_account_id, related_contact_id, is_closed. Returns: Id, CaseNumber, Subject, Status, Priority, Origin, Description, AccountId, ContactId, OwnerId, CreatedDate, ClosedDate. Max 200 (default: 50).`,
+        inputSchema: z.object({
+            limit: z.number().int().min(1).max(200).optional().describe('Max results 1-200 (default: 50)'),
+            subject_contains: z.string().optional().describe('Filter by subject (case-insensitive)'),
+            status: z.string().optional().describe('Filter by status (New, Working, Escalated, Closed)'),
+            priority: z.string().optional().describe('Filter by priority (High, Medium, Low)'),
+            related_account_id: z.string().optional().describe('Filter by Account ID'),
+            related_contact_id: z.string().optional().describe('Filter by Contact ID'),
+            is_closed: z.boolean().optional().describe('Filter by closed status'),
+            fields: z.array(z.string()).optional().describe('Custom fields (must be valid API names)'),
+        }),
+        annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+    }, withErrorHandling(async (args) => {
+        return withConnection(undefined, async (conn) => {
+            const defaultFields = ['Id', 'CaseNumber', 'Subject', 'Status', 'Priority', 'Origin', 'Description', 'AccountId', 'ContactId', 'OwnerId', 'CreatedDate', 'ClosedDate'];
+            const fields = validateFields(args.fields || [], defaultFields);
+            let query = `SELECT ${fields.join(', ')} FROM Case`;
+            const conditions = [];
+            if (args.subject_contains)
+                conditions.push(`Subject LIKE '%${escapeSOQLLike(args.subject_contains)}%'`);
+            if (args.status)
+                conditions.push(`Status = '${escapeSOQL(args.status)}'`);
+            if (args.priority)
+                conditions.push(`Priority = '${escapeSOQL(args.priority)}'`);
+            if (args.related_account_id)
+                conditions.push(`AccountId = '${escapeSOQL(args.related_account_id)}'`);
+            if (args.related_contact_id)
+                conditions.push(`ContactId = '${escapeSOQL(args.related_contact_id)}'`);
+            if (args.is_closed !== undefined)
+                conditions.push(`IsClosed = ${args.is_closed}`);
+            if (conditions.length > 0)
+                query += ` WHERE ${conditions.join(' AND ')}`;
+            const limit = Math.min(Math.max(1, args.limit ?? 50), 200);
+            query += ` LIMIT ${limit}`;
+            const result = await conn.query(query);
+            return JSON.stringify({ ok: true, records: sanitizeRecords(result.records, 'salesforce:get_cases:records'), totalSize: result.totalSize });
+        });
+    }));
+    server.registerTool('salesforce_create_case', {
+        description: `Create a support case. Required: subject. Optional: status, priority, origin, description, related_account_id, related_contact_id, fields.`,
+        inputSchema: z.object({
+            subject: z.string().min(1).describe('Case subject (required)'),
+            status: z.string().optional().describe('Case status (default: New)'),
+            priority: z.string().optional().describe('Priority (High, Medium, Low)'),
+            origin: z.string().optional().describe('Case origin (Phone, Email, Web)'),
+            description: z.string().optional().describe('Case description'),
+            related_account_id: z.string().optional().describe('Account ID to associate with'),
+            related_contact_id: z.string().optional().describe('Contact ID to associate with'),
+            fields: z.record(z.unknown()).optional().describe('Additional/custom fields as key-value pairs'),
+        }),
+        annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true },
+    }, withErrorHandling(async (args) => {
+        return withConnection(undefined, async (conn) => {
+            const data = { Subject: args.subject };
+            if (args.status)
+                data.Status = args.status;
+            if (args.priority)
+                data.Priority = args.priority;
+            if (args.origin)
+                data.Origin = args.origin;
+            if (args.description)
+                data.Description = args.description;
+            if (args.related_account_id)
+                data.AccountId = args.related_account_id;
+            if (args.related_contact_id)
+                data.ContactId = args.related_contact_id;
+            if (args.fields)
+                validateAndMergeCustomFields(data, args.fields);
+            const result = await conn.sobject('Case').create(data);
+            if (!result.success)
+                throw new ConnectorError('Failed to create case', 'CREATE_ERROR', formatVendorErrors(result.errors));
+            return JSON.stringify({ ok: true, status: 'success', object: 'Case', id: result.id, subject: args.subject });
+        });
+    }));
+    server.registerTool('salesforce_update_case', {
+        description: `Update a support case. Required: id. Updatable: subject, status, priority, origin, description, related_account_id, related_contact_id, fields.`,
+        inputSchema: z.object({
+            id: z.string().min(1).describe('Salesforce Case ID (required)'),
+            subject: z.string().optional().describe('Case subject'),
+            status: z.string().optional().describe('Case status (e.g., Working, Escalated, Closed)'),
+            priority: z.string().optional().describe('Priority (High, Medium, Low)'),
+            origin: z.string().optional().describe('Case origin'),
+            description: z.string().optional().describe('Description'),
+            related_account_id: z.string().optional().describe('Account ID to associate with'),
+            related_contact_id: z.string().optional().describe('Contact ID to associate with'),
+            fields: z.record(z.unknown()).optional().describe('Additional/custom fields as key-value pairs'),
+        }),
+        annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true },
+    }, withErrorHandling(async (args) => {
+        return withConnection(undefined, async (conn) => {
+            const updateData = { Id: args.id };
+            if (args.subject)
+                updateData.Subject = args.subject;
+            if (args.status)
+                updateData.Status = args.status;
+            if (args.priority)
+                updateData.Priority = args.priority;
+            if (args.origin)
+                updateData.Origin = args.origin;
+            if (args.description)
+                updateData.Description = args.description;
+            if (args.related_account_id)
+                updateData.AccountId = args.related_account_id;
+            if (args.related_contact_id)
+                updateData.ContactId = args.related_contact_id;
+            if (args.fields)
+                validateAndMergeCustomFields(updateData, args.fields);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            const result = await conn.sobject('Case').update(updateData);
+            checkSaveResult(result, 'Failed to update case');
+            return JSON.stringify({ ok: true, status: 'success', object: 'Case', id: args.id });
+        });
+    }));
+}
+//# sourceMappingURL=cases.js.map

package/dist/tools/contacts.js

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { withErrorHandling, escapeSOQL, escapeSOQLLike, validateFields, validateAndMergeCustomFields, checkSaveResult } from '../utils.js';
+import { withErrorHandling, escapeSOQL, escapeSOQLLike, validateFields, validateAndMergeCustomFields, checkSaveResult, formatVendorErrors, sanitizeRecords } from '../utils.js';
 import { withConnection } from '../client.js';
 import { ConnectorError } from '../types.js';
 export function registerContactTools(server) {
@@ -32,7 +32,7 @@ export function registerContactTools(server) {
             const limit = Math.min(Math.max(1, args.limit ?? 50), 200);
             query += ` LIMIT ${limit}`;
             const result = await conn.query(query);
-            return JSON.stringify({ ok: true, records: result.records, totalSize: result.totalSize });
+            return JSON.stringify({ ok: true, records: sanitizeRecords(result.records, 'salesforce:get_contacts:records'), totalSize: result.totalSize });
         });
     }));
     server.registerTool('salesforce_create_contact', {
@@ -46,7 +46,7 @@ export function registerContactTools(server) {
             related_account_id: z.string().optional().describe('Account ID to associate with'),
             fields: z.record(z.unknown()).optional().describe('Additional/custom fields as key-value pairs'),
         }),
-        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+        annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true },
     }, withErrorHandling(async (args) => {
         return withConnection(undefined, async (conn) => {
             const data = { LastName: args.last_name };
@@ -64,7 +64,7 @@ export function registerContactTools(server) {
                 validateAndMergeCustomFields(data, args.fields);
             const result = await conn.sobject('Contact').create(data);
             if (!result.success)
-                throw new ConnectorError('Failed to create contact', 'CREATE_ERROR', JSON.stringify(result.errors));
+                throw new ConnectorError('Failed to create contact', 'CREATE_ERROR', formatVendorErrors(result.errors));
             return JSON.stringify({ ok: true, status: 'success', object: 'Contact', id: result.id, name: `${args.first_name || ''} ${args.last_name}`.trim() });
         });
     }));

package/dist/tools/events.d.ts

@@ -0,0 +1,3 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export declare function registerEventTools(server: McpServer): void;
+//# sourceMappingURL=events.d.ts.map

package/dist/tools/events.js

@@ -0,0 +1,90 @@
+import { z } from 'zod';
+import { withErrorHandling, escapeSOQL, escapeSOQLLike, validateFields, validateAndMergeCustomFields, formatSOQLDateTime, formatVendorErrors, sanitizeRecords } from '../utils.js';
+import { withConnection } from '../client.js';
+import { ConnectorError } from '../types.js';
+export function registerEventTools(server) {
+    server.registerTool('salesforce_get_events', {
+        description: `Get calendar events. Filters: subject_contains, who_id, what_id, start_from, start_to. Dates accept YYYY-MM-DD (midnight UTC) or ISO 8601 datetimes. Returns: Id, Subject, StartDateTime, EndDateTime, Location, Description, WhoId, WhatId, OwnerId, IsAllDayEvent. Max 200 (default: 50).`,
+        inputSchema: z.object({
+            limit: z.number().int().min(1).max(200).optional().describe('Max results 1-200 (default: 50)'),
+            subject_contains: z.string().optional().describe('Filter by subject (case-insensitive)'),
+            who_id: z.string().optional().describe('Filter by WhoId (Contact or Lead ID)'),
+            what_id: z.string().optional().describe('Filter by WhatId (Account or Opportunity ID)'),
+            start_from: z.string().optional().describe('Events starting on/after this date or datetime (YYYY-MM-DD or ISO 8601; see tool description for an example)'),
+            start_to: z.string().optional().describe('Events starting on/before this date or datetime (YYYY-MM-DD or ISO 8601)'),
+            fields: z.array(z.string()).optional().describe('Custom fields (must be valid API names)'),
+        }),
+        annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+    }, withErrorHandling(async (args) => {
+        return withConnection(undefined, async (conn) => {
+            const defaultFields = ['Id', 'Subject', 'StartDateTime', 'EndDateTime', 'Location', 'Description', 'WhoId', 'WhatId', 'OwnerId', 'IsAllDayEvent'];
+            const fields = validateFields(args.fields || [], defaultFields);
+            let query = `SELECT ${fields.join(', ')} FROM Event`;
+            const conditions = [];
+            if (args.subject_contains)
+                conditions.push(`Subject LIKE '%${escapeSOQLLike(args.subject_contains)}%'`);
+            if (args.who_id)
+                conditions.push(`WhoId = '${escapeSOQL(args.who_id)}'`);
+            if (args.what_id)
+                conditions.push(`WhatId = '${escapeSOQL(args.what_id)}'`);
+            if (args.start_from)
+                conditions.push(`StartDateTime >= ${formatSOQLDateTime(args.start_from, 'start_from')}`);
+            if (args.start_to)
+                conditions.push(`StartDateTime <= ${formatSOQLDateTime(args.start_to, 'start_to')}`);
+            if (conditions.length > 0)
+                query += ` WHERE ${conditions.join(' AND ')}`;
+            query += ' ORDER BY StartDateTime ASC';
+            const limit = Math.min(Math.max(1, args.limit ?? 50), 200);
+            query += ` LIMIT ${limit}`;
+            const result = await conn.query(query);
+            return JSON.stringify({ ok: true, records: sanitizeRecords(result.records, 'salesforce:get_events:records'), totalSize: result.totalSize });
+        });
+    }));
+    server.registerTool('salesforce_create_event', {
+        description: `Create a calendar event. Required: subject, start_date_time, end_date_time. Optional: location, description, who_id, what_id, is_all_day_event, owner_id, fields. Datetimes must be ISO 8601 (e.g. "2026-01-09T14:30:00Z"); all-day events accept plain dates (YYYY-MM-DD).`,
+        inputSchema: z.object({
+            subject: z.string().min(1).describe('Event subject (required)'),
+            start_date_time: z.string().min(1).describe('Start (required) — ISO 8601 datetime (see tool description for an example), or YYYY-MM-DD for all-day events'),
+            end_date_time: z.string().min(1).describe('End (required) — ISO 8601 datetime, or YYYY-MM-DD for all-day events'),
+            location: z.string().optional().describe('Event location'),
+            description: z.string().optional().describe('Event description'),
+            who_id: z.string().optional().describe('Contact or Lead ID to invite/relate'),
+            what_id: z.string().optional().describe('Account or Opportunity ID to relate'),
+            is_all_day_event: z.boolean().optional().describe('All-day event (default: false)'),
+            owner_id: z.string().optional().describe('Owner User ID'),
+            fields: z.record(z.unknown()).optional().describe('Additional/custom fields as key-value pairs'),
+        }),
+        annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true },
+    }, withErrorHandling(async (args) => {
+        // Validate formats up front for actionable errors; the validated values
+        // go into the create body verbatim (JSON body — no SOQL injection surface).
+        formatSOQLDateTime(args.start_date_time, 'start_date_time');
+        formatSOQLDateTime(args.end_date_time, 'end_date_time');
+        return withConnection(undefined, async (conn) => {
+            const data = {
+                Subject: args.subject,
+                StartDateTime: args.start_date_time,
+                EndDateTime: args.end_date_time,
+            };
+            if (args.location)
+                data.Location = args.location;
+            if (args.description)
+                data.Description = args.description;
+            if (args.who_id)
+                data.WhoId = args.who_id;
+            if (args.what_id)
+                data.WhatId = args.what_id;
+            if (args.is_all_day_event !== undefined)
+                data.IsAllDayEvent = args.is_all_day_event;
+            if (args.owner_id)
+                data.OwnerId = args.owner_id;
+            if (args.fields)
+                validateAndMergeCustomFields(data, args.fields);
+            const result = await conn.sobject('Event').create(data);
+            if (!result.success)
+                throw new ConnectorError('Failed to create event', 'CREATE_ERROR', formatVendorErrors(result.errors));
+            return JSON.stringify({ ok: true, status: 'success', object: 'Event', id: result.id, subject: args.subject });
+        });
+    }));
+}
+//# sourceMappingURL=events.js.map

package/dist/tools/index.d.ts

@@ -4,6 +4,12 @@ export { registerContactTools } from './contacts.js';
 export { registerOpportunityTools } from './opportunities.js';
 export { registerLeadTools } from './leads.js';
 export { registerTaskTools } from './tasks.js';
+export { registerCaseTools } from './cases.js';
+export { registerEventTools } from './events.js';
+export { registerSearchTools } from './search.js';
+export { registerNoteTools } from './notes.js';
+export { registerCampaignTools } from './campaigns.js';
+export { registerReportTools } from './reports.js';
 export { registerUserTools } from './users.js';
 export { registerQueryTools } from './query.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/tools/index.js

@@ -4,6 +4,12 @@ export { registerContactTools } from './contacts.js';
 export { registerOpportunityTools } from './opportunities.js';
 export { registerLeadTools } from './leads.js';
 export { registerTaskTools } from './tasks.js';
+export { registerCaseTools } from './cases.js';
+export { registerEventTools } from './events.js';
+export { registerSearchTools } from './search.js';
+export { registerNoteTools } from './notes.js';
+export { registerCampaignTools } from './campaigns.js';
+export { registerReportTools } from './reports.js';
 export { registerUserTools } from './users.js';
 export { registerQueryTools } from './query.js';
 //# sourceMappingURL=index.js.map