@mindstone/mcp-server-salesforce 0.1.2

package/dist/tools/leads.js

@@ -0,0 +1,135 @@
+import { z } from 'zod';
+import { withErrorHandling, escapeSOQL, escapeSOQLLike, validateFields, validateAndMergeCustomFields, checkSaveResult } from '../utils.js';
+import { withConnection } from '../client.js';
+import { ConnectorError } from '../types.js';
+export function registerLeadTools(server) {
+    server.registerTool('salesforce_get_leads', {
+        description: `Get leads. Filters: name_contains, company_contains, email_contains, status. Max 200 (default: 50).`,
+        inputSchema: z.object({
+            limit: z.number().int().min(1).max(200).optional().describe('Max results 1-200 (default: 50)'),
+            name_contains: z.string().optional().describe('Filter by name'),
+            company_contains: z.string().optional().describe('Filter by company'),
+            email_contains: z.string().optional().describe('Filter by email'),
+            status: z.string().optional().describe('Filter by status'),
+            fields: z.array(z.string()).optional().describe('Custom fields'),
+        }),
+        annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+    }, withErrorHandling(async (args) => {
+        return withConnection(undefined, async (conn) => {
+            const defaultFields = ['Id', 'FirstName', 'LastName', 'Company', 'Email', 'Phone', 'Status', 'Title'];
+            const fields = validateFields(args.fields || [], defaultFields);
+            let query = `SELECT ${fields.join(', ')} FROM Lead`;
+            const conditions = [];
+            if (args.name_contains) {
+                const escaped = escapeSOQLLike(args.name_contains);
+                conditions.push(`(FirstName LIKE '%${escaped}%' OR LastName LIKE '%${escaped}%')`);
+            }
+            if (args.company_contains)
+                conditions.push(`Company LIKE '%${escapeSOQLLike(args.company_contains)}%'`);
+            if (args.email_contains)
+                conditions.push(`Email LIKE '%${escapeSOQLLike(args.email_contains)}%'`);
+            if (args.status)
+                conditions.push(`Status = '${escapeSOQL(args.status)}'`);
+            if (conditions.length > 0)
+                query += ` WHERE ${conditions.join(' AND ')}`;
+            const limit = Math.min(Math.max(1, args.limit ?? 50), 200);
+            query += ` LIMIT ${limit}`;
+            const result = await conn.query(query);
+            return JSON.stringify({ ok: true, records: result.records, totalSize: result.totalSize });
+        });
+    }));
+    server.registerTool('salesforce_create_lead', {
+        description: `Create a lead. Required: last_name, company. Optional: first_name, email, phone, title, status, fields.`,
+        inputSchema: z.object({
+            first_name: z.string().optional().describe('First name'),
+            last_name: z.string().min(1).describe('Last name (required)'),
+            company: z.string().min(1).describe('Company name (required)'),
+            email: z.string().optional().describe('Email address'),
+            phone: z.string().optional().describe('Phone number'),
+            title: z.string().optional().describe('Job title'),
+            status: z.string().optional().describe('Lead status'),
+            fields: z.record(z.unknown()).optional().describe('Additional/custom fields'),
+        }),
+        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+    }, withErrorHandling(async (args) => {
+        return withConnection(undefined, async (conn) => {
+            const data = { LastName: args.last_name, Company: args.company };
+            if (args.first_name)
+                data.FirstName = args.first_name;
+            if (args.email)
+                data.Email = args.email;
+            if (args.phone)
+                data.Phone = args.phone;
+            if (args.title)
+                data.Title = args.title;
+            if (args.status)
+                data.Status = args.status;
+            if (args.fields)
+                validateAndMergeCustomFields(data, args.fields);
+            const result = await conn.sobject('Lead').create(data);
+            if (!result.success)
+                throw new ConnectorError('Failed to create lead', 'CREATE_ERROR', JSON.stringify(result.errors));
+            return JSON.stringify({ ok: true, status: 'success', object: 'Lead', id: result.id, name: `${args.first_name || ''} ${args.last_name}`.trim() });
+        });
+    }));
+    server.registerTool('salesforce_convert_lead', {
+        description: `Convert a lead into Account + Contact, and optionally an Opportunity. Required: lead_id. Optional: create_opportunity, opportunity_name.`,
+        inputSchema: z.object({
+            lead_id: z.string().min(1).describe('Lead ID to convert (required)'),
+            create_opportunity: z.boolean().optional().describe('Create opportunity (default: true)'),
+            opportunity_name: z.string().optional().describe('Name for new opportunity'),
+        }),
+        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+    }, withErrorHandling(async (args) => {
+        return withConnection(undefined, async (conn) => {
+            const leadConvert = {
+                leadId: args.lead_id,
+                convertedStatus: 'Closed - Converted',
+                doNotCreateOpportunity: args.create_opportunity === false,
+            };
+            const result = await conn
+                .soap.convertLead([leadConvert]);
+            return JSON.stringify({ ok: true, status: 'success', result: result[0] });
+        });
+    }));
+    server.registerTool('salesforce_update_lead', {
+        description: `Update a lead. Required: lead_id. Updatable: first_name, last_name, company, email, phone, title, status, fields.`,
+        inputSchema: z.object({
+            lead_id: z.string().min(1).describe('Salesforce Lead ID (required)'),
+            first_name: z.string().optional().describe('First name'),
+            last_name: z.string().optional().describe('Last name'),
+            company: z.string().optional().describe('Company name'),
+            email: z.string().optional().describe('Email address'),
+            phone: z.string().optional().describe('Phone number'),
+            title: z.string().optional().describe('Job title'),
+            status: z.string().optional().describe('Lead status'),
+            fields: z.record(z.unknown()).optional().describe('Additional/custom fields'),
+        }),
+        annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true },
+    }, withErrorHandling(async (args) => {
+        return withConnection(undefined, async (conn) => {
+            const updateData = { Id: args.lead_id };
+            if (args.first_name)
+                updateData.FirstName = args.first_name;
+            if (args.last_name)
+                updateData.LastName = args.last_name;
+            if (args.company)
+                updateData.Company = args.company;
+            if (args.email)
+                updateData.Email = args.email;
+            if (args.phone)
+                updateData.Phone = args.phone;
+            if (args.title)
+                updateData.Title = args.title;
+            if (args.status)
+                updateData.Status = args.status;
+            if (args.fields)
+                validateAndMergeCustomFields(updateData, args.fields);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            const result = await conn.sobject('Lead').update(updateData);
+            checkSaveResult(result, 'Failed to update lead');
+            return JSON.stringify({ ok: true, status: 'success', object: 'Lead', id: args.lead_id });
+        });
+    }));
+}
+//# sourceMappingURL=leads.js.map

package/dist/tools/opportunities.d.ts

@@ -0,0 +1,3 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export declare function registerOpportunityTools(server: McpServer): void;
+//# sourceMappingURL=opportunities.d.ts.map

package/dist/tools/opportunities.js

@@ -0,0 +1,108 @@
+import { z } from 'zod';
+import { withErrorHandling, escapeSOQL, escapeSOQLLike, validateFields, validateAndMergeCustomFields, formatSOQLDate, checkSaveResult } from '../utils.js';
+import { withConnection } from '../client.js';
+import { ConnectorError } from '../types.js';
+export function registerOpportunityTools(server) {
+    server.registerTool('salesforce_get_opportunities', {
+        description: `Get opportunities. Filters: name_contains, stage, related_account_id, close_date_from, close_date_to. Dates must be YYYY-MM-DD. Max 200 (default: 50).`,
+        inputSchema: z.object({
+            limit: z.number().int().min(1).max(200).optional().describe('Max results 1-200 (default: 50)'),
+            name_contains: z.string().optional().describe('Filter by name'),
+            stage: z.string().optional().describe('Filter by stage'),
+            related_account_id: z.string().optional().describe('Filter by Account ID'),
+            close_date_from: z.string().optional().describe('Closing on/after date (YYYY-MM-DD)'),
+            close_date_to: z.string().optional().describe('Closing on/before date (YYYY-MM-DD)'),
+            fields: z.array(z.string()).optional().describe('Custom fields'),
+        }),
+        annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+    }, withErrorHandling(async (args) => {
+        return withConnection(undefined, async (conn) => {
+            const defaultFields = ['Id', 'Name', 'StageName', 'Amount', 'CloseDate', 'AccountId', 'Probability'];
+            const fields = validateFields(args.fields || [], defaultFields);
+            let query = `SELECT ${fields.join(', ')} FROM Opportunity`;
+            const conditions = [];
+            if (args.name_contains)
+                conditions.push(`Name LIKE '%${escapeSOQLLike(args.name_contains)}%'`);
+            if (args.stage)
+                conditions.push(`StageName = '${escapeSOQL(args.stage)}'`);
+            if (args.related_account_id)
+                conditions.push(`AccountId = '${escapeSOQL(args.related_account_id)}'`);
+            if (args.close_date_from)
+                conditions.push(`CloseDate >= ${formatSOQLDate(args.close_date_from, 'close_date_from')}`);
+            if (args.close_date_to)
+                conditions.push(`CloseDate <= ${formatSOQLDate(args.close_date_to, 'close_date_to')}`);
+            if (conditions.length > 0)
+                query += ` WHERE ${conditions.join(' AND ')}`;
+            const limit = Math.min(Math.max(1, args.limit ?? 50), 200);
+            query += ` LIMIT ${limit}`;
+            const result = await conn.query(query);
+            return JSON.stringify({ ok: true, records: result.records, totalSize: result.totalSize });
+        });
+    }));
+    server.registerTool('salesforce_create_opportunity', {
+        description: `Create an opportunity. Required: name, stage_name, close_date (YYYY-MM-DD). Optional: amount, related_account_id, description, fields.`,
+        inputSchema: z.object({
+            name: z.string().min(1).describe('Opportunity name (required)'),
+            stage_name: z.string().min(1).describe('Stage name (required)'),
+            close_date: z.string().min(1).describe('Close date YYYY-MM-DD (required)'),
+            amount: z.number().optional().describe('Opportunity amount'),
+            related_account_id: z.string().optional().describe('Account ID to associate with'),
+            description: z.string().optional().describe('Description'),
+            fields: z.record(z.unknown()).optional().describe('Additional/custom fields as key-value pairs'),
+        }),
+        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+    }, withErrorHandling(async (args) => {
+        formatSOQLDate(args.close_date, 'close_date');
+        return withConnection(undefined, async (conn) => {
+            const data = { Name: args.name, StageName: args.stage_name, CloseDate: args.close_date };
+            if (args.amount !== undefined)
+                data.Amount = args.amount;
+            if (args.related_account_id)
+                data.AccountId = args.related_account_id;
+            if (args.description)
+                data.Description = args.description;
+            if (args.fields)
+                validateAndMergeCustomFields(data, args.fields);
+            const result = await conn.sobject('Opportunity').create(data);
+            if (!result.success)
+                throw new ConnectorError('Failed to create opportunity', 'CREATE_ERROR', JSON.stringify(result.errors));
+            return JSON.stringify({ ok: true, status: 'success', object: 'Opportunity', id: result.id, name: args.name });
+        });
+    }));
+    server.registerTool('salesforce_update_opportunity', {
+        description: `Update an opportunity. Required: id. Updatable: name, stage_name, close_date (YYYY-MM-DD), amount, description, fields.`,
+        inputSchema: z.object({
+            id: z.string().min(1).describe('Salesforce Opportunity ID (required)'),
+            name: z.string().optional().describe('Opportunity name'),
+            stage_name: z.string().optional().describe('Stage name'),
+            close_date: z.string().optional().describe('Close date YYYY-MM-DD'),
+            amount: z.number().optional().describe('Amount'),
+            description: z.string().optional().describe('Description'),
+            fields: z.record(z.unknown()).optional().describe('Additional/custom fields'),
+        }),
+        annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true },
+    }, withErrorHandling(async (args) => {
+        if (args.close_date)
+            formatSOQLDate(args.close_date, 'close_date');
+        return withConnection(undefined, async (conn) => {
+            const updateData = { Id: args.id };
+            if (args.name)
+                updateData.Name = args.name;
+            if (args.stage_name)
+                updateData.StageName = args.stage_name;
+            if (args.close_date)
+                updateData.CloseDate = args.close_date;
+            if (args.amount !== undefined)
+                updateData.Amount = args.amount;
+            if (args.description)
+                updateData.Description = args.description;
+            if (args.fields)
+                validateAndMergeCustomFields(updateData, args.fields);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            const result = await conn.sobject('Opportunity').update(updateData);
+            checkSaveResult(result, 'Failed to update opportunity');
+            return JSON.stringify({ ok: true, status: 'success', object: 'Opportunity', id: args.id });
+        });
+    }));
+}
+//# sourceMappingURL=opportunities.js.map

package/dist/tools/query.d.ts

@@ -0,0 +1,17 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+/**
+ * Enforce a hard cap on the LIMIT clause of a caller-supplied SOQL query.
+ *
+ * The cap is applied AFTER stripping line and block comments and trailing
+ * whitespace, so trailing-comment/whitespace bypass attempts (LIMIT 5000
+ * followed by trailing whitespace, line comments, or block comments) are
+ * neutralised. OFFSET clauses are preserved on the output side, and a
+ * caller-supplied OFFSET-without-LIMIT triggers an inserted cap.
+ *
+ * The result is a single, syntactically valid SOQL statement with exactly
+ * one `LIMIT <n>` clause where `n <= maxLimit`, and at most one trailing
+ * `OFFSET <n>` clause.
+ */
+export declare function applyQueryLimitCap(rawQuery: string, maxLimit: number): string;
+export declare function registerQueryTools(server: McpServer): void;
+//# sourceMappingURL=query.d.ts.map

package/dist/tools/query.js

@@ -0,0 +1,267 @@
+import { z } from 'zod';
+import { withErrorHandling, validateObjectName, validateFields, isValidQueryFieldName, isValidFieldName, escapeSOQL, ALLOWED_FILTER_OPERATORS, validateAndMergeCustomFields, checkSaveResult } from '../utils.js';
+import { withConnection } from '../client.js';
+import { ConnectorError } from '../types.js';
+// Strip SQL-style line ("// ...") and block ("/* ... ") comments from a
+// SOQL query. SOQL itself does not officially support either form, but
+// we defensively strip both because callers (or attackers crafting
+// tool-arguments) commonly use them to evade naive trailing-LIMIT
+// regexes.
+//
+// The walker is QUOTE-AWARE: characters inside a SOQL single-quoted string
+// literal are preserved verbatim. SOQL string literals support two escape
+// forms for an embedded apostrophe: doubled-quote `''` and backslash-quote
+// `\'`. We honour both, plus generic backslash-escapes (`\\`, `\n`, etc.)
+// which simply consume the next character. Without quote-awareness, a
+// query like `WHERE Website = 'https://example.com/path'` would be
+// corrupted to `WHERE Website = 'https:` (unterminated literal), since
+// the naive global regex would treat the `//` inside the quoted span as
+// a line comment.
+function stripSoqlComments(query) {
+    let out = '';
+    let i = 0;
+    const n = query.length;
+    while (i < n) {
+        const ch = query[i];
+        // Inside a single-quoted SOQL string literal: copy verbatim until the
+        // matching close-quote, honouring backslash escapes and the doubled-
+        // apostrophe escape ('').
+        if (ch === "'") {
+            out += ch;
+            i++;
+            while (i < n) {
+                const c = query[i];
+                if (c === '\\' && i + 1 < n) {
+                    // Generic backslash escape: keep both characters verbatim.
+                    out += c + query[i + 1];
+                    i += 2;
+                    continue;
+                }
+                if (c === "'") {
+                    // Doubled-apostrophe = literal apostrophe inside the literal.
+                    if (i + 1 < n && query[i + 1] === "'") {
+                        out += "''";
+                        i += 2;
+                        continue;
+                    }
+                    // Closing quote.
+                    out += "'";
+                    i++;
+                    break;
+                }
+                out += c;
+                i++;
+            }
+            continue;
+        }
+        // Outside any quoted literal: strip block + line comments.
+        if (ch === '/' && i + 1 < n) {
+            const next = query[i + 1];
+            if (next === '*') {
+                // Block comment: consume up to the closing */ (or EOF).
+                i += 2;
+                while (i < n && !(query[i] === '*' && i + 1 < n && query[i + 1] === '/')) {
+                    i++;
+                }
+                if (i < n)
+                    i += 2; // skip the closing */
+                out += ' ';
+                continue;
+            }
+            if (next === '/') {
+                // Line comment: consume up to (but not including) the newline.
+                i += 2;
+                while (i < n && query[i] !== '\n')
+                    i++;
+                out += ' ';
+                continue;
+            }
+        }
+        out += ch;
+        i++;
+    }
+    return out;
+}
+/**
+ * Enforce a hard cap on the LIMIT clause of a caller-supplied SOQL query.
+ *
+ * The cap is applied AFTER stripping line and block comments and trailing
+ * whitespace, so trailing-comment/whitespace bypass attempts (LIMIT 5000
+ * followed by trailing whitespace, line comments, or block comments) are
+ * neutralised. OFFSET clauses are preserved on the output side, and a
+ * caller-supplied OFFSET-without-LIMIT triggers an inserted cap.
+ *
+ * The result is a single, syntactically valid SOQL statement with exactly
+ * one `LIMIT <n>` clause where `n <= maxLimit`, and at most one trailing
+ * `OFFSET <n>` clause.
+ */
+export function applyQueryLimitCap(rawQuery, maxLimit) {
+    const cleaned = stripSoqlComments(rawQuery).trim();
+    let base = cleaned;
+    let offsetClause = '';
+    const offsetMatch = base.match(/^([\s\S]*?)\s+OFFSET\s+(\d+)\s*$/i);
+    if (offsetMatch) {
+        base = offsetMatch[1];
+        offsetClause = ` OFFSET ${offsetMatch[2]}`;
+    }
+    const limitMatch = base.match(/^([\s\S]*?)\s+LIMIT\s+(\d+)\s*$/i);
+    let head;
+    let limit;
+    if (limitMatch) {
+        head = limitMatch[1].trimEnd();
+        const current = parseInt(limitMatch[2], 10);
+        limit = Math.min(current, maxLimit);
+    }
+    else {
+        head = base.trimEnd();
+        limit = maxLimit;
+    }
+    return `${head} LIMIT ${limit}${offsetClause}`;
+}
+export function registerQueryTools(server) {
+    server.registerTool('salesforce_query', {
+        description: `Execute a raw SOQL query. For advanced queries only — prefer dedicated tools for standard operations. Max 200 records enforced.`,
+        inputSchema: z.object({
+            query: z.string().min(1).describe('SOQL query string'),
+        }),
+        annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+    }, withErrorHandling(async (args) => {
+        return withConnection(undefined, async (conn) => {
+            const MAX_LIMIT = 200;
+            const query = applyQueryLimitCap(args.query, MAX_LIMIT);
+            const result = await conn.query(query);
+            return JSON.stringify({ ok: true, records: result.records, totalSize: result.totalSize, done: result.done });
+        });
+    }));
+    server.registerTool('salesforce_describe_object', {
+        description: `Get object metadata and field definitions. Returns field names, types, and required flags. Common objects: Account, Contact, Opportunity, Lead, Case, Task.`,
+        inputSchema: z.object({
+            object_name: z.string().min(1).describe('Object API name (Account, Contact, Opportunity, Lead, CustomObject__c)'),
+        }),
+        annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+    }, withErrorHandling(async (args) => {
+        return withConnection(undefined, async (conn) => {
+            const metadata = await conn.sobject(args.object_name).describe();
+            return JSON.stringify({
+                ok: true,
+                name: metadata.name,
+                label: metadata.label,
+                labelPlural: metadata.labelPlural,
+                fields: metadata.fields.map((f) => ({
+                    name: f.name,
+                    label: f.label,
+                    type: f.type,
+                    required: !f.nillable && !f.defaultedOnCreate,
+                    updateable: f.updateable,
+                    createable: f.createable,
+                })),
+                recordTypeInfos: metadata.recordTypeInfos,
+            });
+        });
+    }));
+    server.registerTool('salesforce_list_objects', {
+        description: `List available Salesforce sObjects. Default shows custom objects only. Set custom_only=false to include standard objects.`,
+        inputSchema: z.object({
+            custom_only: z.boolean().optional().describe('Show only custom objects (default: true)'),
+        }),
+        annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+    }, withErrorHandling(async (args) => {
+        return withConnection(undefined, async (conn) => {
+            const result = await conn.describeGlobal();
+            let objects = result.sobjects.map((s) => ({
+                name: s.name,
+                label: s.label,
+                queryable: s.queryable,
+                createable: s.createable,
+                updateable: s.updateable,
+                custom: s.custom,
+            }));
+            const customOnly = args.custom_only !== false;
+            if (customOnly)
+                objects = objects.filter((o) => o.custom);
+            return JSON.stringify({ ok: true, objects, count: objects.length });
+        });
+    }));
+    server.registerTool('salesforce_create_record', {
+        description: `Generic record creation for any Salesforce object. For standard objects, prefer dedicated tools.`,
+        inputSchema: z.object({
+            object_name: z.string().min(1).describe('sObject API name (e.g., Invoice__c, Case)'),
+            fields: z.record(z.unknown()).describe('Field-value pairs to set on the new record'),
+        }),
+        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+    }, withErrorHandling(async (args) => {
+        validateObjectName(args.object_name);
+        return withConnection(undefined, async (conn) => {
+            const data = {};
+            validateAndMergeCustomFields(data, args.fields);
+            const result = await conn.sobject(args.object_name).create(data);
+            if (!result.success)
+                throw new ConnectorError(`Failed to create ${args.object_name} record`, 'CREATE_ERROR', JSON.stringify(result.errors));
+            return JSON.stringify({ ok: true, status: 'success', object: args.object_name, id: result.id });
+        });
+    }));
+    server.registerTool('salesforce_update_record', {
+        description: `Generic record update for any Salesforce object. For standard objects, prefer dedicated tools.`,
+        inputSchema: z.object({
+            object_name: z.string().min(1).describe('sObject API name'),
+            id: z.string().min(1).describe('Salesforce record ID to update'),
+            fields: z.record(z.unknown()).describe('Field-value pairs to update'),
+        }),
+        annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true },
+    }, withErrorHandling(async (args) => {
+        validateObjectName(args.object_name);
+        return withConnection(undefined, async (conn) => {
+            const updateData = { Id: args.id };
+            validateAndMergeCustomFields(updateData, args.fields);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            const result = await conn.sobject(args.object_name).update(updateData);
+            checkSaveResult(result, `Failed to update ${args.object_name} record`);
+            return JSON.stringify({ ok: true, status: 'success', object: args.object_name, id: args.id });
+        });
+    }));
+    server.registerTool('salesforce_get_records', {
+        description: `Generic record query for any Salesforce object. For standard objects, prefer dedicated get tools.`,
+        inputSchema: z.object({
+            object_name: z.string().min(1).describe('sObject API name'),
+            fields: z.array(z.string()).optional().describe('Fields to SELECT (defaults to Id)'),
+            filters: z.array(z.object({
+                field: z.string().describe('Field API name'),
+                operator: z.enum(['=', '!=', '<', '>', '<=', '>=', 'LIKE']).describe('Comparison operator'),
+                value: z.union([z.string(), z.number(), z.boolean()]).describe('Filter value'),
+            })).optional().describe('WHERE conditions (AND-joined)'),
+            limit: z.number().int().min(1).max(200).optional().describe('Max results 1-200 (default: 50)'),
+        }),
+        annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+    }, withErrorHandling(async (args) => {
+        validateObjectName(args.object_name);
+        return withConnection(undefined, async (conn) => {
+            const fields = validateFields(args.fields || [], ['Id'], isValidQueryFieldName);
+            let soql = `SELECT ${fields.join(', ')} FROM ${args.object_name}`;
+            if (args.filters && args.filters.length > 0) {
+                const conditions = [];
+                for (const filter of args.filters) {
+                    if (!isValidFieldName(filter.field)) {
+                        throw new ConnectorError(`Invalid filter field name: "${filter.field}"`, 'INVALID_FIELD_NAMES', 'Field names must be valid API names');
+                    }
+                    if (!ALLOWED_FILTER_OPERATORS.has(filter.operator)) {
+                        throw new ConnectorError(`Invalid filter operator: "${filter.operator}"`, 'INVALID_OPERATOR', `Allowed: ${[...ALLOWED_FILTER_OPERATORS].join(', ')}`);
+                    }
+                    let formattedValue;
+                    if (typeof filter.value === 'string') {
+                        formattedValue = `'${escapeSOQL(filter.value)}'`;
+                    }
+                    else {
+                        formattedValue = `${filter.value}`;
+                    }
+                    conditions.push(`${filter.field} ${filter.operator} ${formattedValue}`);
+                }
+                soql += ` WHERE ${conditions.join(' AND ')}`;
+            }
+            const limit = Math.min(Math.max(1, args.limit ?? 50), 200);
+            soql += ` LIMIT ${limit}`;
+            const result = await conn.query(soql);
+            return JSON.stringify({ ok: true, records: result.records, totalSize: result.totalSize, done: result.done });
+        });
+    }));
+}
+//# sourceMappingURL=query.js.map

package/dist/tools/tasks.d.ts

@@ -0,0 +1,3 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export declare function registerTaskTools(server: McpServer): void;
+//# sourceMappingURL=tasks.d.ts.map