@mindstone/mcp-server-salesforce 0.1.3 → 0.2.0

package/README.md

@@ -9,9 +9,9 @@ Salesforce CRM MCP server — accounts, contacts, opportunities, leads, tasks, u
 
 ## Status
 
-- **Version:** [0.1.2](./CHANGELOG.md) · [npm](https://www.npmjs.com/package/@mindstone/mcp-server-salesforce)
+- **Version:** [0.2.0](./CHANGELOG.md) · [npm](https://www.npmjs.com/package/@mindstone/mcp-server-salesforce)
 - **Auth:** OAuth (local 127.0.0.1 callback) or static access token ([`SALESFORCE_CLIENT_SECRET`](./server.json), [`SALESFORCE_ACCESS_TOKEN`](./server.json))
-- **Tools:** [26](./src/tools/) (accounts, contacts, opportunities, leads, tasks, query)
+- **Tools:** [37](./src/tools/) (accounts, contacts, opportunities, leads, tasks, cases, events, search, notes, campaigns, reports, query)
 - **Surface:** cloud-api
 - **Machine-readable:** [`STATUS.json`](./STATUS.json)
 
@@ -135,7 +135,7 @@ Then call `salesforce_connect_account` to start the OAuth flow.
 - `SALESFORCE_OAUTH_PORT` — OAuth callback port (`0` = OS-assigned; default: `0`)
 - `SALESFORCE_OAUTH_SCOPES` — Space-separated OAuth scopes. Leave unset to use the connector default.
 
-## Available Tools (26)
+## Available Tools (37)
 
 ### Account Management
 - `salesforce_connect_account` — Connect a Salesforce account via OAuth
@@ -168,6 +168,29 @@ Then call `salesforce_connect_account` to start the OAuth flow.
 - `salesforce_create_task` — Create a task
 - `salesforce_update_task` — Update a task
 
+### Cases
+- `salesforce_get_cases` — Get support cases with filters
+- `salesforce_create_case` — Create a support case
+- `salesforce_update_case` — Update a support case
+
+### Events
+- `salesforce_get_events` — Get calendar events with filters
+- `salesforce_create_event` — Create a calendar event
+
+### Search
+- `salesforce_search` — Cross-object full-text search (SOSL); the response's `truncated` flag tells you whether more matches exist beyond the limit
+
+### Notes
+- `salesforce_get_notes` — Get notes attached to a record
+- `salesforce_create_note` — Create a note, optionally attached to a record (a failed attach rolls the note back, or reports the orphaned note ID)
+
+### Campaigns
+- `salesforce_get_campaigns` — Get marketing campaigns with filters
+- `salesforce_get_campaign_members` — Get leads/contacts in a campaign
+
+### Reports
+- `salesforce_run_report` — Run an existing Salesforce report (Analytics REST API)
+
 ### Users
 - `salesforce_get_users` — Get Salesforce users
 
@@ -187,6 +210,8 @@ Then call `salesforce_connect_account` to start the OAuth flow.
 - OAuth credentials are stored under `SALESFORCE_CONFIG_DIR` (default `~/.mcp/salesforce`) with restrictive directory and file permissions.
 - Write and disconnect tools are marked so capable hosts can ask for confirmation before changing Salesforce data.
 - SOQL helper paths escape string and `LIKE` values, strip comments quote-safely before applying the query limit cap, and enforce a maximum of 200 records for raw SOQL queries.
+- Record text returned by read tools is wrapped in `<untrusted-content>` envelopes so Salesforce-authored field values are presented to the model as data, not instructions.
+- `salesforce_convert_lead` reports a conversion as failed when Salesforce rejects it at the record level (e.g. a validation rule), instead of claiming success; the org-authored error detail is enveloped the same way.
 
 ## Licence
 

package/dist/client.js

@@ -1,5 +1,5 @@
 import jsforce from 'jsforce';
-import { ConnectorError, } from './types.js';
+import { ConnectorError, SALESFORCE_API_VERSION, } from './types.js';
 import { getAuthMode, getActiveToken, loadAccounts, loadToken, saveToken, deleteToken, saveAccounts, } from './auth.js';
 // Connection cache per account
 const connections = new Map();
@@ -44,6 +44,7 @@ export async function getConnection(accountId) {
     const connectionConfig = {
         instanceUrl: tokenData.instance_url,
         accessToken: tokenData.access_token,
+        version: SALESFORCE_API_VERSION,
     };
     // Only hand jsforce a refresh token when we can also give it a way to USE
     // that token — i.e. the OAuth2 client info to build a refresh delegate.

package/dist/server.js

@@ -1,7 +1,7 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { SERVER_NAME, SERVER_VERSION } from './types.js';
 import { resolveAuthMode } from './auth.js';
-import { registerAuthTools, registerAccountTools, registerContactTools, registerOpportunityTools, registerLeadTools, registerTaskTools, registerUserTools, registerQueryTools, } from './tools/index.js';
+import { registerAuthTools, registerAccountTools, registerContactTools, registerOpportunityTools, registerLeadTools, registerTaskTools, registerCaseTools, registerEventTools, registerSearchTools, registerNoteTools, registerCampaignTools, registerReportTools, registerUserTools, registerQueryTools, } from './tools/index.js';
 export function createServer() {
     resolveAuthMode();
     const server = new McpServer({
@@ -14,6 +14,12 @@ export function createServer() {
     registerOpportunityTools(server);
     registerLeadTools(server);
     registerTaskTools(server);
+    registerCaseTools(server);
+    registerEventTools(server);
+    registerSearchTools(server);
+    registerNoteTools(server);
+    registerCampaignTools(server);
+    registerReportTools(server);
     registerUserTools(server);
     registerQueryTools(server);
     return server;

package/dist/tools/accounts.js

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { withErrorHandling, escapeSOQL, escapeSOQLLike, validateFields, validateAndMergeCustomFields, checkSaveResult } from '../utils.js';
+import { withErrorHandling, escapeSOQL, escapeSOQLLike, validateFields, validateAndMergeCustomFields, checkSaveResult, formatVendorErrors, sanitizeRecords } from '../utils.js';
 import { withConnection } from '../client.js';
 export function registerAccountTools(server) {
     server.registerTool('salesforce_get_accounts', {
@@ -29,7 +29,7 @@ export function registerAccountTools(server) {
             const limit = Math.min(Math.max(1, args.limit ?? 50), 200);
             query += ` LIMIT ${limit}`;
             const result = await conn.query(query);
-            return JSON.stringify({ ok: true, records: result.records, totalSize: result.totalSize, done: result.done });
+            return JSON.stringify({ ok: true, records: sanitizeRecords(result.records, 'salesforce:get_accounts:records'), totalSize: result.totalSize, done: result.done });
         });
     }));
     server.registerTool('salesforce_create_account', {
@@ -43,7 +43,7 @@ export function registerAccountTools(server) {
             description: z.string().optional().describe('Account description'),
             fields: z.record(z.unknown()).optional().describe('Additional/custom fields as key-value pairs'),
         }),
-        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+        annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true },
     }, withErrorHandling(async (args) => {
         return withConnection(undefined, async (conn) => {
             const data = { Name: args.name };
@@ -62,7 +62,7 @@ export function registerAccountTools(server) {
             const result = await conn.sobject('Account').create(data);
             if (!result.success) {
                 const { ConnectorError } = await import('../types.js');
-                throw new ConnectorError('Failed to create account', 'CREATE_ERROR', JSON.stringify(result.errors));
+                throw new ConnectorError('Failed to create account', 'CREATE_ERROR', formatVendorErrors(result.errors));
             }
             return JSON.stringify({ ok: true, status: 'success', object: 'Account', id: result.id, name: args.name });
         });

package/dist/tools/campaigns.d.ts

@@ -0,0 +1,3 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export declare function registerCampaignTools(server: McpServer): void;
+//# sourceMappingURL=campaigns.d.ts.map

package/dist/tools/campaigns.js

@@ -0,0 +1,78 @@
+import { z } from 'zod';
+import { withErrorHandling, escapeSOQL, escapeSOQLLike, validateFields, formatSOQLDate, sanitizeRecords } from '../utils.js';
+import { withConnection } from '../client.js';
+export function registerCampaignTools(server) {
+    server.registerTool('salesforce_get_campaigns', {
+        description: `Get marketing campaigns. Filters: name_contains, campaign_type, status, is_active, start_date_from, start_date_to. Returns: Id, Name, Type, Status, IsActive, StartDate, EndDate, Description. Max 200 (default: 50).`,
+        inputSchema: z.object({
+            limit: z.number().int().min(1).max(200).optional().describe('Max results 1-200 (default: 50)'),
+            name_contains: z.string().optional().describe('Filter by name (case-insensitive)'),
+            campaign_type: z.string().optional().describe('Filter by type (Email, Webinar, Advertisement)'),
+            status: z.string().optional().describe('Filter by status (Planned, In Progress, Completed)'),
+            is_active: z.boolean().optional().describe('Filter by active status'),
+            start_date_from: z.string().optional().describe('Campaigns starting on/after date (YYYY-MM-DD)'),
+            start_date_to: z.string().optional().describe('Campaigns starting on/before date (YYYY-MM-DD)'),
+            fields: z.array(z.string()).optional().describe('Custom fields (must be valid API names)'),
+        }),
+        annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+    }, withErrorHandling(async (args) => {
+        return withConnection(undefined, async (conn) => {
+            const defaultFields = ['Id', 'Name', 'Type', 'Status', 'IsActive', 'StartDate', 'EndDate', 'Description'];
+            const fields = validateFields(args.fields || [], defaultFields);
+            let query = `SELECT ${fields.join(', ')} FROM Campaign`;
+            const conditions = [];
+            if (args.name_contains)
+                conditions.push(`Name LIKE '%${escapeSOQLLike(args.name_contains)}%'`);
+            if (args.campaign_type)
+                conditions.push(`Type = '${escapeSOQL(args.campaign_type)}'`);
+            if (args.status)
+                conditions.push(`Status = '${escapeSOQL(args.status)}'`);
+            if (args.is_active !== undefined)
+                conditions.push(`IsActive = ${args.is_active}`);
+            if (args.start_date_from)
+                conditions.push(`StartDate >= ${formatSOQLDate(args.start_date_from, 'start_date_from')}`);
+            if (args.start_date_to)
+                conditions.push(`StartDate <= ${formatSOQLDate(args.start_date_to, 'start_date_to')}`);
+            if (conditions.length > 0)
+                query += ` WHERE ${conditions.join(' AND ')}`;
+            const limit = Math.min(Math.max(1, args.limit ?? 50), 200);
+            query += ` LIMIT ${limit}`;
+            const result = await conn.query(query);
+            return JSON.stringify({ ok: true, records: sanitizeRecords(result.records, 'salesforce:get_campaigns:records'), totalSize: result.totalSize });
+        });
+    }));
+    server.registerTool('salesforce_get_campaign_members', {
+        description: `Get campaign members (leads/contacts in a campaign). Filters: campaign_id, lead_id, contact_id, status. Returns: Id, CampaignId, LeadId, ContactId, Status, CreatedDate. Max 200 (default: 50).`,
+        inputSchema: z.object({
+            limit: z.number().int().min(1).max(200).optional().describe('Max results 1-200 (default: 50)'),
+            campaign_id: z.string().optional().describe('Filter by Campaign ID'),
+            lead_id: z.string().optional().describe('Filter by Lead ID'),
+            contact_id: z.string().optional().describe('Filter by Contact ID'),
+            status: z.string().optional().describe('Filter by member status (Sent, Responded)'),
+            fields: z.array(z.string()).optional().describe('Custom fields (must be valid API names)'),
+        }),
+        annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+    }, withErrorHandling(async (args) => {
+        return withConnection(undefined, async (conn) => {
+            const defaultFields = ['Id', 'CampaignId', 'LeadId', 'ContactId', 'Status', 'CreatedDate'];
+            const fields = validateFields(args.fields || [], defaultFields);
+            let query = `SELECT ${fields.join(', ')} FROM CampaignMember`;
+            const conditions = [];
+            if (args.campaign_id)
+                conditions.push(`CampaignId = '${escapeSOQL(args.campaign_id)}'`);
+            if (args.lead_id)
+                conditions.push(`LeadId = '${escapeSOQL(args.lead_id)}'`);
+            if (args.contact_id)
+                conditions.push(`ContactId = '${escapeSOQL(args.contact_id)}'`);
+            if (args.status)
+                conditions.push(`Status = '${escapeSOQL(args.status)}'`);
+            if (conditions.length > 0)
+                query += ` WHERE ${conditions.join(' AND ')}`;
+            const limit = Math.min(Math.max(1, args.limit ?? 50), 200);
+            query += ` LIMIT ${limit}`;
+            const result = await conn.query(query);
+            return JSON.stringify({ ok: true, records: sanitizeRecords(result.records, 'salesforce:get_campaign_members:records'), totalSize: result.totalSize });
+        });
+    }));
+}
+//# sourceMappingURL=campaigns.js.map

package/dist/tools/cases.d.ts

@@ -0,0 +1,3 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export declare function registerCaseTools(server: McpServer): void;
+//# sourceMappingURL=cases.d.ts.map

package/dist/tools/cases.js

@@ -0,0 +1,121 @@
+import { z } from 'zod';
+import { withErrorHandling, escapeSOQL, escapeSOQLLike, validateFields, validateAndMergeCustomFields, checkSaveResult, formatVendorErrors, sanitizeRecords } from '../utils.js';
+import { withConnection } from '../client.js';
+import { ConnectorError } from '../types.js';
+export function registerCaseTools(server) {
+    server.registerTool('salesforce_get_cases', {
+        description: `Get support cases. Filters: subject_contains, status, priority, related_account_id, related_contact_id, is_closed. Returns: Id, CaseNumber, Subject, Status, Priority, Origin, Description, AccountId, ContactId, OwnerId, CreatedDate, ClosedDate. Max 200 (default: 50).`,
+        inputSchema: z.object({
+            limit: z.number().int().min(1).max(200).optional().describe('Max results 1-200 (default: 50)'),
+            subject_contains: z.string().optional().describe('Filter by subject (case-insensitive)'),
+            status: z.string().optional().describe('Filter by status (New, Working, Escalated, Closed)'),
+            priority: z.string().optional().describe('Filter by priority (High, Medium, Low)'),
+            related_account_id: z.string().optional().describe('Filter by Account ID'),
+            related_contact_id: z.string().optional().describe('Filter by Contact ID'),
+            is_closed: z.boolean().optional().describe('Filter by closed status'),
+            fields: z.array(z.string()).optional().describe('Custom fields (must be valid API names)'),
+        }),
+        annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+    }, withErrorHandling(async (args) => {
+        return withConnection(undefined, async (conn) => {
+            const defaultFields = ['Id', 'CaseNumber', 'Subject', 'Status', 'Priority', 'Origin', 'Description', 'AccountId', 'ContactId', 'OwnerId', 'CreatedDate', 'ClosedDate'];
+            const fields = validateFields(args.fields || [], defaultFields);
+            let query = `SELECT ${fields.join(', ')} FROM Case`;
+            const conditions = [];
+            if (args.subject_contains)
+                conditions.push(`Subject LIKE '%${escapeSOQLLike(args.subject_contains)}%'`);
+            if (args.status)
+                conditions.push(`Status = '${escapeSOQL(args.status)}'`);
+            if (args.priority)
+                conditions.push(`Priority = '${escapeSOQL(args.priority)}'`);
+            if (args.related_account_id)
+                conditions.push(`AccountId = '${escapeSOQL(args.related_account_id)}'`);
+            if (args.related_contact_id)
+                conditions.push(`ContactId = '${escapeSOQL(args.related_contact_id)}'`);
+            if (args.is_closed !== undefined)
+                conditions.push(`IsClosed = ${args.is_closed}`);
+            if (conditions.length > 0)
+                query += ` WHERE ${conditions.join(' AND ')}`;
+            const limit = Math.min(Math.max(1, args.limit ?? 50), 200);
+            query += ` LIMIT ${limit}`;
+            const result = await conn.query(query);
+            return JSON.stringify({ ok: true, records: sanitizeRecords(result.records, 'salesforce:get_cases:records'), totalSize: result.totalSize });
+        });
+    }));
+    server.registerTool('salesforce_create_case', {
+        description: `Create a support case. Required: subject. Optional: status, priority, origin, description, related_account_id, related_contact_id, fields.`,
+        inputSchema: z.object({
+            subject: z.string().min(1).describe('Case subject (required)'),
+            status: z.string().optional().describe('Case status (default: New)'),
+            priority: z.string().optional().describe('Priority (High, Medium, Low)'),
+            origin: z.string().optional().describe('Case origin (Phone, Email, Web)'),
+            description: z.string().optional().describe('Case description'),
+            related_account_id: z.string().optional().describe('Account ID to associate with'),
+            related_contact_id: z.string().optional().describe('Contact ID to associate with'),
+            fields: z.record(z.unknown()).optional().describe('Additional/custom fields as key-value pairs'),
+        }),
+        annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true },
+    }, withErrorHandling(async (args) => {
+        return withConnection(undefined, async (conn) => {
+            const data = { Subject: args.subject };
+            if (args.status)
+                data.Status = args.status;
+            if (args.priority)
+                data.Priority = args.priority;
+            if (args.origin)
+                data.Origin = args.origin;
+            if (args.description)
+                data.Description = args.description;
+            if (args.related_account_id)
+                data.AccountId = args.related_account_id;
+            if (args.related_contact_id)
+                data.ContactId = args.related_contact_id;
+            if (args.fields)
+                validateAndMergeCustomFields(data, args.fields);
+            const result = await conn.sobject('Case').create(data);
+            if (!result.success)
+                throw new ConnectorError('Failed to create case', 'CREATE_ERROR', formatVendorErrors(result.errors));
+            return JSON.stringify({ ok: true, status: 'success', object: 'Case', id: result.id, subject: args.subject });
+        });
+    }));
+    server.registerTool('salesforce_update_case', {
+        description: `Update a support case. Required: id. Updatable: subject, status, priority, origin, description, related_account_id, related_contact_id, fields.`,
+        inputSchema: z.object({
+            id: z.string().min(1).describe('Salesforce Case ID (required)'),
+            subject: z.string().optional().describe('Case subject'),
+            status: z.string().optional().describe('Case status (e.g., Working, Escalated, Closed)'),
+            priority: z.string().optional().describe('Priority (High, Medium, Low)'),
+            origin: z.string().optional().describe('Case origin'),
+            description: z.string().optional().describe('Description'),
+            related_account_id: z.string().optional().describe('Account ID to associate with'),
+            related_contact_id: z.string().optional().describe('Contact ID to associate with'),
+            fields: z.record(z.unknown()).optional().describe('Additional/custom fields as key-value pairs'),
+        }),
+        annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true },
+    }, withErrorHandling(async (args) => {
+        return withConnection(undefined, async (conn) => {
+            const updateData = { Id: args.id };
+            if (args.subject)
+                updateData.Subject = args.subject;
+            if (args.status)
+                updateData.Status = args.status;
+            if (args.priority)
+                updateData.Priority = args.priority;
+            if (args.origin)
+                updateData.Origin = args.origin;
+            if (args.description)
+                updateData.Description = args.description;
+            if (args.related_account_id)
+                updateData.AccountId = args.related_account_id;
+            if (args.related_contact_id)
+                updateData.ContactId = args.related_contact_id;
+            if (args.fields)
+                validateAndMergeCustomFields(updateData, args.fields);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            const result = await conn.sobject('Case').update(updateData);
+            checkSaveResult(result, 'Failed to update case');
+            return JSON.stringify({ ok: true, status: 'success', object: 'Case', id: args.id });
+        });
+    }));
+}
+//# sourceMappingURL=cases.js.map

package/dist/tools/contacts.js

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { withErrorHandling, escapeSOQL, escapeSOQLLike, validateFields, validateAndMergeCustomFields, checkSaveResult } from '../utils.js';
+import { withErrorHandling, escapeSOQL, escapeSOQLLike, validateFields, validateAndMergeCustomFields, checkSaveResult, formatVendorErrors, sanitizeRecords } from '../utils.js';
 import { withConnection } from '../client.js';
 import { ConnectorError } from '../types.js';
 export function registerContactTools(server) {
@@ -32,7 +32,7 @@ export function registerContactTools(server) {
             const limit = Math.min(Math.max(1, args.limit ?? 50), 200);
             query += ` LIMIT ${limit}`;
             const result = await conn.query(query);
-            return JSON.stringify({ ok: true, records: result.records, totalSize: result.totalSize });
+            return JSON.stringify({ ok: true, records: sanitizeRecords(result.records, 'salesforce:get_contacts:records'), totalSize: result.totalSize });
         });
     }));
     server.registerTool('salesforce_create_contact', {
@@ -46,7 +46,7 @@ export function registerContactTools(server) {
             related_account_id: z.string().optional().describe('Account ID to associate with'),
             fields: z.record(z.unknown()).optional().describe('Additional/custom fields as key-value pairs'),
         }),
-        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+        annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true },
     }, withErrorHandling(async (args) => {
         return withConnection(undefined, async (conn) => {
             const data = { LastName: args.last_name };
@@ -64,7 +64,7 @@ export function registerContactTools(server) {
                 validateAndMergeCustomFields(data, args.fields);
             const result = await conn.sobject('Contact').create(data);
             if (!result.success)
-                throw new ConnectorError('Failed to create contact', 'CREATE_ERROR', JSON.stringify(result.errors));
+                throw new ConnectorError('Failed to create contact', 'CREATE_ERROR', formatVendorErrors(result.errors));
             return JSON.stringify({ ok: true, status: 'success', object: 'Contact', id: result.id, name: `${args.first_name || ''} ${args.last_name}`.trim() });
         });
     }));

package/dist/tools/events.d.ts

@@ -0,0 +1,3 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export declare function registerEventTools(server: McpServer): void;
+//# sourceMappingURL=events.d.ts.map

package/dist/tools/events.js

@@ -0,0 +1,90 @@
+import { z } from 'zod';
+import { withErrorHandling, escapeSOQL, escapeSOQLLike, validateFields, validateAndMergeCustomFields, formatSOQLDateTime, formatVendorErrors, sanitizeRecords } from '../utils.js';
+import { withConnection } from '../client.js';
+import { ConnectorError } from '../types.js';
+export function registerEventTools(server) {
+    server.registerTool('salesforce_get_events', {
+        description: `Get calendar events. Filters: subject_contains, who_id, what_id, start_from, start_to. Dates accept YYYY-MM-DD (midnight UTC) or ISO 8601 datetimes. Returns: Id, Subject, StartDateTime, EndDateTime, Location, Description, WhoId, WhatId, OwnerId, IsAllDayEvent. Max 200 (default: 50).`,
+        inputSchema: z.object({
+            limit: z.number().int().min(1).max(200).optional().describe('Max results 1-200 (default: 50)'),
+            subject_contains: z.string().optional().describe('Filter by subject (case-insensitive)'),
+            who_id: z.string().optional().describe('Filter by WhoId (Contact or Lead ID)'),
+            what_id: z.string().optional().describe('Filter by WhatId (Account or Opportunity ID)'),
+            start_from: z.string().optional().describe('Events starting on/after this date or datetime (YYYY-MM-DD or ISO 8601; see tool description for an example)'),
+            start_to: z.string().optional().describe('Events starting on/before this date or datetime (YYYY-MM-DD or ISO 8601)'),
+            fields: z.array(z.string()).optional().describe('Custom fields (must be valid API names)'),
+        }),
+        annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+    }, withErrorHandling(async (args) => {
+        return withConnection(undefined, async (conn) => {
+            const defaultFields = ['Id', 'Subject', 'StartDateTime', 'EndDateTime', 'Location', 'Description', 'WhoId', 'WhatId', 'OwnerId', 'IsAllDayEvent'];
+            const fields = validateFields(args.fields || [], defaultFields);
+            let query = `SELECT ${fields.join(', ')} FROM Event`;
+            const conditions = [];
+            if (args.subject_contains)
+                conditions.push(`Subject LIKE '%${escapeSOQLLike(args.subject_contains)}%'`);
+            if (args.who_id)
+                conditions.push(`WhoId = '${escapeSOQL(args.who_id)}'`);
+            if (args.what_id)
+                conditions.push(`WhatId = '${escapeSOQL(args.what_id)}'`);
+            if (args.start_from)
+                conditions.push(`StartDateTime >= ${formatSOQLDateTime(args.start_from, 'start_from')}`);
+            if (args.start_to)
+                conditions.push(`StartDateTime <= ${formatSOQLDateTime(args.start_to, 'start_to')}`);
+            if (conditions.length > 0)
+                query += ` WHERE ${conditions.join(' AND ')}`;
+            query += ' ORDER BY StartDateTime ASC';
+            const limit = Math.min(Math.max(1, args.limit ?? 50), 200);
+            query += ` LIMIT ${limit}`;
+            const result = await conn.query(query);
+            return JSON.stringify({ ok: true, records: sanitizeRecords(result.records, 'salesforce:get_events:records'), totalSize: result.totalSize });
+        });
+    }));
+    server.registerTool('salesforce_create_event', {
+        description: `Create a calendar event. Required: subject, start_date_time, end_date_time. Optional: location, description, who_id, what_id, is_all_day_event, owner_id, fields. Datetimes must be ISO 8601 (e.g. "2026-01-09T14:30:00Z"); all-day events accept plain dates (YYYY-MM-DD).`,
+        inputSchema: z.object({
+            subject: z.string().min(1).describe('Event subject (required)'),
+            start_date_time: z.string().min(1).describe('Start (required) — ISO 8601 datetime (see tool description for an example), or YYYY-MM-DD for all-day events'),
+            end_date_time: z.string().min(1).describe('End (required) — ISO 8601 datetime, or YYYY-MM-DD for all-day events'),
+            location: z.string().optional().describe('Event location'),
+            description: z.string().optional().describe('Event description'),
+            who_id: z.string().optional().describe('Contact or Lead ID to invite/relate'),
+            what_id: z.string().optional().describe('Account or Opportunity ID to relate'),
+            is_all_day_event: z.boolean().optional().describe('All-day event (default: false)'),
+            owner_id: z.string().optional().describe('Owner User ID'),
+            fields: z.record(z.unknown()).optional().describe('Additional/custom fields as key-value pairs'),
+        }),
+        annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true },
+    }, withErrorHandling(async (args) => {
+        // Validate formats up front for actionable errors; the validated values
+        // go into the create body verbatim (JSON body — no SOQL injection surface).
+        formatSOQLDateTime(args.start_date_time, 'start_date_time');
+        formatSOQLDateTime(args.end_date_time, 'end_date_time');
+        return withConnection(undefined, async (conn) => {
+            const data = {
+                Subject: args.subject,
+                StartDateTime: args.start_date_time,
+                EndDateTime: args.end_date_time,
+            };
+            if (args.location)
+                data.Location = args.location;
+            if (args.description)
+                data.Description = args.description;
+            if (args.who_id)
+                data.WhoId = args.who_id;
+            if (args.what_id)
+                data.WhatId = args.what_id;
+            if (args.is_all_day_event !== undefined)
+                data.IsAllDayEvent = args.is_all_day_event;
+            if (args.owner_id)
+                data.OwnerId = args.owner_id;
+            if (args.fields)
+                validateAndMergeCustomFields(data, args.fields);
+            const result = await conn.sobject('Event').create(data);
+            if (!result.success)
+                throw new ConnectorError('Failed to create event', 'CREATE_ERROR', formatVendorErrors(result.errors));
+            return JSON.stringify({ ok: true, status: 'success', object: 'Event', id: result.id, subject: args.subject });
+        });
+    }));
+}
+//# sourceMappingURL=events.js.map

package/dist/tools/index.d.ts

@@ -4,6 +4,12 @@ export { registerContactTools } from './contacts.js';
 export { registerOpportunityTools } from './opportunities.js';
 export { registerLeadTools } from './leads.js';
 export { registerTaskTools } from './tasks.js';
+export { registerCaseTools } from './cases.js';
+export { registerEventTools } from './events.js';
+export { registerSearchTools } from './search.js';
+export { registerNoteTools } from './notes.js';
+export { registerCampaignTools } from './campaigns.js';
+export { registerReportTools } from './reports.js';
 export { registerUserTools } from './users.js';
 export { registerQueryTools } from './query.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/tools/index.js

@@ -4,6 +4,12 @@ export { registerContactTools } from './contacts.js';
 export { registerOpportunityTools } from './opportunities.js';
 export { registerLeadTools } from './leads.js';
 export { registerTaskTools } from './tasks.js';
+export { registerCaseTools } from './cases.js';
+export { registerEventTools } from './events.js';
+export { registerSearchTools } from './search.js';
+export { registerNoteTools } from './notes.js';
+export { registerCampaignTools } from './campaigns.js';
+export { registerReportTools } from './reports.js';
 export { registerUserTools } from './users.js';
 export { registerQueryTools } from './query.js';
 //# sourceMappingURL=index.js.map

package/dist/tools/leads.js

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { withErrorHandling, escapeSOQL, escapeSOQLLike, validateFields, validateAndMergeCustomFields, checkSaveResult } from '../utils.js';
+import { withErrorHandling, escapeSOQL, escapeSOQLLike, validateFields, validateAndMergeCustomFields, checkSaveResult, formatVendorErrors, sanitizeRecords, sanitizeExternalData } from '../utils.js';
 import { withConnection } from '../client.js';
 import { ConnectorError } from '../types.js';
 export function registerLeadTools(server) {
@@ -35,7 +35,7 @@ export function registerLeadTools(server) {
             const limit = Math.min(Math.max(1, args.limit ?? 50), 200);
             query += ` LIMIT ${limit}`;
             const result = await conn.query(query);
-            return JSON.stringify({ ok: true, records: result.records, totalSize: result.totalSize });
+            return JSON.stringify({ ok: true, records: sanitizeRecords(result.records, 'salesforce:get_leads:records'), totalSize: result.totalSize });
         });
     }));
     server.registerTool('salesforce_create_lead', {
@@ -50,7 +50,7 @@ export function registerLeadTools(server) {
             status: z.string().optional().describe('Lead status'),
             fields: z.record(z.unknown()).optional().describe('Additional/custom fields'),
         }),
-        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+        annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true },
     }, withErrorHandling(async (args) => {
         return withConnection(undefined, async (conn) => {
             const data = { LastName: args.last_name, Company: args.company };
@@ -68,7 +68,7 @@ export function registerLeadTools(server) {
                 validateAndMergeCustomFields(data, args.fields);
             const result = await conn.sobject('Lead').create(data);
             if (!result.success)
-                throw new ConnectorError('Failed to create lead', 'CREATE_ERROR', JSON.stringify(result.errors));
+                throw new ConnectorError('Failed to create lead', 'CREATE_ERROR', formatVendorErrors(result.errors));
             return JSON.stringify({ ok: true, status: 'success', object: 'Lead', id: result.id, name: `${args.first_name || ''} ${args.last_name}`.trim() });
         });
     }));
@@ -79,7 +79,7 @@ export function registerLeadTools(server) {
             create_opportunity: z.boolean().optional().describe('Create opportunity (default: true)'),
             opportunity_name: z.string().optional().describe('Name for new opportunity'),
         }),
-        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+        annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true },
     }, withErrorHandling(async (args) => {
         return withConnection(undefined, async (conn) => {
             const leadConvert = {
@@ -87,9 +87,17 @@ export function registerLeadTools(server) {
                 convertedStatus: 'Closed - Converted',
                 doNotCreateOpportunity: args.create_opportunity === false,
             };
-            const result = await conn
-                .soap.convertLead([leadConvert]);
-            return JSON.stringify({ ok: true, status: 'success', result: result[0] });
+            const result = await conn.soap.convertLead([leadConvert]);
+            const convertResult = result[0];
+            // SOAP convertLead reports record-level failures IN THE RESULT
+            // (success:false + errors[]), not as a fault — checking success is the
+            // only way to avoid reporting a conversion that never happened. The
+            // error messages are org-authored validation-rule text, so they are
+            // enveloped like every other vendor error (invariant #6).
+            if (!convertResult.success) {
+                throw new ConnectorError('Failed to convert lead', 'CONVERT_ERROR', formatVendorErrors(convertResult.errors));
+            }
+            return JSON.stringify({ ok: true, status: 'success', result: sanitizeExternalData(convertResult, 'salesforce:convert_lead:result') });
         });
     }));
     server.registerTool('salesforce_update_lead', {

package/dist/tools/notes.d.ts

@@ -0,0 +1,3 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export declare function registerNoteTools(server: McpServer): void;
+//# sourceMappingURL=notes.d.ts.map