@mindstone/mcp-server-salesforce 0.1.3 → 0.2.1

package/README.md

@@ -9,9 +9,9 @@ Salesforce CRM MCP server — accounts, contacts, opportunities, leads, tasks, u
 
 ## Status
 
-- **Version:** [0.1.2](./CHANGELOG.md) · [npm](https://www.npmjs.com/package/@mindstone/mcp-server-salesforce)
+- **Version:** [0.2.1](./CHANGELOG.md) · [npm](https://www.npmjs.com/package/@mindstone/mcp-server-salesforce)
 - **Auth:** OAuth (local 127.0.0.1 callback) or static access token ([`SALESFORCE_CLIENT_SECRET`](./server.json), [`SALESFORCE_ACCESS_TOKEN`](./server.json))
-- **Tools:** [26](./src/tools/) (accounts, contacts, opportunities, leads, tasks, query)
+- **Tools:** [37](./src/tools/) (accounts, contacts, opportunities, leads, tasks, cases, events, search, notes, campaigns, reports, query)
 - **Surface:** cloud-api
 - **Machine-readable:** [`STATUS.json`](./STATUS.json)
 
@@ -135,7 +135,7 @@ Then call `salesforce_connect_account` to start the OAuth flow.
 - `SALESFORCE_OAUTH_PORT` — OAuth callback port (`0` = OS-assigned; default: `0`)
 - `SALESFORCE_OAUTH_SCOPES` — Space-separated OAuth scopes. Leave unset to use the connector default.
 
-## Available Tools (26)
+## Available Tools (37)
 
 ### Account Management
 - `salesforce_connect_account` — Connect a Salesforce account via OAuth
@@ -168,6 +168,29 @@ Then call `salesforce_connect_account` to start the OAuth flow.
 - `salesforce_create_task` — Create a task
 - `salesforce_update_task` — Update a task
 
+### Cases
+- `salesforce_get_cases` — Get support cases with filters
+- `salesforce_create_case` — Create a support case
+- `salesforce_update_case` — Update a support case
+
+### Events
+- `salesforce_get_events` — Get calendar events with filters
+- `salesforce_create_event` — Create a calendar event
+
+### Search
+- `salesforce_search` — Cross-object full-text search (SOSL); the response's `truncated` flag tells you whether more matches exist beyond the limit
+
+### Notes
+- `salesforce_get_notes` — Get notes attached to a record
+- `salesforce_create_note` — Create a note, optionally attached to a record (a failed attach rolls the note back, or reports the orphaned note ID)
+
+### Campaigns
+- `salesforce_get_campaigns` — Get marketing campaigns with filters
+- `salesforce_get_campaign_members` — Get leads/contacts in a campaign
+
+### Reports
+- `salesforce_run_report` — Run an existing Salesforce report (Analytics REST API)
+
 ### Users
 - `salesforce_get_users` — Get Salesforce users
 
@@ -187,6 +210,8 @@ Then call `salesforce_connect_account` to start the OAuth flow.
 - OAuth credentials are stored under `SALESFORCE_CONFIG_DIR` (default `~/.mcp/salesforce`) with restrictive directory and file permissions.
 - Write and disconnect tools are marked so capable hosts can ask for confirmation before changing Salesforce data.
 - SOQL helper paths escape string and `LIKE` values, strip comments quote-safely before applying the query limit cap, and enforce a maximum of 200 records for raw SOQL queries.
+- Record text returned by read tools is wrapped in `<untrusted-content>` envelopes so Salesforce-authored field values are presented to the model as data, not instructions.
+- `salesforce_convert_lead` reports a conversion as failed when Salesforce rejects it at the record level (e.g. a validation rule), instead of claiming success; the org-authored error detail is enveloped the same way.
 
 ## Licence
 

package/dist/client.js

@@ -1,5 +1,5 @@
 import jsforce from 'jsforce';
-import { ConnectorError, } from './types.js';
+import { ConnectorError, SALESFORCE_API_VERSION, } from './types.js';
 import { getAuthMode, getActiveToken, loadAccounts, loadToken, saveToken, deleteToken, saveAccounts, } from './auth.js';
 // Connection cache per account
 const connections = new Map();
@@ -44,6 +44,7 @@ export async function getConnection(accountId) {
     const connectionConfig = {
         instanceUrl: tokenData.instance_url,
         accessToken: tokenData.access_token,
+        version: SALESFORCE_API_VERSION,
     };
     // Only hand jsforce a refresh token when we can also give it a way to USE
     // that token — i.e. the OAuth2 client info to build a refresh delegate.

package/dist/server.js

@@ -1,7 +1,7 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { SERVER_NAME, SERVER_VERSION } from './types.js';
 import { resolveAuthMode } from './auth.js';
-import { registerAuthTools, registerAccountTools, registerContactTools, registerOpportunityTools, registerLeadTools, registerTaskTools, registerUserTools, registerQueryTools, } from './tools/index.js';
+import { registerAuthTools, registerAccountTools, registerContactTools, registerOpportunityTools, registerLeadTools, registerTaskTools, registerCaseTools, registerEventTools, registerSearchTools, registerNoteTools, registerCampaignTools, registerReportTools, registerUserTools, registerQueryTools, } from './tools/index.js';
 export function createServer() {
     resolveAuthMode();
     const server = new McpServer({
@@ -14,6 +14,12 @@ export function createServer() {
     registerOpportunityTools(server);
     registerLeadTools(server);
     registerTaskTools(server);
+    registerCaseTools(server);
+    registerEventTools(server);
+    registerSearchTools(server);
+    registerNoteTools(server);
+    registerCampaignTools(server);
+    registerReportTools(server);
     registerUserTools(server);
     registerQueryTools(server);
     return server;

package/dist/tools/accounts.js

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { withErrorHandling, escapeSOQL, escapeSOQLLike, validateFields, validateAndMergeCustomFields, checkSaveResult } from '../utils.js';
+import { withErrorHandling, escapeSOQL, escapeSOQLLike, validateFields, validateAndMergeCustomFields, checkSaveResult, formatVendorErrors, sanitizeRecords } from '../utils.js';
 import { withConnection } from '../client.js';
 export function registerAccountTools(server) {
     server.registerTool('salesforce_get_accounts', {
@@ -29,7 +29,7 @@ export function registerAccountTools(server) {
             const limit = Math.min(Math.max(1, args.limit ?? 50), 200);
             query += ` LIMIT ${limit}`;
             const result = await conn.query(query);
-            return JSON.stringify({ ok: true, records: result.records, totalSize: result.totalSize, done: result.done });
+            return JSON.stringify({ ok: true, records: sanitizeRecords(result.records, 'salesforce:get_accounts:records'), totalSize: result.totalSize, done: result.done });
         });
     }));
     server.registerTool('salesforce_create_account', {
@@ -43,7 +43,7 @@ export function registerAccountTools(server) {
             description: z.string().optional().describe('Account description'),
             fields: z.record(z.unknown()).optional().describe('Additional/custom fields as key-value pairs'),
         }),
-        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+        annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true },
     }, withErrorHandling(async (args) => {
         return withConnection(undefined, async (conn) => {
             const data = { Name: args.name };
@@ -62,7 +62,7 @@ export function registerAccountTools(server) {
             const result = await conn.sobject('Account').create(data);
             if (!result.success) {
                 const { ConnectorError } = await import('../types.js');
-                throw new ConnectorError('Failed to create account', 'CREATE_ERROR', JSON.stringify(result.errors));
+                throw new ConnectorError('Failed to create account', 'CREATE_ERROR', formatVendorErrors(result.errors));
             }
             return JSON.stringify({ ok: true, status: 'success', object: 'Account', id: result.id, name: args.name });
         });

package/dist/tools/auth-tools.js

@@ -1,8 +1,19 @@
+import { createHash } from 'node:crypto';
 import { z } from 'zod';
-import { withErrorHandling } from '../utils.js';
+import { withErrorHandling, sanitizeExternalData } from '../utils.js';
 import { getAuthMode, loadToken, startStandaloneOAuth } from '../auth.js';
 import { bridgeRequest } from '../bridge.js';
 import { listConnectedAccounts, removeAccount } from '../client.js';
+// Disconnect needs a raw handle the model can copy verbatim into
+// salesforce_disconnect_account, but the storage id is username-derived
+// (sanitizeFilename) — passing it through raw would re-open the very channel
+// the envelopes below close. Instead the account list exposes a
+// connector-authored `ref` (truncated hash of the storage id): stable across
+// calls, shaped like data, and containing zero external text.
+function accountRef(accountId) {
+    return `acct_${createHash('sha256').update(String(accountId)).digest('hex').slice(0, 12)}`;
+}
+const ACCOUNT_REF_SHAPE = /^acct_[0-9a-f]{12}$/;
 export function registerAuthTools(server) {
     server.registerTool('salesforce_connect_account', {
         description: `Connect a Salesforce account via OAuth. Takes no parameters — call with {}.
@@ -41,34 +52,40 @@ After connecting, verify with salesforce_list_connected_accounts.`,
         if (mode === 'bridge') {
             const result = await bridgeRequest(process.env.MCP_BRIDGE_CONFIGURE_ENDPOINT || '/mcp/configure', {});
             if (result.success) {
+                // The bridge username is host/org-authored external text: envelope
+                // it before it reaches model-visible output (AGENTS.md invariant #6).
+                const username = result.username ? sanitizeExternalData(result.username, 'salesforce:auth') : undefined;
                 return JSON.stringify({
                     ok: true,
                     status: 'authenticated',
-                    message: `Successfully connected Salesforce account${result.username ? `: ${result.username}` : ''}`,
-                    username: result.username,
+                    message: `Successfully connected Salesforce account${username ? `: ${username}` : ''}`,
+                    username,
                     next_step: 'You can now use Salesforce tools. Try salesforce_list_connected_accounts to verify.',
                 });
             }
             return JSON.stringify({
                 ok: false,
-                error: result.error || 'Failed to authenticate with Salesforce',
+                error: result.error
+                    ? sanitizeExternalData(result.error, 'salesforce:auth')
+                    : 'Failed to authenticate with Salesforce',
                 action_required: 'Please try calling salesforce_connect_account again.',
             });
         }
         // standalone_oauth
         const result = await startStandaloneOAuth();
         if (result.success) {
+            const username = result.username ? sanitizeExternalData(result.username, 'salesforce:auth') : undefined;
             return JSON.stringify({
                 ok: true,
                 status: 'authenticated',
-                message: `Successfully connected Salesforce account${result.username ? `: ${result.username}` : ''}`,
-                username: result.username,
+                message: `Successfully connected Salesforce account${username ? `: ${username}` : ''}`,
+                username,
                 next_step: 'You can now use Salesforce tools. Try salesforce_list_connected_accounts to verify.',
             });
         }
         return JSON.stringify({
             ok: false,
-            error: result.error || 'Failed to authenticate',
+            error: result.error ? sanitizeExternalData(result.error, 'salesforce:auth') : 'Failed to authenticate',
             action_required: 'Please try calling salesforce_connect_account again.',
         });
     }));
@@ -127,11 +144,15 @@ This MCP instance operates on a single Salesforce account. If no account is conn
             const hasValidToken = token && (token.expires_at ?? 0) > Date.now();
             const hasRefresh = token && !!token.refresh_token;
             return {
-                username: a.username,
-                instance_url: a.instance_url,
+                // Connector-authored raw handle for salesforce_disconnect_account
+                // (the storage id stays internal — it is username-derived and would
+                // re-open the channel the envelopes below close).
+                ref: accountRef(a.id),
+                username: a.username ? sanitizeExternalData(a.username, 'salesforce:auth') : a.username,
+                instance_url: a.instance_url ? sanitizeExternalData(a.instance_url, 'salesforce:auth') : a.instance_url,
                 is_sandbox: a.is_sandbox,
                 status: hasValidToken || hasRefresh ? 'active' : 'expired',
-                connected_at: a.connected_at,
+                connected_at: a.connected_at ? sanitizeExternalData(a.connected_at, 'salesforce:auth') : a.connected_at,
             };
         });
         return JSON.stringify({
@@ -145,9 +166,10 @@ This MCP instance operates on a single Salesforce account. If no account is conn
     server.registerTool('salesforce_disconnect_account', {
         description: `Disconnect a Salesforce account. Example: { "username": "user@company.com" }
 
+Accepts the account \`ref\` from salesforce_list_connected_accounts as well as the raw username.
 Permanently removes stored credentials. Use when switching accounts or troubleshooting.`,
         inputSchema: z.object({
-            username: z.string().min(1).describe('Username of the account to disconnect'),
+            username: z.string().min(1).describe('Username or account ref of the account to disconnect'),
         }),
         annotations: {
             readOnlyHint: false,
@@ -166,7 +188,20 @@ Permanently removes stored credentials. Use when switching accounts or troublesh
                     : 'No accounts to disconnect — set up authentication first.',
             });
         }
-        removeAccount(args.username);
+        // Resolve a connector-authored `ref` back to the storage id.
+        let usernameOrId = args.username;
+        if (ACCOUNT_REF_SHAPE.test(usernameOrId)) {
+            const match = listConnectedAccounts().find((a) => accountRef(a.id) === usernameOrId);
+            if (!match) {
+                return JSON.stringify({
+                    ok: false,
+                    error: `Account not found: ${usernameOrId}`,
+                    resolution: 'Use salesforce_list_connected_accounts to see connected accounts.',
+                });
+            }
+            usernameOrId = match.id;
+        }
+        removeAccount(usernameOrId);
         return JSON.stringify({
             ok: true,
             message: `Disconnected Salesforce account: ${args.username}`,

package/dist/tools/campaigns.d.ts

@@ -0,0 +1,3 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export declare function registerCampaignTools(server: McpServer): void;
+//# sourceMappingURL=campaigns.d.ts.map

package/dist/tools/campaigns.js

@@ -0,0 +1,78 @@
+import { z } from 'zod';
+import { withErrorHandling, escapeSOQL, escapeSOQLLike, validateFields, formatSOQLDate, sanitizeRecords } from '../utils.js';
+import { withConnection } from '../client.js';
+export function registerCampaignTools(server) {
+    server.registerTool('salesforce_get_campaigns', {
+        description: `Get marketing campaigns. Filters: name_contains, campaign_type, status, is_active, start_date_from, start_date_to. Returns: Id, Name, Type, Status, IsActive, StartDate, EndDate, Description. Max 200 (default: 50).`,
+        inputSchema: z.object({
+            limit: z.number().int().min(1).max(200).optional().describe('Max results 1-200 (default: 50)'),
+            name_contains: z.string().optional().describe('Filter by name (case-insensitive)'),
+            campaign_type: z.string().optional().describe('Filter by type (Email, Webinar, Advertisement)'),
+            status: z.string().optional().describe('Filter by status (Planned, In Progress, Completed)'),
+            is_active: z.boolean().optional().describe('Filter by active status'),
+            start_date_from: z.string().optional().describe('Campaigns starting on/after date (YYYY-MM-DD)'),
+            start_date_to: z.string().optional().describe('Campaigns starting on/before date (YYYY-MM-DD)'),
+            fields: z.array(z.string()).optional().describe('Custom fields (must be valid API names)'),
+        }),
+        annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+    }, withErrorHandling(async (args) => {
+        return withConnection(undefined, async (conn) => {
+            const defaultFields = ['Id', 'Name', 'Type', 'Status', 'IsActive', 'StartDate', 'EndDate', 'Description'];
+            const fields = validateFields(args.fields || [], defaultFields);
+            let query = `SELECT ${fields.join(', ')} FROM Campaign`;
+            const conditions = [];
+            if (args.name_contains)
+                conditions.push(`Name LIKE '%${escapeSOQLLike(args.name_contains)}%'`);
+            if (args.campaign_type)
+                conditions.push(`Type = '${escapeSOQL(args.campaign_type)}'`);
+            if (args.status)
+                conditions.push(`Status = '${escapeSOQL(args.status)}'`);
+            if (args.is_active !== undefined)
+                conditions.push(`IsActive = ${args.is_active}`);
+            if (args.start_date_from)
+                conditions.push(`StartDate >= ${formatSOQLDate(args.start_date_from, 'start_date_from')}`);
+            if (args.start_date_to)
+                conditions.push(`StartDate <= ${formatSOQLDate(args.start_date_to, 'start_date_to')}`);
+            if (conditions.length > 0)
+                query += ` WHERE ${conditions.join(' AND ')}`;
+            const limit = Math.min(Math.max(1, args.limit ?? 50), 200);
+            query += ` LIMIT ${limit}`;
+            const result = await conn.query(query);
+            return JSON.stringify({ ok: true, records: sanitizeRecords(result.records, 'salesforce:get_campaigns:records'), totalSize: result.totalSize });
+        });
+    }));
+    server.registerTool('salesforce_get_campaign_members', {
+        description: `Get campaign members (leads/contacts in a campaign). Filters: campaign_id, lead_id, contact_id, status. Returns: Id, CampaignId, LeadId, ContactId, Status, CreatedDate. Max 200 (default: 50).`,
+        inputSchema: z.object({
+            limit: z.number().int().min(1).max(200).optional().describe('Max results 1-200 (default: 50)'),
+            campaign_id: z.string().optional().describe('Filter by Campaign ID'),
+            lead_id: z.string().optional().describe('Filter by Lead ID'),
+            contact_id: z.string().optional().describe('Filter by Contact ID'),
+            status: z.string().optional().describe('Filter by member status (Sent, Responded)'),
+            fields: z.array(z.string()).optional().describe('Custom fields (must be valid API names)'),
+        }),
+        annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+    }, withErrorHandling(async (args) => {
+        return withConnection(undefined, async (conn) => {
+            const defaultFields = ['Id', 'CampaignId', 'LeadId', 'ContactId', 'Status', 'CreatedDate'];
+            const fields = validateFields(args.fields || [], defaultFields);
+            let query = `SELECT ${fields.join(', ')} FROM CampaignMember`;
+            const conditions = [];
+            if (args.campaign_id)
+                conditions.push(`CampaignId = '${escapeSOQL(args.campaign_id)}'`);
+            if (args.lead_id)
+                conditions.push(`LeadId = '${escapeSOQL(args.lead_id)}'`);
+            if (args.contact_id)
+                conditions.push(`ContactId = '${escapeSOQL(args.contact_id)}'`);
+            if (args.status)
+                conditions.push(`Status = '${escapeSOQL(args.status)}'`);
+            if (conditions.length > 0)
+                query += ` WHERE ${conditions.join(' AND ')}`;
+            const limit = Math.min(Math.max(1, args.limit ?? 50), 200);
+            query += ` LIMIT ${limit}`;
+            const result = await conn.query(query);
+            return JSON.stringify({ ok: true, records: sanitizeRecords(result.records, 'salesforce:get_campaign_members:records'), totalSize: result.totalSize });
+        });
+    }));
+}
+//# sourceMappingURL=campaigns.js.map

package/dist/tools/cases.d.ts

@@ -0,0 +1,3 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export declare function registerCaseTools(server: McpServer): void;
+//# sourceMappingURL=cases.d.ts.map

package/dist/tools/cases.js

@@ -0,0 +1,121 @@
+import { z } from 'zod';
+import { withErrorHandling, escapeSOQL, escapeSOQLLike, validateFields, validateAndMergeCustomFields, checkSaveResult, formatVendorErrors, sanitizeRecords } from '../utils.js';
+import { withConnection } from '../client.js';
+import { ConnectorError } from '../types.js';
+export function registerCaseTools(server) {
+    server.registerTool('salesforce_get_cases', {
+        description: `Get support cases. Filters: subject_contains, status, priority, related_account_id, related_contact_id, is_closed. Returns: Id, CaseNumber, Subject, Status, Priority, Origin, Description, AccountId, ContactId, OwnerId, CreatedDate, ClosedDate. Max 200 (default: 50).`,
+        inputSchema: z.object({
+            limit: z.number().int().min(1).max(200).optional().describe('Max results 1-200 (default: 50)'),
+            subject_contains: z.string().optional().describe('Filter by subject (case-insensitive)'),
+            status: z.string().optional().describe('Filter by status (New, Working, Escalated, Closed)'),
+            priority: z.string().optional().describe('Filter by priority (High, Medium, Low)'),
+            related_account_id: z.string().optional().describe('Filter by Account ID'),
+            related_contact_id: z.string().optional().describe('Filter by Contact ID'),
+            is_closed: z.boolean().optional().describe('Filter by closed status'),
+            fields: z.array(z.string()).optional().describe('Custom fields (must be valid API names)'),
+        }),
+        annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+    }, withErrorHandling(async (args) => {
+        return withConnection(undefined, async (conn) => {
+            const defaultFields = ['Id', 'CaseNumber', 'Subject', 'Status', 'Priority', 'Origin', 'Description', 'AccountId', 'ContactId', 'OwnerId', 'CreatedDate', 'ClosedDate'];
+            const fields = validateFields(args.fields || [], defaultFields);
+            let query = `SELECT ${fields.join(', ')} FROM Case`;
+            const conditions = [];
+            if (args.subject_contains)
+                conditions.push(`Subject LIKE '%${escapeSOQLLike(args.subject_contains)}%'`);
+            if (args.status)
+                conditions.push(`Status = '${escapeSOQL(args.status)}'`);
+            if (args.priority)
+                conditions.push(`Priority = '${escapeSOQL(args.priority)}'`);
+            if (args.related_account_id)
+                conditions.push(`AccountId = '${escapeSOQL(args.related_account_id)}'`);
+            if (args.related_contact_id)
+                conditions.push(`ContactId = '${escapeSOQL(args.related_contact_id)}'`);
+            if (args.is_closed !== undefined)
+                conditions.push(`IsClosed = ${args.is_closed}`);
+            if (conditions.length > 0)
+                query += ` WHERE ${conditions.join(' AND ')}`;
+            const limit = Math.min(Math.max(1, args.limit ?? 50), 200);
+            query += ` LIMIT ${limit}`;
+            const result = await conn.query(query);
+            return JSON.stringify({ ok: true, records: sanitizeRecords(result.records, 'salesforce:get_cases:records'), totalSize: result.totalSize });
+        });
+    }));
+    server.registerTool('salesforce_create_case', {
+        description: `Create a support case. Required: subject. Optional: status, priority, origin, description, related_account_id, related_contact_id, fields.`,
+        inputSchema: z.object({
+            subject: z.string().min(1).describe('Case subject (required)'),
+            status: z.string().optional().describe('Case status (default: New)'),
+            priority: z.string().optional().describe('Priority (High, Medium, Low)'),
+            origin: z.string().optional().describe('Case origin (Phone, Email, Web)'),
+            description: z.string().optional().describe('Case description'),
+            related_account_id: z.string().optional().describe('Account ID to associate with'),
+            related_contact_id: z.string().optional().describe('Contact ID to associate with'),
+            fields: z.record(z.unknown()).optional().describe('Additional/custom fields as key-value pairs'),
+        }),
+        annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true },
+    }, withErrorHandling(async (args) => {
+        return withConnection(undefined, async (conn) => {
+            const data = { Subject: args.subject };
+            if (args.status)
+                data.Status = args.status;
+            if (args.priority)
+                data.Priority = args.priority;
+            if (args.origin)
+                data.Origin = args.origin;
+            if (args.description)
+                data.Description = args.description;
+            if (args.related_account_id)
+                data.AccountId = args.related_account_id;
+            if (args.related_contact_id)
+                data.ContactId = args.related_contact_id;
+            if (args.fields)
+                validateAndMergeCustomFields(data, args.fields);
+            const result = await conn.sobject('Case').create(data);
+            if (!result.success)
+                throw new ConnectorError('Failed to create case', 'CREATE_ERROR', formatVendorErrors(result.errors));
+            return JSON.stringify({ ok: true, status: 'success', object: 'Case', id: result.id, subject: args.subject });
+        });
+    }));
+    server.registerTool('salesforce_update_case', {
+        description: `Update a support case. Required: id. Updatable: subject, status, priority, origin, description, related_account_id, related_contact_id, fields.`,
+        inputSchema: z.object({
+            id: z.string().min(1).describe('Salesforce Case ID (required)'),
+            subject: z.string().optional().describe('Case subject'),
+            status: z.string().optional().describe('Case status (e.g., Working, Escalated, Closed)'),
+            priority: z.string().optional().describe('Priority (High, Medium, Low)'),
+            origin: z.string().optional().describe('Case origin'),
+            description: z.string().optional().describe('Description'),
+            related_account_id: z.string().optional().describe('Account ID to associate with'),
+            related_contact_id: z.string().optional().describe('Contact ID to associate with'),
+            fields: z.record(z.unknown()).optional().describe('Additional/custom fields as key-value pairs'),
+        }),
+        annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: true },
+    }, withErrorHandling(async (args) => {
+        return withConnection(undefined, async (conn) => {
+            const updateData = { Id: args.id };
+            if (args.subject)
+                updateData.Subject = args.subject;
+            if (args.status)
+                updateData.Status = args.status;
+            if (args.priority)
+                updateData.Priority = args.priority;
+            if (args.origin)
+                updateData.Origin = args.origin;
+            if (args.description)
+                updateData.Description = args.description;
+            if (args.related_account_id)
+                updateData.AccountId = args.related_account_id;
+            if (args.related_contact_id)
+                updateData.ContactId = args.related_contact_id;
+            if (args.fields)
+                validateAndMergeCustomFields(updateData, args.fields);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            const result = await conn.sobject('Case').update(updateData);
+            checkSaveResult(result, 'Failed to update case');
+            return JSON.stringify({ ok: true, status: 'success', object: 'Case', id: args.id });
+        });
+    }));
+}
+//# sourceMappingURL=cases.js.map

package/dist/tools/contacts.js

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { withErrorHandling, escapeSOQL, escapeSOQLLike, validateFields, validateAndMergeCustomFields, checkSaveResult } from '../utils.js';
+import { withErrorHandling, escapeSOQL, escapeSOQLLike, validateFields, validateAndMergeCustomFields, checkSaveResult, formatVendorErrors, sanitizeRecords } from '../utils.js';
 import { withConnection } from '../client.js';
 import { ConnectorError } from '../types.js';
 export function registerContactTools(server) {
@@ -32,7 +32,7 @@ export function registerContactTools(server) {
             const limit = Math.min(Math.max(1, args.limit ?? 50), 200);
             query += ` LIMIT ${limit}`;
             const result = await conn.query(query);
-            return JSON.stringify({ ok: true, records: result.records, totalSize: result.totalSize });
+            return JSON.stringify({ ok: true, records: sanitizeRecords(result.records, 'salesforce:get_contacts:records'), totalSize: result.totalSize });
         });
     }));
     server.registerTool('salesforce_create_contact', {
@@ -46,7 +46,7 @@ export function registerContactTools(server) {
             related_account_id: z.string().optional().describe('Account ID to associate with'),
             fields: z.record(z.unknown()).optional().describe('Additional/custom fields as key-value pairs'),
         }),
-        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+        annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true },
     }, withErrorHandling(async (args) => {
         return withConnection(undefined, async (conn) => {
             const data = { LastName: args.last_name };
@@ -64,7 +64,7 @@ export function registerContactTools(server) {
                 validateAndMergeCustomFields(data, args.fields);
             const result = await conn.sobject('Contact').create(data);
             if (!result.success)
-                throw new ConnectorError('Failed to create contact', 'CREATE_ERROR', JSON.stringify(result.errors));
+                throw new ConnectorError('Failed to create contact', 'CREATE_ERROR', formatVendorErrors(result.errors));
             return JSON.stringify({ ok: true, status: 'success', object: 'Contact', id: result.id, name: `${args.first_name || ''} ${args.last_name}`.trim() });
         });
     }));

package/dist/tools/events.d.ts

@@ -0,0 +1,3 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export declare function registerEventTools(server: McpServer): void;
+//# sourceMappingURL=events.d.ts.map

package/dist/tools/events.js

@@ -0,0 +1,90 @@
+import { z } from 'zod';
+import { withErrorHandling, escapeSOQL, escapeSOQLLike, validateFields, validateAndMergeCustomFields, formatSOQLDateTime, formatVendorErrors, sanitizeRecords } from '../utils.js';
+import { withConnection } from '../client.js';
+import { ConnectorError } from '../types.js';
+export function registerEventTools(server) {
+    server.registerTool('salesforce_get_events', {
+        description: `Get calendar events. Filters: subject_contains, who_id, what_id, start_from, start_to. Dates accept YYYY-MM-DD (midnight UTC) or ISO 8601 datetimes. Returns: Id, Subject, StartDateTime, EndDateTime, Location, Description, WhoId, WhatId, OwnerId, IsAllDayEvent. Max 200 (default: 50).`,
+        inputSchema: z.object({
+            limit: z.number().int().min(1).max(200).optional().describe('Max results 1-200 (default: 50)'),
+            subject_contains: z.string().optional().describe('Filter by subject (case-insensitive)'),
+            who_id: z.string().optional().describe('Filter by WhoId (Contact or Lead ID)'),
+            what_id: z.string().optional().describe('Filter by WhatId (Account or Opportunity ID)'),
+            start_from: z.string().optional().describe('Events starting on/after this date or datetime (YYYY-MM-DD or ISO 8601; see tool description for an example)'),
+            start_to: z.string().optional().describe('Events starting on/before this date or datetime (YYYY-MM-DD or ISO 8601)'),
+            fields: z.array(z.string()).optional().describe('Custom fields (must be valid API names)'),
+        }),
+        annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+    }, withErrorHandling(async (args) => {
+        return withConnection(undefined, async (conn) => {
+            const defaultFields = ['Id', 'Subject', 'StartDateTime', 'EndDateTime', 'Location', 'Description', 'WhoId', 'WhatId', 'OwnerId', 'IsAllDayEvent'];
+            const fields = validateFields(args.fields || [], defaultFields);
+            let query = `SELECT ${fields.join(', ')} FROM Event`;
+            const conditions = [];
+            if (args.subject_contains)
+                conditions.push(`Subject LIKE '%${escapeSOQLLike(args.subject_contains)}%'`);
+            if (args.who_id)
+                conditions.push(`WhoId = '${escapeSOQL(args.who_id)}'`);
+            if (args.what_id)
+                conditions.push(`WhatId = '${escapeSOQL(args.what_id)}'`);
+            if (args.start_from)
+                conditions.push(`StartDateTime >= ${formatSOQLDateTime(args.start_from, 'start_from')}`);
+            if (args.start_to)
+                conditions.push(`StartDateTime <= ${formatSOQLDateTime(args.start_to, 'start_to')}`);
+            if (conditions.length > 0)
+                query += ` WHERE ${conditions.join(' AND ')}`;
+            query += ' ORDER BY StartDateTime ASC';
+            const limit = Math.min(Math.max(1, args.limit ?? 50), 200);
+            query += ` LIMIT ${limit}`;
+            const result = await conn.query(query);
+            return JSON.stringify({ ok: true, records: sanitizeRecords(result.records, 'salesforce:get_events:records'), totalSize: result.totalSize });
+        });
+    }));
+    server.registerTool('salesforce_create_event', {
+        description: `Create a calendar event. Required: subject, start_date_time, end_date_time. Optional: location, description, who_id, what_id, is_all_day_event, owner_id, fields. Datetimes must be ISO 8601 (e.g. "2026-01-09T14:30:00Z"); all-day events accept plain dates (YYYY-MM-DD).`,
+        inputSchema: z.object({
+            subject: z.string().min(1).describe('Event subject (required)'),
+            start_date_time: z.string().min(1).describe('Start (required) — ISO 8601 datetime (see tool description for an example), or YYYY-MM-DD for all-day events'),
+            end_date_time: z.string().min(1).describe('End (required) — ISO 8601 datetime, or YYYY-MM-DD for all-day events'),
+            location: z.string().optional().describe('Event location'),
+            description: z.string().optional().describe('Event description'),
+            who_id: z.string().optional().describe('Contact or Lead ID to invite/relate'),
+            what_id: z.string().optional().describe('Account or Opportunity ID to relate'),
+            is_all_day_event: z.boolean().optional().describe('All-day event (default: false)'),
+            owner_id: z.string().optional().describe('Owner User ID'),
+            fields: z.record(z.unknown()).optional().describe('Additional/custom fields as key-value pairs'),
+        }),
+        annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true },
+    }, withErrorHandling(async (args) => {
+        // Validate formats up front for actionable errors; the validated values
+        // go into the create body verbatim (JSON body — no SOQL injection surface).
+        formatSOQLDateTime(args.start_date_time, 'start_date_time');
+        formatSOQLDateTime(args.end_date_time, 'end_date_time');
+        return withConnection(undefined, async (conn) => {
+            const data = {
+                Subject: args.subject,
+                StartDateTime: args.start_date_time,
+                EndDateTime: args.end_date_time,
+            };
+            if (args.location)
+                data.Location = args.location;
+            if (args.description)
+                data.Description = args.description;
+            if (args.who_id)
+                data.WhoId = args.who_id;
+            if (args.what_id)
+                data.WhatId = args.what_id;
+            if (args.is_all_day_event !== undefined)
+                data.IsAllDayEvent = args.is_all_day_event;
+            if (args.owner_id)
+                data.OwnerId = args.owner_id;
+            if (args.fields)
+                validateAndMergeCustomFields(data, args.fields);
+            const result = await conn.sobject('Event').create(data);
+            if (!result.success)
+                throw new ConnectorError('Failed to create event', 'CREATE_ERROR', formatVendorErrors(result.errors));
+            return JSON.stringify({ ok: true, status: 'success', object: 'Event', id: result.id, subject: args.subject });
+        });
+    }));
+}
+//# sourceMappingURL=events.js.map

package/dist/tools/index.d.ts

@@ -4,6 +4,12 @@ export { registerContactTools } from './contacts.js';
 export { registerOpportunityTools } from './opportunities.js';
 export { registerLeadTools } from './leads.js';
 export { registerTaskTools } from './tasks.js';
+export { registerCaseTools } from './cases.js';
+export { registerEventTools } from './events.js';
+export { registerSearchTools } from './search.js';
+export { registerNoteTools } from './notes.js';
+export { registerCampaignTools } from './campaigns.js';
+export { registerReportTools } from './reports.js';
 export { registerUserTools } from './users.js';
 export { registerQueryTools } from './query.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/tools/index.js

@@ -4,6 +4,12 @@ export { registerContactTools } from './contacts.js';
 export { registerOpportunityTools } from './opportunities.js';
 export { registerLeadTools } from './leads.js';
 export { registerTaskTools } from './tasks.js';
+export { registerCaseTools } from './cases.js';
+export { registerEventTools } from './events.js';
+export { registerSearchTools } from './search.js';
+export { registerNoteTools } from './notes.js';
+export { registerCampaignTools } from './campaigns.js';
+export { registerReportTools } from './reports.js';
 export { registerUserTools } from './users.js';
 export { registerQueryTools } from './query.js';
 //# sourceMappingURL=index.js.map