Which integrations are available for this server?

Automates PR scanning with SARIF output via SquireX GitHub App, providing security checks on every pull request. Scans Salesforce Agentforce metadata (Apex, Flows, GenAI, etc.) for 61+ security and operational risks, and can push test specs to Salesforce Testing Center. Analyzes Slack bot configurations for missing DLP guards in Agentforce integrations.

How do I use @squirex.dev/mcp-server?

1. Click on "Install Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@@squirex.dev/mcp-server run a full security scan on my agentforce metadata" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

@squirex.dev/mcp-server

Official

by SquireX-dev

Overview Schema Related Servers Score Discussions

TypeScript

Local

@squirex.dev/mcp-server

SquireX MCP Server — Agentforce Capability Scanner for AI Coding Agents

npm version License

Model Context Protocol server exposing the SquireX Agentforce Capability Scanner to AI-powered developer tools. Works with Claude Code, Gemini, GitHub Copilot, and any MCP-compatible IDE.

Why SquireX?

Salesforce Agentforce agents use LLMs to autonomously execute Apex, Flows, and external services. Without guardrails, this creates OWASP LLM Top 10 vulnerabilities:

🔴 Excessive Agency — Agents that modify data without user confirmation
🔴 Prompt Injection — User input that hijacks agent instructions
🔴 Privilege Escalation — Actions running in system context without sharing
🟠 Supply Chain — Stale API versions that silently skip metadata types

SquireX scans your Agentforce metadata with 61+ SAST rules across 27 categories and integrates directly into your AI coding workflow.

Related MCP server: frogeye-mcp

Quick Start

Add to your AI IDE configuration (Claude Code, Gemini, VS Code, JetBrains):

{
  "mcpServers": {
    "squirex": {
      "command": "npx",
      "args": ["-y", "@squirex.dev/mcp-server"],
      "env": {
        "SQUIREX_PROJECT_DIR": "/path/to/your/salesforce/project"
      }
    }
  }
}

That's it. Your AI agent now has access to the Agentforce Capability Scanner.

MCP Surface

Tools (16)

Core Scanning (Primary Value)

Tool	Description
`scan_agentforce`	Run all 61+ SAST rules against the project. Returns SARIF.
`scan_agentforce_file`	Scan a single metadata file (`.genAiFunction-meta.xml`, `.agent`, etc.)
`scan_agentforce_rule`	Run a specific rule (e.g., `AGENTFORCE-1.1`)

Rule Intelligence

Tool	Description
`list_scan_rules`	List all 61+ rules with ID, category, severity
`get_rule_details`	Deep dive: description + remediation guidance
`explain_violation`	Root-cause analysis for a specific violation
`suggest_fix`	Generate a code/metadata fix suggestion

Apex Testing & Schema

Tool	Description
`run_tests`	Execute Apex tests locally using the Go interpreter
`get_coverage`	Extract line-level code coverage data
`analyze_schema`	Aggregate inferred SObject schema from the codebase
`predict_conflicts`	Predict merge conflicts between branches
`generate_sarif_report`	Generate SARIF for CI/CD pipeline integration

Testing Center Bridge

Tool	Description
`generate_dx_tests`	Convert scan violations → Agentforce DX test YAML for Testing Center
`validate_dx_tests`	Validate DX test spec syntax and schema
`push_to_testing_center`	Push test spec to Salesforce via `sf agent test run`
`get_testing_center_results`	Get status/results of a Testing Center test run

Resources (6)

URI	Description
`squirex://scan/rules`	Complete 51+ rule catalog
`squirex://scan/rules/{id}`	Rule detail with remediation
`squirex://scan/results/latest`	Latest scan results (SARIF)
`squirex://schema/objects`	Inferred SObject schema
`squirex://test-results/latest`	Latest Apex test results
`squirex://coverage/latest`	Latest code coverage

Prompts (4)

Prompt	What It Does
`review-agentforce-security`	Full 51+ rule scan → prioritized remediation plan
`fix-agentforce-violation`	Diagnose + fix a specific violation
`harden-agent-metadata`	Proactive defense-in-depth review
`generate-test-evaluation`	Generate Agentforce DX test YAML specs for Testing Center

Agentforce Capability Scanner — 61+ Rules

#	Category	Rules	Severity
1	Action Configuration	Mandatory Confirmation, Schema Sync, Privilege Analysis	🔴 Critical / 🟠 High
2	Agent Script Safety	Validation Guards, Transition Integrity, Prompt Injection Defense	🔴 Critical / 🟠 High
3	Grounding Security	Hardcoded Secrets, FLS Masking Alignment	🔴 Critical / 🟠 High
4	Structural Dependency	Planner Completeness, Deactivation Collision, Evaluation Governance	🟠 High / 🟡 Medium
5	Flow Security	Flow Context/Silent State/Injection, API Injection, PT Poisoning/Activation	🔴 Critical / 🟠 High
6	Supply Chain Security	API Downgrade, Schema Desync, Managed Package Origin	🟠 High / 🟡 Medium
7	Agentic Architecture	Topic Bloat, Skill Semantics, Orphaned Bot Evaluation	🟠 High / 🟡 Medium
9	Instruction Integrity	Metadata Instruction Poisoning, Cross-Topic Boundary	🔴 Critical / 🟠 High
10	Operational Reliability	Validation Conflict	🟡 Medium
11	Autonomous Scheduling	Unguarded Scheduled Action, Time-Window Privilege Drift	🔴 Critical / 🟠 High
12	Copilot Studio Config	Memory Poisoning, API Version Drift	🔴 Critical
13	Data Cloud Grounding	RAG Without Schema Classification	🔴 Critical
14	Slack Integration	Slack Bot Without DLP Guard	🟠 High
15	External Service Security	Certificate Pinning, Dynamic Cloaking RAG	🟠 High
16	Custom Permission	Agent Action Without Permission Gate	🟠 High
17	Commerce	Idempotency Key, Amount Bounds Check	🔴 Critical
18	Multi-Agent Orchestration	Compositional Fragment Trap, Sybil Identity	🔴 Critical / 🟠 High
19	Platform Event / CDC	Sub-agent Spawning Loop, CDC Field Filter	🔴 Critical / 🟠 High
20–24	OWASP LLM Top 10	Excessive Agency, Data Exfil, SSRF, DoS, MCP Auth	🔴 Critical / 🟠 High
30–34	Enterprise Graph	PII Graph, Privilege Graph, Blast Radius, MCP Scope, XSS Graph	🔴 Critical / 🟠 High

Supported Metadata Types

.genAiFunction-meta.xml
.genAiPlugin-meta.xml
.genAiPlannerBundle-meta.xml
.genAiPromptTemplate-meta.xml
.genAiPromptTemplateActv-meta.xml
.agent files
.cls (Apex classes)
.trigger (Apex triggers)
.namedCredential-meta.xml
.connectedApp-meta.xml
.field-meta.xml
.aiEvaluationDefinition-meta.xml
.flow-meta.xml
schema.json
sfdx-project.json
package.xml
LWC components (.js in lwc/ dirs)

How It Works

AI Coding Agent (Claude / Gemini / Copilot)
        │
        │ MCP Protocol (stdio)
        ▼
┌─────────────────────────┐
│ @squirex.dev/mcp-server │ ← This package
│  16 tools, 6 resources  │
│  4 prompts              │
└───────┬─────────────────┘
        │ spawn
        ▼
┌─────────────────────────┐
│   squirex CLI            │
│   scan / generate-tests  │ ← Testing Center bridge
└───────┬─────────────────┘
        │ JSON IPC
        ▼
┌─────────────────────────┐      ┌─────────────────────┐
│   squireinterp           │      │   sf agent test run  │
│   Go Execution Engine    │      │   (Salesforce CLI)   │
│   61+ SAST Rules         │      │   → Testing Center   │
└─────────────────────────┘      └─────────────────────┘

The Testing Center bridge tools delegate to squirex generate-tests, which:

Runs a capability scan (or reads existing SARIF)
Converts violations to Agentforce DX test YAML (all 61+ rules, normalized AGENTFORCE-X.Y IDs)
Optionally validates and pushes to the Salesforce Testing Center via sf agent test run

Requirements

Node.js ≥ 18
squirex CLI installed (or available via npx)
A Salesforce project with Agentforce metadata

GitHub App Integration

For automated PR scanning, install the SquireX GitHub App — one-click setup, 51+ rule scan on every pull request, SARIF in your Security tab.

Plan	Public Repos	Private Repos	Price
Free	Unlimited	—	$0
Pro	Unlimited	1	$49/repo/month
Enterprise	Unlimited	Unlimited	$299/org/month

License

Proprietary — See LICENSE.md

⚡ Built by SquireX — Securing the AI Agent Pipeline

Install Server

license - permissive license

quality

maintenance

How are these scores calculated?

Maintenance

–Maintainers

–Response time

–Release cycle

–Releases (12mo)

Commit activity

Resources

Need Help?

Related Servers

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Tools

View all tools

Related MCP Servers

DevSecOps MCP Server
Testing & QA Tools Security Developer Tools
JesusDavidQuarksoft
A
license
B
quality
D
maintenance
An MCP server that integrates SAST, DAST, and SCA security tools to enable AI-driven vulnerability scanning and automated security reporting. It allows AI assistants to execute and analyze results from tools like Semgrep, OWASP ZAP, and Trivy within a DevSecOps workflow.
Updated 6 months ago (2026-02-04 02:27 UTC)
6
MIT
frogeye-mcpofficial
Code Analysis Penetration Testing Security
frogeye-ai
F
license
-
quality
D
maintenance
AI-powered security vulnerability detection for MCP-compatible agents, offering real-time scanning of code against a knowledge graph of 24,000+ vulnerability patterns.
Updated 3 months ago (2026-05-05 10:36 UTC)
Spotter-SAST
Code Analysis Testing & QA Tools Security
george-mellow
A
license
C
quality
D
maintenance
Enterprise-grade MCP server for static application security testing with multi-tool integration, compliance verification, AI-powered remediation, and multi-tenant management.
Updated a year ago (2025-08-06 20:20 UTC)
23
10
MIT
Heliosofficial
Code Analysis Penetration Testing Security
alibaba
A
license
-
quality
D
maintenance
MCP server that securely reviews AI-generated code for vulnerabilities such as SQL injection, command injection, and hardcoded credentials.
Updated 9 months ago (2025-11-03 07:11 UTC)
11
Apache 2.0

View all related MCP servers

Related MCP Connectors

Frogeye Security Scanner
Zero-config MCP security scanner for AI-generated apps. 25K+ vulnerability patterns.
agent-sec
Zero-install security baseline for AI coding agents — OWASP/CWE-cited rules over MCP.
shadowgate-mcp
Security firewall for AI agents — scans MCP calls for injection, secrets, and risks.

View all MCP Connectors

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/SquireX-dev/squirex-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server

@squirex.dev/mcp-server

Why SquireX?

Quick Start

MCP Surface

Tools (16)

Core Scanning (Primary Value)

Rule Intelligence

Apex Testing & Schema

Testing Center Bridge

Resources (6)

Prompts (4)

Agentforce Capability Scanner — 61+ Rules

Supported Metadata Types

How It Works

Requirements

GitHub App Integration

License

Maintenance

Resources

Looking for Admin?

Tools

Related MCP Servers

DevSecOps MCP Server

frogeye-mcpofficial

Spotter-SAST

Heliosofficial

Related MCP Connectors

Latest Blog Posts

MCP directory API