@squirex.dev/mcp-server
OfficialServer Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| SQUIREX_PROJECT_DIR | Yes | Path to your Salesforce project directory |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {} |
| prompts | {} |
| resources | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| scan_agentforceA | Run the full Agentforce Capability Scan (26 SAST rules across 9 categories) against the current project. Returns SARIF-structured violations covering action configuration, agent script safety, grounding security, structural dependencies, flow/prompt template security, supply chain, agentic architecture, instruction integrity, and operational reliability. |
| scan_agentforce_fileA | Scan a specific Agentforce metadata file for capability violations. Supports .genAiFunction-meta.xml, .genAiPlugin-meta.xml, .genAiPlannerBundle-meta.xml, .genAiPromptTemplate-meta.xml, .agent files, .cls (Apex), .trigger, and schema.json files. |
| scan_agentforce_ruleA | Run a single Agentforce SAST rule against the project. Useful for focused analysis. Rule IDs follow the pattern AGENTFORCE-X.Y (e.g., AGENTFORCE-1.1 for Mandatory User Confirmation). |
| list_scan_rulesA | List all 26 Agentforce Capability Scanner rules with their ID, name, category, severity, and description. Use this to understand the full scope of the security scan. |
| get_rule_detailsA | Get detailed information about a specific Agentforce SAST rule including its description, severity, and remediation guidance. |
| explain_violationA | Given a SARIF violation from a scan, provide root-cause analysis and step-by-step remediation guidance. Pass the full violation object or just the ruleId and file path. |
| suggest_fixA | Given a specific Agentforce violation (rule ID + file), generate a suggested metadata or code fix. Returns a diff-style suggestion. |
| run_testsA | Execute Apex tests locally using the high-fidelity Go interpreter. Returns structured test results with pass/fail status, assertion details, stack traces, and line-level code coverage. |
| get_coverageA | Extract code coverage data from the most recent test run. Shows covered/uncovered lines per class. |
| analyze_schemaA | Aggregate and analyze the inferred schema from all Apex classes in the project. Returns SObject definitions, field usage heatmaps, and relationship graphs. Useful for understanding the data model without an org connection. |
| predict_conflictsB | Predict merge conflicts between two branches by analyzing Apex class changes, DML patterns, and metadata dependencies. Helps prevent deployment failures. |
| generate_sarif_reportA | Generate a SARIF (Static Analysis Results Interchange Format) report from the Agentforce Capability Scan. SARIF is the standard format for GitHub Security tab, Azure DevOps, and other CI/CD integrations. |
| generate_dx_testsA | Convert Agentforce scan violations into Agentforce DX test specifications (YAML format) compatible with |
| validate_dx_testsA | Validate a generated Agentforce DX test spec without executing it. Delegates to |
| push_to_testing_centerA | Push an Agentforce DX test spec to the Salesforce Testing Center. Delegates to |
| get_testing_center_resultsA | Get the status and results of a previously submitted Agentforce Test Run from the Testing Center. Requires an authenticated Salesforce org. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
| review-agentforce-security | Run a comprehensive Agentforce security review: execute all 26 SAST rules, prioritize violations by severity, and produce a structured remediation plan. |
| fix-agentforce-violation | Diagnose a specific Agentforce violation and apply the fix. The agent will read the rule details, analyze the violating file, and suggest or apply code/metadata changes. |
| harden-agent-metadata | Proactively review all Agentforce metadata (GenAiFunction, GenAiPlugin, GenAiPromptTemplate, .agent files) and suggest hardening improvements even if no violations are found. Focus on defense-in-depth. |
| generate-test-evaluation | Generate Agentforce DX test specifications (YAML) based on scan results. These test specs can be pushed to the Agentforce Testing Center to validate agent behavior dynamically after metadata changes. |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
| Agentforce Scan Rules | Complete catalog of all 26 Agentforce SAST rules with ID, name, category, severity, description, and remediation guidance. |
| Latest Scan Results | Most recent Agentforce Capability Scan results in SARIF format. |
| Inferred Schema Objects | List of all SObjects inferred from the codebase, including custom objects and standard object overrides. |
| Latest Test Results | Most recent Apex test execution results including pass/fail status, assertions, and timings. |
| Latest Coverage Data | Most recent code coverage data — covered/uncovered lines per class. |
TDQS
Scored across 16 tools
Most tools have clear, distinct scopes (scan whole project vs. specific file vs. specific rule; explain vs. suggest fix). The only minor overlap is between scan_agentforce and generate_sarif_report, both of which output SARIF, which could cause an agent to pick the wrong one when a report artifact is needed.
All tool names follow a consistent verb_noun pattern with lowercase and underscores (scan_agentforce, list_scan_rules, generate_sarif_report, push_to_testing_center). The verbs are predictable and clearly indicate the action, making the set easy to navigate.
With 16 tools, the server is slightly over the typical 3-15 well-scoped range, but each tool serves a distinct purpose within the two main workflows (scanning and testing). The count feels justified and not bloated, so it earns a 4 rather than a 3.
The tool surface covers the full scanning lifecycle (run scans, list rules, get details, generate reports, explain and suggest fixes) and the testing workflow (run tests, get coverage, generate/validate/push test specs, retrieve results). Minor gaps include no direct way to apply suggested fixes or retrieve historical scan results, but these are workable.