Run Code Analyzer (PMD/ESLint/RetireJS/SFGE)
sf_run_code_scannerRuns multi-engine static analysis on Apex classes to detect security vulnerabilities and code quality issues. Automatically falls back to Java-free engines if Java is unavailable.
Instructions
Runs Salesforce Code Analyzer against Apex classes in the org — a real multi-engine static analysis scan (PMD rules including ApexCRUDViolation and OperationWithLimitsInLoop, SFGE data-flow analysis for SOQL injection, RetireJS for vulnerable JS libraries, ESLint, and Salesforce's regex engine), on top of the lighter-weight sf_scan_apex_antipatterns heuristic check. Retrieves class bodies via the Tooling API into a temp workspace, runs the scanner, and cleans up afterward. PMD/CPD/SFGE engines require Java 11+ on the host running this MCP server — if Java isn't detected, the scan automatically falls back to the Java-free engines (eslint, retire-js, regex, flow) and flags this in the response rather than failing.
classNames: optional list of class names to scan (omit to scan all active classes) maxClasses: maximum classes to scan (default 20, max 200) ruleSelector: optional override, e.g. ['pmd:Security'] — defaults to 'Recommended' rules (auto-restricted per the Java note above)
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| classNames | No | Apex class names to scan (omit to scan all active classes) | |
| maxClasses | No | Maximum number of classes to scan | |
| ruleSelector | No | Override rule selectors, e.g. ['pmd:Security', 'eslint:Recommended']. Defaults to 'Recommended' rules, auto-restricted to non-Java engines (eslint, retire-js, regex, flow) if Java isn't detected on the host. |