Run Code Analyzer (PMD/ESLint/RetireJS/SFGE)
sf_run_code_scannerDetect code quality and security issues in Apex classes using Salesforce Code Analyzer, including static analysis from PMD, SFGE, and ESLint engines.
Instructions
Runs Salesforce Code Analyzer against Apex classes in the org — a real multi-engine static analysis scan (PMD rules including ApexCRUDViolation and OperationWithLimitsInLoop, SFGE data-flow analysis for SOQL injection, RetireJS for vulnerable JS libraries, ESLint, and Salesforce's regex engine), on top of the lighter-weight sf_scan_apex_antipatterns heuristic check. Retrieves class bodies via the Tooling API into a temp workspace, runs the scanner, and cleans up afterward. PMD/CPD/SFGE engines require Java 11+ on the host running this MCP server — if Java isn't detected, the scan automatically falls back to the Java-free engines (eslint, retire-js, regex, flow) and flags this in the response rather than failing.
classNames: optional list of class names to scan (omit to scan all active classes) maxClasses: maximum classes to scan (default 20, max 200) ruleSelector: optional override, e.g. ['pmd:Security'] — defaults to 'Recommended' rules (auto-restricted per the Java note above)
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| classNames | No | Apex class names to scan (omit to scan all active classes) | |
| maxClasses | No | Maximum number of classes to scan | |
| ruleSelector | No | Override rule selectors, e.g. ['pmd:Security', 'eslint:Recommended']. Defaults to 'Recommended' rules, auto-restricted to non-Java engines (eslint, retire-js, regex, flow) if Java isn't detected on the host. |