orgintel
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| ORGINTEL_DB | No | Override path for the DuckDB snapshot store (default: ~/.orgintel/snapshots.db) | ~/.orgintel/snapshots.db |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| snapshot_orgA | Bulk-fetch a Salesforce org's permission architecture into the local snapshot store. Returns ONLY summary statistics — never permission rows. scope defaults to all tables; pass 'setup_entity_access:apex' to include Apex (off by default). |
| list_snapshotsA | List available snapshots (newest first) with org, timestamp, and row counts. |
| describe_objectA | Live describe of an object's fields with a sensitivity_guess flag per field (SSN/DOB/account-number/etc from config). Sensitive fields ordered first. |
| soql_queryA | Read-only SOQL. SELECT-only (parser-guarded), hard row cap, identifier columns (Name/Email/Phone/...) redacted before results are returned (DESIGN §2.7). |
| list_profilesA | Profiles in a snapshot: name, license, user count, perm cardinality, and whether they hold ModifyAllData. Sorted by user count desc. Unassigned profiles surfaced. |
| permission_diffA | Symmetric difference of permissions between two principals (profile or permission set). Differing fields grouped by (a_perm, b_perm) signature. The P1 workhorse. |
| find_sensitive_accessA | Every principal granting read/edit on a field whose name matches a sensitivity pattern (SSN/DOB/account-number/card/comp/… from config), with how many users end up with that access (resolved through effective permissions, honoring muting). Recall is prioritized over precision — expect broad matches. |
| verify_decompositionA | Formal check: does a proposed base-profile + permission-set/group decomposition leave EVERY user's effective permission set unchanged? Returns per-user added/removed grants (both must be empty to pass) and any users the plan fails to cover. This is a boolean, not a vibe — it either preserves privilege exactly or it doesn't. |
| propose_decompositionA | Propose a thin-base-profile + permission-set decomposition. The STRUCTURE is computed deterministically (cluster the profiles, derive each cluster's shared base and each profile's deviation) and is run through verify_decomposition before it is returned — if it doesn't preserve every user's effective permissions, you get the failure, not the proposal. Names and rationale are deliberately NOT provided: the tool returns placeholder keys plus each base's member profile names and shared grants as raw material for YOU to name in the customer's vocabulary and justify. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 9 tools
Each tool targets a distinct operation: snapshots, listing, describing, querying, profiling, diffing, sensitive access search, and decomposition verification/proposal. No overlap in functionality.
All tools follow a consistent verb_noun snake_case pattern (e.g., snapshot_org, list_snapshots, permission_diff), making the purpose clear from the name.
9 tools is well-scoped for the domain of Salesforce org permission analysis and decomposition. Each tool serves a clear role without redundancy.
The toolset covers the entire workflow: fetching permission architecture, describing objects, querying, listing profiles, diffing permissions, finding sensitive access, and proposing/verifying decompositions. No obvious gaps.