"DuckDB" matching MCP servers:

Analyzes Salesforce permission architecture (profiles, permission sets, groups) to support RBAC remediation. It snapshots the permission model into DuckDB and provides tools for diffs, sensitive access detection, and verified decomposition proposals.