MCP Server

The sfdt Model Context Protocol (MCP) server exposes Salesforce release-management, testing, and governance tools directly to agentic workflows — Claude Code, Cursor, Copilot, or any standard MCP client.

Start the server

sfdt mcp start

This starts a JSON-RPC 2.0 stdio stream on standard input/output. All operational logs are routed to stderr to keep the RPC channel clean. The server is stateless per request — every tool call shells out to the sfdt CLI.

Configuration

Configure it under the mcp key in .sfdt/config.json:

{
  "mcp": {
    "enabled": true,
    "parking": {
      "enabled": true,
      "thresholdBytes": 50000,
      "ttlSeconds": 86400,
      "cacheScope": "session"
    }
  }
}

Pinning which projects a server serves

Every tool accepts a projectRoot, and that value is chosen by the model — while SFDT’s AI surfaces feed that model untrusted org content (Apex compile errors, flow metadata, deploy failure text). So a call you read as “query the current project” can name a different checkout and run against that org, with the tool list still presenting it as read-only.

Since 0.26.0 the default depends on how the server was launched — which is what separates the safe case from the abusable one.

So a multi-project server is one you start outside any project — which is what it already was. To keep a project-bound server serving several checkouts, name them:

export SFDT_MCP_PROJECT_ROOTS="/work/customer-a:/work/customer-b"

Colon-separated absolute paths. The allowlist wins wherever it is set.

Two details worth knowing:

• Being “inside a project” is decided by finding the project, not by whether its configuration loads. A project whose .sfdt/config.json or sfdx-project.json is malformed still binds the server — those files are committed and arrive with whatever repo was cloned, so the alternative would let a repository decide that the server reviewing it should be unrestricted.
• Paths are compared physically, after resolving symlinks. A committed symlink pointing out of the project does not satisfy the check.

Exposed tools

Pre-deployment validation

Deployment & rollback (safety-gated)

Analysis & observe

Scratch orgs & data (safety-gated)

The mutating tools here take the same confirmExecution: true gate as deployment. sfdt_data_export and sfdt_scratch_pool with action: "status" are read-only and need no gate.

Org health & notifications

Context budget governance

Context parking

When a tool result exceeds mcp.parking.thresholdBytes (default 50 KB), the server writes the full payload to .sfdt/cache/parked/<uuid>.json and returns a lightweight envelope instead:

{
  "_parked": true,
  "ref": "parked://<uuid>",
  "byteSize": 123456,
  "rowCount": 42,
  "preview": "...",
  "ttlMs": 86400000,
  "cacheScope": "session"
}

Purge expired parked files:

sfdt mcp cleanup

Client setup

Claude Code

{
  "mcpServers": {
    "sfdt": {
      "command": "node",
      "args": ["/absolute/path/to/sfdt/bin/sfdt.js", "mcp", "start"]
    }
  }
}

Cursor

1. Settings → Features → MCP → + Add New MCP Server.
2. Name: sfdt; Type: stdio.
3. Command: node /absolute/path/to/sfdt/bin/sfdt.js mcp start.