AGENTFORCE-MCP-21: Salesforce MCP Tool Runs Apex, Writes Code, DML or Permissions Without a Gate
🔴 High · Excessive Agency
Detects Salesforce MCP server tools that execute anonymous Apex or write Apex classes / triggers / metadata (critical), change org metadata, permission sets, profiles or field-level security, or run create / update / delete DML on an sObject the caller chooses (high), with no confirmation, allowlist, read-only / enable flag or permission check. Decided from the operations each tool's handler and helpers actually call (Python, TypeScript and Mule tool flows), not from tool names or descriptions. A tool that runs any SOQL the caller sends is reported (medium) only when the server is reachable without authentication.
Details
| Field | Value |
|---|---|
| Rule ID | AGENTFORCE-MCP-21 |
| Severity | High |
| Category | Excessive Agency |
| Compliance | SOC2_CC6, NIST_AI_RMF, EU_AI_ACT_HIGH_RISK |
Remediation
Gate these tools: register them only when an explicit enable flag is set (off by default), ask for user confirmation (MCP elicitation) before each call, restrict DML to an allowlist of objects and fields, and never expose anonymous Apex or Apex / metadata deployment to the model in production orgs. Run the connection as an integration user with only the permissions the tools need.