Agent Capability Scanner
The SquireX scanner is a static analysis engine for Salesforce Agentforce, ServiceNow Now Assist, MuleSoft Agent Fabric, and MCP servers. Unlike generic linters, it constructs a Semantic Graph across all metadata files and evaluates rules that span multiple file types and platforms.
Semantic Graph
SquireX builds a cross-metadata graph before evaluating any rules:
GenAiPlanner
│ orchestrates
▼
GenAiPlugin (Topic)
│ contains
▼
GenAiFunction (Action)
│ invokes
▼
Apex Class ──── shares ──── SObject Schema
│ │
├── calls ──► Flow └── lookup ── CustomField
├── calls ──► PromptTemplate ──► PromptTemplateActv
├── publishes ──► PlatformEvent ──► ApexTrigger
└── callout ──► NamedCredential ──► ConnectedApp
MCPServerConfig ── exposes ──► MCPTool ── shadows? ──► GenAiFunction
│
└── connects ──► AgentFabric ── policy ──► AgentFabricPolicy
23 node types · 21 edge types · O(1) lookup · BFS traversal · 4 platforms
This graph is what enables rules like AGENTFORCE-1.3 (privilege analysis) to trace from an agent action all the way down to the Apex sharing model on the target class — something no single-file linter can do.
How Rules are Evaluated
- Discovery — All supported metadata files are loaded from the target directory
- Parsing — 25+ type-specific parsers extract structured ASTs (including
.mcp.json,agent-network.yaml, Update Set XML,sn_aia_agent, GlideScript) - Linking — The semantic graph is constructed from cross-file references
- Rule Engine — rules execute graph traversals and pattern matches
- SARIF Generation — Results written as SARIF v2.1.0 with line-level locations
Performance
| Project Size | Files | Duration |
|---|---|---|
| Small (< 10 agents) | ~30 files | ~150ms |
| Medium (< 50 agents) | ~150 files | ~400ms |
| Large (100+ agents) | ~500 files | ~1.2s |
Go engine handles rule evaluation; TypeScript handles parsing. The boundary is a JSON IPC channel.