Salesforce Marketing MCP Server

The MCP server implements Salesforce marketing operations functionality with proper authentication via jsforce, but has significant security concerns around credential handling, SOQL injection vulnerabilities, and overly permissive operations. Credentials are required (username, password, security token) but are passed via environment variables as plaintext, and multiple SOQL queries use string interpolation without parameterization, creating SQL injection attack surface. The server's broad permissions match its marketing purpose, but the injection vulnerabilities and lack of input sanitization present real risks. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 3 high severity). Package verification found 1 issue.

6 files analyzed · 12 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.