Datacloud Code MCP

数据云代码MCP

Salesforce数据云（Data360）MCP服务器使用 Cloudflare代码模式 模式：两个工具(search + execute)，每个都采用一个JavaScript异步箭头函数，无论API表面大小如何，都有一个固定的约1吨的工具足迹。

运作原理

该服务器没有公开数百个端点级工具，而是为代理提供了一个稳定的两步循环：

1. search --代理编写JavaScript来过滤OpenAPI规范并发现数据云端点。
2. execute --代理编写JavaScript调用 salesforce.request() 以进行经过身份验证的API请求。

这两个工具都在 node:vm 带有受限全局变量的沙盒。完整的OpenAPI规范从未进入模型上下文——代理通过编程方式对其进行探索 search().

覆盖范围

约185个API系列的数据云操作：

快速开始

npm install
npm run build
npm test        # 27 tests across 5 suites

身份验证选项

选项1：直接访问令牌（与d360 mcp服务器的环境变量相同）

CDP_ACCESS_TOKEN= CDP_INSTANCE_URL= npm run dev

选项2:OAuth客户端凭据

CDP_CLIENT_ID= CDP_CLIENT_SECRET= CDP_LOGIN_URL=https://login.salesforce.com npm run dev

选项3:OAuth web流

1. 集 SALESFORCE_OAUTH_CLIENT_ID, SALESFORCE_OAUTH_CLIENT_SECRET, SALESFORCE_OAUTH_REDIRECT_URI 在 .env.
2. 启动服务器： npm run dev
3. 打开 /oauth/start?user_id=default 并完成登录。

选项4:来自CLI的种子令牌

npm run seed:token     # reads sf CLI auth or env vars
TOKEN_STORE_PATH=./data/tokens.integration.json \
TOKEN_ENCRYPTION_KEY_BASE64='' npm run dev

运行服务器

PORT=3000 HOST=127.0.0.1 npm run dev
curl -sS http://127.0.0.1:3000/healthz

冒烟测试

MCP_URL=http://127.0.0.1:3000/mcp USER_ID=default npm run smoke:mcp

示例通话

搜索：按标签查找端点

{
  "name": "search",
  "arguments": {
    "code": "async () => {\n  const results = [];\n  for (const [path, methods] of Object.entries(spec.paths)) {\n    for (const [method, op] of Object.entries(methods)) {\n      if (op.tags?.some(t => t.toLowerCase().includes('segment'))) {\n        results.push({ method: method.toUpperCase(), path, summary: op.summary });\n      }\n    }\n  }\n  return results;\n}"
  }
}

搜索：检查端点架构

{
  "name": "search",
  "arguments": {
    "code": "async () => {\n  const op = spec.paths['/services/data/v64.0/ssot/query-sql']?.post;\n  return { summary: op?.summary, requestBody: op?.requestBody };\n}"
  }
}

执行：运行SQL查询

{
  "name": "execute",
  "arguments": {
    "code": "async () => {\n  return await salesforce.request({\n    method: 'POST',\n    path: '/services/data/v64.0/ssot/query-sql',\n    body: { sql: 'SELECT FirstName__c FROM UnifiedIndividual__dlm LIMIT 5' }\n  });\n}"
  }
}

执行：链接多个调用

{
  "name": "execute",
  "arguments": {
    "code": "async () => {\n  const list = await salesforce.request({ method: 'GET', path: '/services/data/v64.0/ssot/segments' });\n  const first = list.body?.data?.[0];\n  if (!first) return { message: 'No segments' };\n  return await salesforce.request({ method: 'GET', path: '/services/data/v64.0/ssot/segments/' + first.id });\n}"
  }
}

MCP客户端集成

{
  "mcpServers": {
    "datacloud-code-mcp": {
      "transport": "streamable_http",
      "url": "http://127.0.0.1:3000/mcp",
      "headers": { "x-user-id": "default" }
    }
  }
}

安全模型

• 诱变方法(POST, PATCH, PUT, DELETE)除非被阻止 ALLOW_WRITES=true.
• salesforce.request() 只允许出站HTTP到经过身份验证的实例的主机名+ *.salesforce.com + *.force.com.
• 敏感的标头/正文键在工具输出中被编辑。
• 用户代码在 node:vm 沙盒没有 require, process, global，或文件系统访问。
• 沙盒强制执行 SANDBOX_TIMEOUT_MS （默认15秒）以防止执行失控。

部署到Heroku

heroku create
heroku config:set TOKEN_ENCRYPTION_KEY_BASE64=$(node -e "console.log(require('crypto').randomBytes(32).toString('base64'))")
heroku config:set ALLOW_WRITES=false
heroku config:set CDP_ACCESS_TOKEN= CDP_INSTANCE_URL=
git push heroku main

然后将您的MCP客户端指向 https://.herokuapp.com/mcp.

配置

看 .env.example 对于所有可用的环境变量。

项目布局

src/
  index.ts              HTTP server + MCP session management
  mcp-server.ts         Tool registration (search, execute, auth_status)
  config.ts             Zod-parsed environment config
  types.ts              Shared TypeScript interfaces
  logger.ts             Pino logger
  auth/
    oauth-service.ts    Salesforce OAuth web flow + token exchange
    auth-modes.ts       Strategy resolver (direct/client-cred/password/oauth)
    token-store.ts      AES-256-GCM encrypted token persistence
  schema/
    datacloud-schema-service.ts   Catalog loader, merger, $ref resolver
    catalog.ts                    OpenAPI → PlatformOperation parser
    spec-processor.ts             $ref resolution + spec processing (Cloudflare pattern)
    bundled-spec.ts               Resolve bundled YAML paths
    data360-api.bundled.yaml      Base OpenAPI spec (~35 endpoints)
    d360-extras.yaml              Extended endpoints (~150 more operations)
  sandbox/
    runner.ts           node:vm sandbox executor
    sf-client.ts        salesforce.request() injectable client
    safe-fetch.ts       Hostname-allow-listed fetch wrapper
    truncate.ts         Response truncation
  execute/
    datacloud-executor.ts   Legacy structured executor (kept for reference)
    redaction.ts            Body/header redaction helpers
    http-policy.ts          Retry + read-cache helpers
  safety/
    write-confirmation.ts   HMAC write tokens (used by legacy executor)
  search/
    search-index.ts         BM25 search index (kept for potential reuse)
  utils/
    crypto.ts               AES-256-GCM encrypt/decrypt
    headers.ts              Header value resolver
tests/                      Vitest test suites
scripts/                    Smoke test + token seed scripts
docs/                       Reference docs (Data Cloud guide, Postman)

参考文献

• Cloudflare代码模式MCP --此服务器遵循的模式
• Cloudflare MCP回购 --参考实施
• Anthropic：介绍先进工具的使用