Scrubber MCP — Salesforce tech-debt intelligence for your coding agent.
Scrubber MCP exposes your Salesforce org’s findings, remediation guidance, and dependency graph as deterministic Model Context Protocol tools. Your coding agent identifies and fixes issues directly in your editor — no context-switching to a web UI, no copy-pasting screenshots.
Three primitives, one HTTP endpoint.
Static Authorization: Bearer sk-… keys, scoped to a single org and a fixed allowlist of toolsets. Stored encrypted, rotatable, and every call is logged for security review.
18 tools across 5 toolsets. Clients opt in via the X-Scrubber-Toolsets header; the request can narrow but never widen the per-key allowlist.
Every response wraps the same envelope (apiVersion: "2026-04"). Deterministic JSON, sub-second response times, no surprises.
Pick the toolsets your agent needs.
| Toolset | Status | Tools | Purpose |
|---|---|---|---|
core | Always available | 2 | Orient and identify the connected org. |
findings | Available | 5 | Triggered signals, offender lists, and the per-component-per-signal finding. |
change-safety | Available | 3 | Pre-deployment factual analysis split per change kind (field, permset). |
field-quality | Available | 3 | Per-field data-quality and inventory queries. |
dependencies | Available | 5 | Dependency graph, blast radius, semantic search, and a single-call full-context explorer. |
core is always on, even when callers pass an empty toolset list. Each findings response embeds the matching remediation advisory inline, so there’s no separate toolset to wire up.
What an agent should reach for first.
get_org_health_snapshotcoreStart here — composite score, per-pillar scores, totals for the connected org.
get_signal_findingsfindingsDrill into one signal: full offender list plus the embedded remediation advisory.
get_component_findingfindingsReturns the finding for one component and one signal in a single call — everything you need to fix it.
get_component_full_contextdependenciesOne call returns description, grouped dependencies, every signal, and per-signal advisories.
search_components_semanticdependenciesFind a component by describing it in plain English — no API name required.
Three steps from zero to a tool list.
Get an API key.
Sign in at /api-keys, click New API key, set a label, and submit. The raw key is shown once; copy it immediately. Self-serve keys cover the read-only intelligence toolsets. For change-safety tools, ask your admin to issue a key from /admin/api-keys. See the setup guide for key shape, scopes, and rotation.
Configure your client.
Point your client at https://mcp.scrubber.io/api/mcp. Pick the snippet for your editor:
// ~/.cursor/mcp.json
{
"mcpServers": {
"scrubber": {
"url": "https://mcp.scrubber.io/api/mcp",
"headers": {
"Authorization": "Bearer sk-...",
"X-Scrubber-Toolsets": "core,findings,dependencies"
}
}
}
}claude mcp add --transport http scrubber https://mcp.scrubber.io/api/mcp \
--header "Authorization: Bearer sk-..." \
--header "X-Scrubber-Toolsets: core,findings,dependencies"// a4d_mcp_settings.json
{
"name": "scrubber",
"url": "https://mcp.scrubber.io/api/mcp",
"bearer_token_env_var": "SCRUBBER_API_KEY",
"http_headers": { "X-Scrubber-Toolsets": "core,findings,dependencies" }
}Full Cursor / Claude Code / Vibes configuration: setup guide.
Verify with a stdio probe.
Pipe a tools/list JSON-RPC request into the stdio binary. Two responses on stdout means the server is alive and returning your toolset selection.
printf '%s\n' \
'{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"smoke","version":"0"}}}' \
'{"jsonrpc":"2.0","method":"notifications/initialized"}' \
'{"jsonrpc":"2.0","id":2,"method":"tools/list"}' \
| npx scrubber-mcp --toolsets core,findings