sfi.list_analyses
Catalog gateway: the paginated index of EVERY analysis this server can run - name, one-line summary, and a coarse category (core / search / what-if / documentatio...
sfi.describe_analysis
Catalog gateway: ONE analysis's full description + JSON input schema, fetched on demand (`name`, with or without the `sfi.` prefix).
sfi.run_analysis
Catalog gateway: execute any analysis by `name` with `args` (an object, or a JSON-encoded string of one - a known client quirk handled defensively).
sfi.org_card
Serve the refresh-time ORG CARD - the ≤16KB orientation snapshot to load BEFORE your first question: identity & freshness, coverage and blind spots up front, scal...
sfi.doc_coverage_report
Offline, vault-only documentation-GAP meter - the documentation axis `sfi.tech_debt_score` lacks.
sfi.limit_headroom_report
Offline, vault-only limit-headroom report - the replacement for the retiring Salesforce Optimizer's limit report.
sfi.query_graph
ADVANCED / power-user: a read-only, guard-railed STRUCTURED query over the vault's dependency graph, for ad-hoc questions the purpose-built tools don't cover (e.g.
sfi.who_can_run
The REVERSE of `sfi.user_ability`: given a `Flow:X` (`componentId`), which Profiles / PermissionSets grant RUN access to it (from the `flowAccess` `grantedBy` edges).
sfi.who_can_access_object
The REVERSE of `sfi.why_cant_user_see_record`: given a `CustomObject:X` (`componentId`), ENUMERATE which profiles / permission sets / roles / groups statically ga...
sfi.guest_exposure_report
"What can UNAUTHENTICATED GUEST users see in my Experience Cloud / Site communities?" - the audit for one of the most notorious real-world Salesforce leaks (over-...
sfi.user_ability
"What can this Profile / PermissionSet RUN or DO?" - beyond record CRUD (which `object_access_audit` / `why_cant_user_see_record` cover).
sfi.profile_security
"What are this profile's login & session security policies?" - a focused security-audit surface separate from `user_ability` (which is "what can it RUN or DO").
sfi.lightning_pages
Lightning record pages (FlexiPage), both directions.
sfi.list_view_sharing
"Who is this list view shared with?" - a list view's `<sharedTo>` visibility scope (the groups/roles it shows up for in the list-view picker), now captured at ext...
sfi.app_access
Given a `CustomApplication` (`componentId`, e.g.
sfi.tab_availability
Given a `Profile:X` or `PermissionSet:X` - via `componentId` or the natural `profileApiName` / `profileId` / `permissionSetApiName` / `permissionSetId` selector (...
sfi.lifecycle_process
"What happens when {Object}.{field} becomes {value}?" - the existing process for a specific value or stage transition (which automations already run when a record...
sfi.layout_assignments
The REVERSE of `sfi.layout_for_user`: enumerate every (Profile × RecordType) assignment that targets a page layout - the question an admin asks before editing or...
sfi.automation_collisions
Field-level write-collision + save-recursion cycle detector for ONE object - 'is my org fighting itself on this object?'.
sfi.ai_exposure_report
AI-exposure audit (the R6-13 flagship): 'what data can my org's own AI see?'.
sfi.export_manifest
Group a set of canonical component ids into a well-formed `package.xml` snippet (P8-manifest-export) a human can hand to Gearset / Copado / `sf project deploy`.
sfi.object_access_audit
Given a CustomObject canonical id (`CustomObject:{ApiName}`), enumerate every Profile and PermissionSet that grants OBJECT-level access via incoming `grantedBy` e...
sfi.recordtype_availability
Given a Profile or PermissionSet canonical id (`Profile:{Name}` / `PermissionSet:{Name}`) - or the natural `profileApiName` / `profileId` / `permissionSetApiName`...
sfi.record_creation_paths
"How do records of this object get created?" - the record-provenance trace an admin needs to answer "how did this record get here?".
sfi.flow_graph
The FAITHFUL, LOSSLESS structural graph of a Flow - every canvas element with its REAL <name>, the full element-to-element connector graph (what runs next), decis...
sfi.nonselective_soql
Flag NON-SELECTIVE SOQL - a WHERE clause with a full-table-scan / timeout shape at large data volume.
sfi.flow_bulkification_audit
Flag Flows that perform a record Create / Update / Delete or a Get Records lookup INSIDE a Loop body, plus filterless Get Records anywhere - the Flow-side complem...
sfi.flow_trace
Honest PROJECTION of a Flow over a caller-supplied record state - the "what happens to THIS record" debugger.
sfi.flow_fault_audit
Which Flows have a DML/action element with NO fault path - the flow error-handling hygiene sweep.
sfi.picklist_integrity_scan
Org-wide picklist value-set integrity scan - the INVERSE of what_if_remove_picklist_value (which starts from one value).
sfi.review_change
Pre-deploy change review (the CI/deploy gate): given `components` (1..500 change entries a host assembles from a PR / package.xml / `git diff`; each carries `chan...
sfi.installed_package_catalog
Answer "what packages are installed in this org?" from the `InstalledPackage` metadata the refresh extracts (`installedPackages/<namespace>.installedPackage-meta....
sfi.annotations
Read the curated annotations overlay (`meta/annotations.jsonl`): ownership, lifecycle status (e.g.
sfi.propose_annotation
Record an AI-PROPOSED annotation (owner / status / glossary / domain / note) for a component.
sfi.review_annotations
List UNCONFIRMED annotation proposals from `meta/annotations.jsonl` (AI proposals awaiting human sign-off).
sfi.confirm_annotation
Confirm an AI-proposed annotation: re-writes the existing (componentId, key) value as `source: 'human', confirmed: true` - the same write as CLI `sfi annotate con...
sfi.reject_annotation
Reject (discard) an UNCONFIRMED annotation proposal by writing `op: 'unset'` for the (componentId, key) pair - dedicated reject verb wrapping CLI `sfi annotate <i...
sfi.component_history
The component's change timeline from the vault's OWN git history (`sfi vault git enable`): `git log --follow` over its source file - one entry per source-changing...
sfi.component_change_attribution
Who changed this component in Setup, and when - OFFLINE, from persisted SetupAuditTrail rows (`meta/setup-audit-trail.jsonl` written by `sfi refresh --with-audit-...
sfi.component_as_of
The component AS IT WAS at a git ref in the vault's own history: `git show <ref>:<sourcePath>` re-run through the SAME extractor the refresh uses for that type →...
sfi.history_tracking_gaps
Compliance audit: 'which sensitive fields have no field-history tracking enabled?'.