Connect Salesforce orgs

Vulkro Cloud for Salesforce

The Salesforce app in Vulkro Cloud scans your orgs on a schedule: org posture, users and access, integrations, exposure, personal data and the Apex code, on the same engine as vulkro-sf.

Read-only, always

Vulkro Cloud only reads: your org's configuration and metadata, its code, users and their permissions, login history and IP addresses for threat detection, and record counts. It never reads the contents of your business records, and it never deploys or changes anything in the org.

The connection uses the OAuth scopes api and refresh_token. Those scopes are broader than what Vulkro uses, so the read-only promise comes from the product, and you can narrow it further with the permission set below.

Connect an org

1. Go to Orgs > Connect Org.
2. In Salesforce, create an External Client App you own, following the checklist on that page (it shows the callback address to use). The recommended setup is a dedicated Integration User that holds a "Vulkro read" permission set, with the app approved by an admin for that permission set only, and IP restrictions enforced.
3. Paste the app details back into Vulkro Cloud: the login host (production or sandbox), the consumer key, and a name for the org.
4. Sign in to Salesforce to approve the connection.

A sandbox and a production org are connected the same way: the login host decides which it is. How many production orgs and sandboxes you can connect depends on your plan.

The permissions a scan needs

Permission	Why
API Enabled	Every read goes through the Salesforce APIs.
View Setup and Configuration	Settings, metadata, sharing, Connected Apps and the Setup Audit Trail.
View All Users	Users, profiles, permission sets and their assignments.
View Health Check	The Salesforce Health Check score.
View Event Log Files	Threat detection from the event logs. Skip it if you do not want threat detection.
Modify Metadata Through Metadata API Functions	Salesforce requires it for any Metadata API retrieve, including the read-only retrieve of your code. Vulkro never deploys. Skip it if the code comes from a Git repository (Org Settings > Code Source).
Manage Users (optional)	Salesforce requires it to read login history. Without it, the login history checks are reported as not checked.

Session token, for a quick look

For a sandbox or a developer org, you can also connect with a session token (Session Token (Advanced)). A session token acts with every permission of the person it belongs to and cannot be refreshed, so scheduled scans stop when the session ends. For a production org, use the External Client App above, and never paste a System Administrator's token.

Scans

Run a scan from the org, or set a schedule per org: every 6 hours, daily, weekly or monthly. How often you can schedule depends on your plan. A scan usually takes 10 to 20 minutes, and you can leave the page while it runs.

On the Team plan and up, Org Settings > Code Source can read the org's code from a Git repository instead of the org.

What your team gets

• Issues, one master list. Every finding of every kind in one list per org, kept across scans: org posture, identity, integrations, personal data, code, anti-patterns, tests and coverage, complexity and release readiness. Each issue has a stable key (VK-123), a status, an assignee, and when it was first reported and last updated. When a new scan no longer finds an issue, it is closed on its own; if it comes back, it is reopened.
• Triage with approval. Mark issues in progress or fixed at once. A false positive or an accepted risk is a proposal until someone with the right approves it, and it stays counted until then.
• Rules and suppressions. Every Vulkro rule is listed, including the ones that have not fired yet. Make a rule advisory (listed, not counted) or turn it off, for every org or only some files, and see how many findings each rule has suppressed and who decided. See vulkro-sf checks for the full rule list.
• Custom rules (Team plan and up). Write policies on your org's users, permission sets, integrations and Health Check settings, or code rules for your Apex, and test them on the latest scan before they go live.
• Changes between scans, threat detection, access reviews, compliance and AgentExchange readiness on the Team plan and up.
• Roles. See Roles and home views.

From the terminal and your AI coding agent

Connect vulkro-sf to your workspace once, approving it in the browser:

vulkro-sf cloud connect https://<name>.vulkro.com

Then list what to fix, triage, fix and verify from the terminal, or let your AI coding agent do it through the sf_cloud_* MCP tools and the Vulkro skill:

claude mcp add vulkro-sf -- vulkro-sf mcp serve
curl -fsSL https://dist.vulkro.com/skill-install.sh | bash -s -- --agent claude-code

See vulkro-sf cloud and the full MCP tool list in vulkro-sf mcp serve. Your workspace shows the same steps, with its own address filled in, under My account > vulkro-sf connections.

The workspace connection is workspace access only. Your vulkro-sf licence still comes from your account, and nothing in the cloud commands changes a Salesforce org.