Salesforce-MCP-Server

The primary authentication in `salesforce_mcp.py` uses Web Server OAuth Flow with PKCE, which is a secure standard. Credentials (Client ID/Secret) are loaded from environment variables, which is good practice. However, access tokens are saved to a plaintext file (`~/.salesforce_mcp_token.json`), which presents a moderate risk as any local process with file access can read the token. The `configure_salesforce` MCP tool within `salesforce_mcp.py` confusingly still accepts and stores `username` and `password` in `os.environ`, though these are not used by the primary PKCE authentication flow. Older documentation and test scripts also reference the less secure Username-Password Flow, but the main server has pivoted to PKCE. No malicious patterns like `eval` or obfuscation were detected.