Verified skill
Real-time security audit skill scanning for OWASP Top 10 vulnerabilities and infrastructure misconfigurations.
Automatic Salesforce Org Configuration Drift Remediation
This skill acts as an automated guardian for Salesforce org configurations, continuously monitoring environments against a defined source of truth. It identifies deviations that could lead to deployment failures or compliance issues, providing a clear path to resolution and ensuring Salesforce instances remain aligned and stable.
It eliminates the significant time Salesforce development teams spend manually comparing metadata between orgs and version control, automating the detection and resolution of configuration drift. This reduces operational risk, improves release velocity, and prevents unexpected deployment failures.
Functionally, the skill discovers current Salesforce org metadata, retrieves the desired state from version control, performs deep comparisons, generates detailed drift reports, proposes and validates remediation plans, and executes approved changes, followed by post-remediation verification.
What It Does
This skill automatically discovers the current state of a Salesforce org's metadata, including custom objects, fields, Apex classes, and profiles. It identifies the desired state from a specified source, such as a version control repository. The skill produces a detailed report highlighting all discrepancies and generates a remediation plan to bring the org back into alignment. It verifies proposed changes by simulating deployments and re-scans the org post-remediation to confirm the desired state.
The Problem It Removes
Salesforce development teams frequently struggle with "org drift," where manual changes, hotfixes, or unmanaged deployments cause the production org to diverge from the version-controlled source of truth. This recurring pain leads to failed deployments, unexpected bugs, and significant time spent debugging.
The real cost includes delayed releases, increased developer hours for troubleshooting, production incidents, and a general loss of confidence in the deployment process. It also impacts compliance and audit readiness, as the actual state of the org is unknown.
This skill removes the manual, error-prone work of comparing org configurations and identifying drift. It automates the detection and remediation, allowing teams to maintain a consistent, verifiable state across their Salesforce environments, thereby accelerating deployments and reducing operational risk.
Who It Is For
Salesforce Administrators, Developers, Release Managers, and Compliance Officers in any organization using Salesforce for critical business operations.
Especially valuable when:
- Organizations with multiple Salesforce development teams working on the same org will find this valuable for maintaining consistency.
- Companies undergoing frequent Salesforce releases and deployments will benefit from reduced deployment failures.
- Environments where strict compliance and audit trails are required can ensure their orgs match the source of truth.
- Teams struggling with "metadata lock" or deployment conflicts will see these issues resolved proactively.
- Businesses aiming to reduce manual effort in Salesforce administration will appreciate the automation.
- Enterprises with complex Salesforce orgs and numerous customisations can manage their environments more effectively.
- Teams adopting DevOps practices for Salesforce development will find this skill essential for continuous integration.
How It Differs From Similar Skills
While salesforce-development provides expert patterns for Salesforce platform development, it does not actively monitor for or remediate configuration drift post-deployment. This skill focuses on the operational job of maintaining org integrity against a defined source of truth.
salesforce-automation automates specific tasks within Salesforce, but it does not perform a holistic comparison of metadata or proactively identify and fix discrepancies between environments. This skill operates at a higher level of environmental consistency, ensuring the entire environment aligns with a desired state.
When To Use
- A Salesforce deployment to production fails unexpectedly due to metadata conflicts.
- A new developer joins the team and struggles to understand why their sandbox differs significantly from the main branch.
- An audit requires proof that all Salesforce environments are consistent with the version-controlled source of truth.
- After a critical hotfix was applied directly in production, the team needs to ensure it's properly back-propagated or reconciled.
- Regularly scheduled CI/CD pipeline checks reveal inconsistencies between a sandbox and the main branch.
Inputs
salesforceOrgCredentials: Credentials for the Salesforce org (e.g., production, sandbox, developer org) to be scanned and potentially remediated.
sourceOfTruthRepositoryUrl: The URL of the version control repository (e.g., Git) containing the desired state of the Salesforce metadata.
sourceOfTruthBranch: The specific branch within the version control repository that represents the desired state.
approvalRequiredForDestructiveChanges: Whether explicit user approval is required before applying any remediation steps that involve deleting or overwriting existing metadata not present in the source of truth.
Outputs
driftReport: A detailed report outlining all discrepancies between the current Salesforce org configuration and the desired state, categorized by type, severity, and impact.
remediationPlan: A proposed set of actions (Metadata API deployment package or manual instructions) to bring the Salesforce org into alignment with the desired state.
postRemediationVerificationReport: A report confirming the successful resolution of drift and verifying that no new discrepancies were introduced after remediation.
How It Works From Start To Finish
- Connect to Salesforce orgs and version control system.
- Discover current Salesforce org metadata.
- Retrieve desired state metadata from source of truth.
- Perform deep comparison of metadata components.
- Identify all configuration drift discrepancies.
- Categorize drift by type, severity, and impact.
- Generate a detailed drift report.
- Propose a safe remediation plan.
- Simulate remediation deployment for validation.
- Execute approved remediation steps.
- Verify post-remediation org state.
- Update drift baseline for continuous monitoring.
What you supply
- Salesforce Org credentials (production, sandbox, or developer org).
- Source of truth repository URL and branch (e.g., Git repository with Salesforce DX project).
What it finds out on its own
- All metadata components within the specified Salesforce org.
- All metadata components within the specified source of truth repository.
- Dependencies between metadata components.
- Deployment history and change sets within the org.
Step By Step
-
Connect to Salesforce and Version Control
Establish authenticated connections to the specified Salesforce org and the version control system (e.g., Git repository).
Done when: Both Salesforce org and version control system connections are successfully authenticated and accessible.
If it cannot finish: Report specific connection errors for Salesforce or version control and halt, providing diagnostic logs.
-
Discover Current Org Metadata
Use Salesforce Metadata API to retrieve all metadata components from the connected Salesforce org.
Done when: All accessible metadata components from the Salesforce org are successfully retrieved and stored.
If it cannot finish: Report the specific Metadata API error and halt, providing logs for diagnosis.
-
Retrieve Desired State Metadata
Clone or fetch the specified branch from the version control repository and extract all Salesforce metadata components.
Done when: All metadata components representing the desired state are successfully retrieved from the version control system.
If it cannot finish: Report connection or repository access errors and prompt the user to verify repository URL and branch.
-
Compare Current and Desired States
Perform a deep, component-by-component comparison between the discovered current org metadata and the retrieved desired state metadata. Analyze metadata dependencies.
Done when: A comprehensive list of all discrepancies, including additions, modifications, and deletions, is generated, with dependencies identified.
If it cannot finish: Report comparison engine errors or data parsing issues, suggesting review of retrieved metadata.
-
Categorize and Report Drift
Categorize identified discrepancies by type (e.g., new, modified, deleted), severity (e.g., critical, major, minor), and potential impact. Generate a detailed drift report.
Done when: A structured drift report is produced, listing all discrepancies with their categorization and impact assessment.
If it cannot finish: Report categorization logic errors or report generation failures, providing raw discrepancy data.
-
Propose Remediation Plan
Based on the categorized drift, generate a remediation plan using Salesforce Metadata API deployment packages or explicit manual instructions for unresolvable items. Ensure all components in the plan are derived from the desired state.
Done when: A remediation plan is generated, outlining the necessary steps to align the org with the desired state, with unresolvable items flagged.
If it cannot finish: Report plan generation errors, especially if dependencies cannot be resolved or if the desired state is ambiguous for certain components.
-
Validate Remediation Plan
Perform a `checkOnly` deployment (validation deployment) of the proposed remediation package to the Salesforce org to identify conflicts or errors without applying changes.
Done when: The `checkOnly` deployment completes, and a validation report is generated, indicating success or listing all validation errors.
If it cannot finish: Report all validation errors from the `checkOnly` deployment and do not proceed with actual deployment, suggesting manual intervention.
-
Execute Approved Remediation
Upon user approval, execute the remediation plan by deploying the validated metadata package to the Salesforce org.
Done when: The metadata deployment completes successfully, and the Salesforce org confirms the changes.
If it cannot finish: Rollback any partial changes if possible, report the exact deployment failure, and leave the org in its prior state, providing a clear recovery path.
-
Verify Post-Remediation State
Re-scan the Salesforce org's metadata and compare it against the desired state to confirm that all identified drift has been resolved and no new issues were introduced.
Done when: A post-remediation verification report confirms zero remaining discrepancies against the desired state.
If it cannot finish: Report remaining discrepancies and suggest re-running the remediation or manual inspection, ensuring no false positives.
How It Checks Its Own Work
Checks before it delivers
- Validate generated remediation package against Salesforce Metadata API schema.
- Perform a `checkOnly` deployment to identify potential conflicts or errors before actual deployment.
- Re-fetch org metadata post-remediation and compare against the desired state to confirm resolution.
- Verify that no unintended changes were introduced during remediation.
If something goes wrong
- If metadata retrieval fails: Report the specific API error and halt, providing logs for diagnosis.
- If desired state source is unreachable: Report connection error and prompt user to verify repository access.
- If `checkOnly` deployment fails: Report all validation errors and do not proceed with actual deployment, suggesting manual intervention.
- If actual deployment fails: Rollback any partial changes if possible, report the exact failure, and leave the org in its prior state, providing a clear recovery path.
- If post-remediation verification fails: Report remaining discrepancies and suggest re-running or manual inspection, ensuring no false positives.
Mistakes It Prevents
| The mistake | What it costs | How the skill prevents it |
|---|---|---|
| Deploying changes without first detecting existing configuration drift. | Deployment fails due to unexpected conflicts or overwrites critical manual changes, leading to production incidents and rollbacks. | Always perform a full drift detection scan and generate a remediation report before any deployment to identify discrepancies. |
| Overwriting critical manual changes made directly in a production or UAT environment. | Business-critical functionality breaks, requiring urgent manual intervention and potentially data loss if not properly backed up. | Categorize detected drift, flag manual changes not in the source of truth for human review, and require explicit approval before overwriting. |
| A remediation plan introduces new errors or unintended side effects into the org. | The org becomes unstable, new bugs appear, and the remediation effort itself causes more problems than it solves, eroding trust in the automation. | Always perform a 'checkOnly' deployment (validation deployment) and run automated tests against the remediated sandbox before applying changes to production. |
| Incomplete remediation, leaving partial drift or new discrepancies after the process is supposedly finished. | The 'fixed' org still has inconsistencies, leading to future deployment failures or unexpected behavior, negating the value of the remediation. | Conduct a post-remediation re-scan of the org and compare it against the desired state to confirm all identified drift has been resolved and no new drift introduced. |
| The remediation plan includes components not explicitly present in the source of truth. | The org is brought into an unmanaged state, or critical components are deleted because they were not in the source, leading to data loss or broken functionality. | Ensure all components in the remediation package are explicitly derived from the desired state source of truth, flagging any additions for review. |
| Ignoring metadata dependencies during the remediation process. | Deploying a change to one component without considering its dependencies can break related components, leading to cascading failures across the org. | Analyze metadata dependencies and ensure the remediation plan deploys components in the correct order, or includes all necessary dependent components. |
Edge Cases It Handles
- Deploying changes without first detecting existing configuration drift.
- Always perform a full drift detection scan and generate a remediation report before any deployment to identify discrepancies.
- Overwriting critical manual changes made directly in a production or UAT environment.
- Categorize detected drift, flag manual changes not in the source of truth for human review, and require explicit approval before overwriting.
- A remediation plan introduces new errors or unintended side effects into the org.
- Always perform a 'checkOnly' deployment (validation deployment) and run automated tests against the remediated sandbox before applying changes to production.
- Incomplete remediation, leaving partial drift or new discrepancies after the process is supposedly finished.
- Conduct a post-remediation re-scan of the org and compare it against the desired state to confirm all identified drift has been resolved and no new drift introduced.
- The remediation plan includes components not explicitly present in the source of truth.
- Ensure all components in the remediation package are explicitly derived from the desired state source of truth, flagging any additions for review.
- Ignoring metadata dependencies during the remediation process.
- Analyze metadata dependencies and ensure the remediation plan deploys components in the correct order, or includes all necessary dependent components.
A Worked Example
A Salesforce development team at 'Innovate Solutions' accidentally deployed a hotfix directly to their production org, 'InnovateProd', bypassing their standard Git-based CI/CD pipeline. This hotfix involved adding a new custom field `Project_Status__c` to the `Opportunity` object and modifying an Apex class `OpportunityHelper` to include new validation logic. The `main` branch in their GitHub repository `innovate-salesforce-dx` does not reflect these changes. The team needs to reconcile the production org with the `main` branch.
Input
{"salesforceOrgCredentials": {"username": "prodadmin@innovatesolutions.com", "password": "secureProdPassword", "loginUrl": "https://login.salesforce.com"}, "sourceOfTruthRepositoryUrl": "https://github.com/InnovateSolutions/innovate-salesforce-dx.git", "sourceOfTruthBranch": "main", "approvalRequiredForDestructiveChanges": true}Expected output
{"driftReport": "## Salesforce Org Drift Report for InnovateProd\n\n### Discrepancies Found (2)\n\n| Component Type | Component Name | Discrepancy Type | Severity | Impact |\n|---|---|---|---|---|\n| CustomField | Opportunity.Project_Status__c | Added in Org, Missing in Source | Major | Potential deployment failure, data inconsistency |\n| ApexClass | OpportunityHelper | Modified in Org, Different in Source | Major | Logic divergence, unexpected behavior |\n\n### Proposed Remediation Plan\n\n**Option 1: Reconcile Org to Source (Recommended)**\n* **Action**: Deploy `Opportunity.Project_Status__c` (deletion) and `OpportunityHelper` (revert to source version) to InnovateProd.\n* **Requires Approval**: Yes (for deletion of field and overwrite of class).\n\n**Option 2: Update Source from Org (Manual Review Required)**\n* **Action**: Create a pull request to add `Opportunity.Project_Status__c` and update `OpportunityHelper` in `main` branch.\n* **Requires Approval**: Yes (for code review and merge).", "remediationPlan": {"type": "MetadataDeployment", "description": "Deployment package to align InnovateProd with the 'main' branch.", "componentsToDelete": [{"fullName": "Opportunity.Project_Status__c", "type": "CustomField"}], "componentsToDeploy": [{"fullName": "OpportunityHelper", "type": "ApexClass", "source": "main_branch_version_of_OpportunityHelper.cls"}], "manualReviewRequired": [{"description": "Review the hotfix changes for Opportunity.Project_Status__c and OpportunityHelper to decide if they should be merged into the main branch instead of reverted."}]}, "postRemediationVerificationReport": "## Post-Remediation Verification Report for InnovateProd\n\n### Discrepancies Found (0)\n\nThe Salesforce org 'InnovateProd' is now fully aligned with the 'main' branch of 'innovate-salesforce-dx'. No remaining discrepancies detected."}Why this output: The skill first identifies that `Opportunity.Project_Status__c` exists in the production org but not in the Git `main` branch, and that `OpportunityHelper` in production differs from the `main` branch. It categorizes these as major discrepancies. The proposed remediation plan offers two options: either revert the production org to match the `main` branch (which involves deleting the field and overwriting the class, thus requiring explicit approval), or manually review the hotfix changes to update the `main` branch. The expected output shows the `driftReport` detailing these findings and a `remediationPlan` for the first option. After execution, the `postRemediationVerificationReport` confirms that the production org now perfectly matches the `main` branch, indicating successful remediation.
Keeping It Current And Knowing Its Limits
Keeping it current
The skill runs scheduled drift detection scans (e.g., daily or weekly) and, with user approval, automatically applies approved remediation plans. It integrates with CI/CD pipelines to prevent drift from occurring during deployments.
What it will not do
- It will not invent metadata or configuration details; any unverified discrepancies are flagged for human review.
- It cannot resolve conflicts that require business decisions or manual data manipulation.
- It requires appropriate Salesforce API access and version control system permissions.
- It will not modify data records, only metadata components.
Limitations
Installation
Add to Cline skills directoryRegister as MCP toolAdd to .vscode/skills/Before You Run It
Security notes
- This skill requires Salesforce Org credentials with Metadata API permissions. Ensure these credentials are securely managed and have the minimum necessary access.
- The skill performs outbound network requests to Salesforce APIs and your version control system.
- Remediation plans can involve destructive changes (e.g., deleting metadata components). Explicit user approval is required for such actions, but users should review all proposed changes carefully.
- The skill interacts with your filesystem to clone repositories and manage metadata files.
Questions People Ask
What is Salesforce org drift and why is it a problem?
Org drift occurs when your Salesforce organization's metadata configuration deviates from its defined source of truth, typically a version control repository. This leads to failed deployments, unexpected bugs, and significant time spent debugging, impacting release cycles and compliance.
Is this skill safe to use in a production Salesforce environment?
Yes, the skill is designed with safety in mind. It performs a `checkOnly` deployment (validation) before applying any changes and requires explicit user approval for potentially destructive actions. It also provides a clear recovery path if an actual deployment fails.
What happens if the remediation plan introduces new errors?
The skill includes a post-remediation verification step that re-scans the org and compares it against the desired state. If new discrepancies are found or the org is not fully aligned, it will report these issues, suggesting further inspection or re-running the remediation.
Can this skill resolve all types of configuration drift?
This skill excels at detecting and remediating metadata configuration drift. However, it will not invent metadata, resolve business-level conflicts, or modify data records. Any unresolvable or unverified discrepancies are flagged for human review.
How does this skill help maintain consistency over time?
Beyond one-time remediation, this skill can be integrated into CI/CD pipelines and run scheduled scans. This continuous monitoring and automated, approved remediation helps prevent drift from accumulating, ensuring your Salesforce environments remain consistent with your source of truth.
What people say, and where to get help
No ratings yet. If you have used this skill, yours would be the first.
Sign in to leave a rating
An account keeps your review with your name on it, and lets you edit it later. Sign in or create one free.
No reviews yet
This skill has not been rated. If you have run it, a short note about what you used it for helps the next person more than any description can.
Related Skills You May Like
Discover more AI agent skills in the same category to enhance your workflow automation.
Diagnose OpenClaw Android, iOS, or macOS node pairing, QR/setup code, route, auth, and connection failures.
Leverages AI-assisted debugging and multi-agent orchestration to systematically diagnose, resolve, and prevent production issues, reducing Mean Time To Recovery (MTTR).
A fully functional, temporary preview environment is deployed from a feature branch, verified for correctness, and ready for review.
Premium skill
$120.00 , one time purchase
Automatically generates and optimizes Salesforce reports and dashboards based on natural language requests, ensuring data accuracy and performance.
Interact directly with MCP servers using the mcporter CLI for listing, configuring, authenticating, and calling tools via HTTP or stdio.
Have a Skill to Share?
Join the community and help AI agents learn new capabilities. Submit your skill and reach thousands of developers.