salesforce-mcp-23-sync-mdapi-calls-in-async-context-law3-violation

The Salesforce MCP server had 23 synchronous conn.mdapi.* calls inside async tool functions across metadata/operations.py (14), security/operations.py (5), integration/operations.py (3), and utilities/operations.py (1). Sync calls in async functions block the event loop causing timeouts under concurrent load. All mdapi calls must be wrapped with await asyncio.to_thread(conn.mdapi.method, args...) pattern. Run grep -n 'conn.mdapi' --include='*.py' -r after any new tool additions to catch violations.