Salesforce MCP v7.1.0 + Bible v19.1.10 both merged to main on 2026-05-06. Salesforce now exposes 9 n
What
Salesforce MCP v7.1.0 + Bible v19.1.10 both merged to main on 2026-05-06. Salesforce now exposes 9 new operator-intent tools (673→682): sf_disable/enable_profile_permissions, sf_disable/enable_permission_set_permissions, sf_get_profile/permission_set/muting_permission_set_full_metadata, sf_validate_user_permissions, sf_resolve_permission_dependencies, plus sf_update_permission_set/muting_permission_set_metadata writers. Bible v19.1.10 codifies R48 Complete-Capability Invariant (operator intent in one round-trip; MCP absorbs all iteration) + Check 15 Symmetric Metadata Reader-Writer Audit (framework/scripts/symmetric_reader_audit.py CI gate). Production fail-closed defaults flipped to fullcopy (12 sites); RunLocalTests is now production testLevel default (was structurally-broken RunSpecifiedTests+tests=[]). Salesforce skill v5.0→v5.1 synced (frontmatter + 3 body sites + capability-sync-state.yaml + new references/profile-complete.md, all mirrors byte-identical).
Why
Routing decisions for Salesforce permission-tightening operator outcomes (especially the 19-permission System Admin Clone scenario that motivated v7.1.0) should now route to sf_disable_profile_permissions ONE-CALL surface, not the v7.0.x sf_update_profile_metadata loop pattern. R48 enforcement extends to any future operator-intent MCP work — the principle is reusable across pairs.
Action Required
Update routing to direct profile/permission-set permission tightening to v7.1.0 P5 operator-intent tools. Adopt R48 Complete-Capability Invariant as routing principle for future operator-intent surfaces. When delegating to skill-MCP pairs, expect v7.1.0+ to enforce G5 fail-closed (production deploys require explicit org_alias=production).