Dx Code Analyzer Run

This handles the full scan and results workflow for Salesforce Code Analyzer: you ask it to check security issues, run PMD on your Apex, lint your LWC, or scan just the files you changed, and it builds the correct `sf code-analyzer run` command with proper v4+ syntax (the flags changed and the old ones now break). It runs the scan, parses the output through bundled Node scripts instead of trying to wrangle massive JSON inline, and can filter by engine, severity, file, or rule. If the engine found auto-fixable violations, it discovers them, asks for confirmation, applies the fixes, and summarizes what changed. Useful for AppExchange reviews, pre-commit checks, or just figuring out why PMD is yelling at you. The strict tool restrictions and mandatory script usage keep it from reinventing parsers badly, which is the right call.

skills.sh installs: 6.7K
GitHub stars: 1.2K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add forcedotcom/sf-skills --skill dx-code-analyzer-run --agent claude-code

Installs into .claude/skills of the current project.

Files

Running Code Analyzer Skill

CRITICAL: Mandatory Script Usage

Every interaction with Code Analyzer results MUST go through the bundled scripts in <skill_dir>/scripts/. No exceptions.

WRONG — never do this:

# WRONG: inline Python to parse results
python3 -c "import json; data = json.load(open('results.json'))..."

# WRONG: inline Node.js to parse results
node -e "const data = require('./results.json')..."

# WRONG: jq to filter results
cat results.json | jq '.violations[] | select(.engine=="pmd")'

# WRONG: reading the results file directly (it can be 10MB+)
Read tool → code-analyzer-results-*.json

Also forbidden: run_code_analyzer and any mcp__* tool — Bash only.

RIGHT — always do this:

# Summarize scan results
node "<skill_dir>/scripts/parse-results.js" "./code-analyzer-results-TIMESTAMP.json"

# Filter/rank/query results (by engine, severity, file, rule, category)
node "<skill_dir>/scripts/query-results.js" "./code-analyzer-results-TIMESTAMP.json" --engine pmd --summary

# List/browse available rules (by engine, category, language, severity)
node "<skill_dir>/scripts/list-rules.js" "Security" --top 10

SKILL.md on GitHub