CLI · CRM development · Salesforce
Salesforce CLI
Create and manage Salesforce orgs, deploy metadata and run data commands from a terminal with the sf program.
Wrong org, real changes. Deploys and data commands act on whichever org is targeted. Always pass an explicit target org.
Understand the tool
What it does.
Salesforce CLI is the sf program for working with Salesforce orgs: creating and managing orgs, syncing source to and from them, creating and installing packages, and querying data. It is built on the open-source oclif framework and supports plugins.
Why use it?
Use it when Salesforce changes should be scripted and reviewable, such as deploying metadata from version control or exporting a query for a report. Every command can return JSON for scripts.
A useful fit for
- Deploying metadata from version control
- Scratch org and sandbox management
- Scripted data queries
From need to output
Ways to put it to work.
These are suggested workflows based on the documented capabilities. They are not recorded runtime results.
Use case 01
Check which orgs are connected
Before a deployment, a developer confirms which orgs the CLI can reach.
- Run sf org list --json.
- Confirm the target org's alias.
- Stop if the expected org is missing.
Intended outputA confirmed target before any deploy.
Use case 02
Export records for a report
An admin needs account records in a spreadsheet.
- Write a SOQL query.
- Run it against the named org with JSON or CSV output.
- Review the file before sharing.
Intended outputA reviewed export from the intended org.
A concrete starting point
List connected orgs as JSON
Lists orgs the CLI is authorized to, from local configuration. With no logins, it returns empty lists.
sf org list --jsonWhat this can change
Reads local CLI configuration; does not contact or change any org.
This example has not been executed for this review. Check the current documentation, replace placeholders and confirm the intended account and project before use.
Before you start
Setup and access.
What you’ll need
- Node.js for the npm install, or Salesforce's Windows or macOS installers
- A Salesforce org and login for any org operation
- Terminal access
- Authentication
- Org login through the CLI's web, JWT, access-token or SFDX auth-URL flows (sf org login); authorizations are stored in local CLI configuration.
- Can read
- Org metadata and data within the logged-in user's permissions
- Local CLI configuration
- Can write or change
- Deployments, data changes, org creation and deletion when commands and permissions allow
- Network and data flow
- Salesforce org and login endpoints
- Salesforce CLI telemetry and update services (disabled for this test)
- Approval and control
- The CLI follows org permissions. Use --json and explicit --target-org values in scripts; do not assume a destructive command will ask again.
Check your environment
Compatibility, costs and license.
Compatibility notes
- Windows, macOS and Linux
- npm or platform installers
- Plugins extend the command set
Costs and account requirements
The CLI is free and open source. Salesforce org editions and licenses are priced separately.
Current pricing or plan information ↗Apache-2.0
Code license; Salesforce org use is governed by your Salesforce agreements.
Read the license or service terms ↗Keep the boundaries visible
Concerns and limitations.
Wrong org, real changes
Deploys and data commands act on whichever org is targeted. Always pass an explicit target org.
Plugins run code
Installed plugins add executable code. Install only plugins you have reviewed.
Where it may fall short
- Only version and org listing ran, with no logins.
- Telemetry and autoupdate were disabled for the test.
Observed behavior · 2026-10-18
Runtime and security findings.
The official npm package reported its version and listed connected orgs as JSON with empty lists, confirming credential-free local behavior. No org was contacted.
These checks cover the conditions below. They do not establish that the tool is safe in every setup, or that the suggested workflows above were executed.
What we found
Observed in this evaluation
Machine-readable output without a login
sf org list --json returned structured empty results with no org logged in.
In practice: Use --json and check status in scripts, and pass an explicit --target-org for every org command.
Observed in this evaluation
Several login flows, one local store
sf org login lists web, JWT, access-token and SFDX auth-URL flows; each stores the authorization in local CLI configuration.
In practice: On shared machines or CI, prefer JWT with a dedicated integration user, and log out when done.
Version, environment and fixture
- Version or deployment
- @salesforce/cli 2.154.4 (npm latest at test time)
- Tested target
- @salesforce/cli from the npm registry, run as sf
- Artifact identity
- npm dist.integrity sha512-5y8YyCZvXRDCsjo2HZPzTzhf8Ck8O5F0Lllrem2pfkEa1C6n6el8c1NnePWHBd2rXFw/PWLEPqwMgr3ccA5Gbg== (registry-published package integrity; not an independent provenance audit)
- Environment and fixture
- Debian Linux x86_64 (kernel 6.12); Node.js 24.18.0; npm 11.16.0; installed with --ignore-scripts into an isolated directory.
- Fresh HOME; environment limited to PATH plus SF_DISABLE_TELEMETRY, SF_AUTOUPDATE_DISABLE and SF_SKIP_NEW_VERSION_CHECK; no Salesforce login or credentials.
- Observed 2026-10-19T06:29:11.146438+00:00 through 2026-10-19T06:29:12.161824+00:00 UTC.
Checks and results
2 recorded checks. Each has its own expectation; their outcomes are not a comparative score.
Installed versionMet expectation
- Method
sf --version- Expected
- Print the package version.
- Observed
- Exit 0. @salesforce/cli/2.154.4 linux-x64 node-v24.18.0. Stderr carried a Node warning that a spawned sf process was not found on the isolated PATH; the command still completed.
Empty org listMet expectation
- Method
sf org list --json- Expected
- Return status 0 with empty org lists when no org is logged in.
- Observed
- Exit 0. JSON status 0; result lists other, sandboxes, nonScratchOrgs, devHubs and scratchOrgs all empty; warnings empty.
Practical caveats
- The npm latest version tested (2.154.4) lagged the latest repository release (2.156.5).
- Installed with --ignore-scripts; platform installers were not tested.
What this evaluation does not establish
- Org login (web, JWT or access token), org operations, deployments, data commands and plugin installation.
- Telemetry and autoupdate behavior with defaults on, and the Windows and macOS installers; only the npm package ran on Linux.
Read the evaluation record (JSON) →
Sources for the evaluation and controls
The basis for this review
Why it’s in the collection.
The standard tool for scripted Salesforce work, with JSON output throughout. Ranked after general-purpose tools because it serves one platform.
The number is an editorial starting order within the cli tools collection. It does not measure popularity, speed, reliability or safety.
Why we added it
Round-6 directory addition: the official CLI for the CRM most often named in small-business automation requests.
Selection evidence checked .
- Repository interest
- 184 GitHub stars at this snapshot ↗
Repository-level interest; the latest repository release (2.156.5) is newer than the npm latest version tested (2.154.4)
- Repository activity
- Last push reported by GitHub: . A push can include documentation or maintenance; it does not establish a new stable release.
- Release signal
- 2.156.5 ↗ · published . This selection signal can differ from the exact runtime tested above.
- Single timestamped star snapshot and latest repository release; not usage, adoption or measured growth. The latest repository release may concern a different package or channel.
- Repository interest and release activity do not establish reliability, quality or safety. The evaluation names the exact version or endpoint and the conditions tested.
What we reviewed
- Official setup guide and repository
- Local credential-free run
The evaluation above lists the current runtime coverage and untested behavior.
Reviewed Oct 18, 2026. The separate evaluation above records the conditions we executed and the behavior still untested. Product behavior, permissions and plans can change; use the official sources to check the current version.
Follow the evidence
Official sources.
- Official Salesforce CLI setup guide ↗developer.salesforce.com
- Official repository and license ↗github.com
- Salesforce CLI overview ↗developer.salesforce.com