Salesforce metadata intelligence, run locally
Skemia reads your Salesforce source and metadata on your own machine, then shows how every component connects, what a change will reach, and who can access what. The scan needs no credentials and no org connection, and Skemia never writes to your org.
A map of your org that does not need your org.
Building the map reads files on disk. No login, no Salesforce CLI, no upload. When you do want a live org, Skemia uses your own Salesforce CLI, and it only reads.
Look inside
The interactive graph maps the whole org. Focus a component to see what it uses and what uses it, coloured by category and sized by impact. Every edge says how sure it is.
Local by design
Building the map reads files on disk. It needs no Salesforce credentials, no Salesforce CLI and no org connection, and it writes only to its own output folder.
The Studio, the CLI and the engine run on your machine. The Studio listens on this computer only by default. Anything that contacts a network is a feature you start, and each one is listed on the security page.
Every dependency carries High, Medium or Low confidence and the file that justifies it. Low means a lead, not a fact. No model can add or remove an edge.
How it works
A local DX project, a metadata zip, or a Git repository. With an org key, Skemia can also retrieve an org through your own Salesforce CLI. Narrow the scan to the metadata you care about.
Apex is parsed with a real grammar and LWC with Babel. Every dependency carries a confidence and the file that proves it. The graph is deterministic: the same source gives the same map.
Explore the graph, trace the impact of a change, plan a deploy bundle, work out least-privilege access, and find what is fragile or dead. In the Studio, the CLI, or through an AI agent over MCP.
What is inside
The whole org, as one interactive map.
Focus any component to see what it uses and what uses it, coloured by category and sized by impact. Filter by Area, type or status, change the layout, and right-click a node to jump to its details, trace, deploy bundle or access kit.
See the reach of a change before you make it.
Walk a dependency chain level by level, downstream to see what a component relies on or upstream to see what relies on it. In CI, ske diff reports the blast radius of the files a pull request changed and can fail the build when they have dependents.
If you move this, what has to come with it.
Pick a component and Skemia collects what it depends on, groups it in a suggested deploy order, and writes a package.xml. Items it leaves out are listed with a reason. You deploy it with your own tooling: Skemia never deploys.
Studio view needs a build key
Who can access what, read from metadata.
Object and field access across permission sets, profiles and groups, with muting applied. Dangerous system permissions are flagged, overlapping sets are scored for consolidation, and for an object the answer includes its sharing rules. It shows what is granted, not who is assigned.
A least-privilege permission set, derived from source.
Pick a feature entry point, such as an app, component, flow or controller, and Skemia derives a candidate permission set from what it touches. Each grant carries a confidence and a reason, and blind spots from dynamic code are called out. Review it and validate it in a sandbox.
Studio view needs a build key
Query the map however you work.
The same map drives the ske command line, an MCP server with 31 tools so an AI agent can ask the map instead of reading files, and a read-only SQL console over every component, dependency and risk. No MCP tool connects to an org.
See it live
From the health score to the deploy bundle, permissions and the access kit. Book a time and we will walk an org end to end and answer your questions.
Who it is for
A printable report of how the org is built, by Area, with the most depended-on components and the integration and security surface.
See what a change reaches before you make it, and plan the deploy bundle with a package.xml that follows the dependencies.
Who can access what across permission sets, profiles and groups. Dangerous grants flagged, least-privilege candidates derived from source.
Understand a client org fast and leave with evidence. Client orgs are allowed under the licence, each counted as an Active Org.
Early access
Skemia is in early access. There are no public downloads yet: ask for an evaluation build, or book a walkthrough and see it on a call.
