Run and interpret the ApexGuru engine in Salesforce Code Analyzer v5 for Apex performance and scalability findings: verify the authenticated target org, scope .cls/.trigger files, capture JSON evidence, triage line-level recommendations, validate fixes, and avoid claiming runtime telemetry the report does not contain. Trigger keywords: ApexGuru scan, apexguru Code Analyzer, Apex performance findings, SOQL scalability issue, AI Apex optimization. NOT for general PMD/security lint — use devops/salesforce-code-analyzer. NOT for Apex debug-log or production transaction profiling.
Use ApexGuru as one evidence source for Apex performance work. In Salesforce Code Analyzer v5 it is an AI-driven remote analysis engine that requires an authenticated Salesforce org, scans Apex .cls and .trigger files, and returns line-level JSON findings. A connected org is required for the service; that fact alone does not prove the report contains production runtime telemetry.
Preconditions
Confirm all of the following before scanning:
Check
Required evidence
Stop condition
Code Analyzer generation
sf code-analyzer --help or installed plugin version confirms v5 commands
Legacy sfdx scanner:* only
Target identity
Exact org alias/username resolved by Salesforce CLI
Alias absent, ambiguous, or unauthenticated
ApexGuru availability
Org supports and has ApexGuru activated
Engine unavailable or activation unknown for a required scan
Workspace
Explicit project/workspace root
Accidental scan of a home or monorepo root
Targets
Bounded .cls and .trigger files inside the workspace
Request expects Flow, metadata XML, objects, or other unsupported files
Baseline
Current commit/hash, tests, and scan output path
Findings cannot be tied to source revision
Authority
Read/analysis operation only; no production mutation implied
Request asks the scan to approve or deploy a fix
Authentication is reused from the Salesforce CLI session. Do not put usernames, passwords, access tokens, or refresh tokens in code-analyzer.yml.
Reproducible CLI Scan
Use Code Analyzer v5 and write machine-readable output:
The shown timeout/backoff values are documented defaults. Change them only for an observed need and keep api_max_retry_ms >= api_initial_retry_ms. The overall api_timeout_ms remains the hard budget.
Prefer an explicit --target-org in CI when multiple authenticated orgs exist; it is easier to audit than relying on a developer's default org. Never commit secret material.
Evidence Mode and Attribution
Classify the output before interpreting it:
Mode
What may be claimed
Code Analyzer ApexGuru JSON
ApexGuru analyzed the identified source revision through the authenticated org service and returned these findings
Report explicitly carries analysisMode: static
Preserve the label Static only; do not infer production behavior
Report explicitly carries analysisMode: full or a documented equivalent
Preserve the report's exact label and evidence; identify which metrics are actually present
No mode field or runtime metrics
Label Source analysis; do not call it production telemetry, hotspot frequency, or measured runtime impact
Debug logs, Event Monitoring, APM, or transaction traces
Treat as separate runtime evidence and link it to the source finding without attributing it to ApexGuru unless the report says so
A finding's severity is the engine's prioritization, not a measured CPU/heap/query cost. Validate impact in the relevant transaction and data-volume context.
JSON Result Contract
Code Analyzer v5 JSON contains a root object with runDir, violationCounts, versions, and violations. Each violation should preserve:
rule and engine;
numeric severity 1–5;
message and tags;
all locations plus primaryLocationIndex;
resource links and available suggestions/fixes;
source revision, workspace, target org identity, command, and scan timestamp stored beside the report.
Do not flatten multi-location findings to one line when the analysis path matters. CSV includes only the primary location; JSON or SARIF is preferable for review and automation.
Normalize and group findings with the bundled checker while preserving original JSON. Group by rule, affected transaction/entry point, shared query/DML pattern, and severity—not severity alone.
Inspect code context around every primary and related location, and confirm that the finding applies to a reachable path.
Cross-check runtime relevance using tests, data volume, query plans, debug logs, transaction traces, or production insights when authorized and available.
Choose a disposition and design the smallest safe change: fix, validate, suppress-with-rationale, defer, or not-applicable. Preserve sharing, CRUD/FLS, transaction semantics, bulk behavior, ordering, and error handling.
Test and rescan positive, negative, bulk, and failure paths, then rerun the same targets with the same engine/config and compare result hashes/findings.
Record residual risk and supporting evidence. A zero-finding scan is not proof of runtime performance or absence of all Apex defects.
Disposition Criteria
Disposition
Use when
Required record
fix
Finding is applicable and a safe change is understood
Change, tests, before/after scan, runtime or scale rationale
validate
Applicability or impact depends on data shape or call path
Exact experiment/query plan/log evidence needed
suppress-with-rationale
Finding is accepted, false positive, generated code, or unavoidable under a documented constraint
The checker validates the Code Analyzer JSON shape, severity/location data, Apex file scope, and evidence-mode labeling. It does not contact Salesforce or judge whether a recommendation is correct.
Related Skills
devops/salesforce-code-analyzer — install/configure v5, combine engines, output formats, CI gates, and suppression policy.
apex/apex-performance-profiling — measure actual transaction behavior and governor consumption.
apex/soql-optimization — validate query selectivity and redesign query patterns.
apex/bulkification-patterns — remediate loop/query/DML patterns while preserving semantics.
apex/apexguru-performance-analysis does not deploy, approve, or certify code.
See the bundled references for triage examples, attribution failures, and the official source map.
1---2name: apexguru-performance-analysis3description: Run and interpret the ApexGuru engine in Salesforce Code Analyzer v5 for Apex performance and scalability findings: verify the authenticated target org, scope .cls/.trigger files, capture JSON evidence, triage line-level recommendations, validate fixes, and avoid claiming runtime telemetry the report does not contain. Trigger keywords: ApexGuru scan, apexguru Code Analyzer, Apex performance findings, SOQL scalability issue, AI Apex optimization. NOT for general PMD/security lint — use devops/salesforce-code-analyzer. NOT for Apex debug-log or production transaction profiling.4---56# ApexGuru Performance Analysis78Use ApexGuru as one evidence source for Apex performance work. In Salesforce Code Analyzer v5 it is an AI-driven remote analysis engine that requires an authenticated Salesforce org, scans Apex `.cls` and `.trigger` files, and returns line-level JSON findings. A connected org is required for the service; that fact alone does **not** prove the report contains production runtime telemetry.910---1112## Preconditions1314Confirm all of the following before scanning:1516| Check | Required evidence | Stop condition |17|---|---|---|18| Code Analyzer generation | `sf code-analyzer --help` or installed plugin version confirms v5 commands | Legacy `sfdx scanner:*` only |19| Target identity | Exact org alias/username resolved by Salesforce CLI | Alias absent, ambiguous, or unauthenticated |20| ApexGuru availability | Org supports and has ApexGuru activated | Engine unavailable or activation unknown for a required scan |21| Workspace | Explicit project/workspace root | Accidental scan of a home or monorepo root |22| Targets | Bounded `.cls` and `.trigger` files inside the workspace | Request expects Flow, metadata XML, objects, or other unsupported files |23| Baseline | Current commit/hash, tests, and scan output path | Findings cannot be tied to source revision |24| Authority | Read/analysis operation only; no production mutation implied | Request asks the scan to approve or deploy a fix |2526Authentication is reused from the Salesforce CLI session. Do not put usernames, passwords, access tokens, or refresh tokens in `code-analyzer.yml`.2728---2930## Reproducible CLI Scan3132Use Code Analyzer v5 and write machine-readable output:3334```bash35sf code-analyzer run \36 --rule-selector apexguru \37 --workspace . \38 --target "force-app/main/default/classes/**/*.cls" \39 --target "force-app/main/default/triggers/**/*.trigger" \40 --target-org my-apexguru-org \41 --view detail \42 --output-file artifacts/apexguru-results.json43```4445Important behavior:4647- `--target-org` identifies the authenticated org used by remote engines such as ApexGuru.48- Every target must live under the declared workspace.49- File extension on `--output-file` selects the output schema; use JSON or SARIF when downstream automation needs complete locations.50- ApexGuru scans `.cls` and `.trigger` only. A successful command is not evidence that Flow, object metadata, Visualforce, or LWC was analyzed.51- Use a severity threshold only when the team has defined which ApexGuru severities are merge-blocking and has tested false-positive handling.5253For the installed CLI, verify flags with:5455```bash56sf code-analyzer run --help57```5859---6061## Project Configuration6263A project can set ApexGuru engine defaults in `code-analyzer.yml`:6465```yaml66engines:67 apexguru:68 disable_engine: false69 target_org: my-apexguru-org70 api_timeout_ms: 30000071 api_initial_retry_ms: 200072 api_max_retry_ms: 6000073 api_backoff_multiplier: 274```7576The shown timeout/backoff values are documented defaults. Change them only for an observed need and keep `api_max_retry_ms >= api_initial_retry_ms`. The overall `api_timeout_ms` remains the hard budget.7778Prefer an explicit `--target-org` in CI when multiple authenticated orgs exist; it is easier to audit than relying on a developer's default org. Never commit secret material.7980---8182## Evidence Mode and Attribution8384Classify the output before interpreting it:8586| Mode | What may be claimed |87|---|---|88| Code Analyzer ApexGuru JSON | ApexGuru analyzed the identified source revision through the authenticated org service and returned these findings |89| Report explicitly carries `analysisMode: static` | Preserve the label `Static only`; do not infer production behavior |90| Report explicitly carries `analysisMode: full` or a documented equivalent | Preserve the report's exact label and evidence; identify which metrics are actually present |91| No mode field or runtime metrics | Label `Source analysis`; do not call it production telemetry, hotspot frequency, or measured runtime impact |92| Debug logs, Event Monitoring, APM, or transaction traces | Treat as separate runtime evidence and link it to the source finding without attributing it to ApexGuru unless the report says so |9394A finding's severity is the engine's prioritization, not a measured CPU/heap/query cost. Validate impact in the relevant transaction and data-volume context.9596---9798## JSON Result Contract99100Code Analyzer v5 JSON contains a root object with `runDir`, `violationCounts`, `versions`, and `violations`. Each violation should preserve:101102- `rule` and `engine`;103- numeric severity 1–5;104- message and tags;105- all locations plus `primaryLocationIndex`;106- resource links and available suggestions/fixes;107- source revision, workspace, target org identity, command, and scan timestamp stored beside the report.108109Do not flatten multi-location findings to one line when the analysis path matters. CSV includes only the primary location; JSON or SARIF is preferable for review and automation.110111---112113## Recommended Workflow1141151. **Validate provenance and scope** — source revision, workspace, authenticated target org, command, Code Analyzer/engine versions, `.cls`/`.trigger` targets, timestamp, and output hash.1162. **Normalize and group findings** with the bundled checker while preserving original JSON. Group by rule, affected transaction/entry point, shared query/DML pattern, and severity—not severity alone.1173. **Inspect code context** around every primary and related location, and confirm that the finding applies to a reachable path.1184. **Cross-check runtime relevance** using tests, data volume, query plans, debug logs, transaction traces, or production insights when authorized and available.1195. **Choose a disposition and design** the smallest safe change: `fix`, `validate`, `suppress-with-rationale`, `defer`, or `not-applicable`. Preserve sharing, CRUD/FLS, transaction semantics, bulk behavior, ordering, and error handling.1206. **Test and rescan** positive, negative, bulk, and failure paths, then rerun the same targets with the same engine/config and compare result hashes/findings.1217. **Record residual risk** and supporting evidence. A zero-finding scan is not proof of runtime performance or absence of all Apex defects.122123---124125## Disposition Criteria126127| Disposition | Use when | Required record |128|---|---|---|129| `fix` | Finding is applicable and a safe change is understood | Change, tests, before/after scan, runtime or scale rationale |130| `validate` | Applicability or impact depends on data shape or call path | Exact experiment/query plan/log evidence needed |131| `suppress-with-rationale` | Finding is accepted, false positive, generated code, or unavoidable under a documented constraint | Scope-limited suppression, owner, review trigger, risk |132| `defer` | Valid issue is lower priority than current risk/capacity | Backlog owner, severity rationale, review date/trigger |133| `not-applicable` | Code path or assumption does not apply | Reproducible evidence; do not dismiss from intuition |134135Never auto-apply generated fixes. Performance changes can alter correctness, locking, sharing, query selectivity, memory, and transaction boundaries.136137---138139## Validation Checklist140141- [ ] Exact source revision, workspace, target org, command, versions, timestamp, and output hash are recorded142- [ ] Target org is authenticated and ApexGuru availability is verified143- [ ] Only `.cls` and `.trigger` coverage is claimed144- [ ] Report mode is preserved; absent mode is labeled `Source analysis`145- [ ] Every finding retains severity, rule, message, all locations, and resources146- [ ] Applicability is checked against call path, data volume, sharing, and transaction context147- [ ] Fixes preserve security, bulk behavior, correctness, and error handling148- [ ] Tests and relevant runtime/scale evidence accompany accepted changes149- [ ] Same-target before/after scan is captured150- [ ] Remaining findings and suppressions have owners and rationale151- [ ] Zero findings is not presented as a performance certification152153---154155## Result Validation Command156157```bash158python3 skills/apex/apexguru-performance-analysis/scripts/check_apexguru_performance_analysis.py \159 --input artifacts/apexguru-results.json \160 --output artifacts/apexguru-normalized.json161```162163The checker validates the Code Analyzer JSON shape, severity/location data, Apex file scope, and evidence-mode labeling. It does not contact Salesforce or judge whether a recommendation is correct.164165---166167## Related Skills168169- `devops/salesforce-code-analyzer` — install/configure v5, combine engines, output formats, CI gates, and suppression policy.170- `apex/apex-performance-profiling` — measure actual transaction behavior and governor consumption.171- `apex/soql-optimization` — validate query selectivity and redesign query patterns.172- `apex/bulkification-patterns` — remediate loop/query/DML patterns while preserving semantics.173- `apex/apexguru-performance-analysis` does not deploy, approve, or certify code.174175See the bundled references for triage examples, attribution failures, and the official source map.
Run npx skillmds add pranavnagrecha/apexguru-performance-analysis in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.
Run and interpret the ApexGuru engine in Salesforce Code Analyzer v5 for Apex performance and scalability findings: verify the authenticated target org, scope .cls/.trigger files, capture JSON evidence, triage line-level recommendations, validate fixes, and avoid claiming runtime telemetry the report does not contain. Trigger keywords: ApexGuru scan, apexguru Code Analyzer, Apex performance findings, SOQL scalability issue, AI Apex optimization. NOT for general PMD/security lint — use devops/salesforce-code-analyzer. NOT for Apex debug-log or production transaction profiling. It is listed under Security on SkillMD.
This skill has not completed SkillMD's automated safety review yet. Capability flags: executes scripts, reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.
This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.
Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.
PranavNagrecha (@pranavnagrecha) published this skill. Their other Agent Skills are listed on their SkillMD profile.
PranavNagrecha