ArQPulse — Salesforce Architecture Intelligence

Assess the health, risk and future-readiness of a Salesforce org from inside VS Code.

ArQPulse connects to an authenticated Salesforce org, scans its metadata and configuration, and produces an evidence-backed architecture assessment: scored health across every domain, a prioritised list of findings with the exact components involved, and readiness reports for Hyperforce, Data Cloud, Agentforce and Lightning migration.

Built for architects, tech leads and platform owners who need to answer "what state is this org actually in?" — and be able to show their working.

Requirements

A workspace containing sfdx-project.json activates the extension.

Getting started

1. Install — search ArQPulse in the Extensions panel, or:

ext install neuzenai.arqpulse

2. Authenticate to your org

sf org login web --set-default

3. Activate your licence — run ArQPulse: Activate License from the Command Palette and select your .lic file. The dashboard stays locked until a valid licence is present.

4. Run a scan — ArQPulse: Run Org Health Analyzer.

A first scan on a large org can take several minutes; results open in the ArQPulse dashboard and persist between sessions.

Activation

Licences are validated offline — no licence server, no phone-home. Each licence is digitally signed and bound to an expiry date, and optionally to specific Salesforce users or a maximum number of orgs.

You must be connected to a Salesforce org before activating, as the licence binds to that org. Use ArQPulse: Show License Status to check the current state, and ArQPulse: Export License Diagnostics if you need to raise a support request.

What it analyses

ArQPulse runs 20 analyzers over a single de-duplicated scan of the org, then assesses everything from that captured evidence.

Architecture assessment

• Code Quality — SOQL/DML in loops, hardcoded IDs, trigger design, sharing keywords, class and method size, test coverage from the org
• Automation — Flow and Process Builder inventory, per-object automation load, complexity scoring, legacy automation still in use
• Data Model — object and field inventory, unused and undocumented fields, relationship depth, sharing model per object
• Security — Salesforce Security Health Check, profile and permission-set risk, guest user exposure, connected app hardening, certificate expiry
• Scalability & Platform Capacity — governor limit headroom, async job pressure, org limit consumption, large-data-volume risk
• Integrations — named credentials vs. hardcoded endpoints, remote sites, external services, auth providers
• Technical Debt — quantified debt with an exportable backlog

Future readiness

Dedicated readiness packs scoring the org against a migration target, each with per-check evidence, a severity-ranked blocker list and a sequenced roadmap:

• Hyperforce Readiness
• Data Cloud Readiness
• Agentforce Readiness
• Modernization Center (Classic → Lightning)

Governance

• Rule Library and Rule Packs — enable, disable and tune the rules that apply to your org
• Organization Policy and Executive Governance views
• Scan history with trend tracking and scan-to-scan comparison

Exports — HTML, JSON, CSV, SARIF 2.1.0 (GitHub Code Scanning compatible) and print-to-PDF reports.

Key commands

All commands are prefixed ArQPulse in the Command Palette.

Thirty commands are available in total — browse them by typing ArQPulse in the Command Palette.

Configuration

ArQPulse ships around 50 settings under the sfHealthAnalyzer.* namespace. The ones most often changed:

Default scoring weights:

{
  "codeQuality": 25, "automationDesign": 20, "dataModel": 15,
  "performance": 20, "security": 10, "testing": 5, "integration": 5
}

Project-level rules

Place .sfhealthrc.json in your workspace root to override rule severity and thresholds per project:

{
  "rules": {
    "no-soql-in-loop": "error",
    "no-hardcoded-ids": "warning",
    "max-trigger-lines": ["warning", { "maxLines": 150 }]
  },
  "exclude": ["**/test/**", "**/*Test.cls"]
}

Privacy and data handling

What ArQPulse reads. Org metadata and configuration — Apex, Flows, objects and fields, profiles and permission sets, connected apps, certificates, limits and org settings. It does not query your business records: no Accounts, Contacts, Opportunities or custom object data. It does read administrative objects such as users, profiles and login history, which are required for governance and security analysis.

Where data goes. Analysis runs locally in the extension host. Scan evidence is written to .scan/ in your workspace (added to .gitignore automatically) and never uploaded. Your Salesforce access token is held in memory for the duration of a scan and is never written to disk.

AI and your data

AI features are optional and consent-gated. No data is sent to any model until you explicitly approve it, and the consent prompt names the exact destination before you decide.

Specifics worth knowing:

• Issue explanations send the finding's rule ID, severity, category, message and file path — not your source code.
• Org-level narratives (CTA review, readiness insights, Ask the Architect) send a structured org summary that is run through a PII sanitiser first, stripping record IDs, email addresses, instance URLs, IP addresses and phone numbers.
• Ask the Architect may additionally run read-only queries against your org and send their results to the model. This sits behind its own separate consent gate, which says so explicitly.
• Destinations depend on your configured provider. VS Code's Language Model API keeps data within VS Code. Choosing an external provider (Anthropic, OpenAI, Google) sends data to that provider's API under your own API key. A local endpoint such as Ollama keeps data on your machine. The consent dialog always names the host.

Run ArQPulse: Revoke AI Consent at any time to clear stored consent and cached AI output.

Support

• Support and feature requests — contact@neuzenai.com
• Product information — arqpulse.com
• Release history — see CHANGELOG.md

When reporting a scan problem, attach the scan log from .scan/<OrgId>/scan-log-*.log — it records which data sources succeeded, degraded or failed, and makes most issues diagnosable straight away. ArQPulse: Export License Diagnostics produces the equivalent for activation problems.

© NeuZenAI IT Solutions Pvt Ltd. ArQPulse is commercial software provided under licence. Use requires a valid ArQPulse activation licence.