OrgVitals user guide

OrgVitals never sees your Salesforce username or password. It uses the Salesforce CLI (sf) you have already installed and authenticated. When you pick an org, OrgVitals opens that CLI session, pulls a read-only snapshot of the org's metadata — Apex, LWC, flows, objects, profiles, permission sets — stores it on your machine, and runs its scanners against the snapshot.

A single Google sign-in unlocks the app for licensing and identity. Everything after that is local. Because the analysis works from a stored snapshot, you can browse, filter, export and compare without touching Salesforce again.

You need the Salesforce CLI. Install it, then authenticate at least one org:

# see developer.salesforce.com/tools/salesforcecli
sf org login web        # opens a browser to authenticate an org
sf org list             # confirm the org shows up

On launch OrgVitals runs which sf to find the CLI. If it is missing, a prompt explains how to install it. On a first run you will also:

1. Accept the terms and privacy notice — a one-time consent gate.
2. Sign in with Google. This is identity and licensing only; no Salesforce credentials are entered.
3. Watch a short guided tour over demo data. Skip it if you like, and replay it later from Help → Take the Tour.

Open the org picker at the top-left of the header. It lists every org your Salesforce CLI is authenticated to — the same listsf org list prints. Select one to make it the active org. OrgVitals resolves its 18-character Id, instance URL, edition and user count, and stores them locally.

• Switching orgs re-scopes the whole app to that org.
• API version. Metadata queries use a target API version you can change under Settings → Salesforce API Version. It is validated and cached per org.
• Org family. If the selected org belongs to a family, an extra Org Family tab appears — see section 09.

Press Rescan — or Run Scan on a freshly connected org — to open the scanner picker.

Choose what to run. All 49 scanners are on by default, grouped into five categories. Toggle individual scanners or whole categories — run only the security checks before a go-live, for instance. Some scanners expose thresholds you can tune first: empty-field percentage, maximum class lines, stale after N days.

What happens during a scan.

1. Connect. OrgVitals opens the CLI session for the org.
2. Fetch metadata. One snapshot is downloaded — objects and fields, Apex and flows, profiles and permissions, reports. A live terminal shows progress per phase.
3. Run scanners. Every selected scanner runs across a worker pool, in dependency order. The finding count ticks up as they complete.
4. Score and save. OrgVitals computes the overall score, the grade and the per-category scores, persists the run, and opens the dashboard.

All of it is read-only. Nothing in your org is modified.

The five categories

Batch scans. You can scan several orgs in one run — this is what org family uses. Each org is scanned in isolation, so one failure does not abort the batch, and you get a per-org progress list with a completed and failed summary.

OrgVitals turns findings into a score with one transparent model.

Step one — per-category penalties. Each finding subtracts points from its category, by severity. Every category starts at 100 and cannot drop below zero.

Step two — the weighted overall score. Category scores combine by weight: security 30%, code quality 20%, automation 20%, tech debt 20%, performance 10%.

Step three — the letter grade.

The managed score. As you triage findings — fixed, ignored, snoozed — the dashboard also shows a managed score that recomputes health excluding what you have dismissed. You see the raw picture and where you will land after the planned work.

The dashboard is where a scan lands.

• Overall grade and score — a large A to F grade with the number out of 100.
• Score trend — your overall score plotted across recent scans, so direction is visible.
• New, resolved, total open — how findings moved against the previous scan.
• Scanner results grid — every check that ran, as pass, warn or fail, grouped by category.
• Category breakdown — the five category scores with their own letter grades.
• Fix these first — the highest-impact issues, plus quick wins that are high impact and low effort.
• Export PDF — render the full report to a file. See section 12.

The Findings tab is the complete, filterable list of everything the scanners found.

Open a finding. Click any row to expand it. You get the full explanation, the affected component, an effort estimate, remediation guidance and the status controls in place.

Every finding carries its category, a severity of critical, high, medium or low, a title, a detailed explanation, the affected count, the linked component — click through to insights — and remediation guidance.

Filtering and sorting.

• By severity, using the chips along the top: Critical High Medium Low All.
• By category, by scanner, and by workflow status.
• By text search.
• By priority — sort on a severity or priority model that surfaces quick wins first.

Triage. Give any finding a status. It is saved per org and matched by a stable finding key, so it survives future scans.

Dismissed findings drop out of the dashboard's managed score.

Export and cleanup.

• CSV — export the findings table for sharing or ticketing.
• PDF — export the full formatted report.
• Cleanup generation — for findings that map to deletable metadata (unused Apex classes, fields, LWC, Aura, Visualforce pages, empty fields), OrgVitals generates a destructiveChanges.xml and package.xml pair for a normal metadata deploy. It never performs the deletion itself.

Insights turns the org into a browsable, cross-linked map of its own metadata.

• Browse by type — Apex classes and triggers, LWC, Aura, Visualforce, objects, fields, flows, workflows, approvals, email templates, profiles, permission sets, reports, dashboards, named credentials, users, org limits. Each carries a count and a with-issues filter.
• Component detail — status, API version, line and method counts, test coverage, sharing and access, and code flags: SOQL or DML in a loop, injection risk, CRUD and FLS violations, hardcoded credentials.
• Delete safety — what references a component, before you remove it.
• Impact analysis — the blast radius of a chosen component: everything that depends on it.
• Global search — press ⌘K or Ctrl-K anywhere to fuzzy-search all indexed metadata and jump to it.

Read the source. Pick a metadata type, select a component, and press View Source for the syntax-highlighted, read-only source — flagged lines and issue counts included.

See what depends on what. From the same detail panel, pressDep Graph for a directed map of the component's relationships — triggers to objects, LWC to Apex, flows to objects, SOQL queries.

History — progress over time. Every scan is saved locally. TheHistory tab plots your score over time and lists each run with its grade, severity counts and duration, so you can tell whether remediation is moving the needle. Select an older scan to review its findings or compare it against the current one.

Org family — related orgs, side by side. A family is a group of related orgs that you name — a production org and its sandboxes, say, as QA, UAT and Prod. An org belongs to at most one family. Create and manage them from the Org Family tab, which appears when the selected org is in one.

• Rollup — every org in the family side by side: score, grade, critical count, category bars, last-scan date. Scan all runs a batch across the family.
• Shared findings — checks that appear in two or more orgs, separating systemic problems from one-offs.
• A/B compare — pick two orgs for a latest-scan diff: category deltas, per-check differences, finding-level diff.
• Metadata diff — a structural diff across Apex, triggers, Visualforce, LWC, Aura, objects, fields, flows, workflow rules, email templates, profiles, permission sets, reports and dashboards: what exists only in A, only in B, or differs.
• Source diff — a line-by-line diff of one component's source between the two orgs, split or unified.

To compare code: open compare, pick two orgs, switch to the metadata tab to see what is only in A, only in B or differs, then click a differing component for its source line-diff.

Vita answers plain-English questions about your org and links the relevant records in the answer. Which flows carry the highest risk. Which profiles have Modify All Data. Which Apex classes have zero coverage.

Vita reads your local scan data through read-only lookups — flows, Apex classes and triggers, users, profiles, permission sets, fields, objects, findings, org limits — and summarises what it finds.

Vita is opt-in and off by default. It is the one feature that sends data off your device: to answer a question it sends that question, plus the specific metadata it reads, to Anthropic's Claude API. To use it against a real org you supply your own Anthropic API key, stored encrypted and locally, acknowledge the notice, and enable Vita. Nothing reaches CloudAlgo's servers.

In demo mode Vita returns static sample answers instantly. No key is required and nothing is sent anywhere.

OrgVitals ships with a self-contained demo mode, so you — or a colleague evaluating the app — can see every feature fully populated without connecting a real org.

• The guided tour runs automatically on first launch, walking through the dashboard, findings, insights, history, org family and Ask Vita over the sample Acme family. Use Next, Back or Skip. When it finishes, the app returns to your real, empty state, ready for your own org.
• Replay it from Help → Take the Tour.
• While demo data is showing, a DEMO badge sits in the header. All of it is the synthetic Acme family; your real org data is never touched.

The Acme family covers the full score range and the QA-to-Prod comparison workflow: Acme UAT grades A, Acme Production grades C, Acme QA grades F.

Notifications. The bell at the top-right opens the panel — scan results, warnings, export outcomes and app updates, newest first. Unread items are badged on the bell; open the panel to mark them read, orClear all.

Export a report.

• PDF — on the dashboard, press PDF to export the full health report. OrgVitals renders it and opens a save dialogue so you choose where it goes; a notification confirms it is written.
• CSV — on the findings tab, press Export to save the currently filtered findings. Whatever filters are active is what gets exported.

Delete a family mapping. A family is only a saved grouping — deleting it never touches your orgs or their scans. On theOrg Family tab, use the trash icon next to the family name. The member orgs remain exactly as they were.

Shortcuts

• ⌘K or Ctrl-K — global metadata search, from anywhere.
• Rescan in the header — re-run a scan on the current org.
• Help → Take the Tour — replay the guided walkthrough.

Does OrgVitals change my org? No. Scans are strictly read-only. Even cleanup generation only produces adestructiveChanges.xml that you choose to deploy yourself.

Where is my data stored? In a local SQLite database in your operating system's user-data folder. It is never uploaded. Ask Vita is the only opt-in exception, and it sends only what is needed to answer your question.

Do I have to enter Salesforce credentials? No. OrgVitals uses your existing Salesforce CLI sessions.

The CLI is not detected. Install the Salesforce CLI, runsf org login web, then reopen OrgVitals.

Can I compare a sandbox against production? Yes. Put them in an org family and use A/B compare, metadata diff and source diff.