MCP Salesforce Connector has arbitrary attribute access which leads to disclosure of Salesforce auth token

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "mcp-salesforce-connector"
-version = "0.1.9"
+version = "0.1.10"
 description = "A Model Context Protocol (MCP) server implementation for Salesforce integration"
 readme = "README.md"
 requires-python = ">=3.11"

@@ -13,6 +13,7 @@
 
 from simple_salesforce import Salesforce
 from simple_salesforce.exceptions import SalesforceError
+from simple_salesforce import SFType
 
 import mcp.types as types
 from mcp.server import Server, NotificationOptions
@@ -358,6 +359,8 @@ async def handle_call_tool(name: str, arguments: dict[str, str]) -> list[types.T
             raise ValueError("Missing 'object_name' or 'record_id' argument")
         if not sf_client.sf:
             raise ValueError("Salesforce connection not established.")
+        if not isinstance(sf_object, SFType):
+            raise ValueError(f"Invalid Salesforce object name: {object_name}")
         sf_object = getattr(sf_client.sf, object_name)
         results = sf_object.get(record_id)
         return [