# io.github.taurgis/sfcc-dev-mcp (npm · sfcc-dev-mcp)

MCP server for Salesforce B2C Commerce Cloud development assistance

- Trust score: 77/100 (medium)
- Change this week: +31
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `sfcc-dev-mcp`: 77/100 (this document), [markdown](https://verifymcp.io/servers/taurgis-sfcc-dev-mcp/sfcc-dev-mcp.md), [page](https://verifymcp.io/servers/taurgis-sfcc-dev-mcp/sfcc-dev-mcp)

## Channel facts

- Registry: `npm`
- Package: `sfcc-dev-mcp`
- Version: `1.1.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 83/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known medium-severity CVE affects @hono/node-server 1.19.17, reached via @modelcontextprotocol/sdk > @hono/node-server. A fixed version is available.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (128 of 132), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 97/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to taurgis/sfcc-dev-mcp).
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 116 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 70/100
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 1774 tokens (~98/item across 18 items; 18 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 23/100
  - Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add taurgis-sfcc-dev-mcp -- npx -y sfcc-dev-mcp
```

### Codex

```bash
codex mcp add taurgis-sfcc-dev-mcp -- npx -y sfcc-dev-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "taurgis-sfcc-dev-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "sfcc-dev-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add taurgis-sfcc-dev-mcp --command npx --arg -y --arg sfcc-dev-mcp
```

### Hermes

```yaml
mcp_servers:
  taurgis-sfcc-dev-mcp:
    command: "npx"
    args: ["-y", "sfcc-dev-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "taurgis-sfcc-dev-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "sfcc-dev-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 77, +1)

No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-02 (score 76, +50)

- [security regression] GHSA-frvp-7c67-39w9 affects this package: medium
- [security regression] Known CVEs: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Provenance: unverified → pass
- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.
- [security] The attested source repository moved: taurgis/sfcc-dev-mcp
- [functional regression] Capabilities: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional improvement] Stability: unverified → 0.20
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Schema quality: unverified → good
- [functional] Licence: MIT

### 2026-07-31 (score 26, −20)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 46, +22)

- [functional improvement] Tool coverage: unverified → 100

### 2026-07-28 (score 24, −22)

- [functional regression] Tool coverage: 100 → unverified
- [functional] First check of Schema quality: unverified

### 2026-07-27 (score 46)

First indexed and scored.

## MCP tools (18)

### `sync_agent_instructions` (~366 tokens)

ONLY FOR SALESFORCE B2C COMMERCE (SFCC) PROJECTS. IMPORTANT: Before calling this tool, ALWAYS ASK THE USER if they want to install AGENTS.md and bundled SFCC skills into their project. If the user declines, do NOT call this tool - instead call disable_agent_sync to permanently disable this suggestion. This tool installs/merges AGENTS.md and bundled SFCC skills into the project (or a temp dir for manual merge). Supports dry-run planning, append/replace/skip merge strategies, and selecting skills directory (.github/skills, .agents/skills, .claude/skills, .agent/skills, .cursor/skills, and user-home defaults like ~/.copilot/skills).

Input parameters:

- `destinationType` (string): Where to place the files: project workspace (default), user home, or a temporary directory.
- `dryRun` (boolean): Plan actions without writing files (default true).
- `includeAgents` (boolean): Whether to copy AGENTS.md (default true).
- `includeSkills` (boolean): Whether to copy skills (default true).
- `installMissingOnly` (boolean): Copy only missing skills when true (default) or overwrite existing directories when false.
- `mergeStrategy` (string): How to handle an existing AGENTS.md (default append).
- `preferredRoot` (string): Optional workspace root path or name to target when multiple roots are available.
- `skillsDir` (string): Optional relative skills directory (default prefers existing .github/skills, .agents/skills, .claude/skills, .agent/skills, .cursor/skills; for destinationType=user also checks .copilot/skills).
- `tempDir` (string): Custom directory to use when destinationType is temp.

### `disable_agent_sync` (~78 tokens)

Creates or updates mcp-dev.json in the project root with {"disableAgentSync": true} to permanently disable agent sync suggestions. Call this when the user declines to install AGENTS.md and skills, so they will not be prompted again.

Input parameters:

- `preferredRoot` (string): Optional workspace root path or name to target when multiple roots are available.

### `get_sfcc_class_info` (~235 tokens)

Get detailed information about an SFCC class including properties, methods, constants, and inheritance. Essential for understanding dw.* APIs when building controllers, scripts, templates, or REST APIs. Supports filtering by section and search within class members.

Input parameters:

- `className` (string, required): The SFCC class name (e.g., 'Catalog', 'dw.catalog.Catalog')
- `expand` (boolean): Whether to include detailed information about referenced types used by this class (default: false)
- `includeConstants` (boolean): Whether to include constants in the response (default: true)
- `includeDescription` (boolean): Whether to include the class description in the response (default: true)
- `includeInheritance` (boolean): Whether to include inheritance hierarchy in the response (default: true)
- `includeMethods` (boolean): Whether to include methods in the response (default: true)
- `includeProperties` (boolean): Whether to include properties in the response (default: true)
- `search` (string): Filter class members by keyword (case-insensitive). Single word only, e.g., "price", "get", "custom".

### `search_sfcc_classes` (~73 tokens)

Find SFCC classes by partial name or keyword. Use when you don't know the exact class name (e.g., 'catalog' finds dw.catalog.*, 'price' finds pricing-related classes).

Input parameters:

- `query` (string, required): Single keyword to search class names, e.g., "catalog", "order", "basket".

### `search_sfcc_methods` (~60 tokens)

Find methods across all dw.* classes by name. Use when you know a method exists but not which class contains it.

Input parameters:

- `methodName` (string, required): Method name to search, e.g., "getProduct", "addItem", "calculate".

### `list_sfcc_classes` (~37 tokens)

List all available SFCC dw.* classes organized by namespace. Use to explore the full API surface or find classes in a specific domain.

### `get_sfcc_class_documentation` (~52 tokens)

Get the full raw documentation for an SFCC class including examples and detailed descriptions. Use when get_sfcc_class_info lacks sufficient detail.

Input parameters:

- `className` (string, required): The SFCC class name

### `get_available_sfra_documents` (~48 tokens)

List all SFRA documentation including Server, Request, Response, QueryString, render module, and 26+ model docs (cart, account, billing, shipping, products, pricing).

### `get_sfra_document` (~79 tokens)

Get complete SFRA class or model documentation with properties, methods, and examples. Use for implementing controllers, middleware, or working with SFRA models.

Input parameters:

- `documentName` (string, required): Document name, e.g., "server", "request", "cart", "product-full", "account". Use get_available_sfra_documents for full list.

### `search_sfra_documentation` (~58 tokens)

Search across all SFRA docs for concepts or functionality. Returns relevance-scored results with categorization.

Input parameters:

- `query` (string, required): Search term, e.g., "middleware", "routing", "cache", "cart", "pricing".

### `get_sfra_documents_by_category` (~90 tokens)

Get SFRA documents filtered by functional area (core classes, product models, order/cart, customer, pricing, store).

Input parameters:

- `category` (string, required): Category to filter by: core (Server, Request, Response, etc.), product (product models), order (cart, billing, shipping), customer (account, address), pricing (price models), store (store models), ot…

### `get_sfra_categories` (~27 tokens)

Get all SFRA document categories with counts. Use to understand documentation organization before browsing.

### `list_isml_elements` (~53 tokens)

List all ISML template elements with summaries. Includes control flow (isif, isloop), output (isprint), includes (isinclude, iscomponent), scripting (isscript), and caching (iscache).

### `get_isml_element` (~125 tokens)

Get detailed documentation for an ISML element including syntax, attributes, examples, and use cases.

Input parameters:

- `elementName` (string, required): The ISML element name (e.g., 'isif', 'isloop', 'isprint', 'isinclude', 'iscomponent'). The 'is' prefix is optional.
- `includeAttributes` (boolean): Whether to include attribute information (default: true)
- `includeContent` (boolean): Whether to include full documentation content (default: true)
- `includeSections` (boolean): Whether to include section headings (default: true)

### `search_isml_elements` (~105 tokens)

Search ISML elements by purpose, attribute name, or use case. Returns relevance-scored results with preview snippets.

Input parameters:

- `category` (string): Optional category filter: control-flow, output, includes, scripting, cache, decorators, special, payment, or analytics
- `limit` (integer): Maximum number of results to return
- `query` (string, required): Search term or concept (e.g., 'loop', 'conditional', 'format', 'cache', 'redirect')

### `get_isml_elements_by_category` (~99 tokens)

Get ISML elements filtered by category (control-flow, output, includes, scripting, cache, decorators, special, payment, analytics).

Input parameters:

- `category` (string, required): Category to filter by: control-flow (conditionals, loops), output (formatting), includes (templates, components), scripting (server-side code), cache (caching), decorators (layout), special (redirect…

### `get_isml_categories` (~21 tokens)

Get all ISML element categories with descriptions and counts.

### `generate_cartridge_structure` (~168 tokens)

Generate a complete SFCC cartridge with proper directory structure, configurations, and boilerplate files. Creates files directly in the target directory.

Input parameters:

- `cartridgeName` (string, required): Name of the cartridge (e.g., "plugin_example")
- `fullProjectSetup` (boolean): Whether to create a complete project setup (package.json, webpack, etc.) or just add a cartridge to existing project structure. Use true for new projects, false to add cartridge to existing projects.…
- `targetPath` (string): Target directory path where the cartridge files should be placed. If not specified, files will be placed in the current working directory. Use absolute paths for best results (e.g., "/Users/username/…

## Diagnostics

Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/taurgis-sfcc-dev-mcp/sfcc-dev-mcp#diagnostics

## Score history

- 2026-08-03: 77
- 2026-08-02: 76
- 2026-08-01: 26
- 2026-07-31: 26
- 2026-07-30: 46
- 2026-07-28: 24
- 2026-07-27: 46

## Links

- npm package: https://www.npmjs.com/package/sfcc-dev-mcp
- Socket report: https://socket.dev/npm/package/sfcc-dev-mcp
- Repository: https://github.com/taurgis/sfcc-dev-mcp
- Changelog RSS feed: https://verifymcp.io/servers/taurgis-sfcc-dev-mcp/sfcc-dev-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/taurgis-sfcc-dev-mcp/sfcc-dev-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/taurgis-sfcc-dev-mcp/sfcc-dev-mcp