Store Builder
NPM · SBUILDER-MCP · SCANNED SEP 21
Design, fill with real store data, render and publish Store Builder pages from an AI agent.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 31 of 97 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 0 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability63
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 4043 tokens (~130/item across 31 items; 31 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management47
- Stability observed for 14 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage82
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 46% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 32 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the Store Builder MCP server?
Store Builder runs locally as an npm package, launched with npx -y sbuilder-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · sbuilder-mcp
claude mcp add vuluu2k-sbuilder-mcp -- npx -y sbuilder-mcp
{
"mcpServers": {
"vuluu2k-sbuilder-mcp": {
"command": "npx",
"args": [
"-y",
"sbuilder-mcp"
]
}
}
} {
"servers": {
"vuluu2k-sbuilder-mcp": {
"command": "npx",
"args": [
"-y",
"sbuilder-mcp"
]
}
}
} codex mcp add vuluu2k-sbuilder-mcp -- npx -y sbuilder-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"vuluu2k-sbuilder-mcp": {
"type": "local",
"command": [
"npx",
"-y",
"sbuilder-mcp"
],
"enabled": true
}
}
} openclaw mcp add vuluu2k-sbuilder-mcp --command npx --arg -y --arg sbuilder-mcp
mcp_servers:
vuluu2k-sbuilder-mcp:
command: "npx"
args: ["-y", "sbuilder-mcp"] {
"McpServers": {
"vuluu2k-sbuilder-mcp": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"sbuilder-mcp"
]
}
}
} assistant mcp add vuluu2k-sbuilder-mcp -t stdio -c npx -a -y sbuilder-mcp
{
"mcpServers": {
"vuluu2k-sbuilder-mcp": {
"command": "npx",
"args": [
"-y",
"sbuilder-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 21 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 43 to 47. That category is still filling its 30-day observation window: 13 days of observed history at the previous scan, 14 at this one. The score rises as the window fills, whether or not the server changes.
- 20 Sept 26 0
- Schema quality: 115 → 130 ▼ functional
- Security disclosure: unverified → fail ▼ functional
- Tool coverage: 40% → 46% ▲ functional
- Package version: 0.61.1 → 0.62.0 functional
- 19 Sept 26 0
- Security disclosure: fail → unverified ▼ functional
- 18 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 33 to 37. That category is still filling its 30-day observation window: 10 days of observed history at the previous scan, 11 at this one. The score rises as the window fills, whether or not the server changes.
- 17 Sept 26 +10
- Known CVEs: unverified → pass ▲ security
- Dependency health: unverified → 0.85 ▲ functional
- Package version: 0.61.0 → 0.61.1 functional
- 16 Sept 26 +5
- Stability: 0.27 → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Known CVEs: pass → unverified ▼ security
- Malware scan: unverified → pass ▲ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Dependency health: 0.85 → unverified ▼ functional
- First check of Schema quality: unverified functional
- Package version: 0.59.3 → 0.61.0 functional
- Package version: 0.59.3 → 0.60.4 functional
- Package version: 0.59.3 → 0.60.3 functional
- Package version: 0.59.3 → 0.60.2 functional
- Package version: 0.59.3 → 0.60.1 functional
- Package version: 0.59.3 → 0.60.0 functional
- 15 Sept 26 +11
- Stability: 0.23 → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Malware scan: unverified → pass ▲ security
- Known CVEs: unverified → pass ▲ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Dependency health: unverified → 0.85 ▲ functional
- First check of Schema quality: unverified functional
- Package version: 0.48.1 → 0.59.3 functional
- Package version: 0.48.1 → 0.59.2 functional
- Package version: 0.48.1 → 0.59.1 functional
- Package version: 0.48.1 → 0.59.0 functional
- Package version: 0.48.1 → 0.57.0 functional
- Package version: 0.48.1 → 0.52.0 functional
- Package version: 0.48.1 → 0.50.0 functional
- Package version: 0.48.1 → 0.49.0 functional
- 14 Sept 26 −10
- Known CVEs: pass → unverified ▼ security
- Stability: 0.20 → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Malware scan: unverified → pass ▲ security
- Dependency health: 0.85 → unverified ▼ functional
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- First check of Schema quality: unverified functional
- Package version: 0.41.0 → 0.48.1 functional
- Package version: 0.41.0 → 0.47.2 functional
- Package version: 0.41.0 → 0.47.0 functional
- Package version: 0.41.0 → 0.46.3 functional
- Package version: 0.41.0 → 0.46.2 functional
- Package version: 0.41.0 → 0.46.0 functional
- Package version: 0.41.0 → 0.45.0 functional
- Package version: 0.41.0 → 0.42.0 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 21 Sept 2026 · Analysed npm/sbuilder-mcp@0.62.0
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 97 packages
| Packages resolved | 97 |
|---|---|
| Stale | 31 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
sb_add ~88
Add an element — or a whole NESTED subtree — under a parent. One call builds a complete section: pass children rather than calling this once per node.
| Name | Type | Req | Description |
|---|---|---|---|
| dry_run | boolean | – | – |
| force | boolean | – | Override a render-inference guard; reported as forced |
| index | integer | – | – |
| parent_id | string | yes | – |
| spec | object | yes | – |
No output schema declared.
No examples provided.
sb_api_call ~212
Call an operation from sb_api_find (id), or a route the catalog lacks (method+path); dry run by default. pick selects fields, max_items caps lists, item_offset skips items. Lists over 60 KB say so.
| Name | Type | Req | Description |
|---|---|---|---|
| body | – | – | – |
| dry_run | boolean | – | Defaults to true. Pass false to actually send. |
| id | string | – | Operation id from sb_api_find, e.g. "get:/api/sites/{siteID}/menus" |
| item_offset | integer | – | Offset within this response, after API paging. Reads only. |
| max_items | integer | – | – |
| method | string | – | With path, when id is absent: GET|HEAD|POST|PUT|PATCH|DELETE |
| path | string | – | Bare platform path, e.g. "/api/sites/{siteId}/published"; {siteId} defaults to SB_SITE |
| path_params | object | – | – |
| pick | array | – | – |
| query | object | – | – |
No output schema declared.
No examples provided.
sb_api_find ~125
Find API operations by intent (query), or get a call sheet (id): parameters, credential, body fields and handler caveats. Reaches all 560 operations.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | – | An id from a previous search — returns that operation's full call sheet |
| limit | integer | – | Default 8 |
| query | string | – | What you want to do, in words: "create a menu", "list orders", "upload media" |
| tag | string | – | Narrow to one tag, e.g. "menus", "products", "theme" |
No output schema declared.
No examples provided.
sb_bind ~135
Bind a node to real store data so the page shows actual products, not placeholder text. action makes a button a purchase control.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | – | Pass product.id + specials.boundProductId |
| dry_run | boolean | – | – |
| field | string | yes | Where the value lands, always "specials.<key>" |
| force | boolean | – | Override a render-inference guard; reported as forced |
| id | string | yes | – |
| source | string | yes | e.g. article.author, article.categories, article.content, article.date; 79 in all, and a wrong one is refused with the list |
No output schema declared.
No examples provided.
sb_catalog_search ~87
Find an element type by what it does — or OMIT query to browse every type, the only way to meet one you would not have searched for. detail:true adds the AI hints, as does sb_traits_for.
| Name | Type | Req | Description |
|---|---|---|---|
| detail | boolean | – | Include useWhen / avoidWhen / contentTips per match |
| limit | integer | – | Default 8 |
| query | string | – | – |
No output schema declared.
No examples provided.
sb_connect ~51
Log in and list the sites this account can operate. Call this first. Reads SB_EMAIL and SB_PASSWORD from the environment unless you pass them.
| Name | Type | Req | Description |
|---|---|---|---|
| string | – | – | |
| password | string | – | – |
No output schema declared.
No examples provided.
sb_duplicate ~72
Copy a node and everything under it, under fresh ids, right after the original. The move a designer makes constantly — build one card, duplicate it twice.
| Name | Type | Req | Description |
|---|---|---|---|
| dry_run | boolean | – | – |
| force | boolean | – | Override a render-inference guard; reported as forced |
| id | string | yes | – |
No output schema declared.
No examples provided.
sb_event ~117
Give a node a click action — open the cart, go to a page, open a pop-up. A purchase is not one: use sb_bind action.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | An action this element allows, or "none" to clear. A wrong one is refused with the list |
| dry_run | boolean | – | – |
| force | boolean | – | Override a render-inference guard; reported as forced |
| id | string | yes | – |
| payload | object | – | – |
| trigger | string | – | Default "click" |
No output schema declared.
No examples provided.
sb_import ~180
Read a page from any public URL and add its structure and content to the OPEN page as real elements, styled with this page's own tokens. Not a clone: the source's layout and CSS are not copied. Dry run returns what was found.
| Name | Type | Req | Description |
|---|---|---|---|
| dry_run | boolean | – | – |
| max_images | integer | – | Default 24 — every image is an upload |
| max_nodes | integer | – | No cap by default — bounds the whole import if given |
| max_sections | integer | – | – |
| nav_timeout_ms | integer | – | How long to wait for a page to answer at all. Default 30000; raise it for a slow origin |
| site_id | string | – | – |
| upload_images | boolean | – | Copy the images into this site's media library, default true |
| url | string | yes | The page to read |
No output schema declared.
No examples provided.
sb_import_site ~270
Read a WHOLE site from one URL — its sitemap, or the links on that page — and give each page found its own DRAFT page here, built from this site's tokens. Not a clone. Dry run returns the page list before anything is created.
| Name | Type | Req | Description |
|---|---|---|---|
| depth | integer | – | No sitemap: link depth, default 1 |
| dry_run | boolean | – | – |
| exclude | array | – | – |
| homepage | boolean | – | Entry into this site's home page, default true |
| include | array | – | Path substrings to keep |
| max_images | integer | – | Default 24, whole import |
| max_nodes | integer | – | Per page. No cap by default |
| max_pages | integer | – | Default 12 |
| nav | boolean | – | Shared header linking the new pages, default true |
| nav_timeout_ms | integer | – | How long to wait for a page to answer at all. Default 30000; raise it for a slow origin |
| site_id | string | – | – |
| theme | boolean | – | Patch this site's theme from the entry page's colours and type scale, default true — SITE-WIDE, affecting pages outside this import too |
| upload_images | boolean | – | – |
| url | string | yes | Any page of the site |
No output schema declared.
No examples provided.
sb_live_join ~79
Join the site's live-edit room as a visible peer: every write then appears in any open editor as it happens, with the agent shown by the API key's own name rather than a person's. Always yields, so it is safe beside a human. Works with SB_TOKEN or with SB_EMAIL / SB_PASSWORD.
| Name | Type | Req | Description |
|---|---|---|---|
| site_id | string | – | – |
No output schema declared.
No examples provided.
sb_look ~186
Save, render through the platform's own renderer, and return screenshots at desktop, tablet and mobile widths, measured boxes for the bands and their children, and any layout defect measured on the render (overflow, overlap, unreadable text). node_id frames one element. Judge your work from these, not from memory.
| Name | Type | Req | Description |
|---|---|---|---|
| box_depth | integer | – | Boxes down to this depth in the tree (default 2: bands and their children) |
| format | string | – | jpeg (default) is smaller and faster; png for pixel-exact colour |
| node_id | string | – | Frame just this node instead of the whole page — how a designer looks at one card |
| url | string | – | Shoot this address instead of the draft preview — use the PUBLISHED storefront URL to see real store data |
| widths | array | – | – |
| with_boxes | boolean | – | – |
No output schema declared.
No examples provided.
sb_media_list ~78
The site's media library. Reuse an image before adding another; search by name, filter by type, page with limit/offset.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | – |
| media_type | string | – | e.g. "image" |
| offset | integer | – | – |
| search | string | – | – |
| site_id | string | – | – |
No output schema declared.
No examples provided.
sb_media_upload ~184
Put an image into the media library and get its URL back, ready for sb_set. Takes a local path, a URL, or a SEARCH — `query` returns real photographs with their own descriptions, and `pick` uploads the one you chose, or several at once to stock a site you just built. The only way to add an image.
| Name | Type | Req | Description |
|---|---|---|---|
| dry_run | boolean | – | – |
| folder_id | string | – | – |
| name | string | – | – |
| orientation | string | – | – |
| path | string | – | A file on this machine |
| pick | – | – | The id of the search result to upload — or several ids, which stocks a site in one call |
| query | string | – | Search real photographs; read the descriptions, then pick |
| site_id | string | – | – |
| url | string | – | Fetched, then uploaded |
No output schema declared.
No examples provided.
sb_move ~65
Move a node to another parent at an index.
| Name | Type | Req | Description |
|---|---|---|---|
| dry_run | boolean | – | – |
| force | boolean | – | Override a render-inference guard; reported as forced |
| id | string | yes | – |
| index | integer | yes | – |
| parent_id | string | yes | – |
No output schema declared.
No examples provided.
sb_node_read ~34
One node in full — style, config, specials, per-breakpoint overrides, bindings.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | – |
No output schema declared.
No examples provided.
sb_outline ~62
The open page as a compressed tree — id, type, name, child count, band, and whether a node is a shared global or a site overlay. Never the raw document: a real page is hundreds of KB of JSON.
| Name | Type | Req | Description |
|---|---|---|---|
| depth | integer | – | – |
No output schema declared.
No examples provided.
sb_page_create ~219
A store type (product, category, search, blog, post, complete) arrives with the document the editor gives a merchant — product carries the whole bound buy box; seed:false for blank. Any other type is empty and sb_page_open seeds its ROOT. TYPE is the route: /checkout and /products/{slug} need a PUBLISHED page of that type or they 404.
| Name | Type | Req | Description |
|---|---|---|---|
| chrome | boolean | – | Carry the site's header and footer, default true |
| dry_run | boolean | – | – |
| headline | string | – | The complete page's thank-you line. |
| is_homepage | boolean | – | – |
| locale | string | – | vi (default) or en — the complete page's wording. |
| name | string | yes | – |
| seed | boolean | – | Default true; false creates a blank page. |
| settings | object | – | – |
| site_id | string | – | – |
| slug | string | – | – |
| type | string | – | page (default); sb_page_list lists every type and where each is served |
No output schema declared.
No examples provided.
sb_page_list ~32
Every page on the site, with its slug and whether it is live.
| Name | Type | Req | Description |
|---|---|---|---|
| site_id | string | – | – |
No output schema declared.
No examples provided.
sb_page_open ~61
Open a page for editing and return its outline. Call before any sb_add / sb_set / sb_move / sb_remove. Find page ids with sb_api_find "list pages".
| Name | Type | Req | Description |
|---|---|---|---|
| page_id | string | yes | – |
| site_id | string | – | – |
No output schema declared.
No examples provided.
sb_publish ~78
Compile the draft into the live page. PUBLISH CASCADES: a page sharing a global section with others republishes them too, because a header edited once must not go live on one page and stay stale on the rest.
| Name | Type | Req | Description |
|---|---|---|---|
| dry_run | boolean | – | – |
| page_id | string | yes | – |
| site_id | string | – | – |
No output schema declared.
No examples provided.
sb_remove ~48
Remove a node and its whole subtree.
| Name | Type | Req | Description |
|---|---|---|---|
| dry_run | boolean | – | – |
| force | boolean | – | Override a render-inference guard; reported as forced |
| id | string | yes | – |
No output schema declared.
No examples provided.
sb_review ~60
What a VISITOR would meet on the open page (blank band, placeholder, dead binding) AND what stands between this store and a paid order (checkout page, gateway, delivery, a way back to the cart). Run it before calling a page finished.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
sb_set ~211
Write style, config or specials keys on one node, or on many through edits (one save, one live frame). Per BREAKPOINT by default; base:true writes the fallback layer, right for a value that should not vary.
| Name | Type | Req | Description |
|---|---|---|---|
| base | boolean | – | – |
| breakpoint | string | – | – |
| dry_run | boolean | – | – |
| edits | array | – | – |
| force | boolean | – | Override a render-inference guard; reported as forced |
| id | string | – | – |
| keys | object | – | – |
| namespace | string | – | – |
| state | string | – | An interaction state — "hover", or "stuck" for how a pinned element looks once it is stuck (needs a sticky/fixed self-or-ancestor; a descendant styles itself through the host). |
| unset | array | – | Keys to REMOVE from the same slot — the only way to undo a write. Setting null is not the same: null is a stored value, so the override still counts as present. |
No output schema declared.
No examples provided.
sb_site_list ~17
List the sites this account can operate.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
sb_store ~547
Run a store flow that must happen in a fixed order. action:"checkout" makes the order form, configures it, saves its fields with this store's real payment and delivery options, then creates and PUBLISHES the checkout page — /checkout 404s without all four. action:"form" seeds any of the platform's other form templates (login, register, forgot, reset, verify, contact, subscribe, booking, review and more) with its own field document, which is the part that cannot be guessed. action:"chrome" gives every page ONE shared header, built from the pages this site already has — the gap sb_review reports as siteChrome. action:"menu" binds a menu node on the open page to the site's menu and resolves its links, the way the editor does. action:"overlay_attach" puts a pop-up on the open page (kind:"popup") or points a list-dataset at a quick-view panel (kind:"quickview", list_id), creating either from the platform's own seed when overlay_id is omitted, and re-reads the page afterwards as the editor must. action:"app" installs one of the platform's built-in apps (app_key) and creates the pages it needs that installing it does not — today only "courses" has any, from the platform's own scaffold; every other key installs with nothing further to build. Dry run returns the plan.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | – |
| app_key | string | – | action:"app" — which built-in app to install |
| dry_run | boolean | – | – |
| footer | boolean | – | action:"chrome" — build a shared FOOTER instead of a header |
| headline | string | – | – |
| kind | string | – | action:"overlay_attach" — which kind of overlay to attach |
| language | string | – | Copy language, default vi |
| list_id | string | – | action:"overlay_attach" kind:"quickview" — the list-dataset node on the open page |
| menu_id | string | – | – |
| name | string | – | action:"form" — the form's name in the merchant's list. action:"overlay_attach" with no overlay_id — the new pop-up/quick-view's name. |
| node_id | string | – | action:"menu" — the menu node on the open page |
| overlay_id | string | – | action:"overlay_attach" — an existing overlay; omit to create one from the seed |
| page_name | string | – | – |
| site_id | string | – | – |
| template | string | – | action:"form" — which of the platform's own form templates to seed |
No output schema declared.
No examples provided.
sb_template_use ~83
Instantiate a section template into a page — the site's own (the server copies it) or one of the BUILT-IN layouts sb_templates lists, which are composed against this page's own tokens rather than copied.
| Name | Type | Req | Description |
|---|---|---|---|
| dry_run | boolean | – | – |
| page_id | string | yes | – |
| site_id | string | – | – |
| template_id | string | yes | – |
No output schema declared.
No examples provided.
sb_templates ~46
The store's saved section templates — designed sections a person starts from rather than assembling one. Use sb_template_use to drop one into the open page.
| Name | Type | Req | Description |
|---|---|---|---|
| site_id | string | – | – |
No output schema declared.
No examples provided.
sb_theme ~154
The site's palette and type scale — the layer every element's style preset resolves from, so one token repaints every page at once. Call it with nothing to read what the site actually has. `colors` and `text_styles` PATCH the saved document: what you do not name is kept.
| Name | Type | Req | Description |
|---|---|---|---|
| colors | object | – | Token id -> CSS colour, e.g. { "heading": "#2E2A3B", "primary": "#E8557A" } |
| dry_run | boolean | – | – |
| site_id | string | – | – |
| text_styles | object | – | Text style slug -> base declarations, e.g. { "h1": { "fontSize": "48px" } } |
No output schema declared.
No examples provided.
sb_traits_for ~89
This element's INSPECTOR, as a person sees it: tabs, groups, and every control name — with what each DECLARED control writes, and the AI hints for using the element. Read this before styling an element; pass control to read one control in full.
| Name | Type | Req | Description |
|---|---|---|---|
| control | string | – | Narrow to one control, e.g. "font_size" |
| type | string | yes | – |
No output schema declared.
No examples provided.
sb_undo ~135
Put back what a PUT through sb_api_call replaced — settings, a product, a form, anything with a shape. IN THIS PROCESS ONLY, capped, and gone when it exits. For a PAGE the platform keeps its own: GET .../pages/{pageId}/history lists the autosave checkpoint it writes on every draft save, versions lists the labelled snapshots, and either restores. That one survives everything and is the better answer whenever the thing to recover is a page. No argument lists what is undoable here.
| Name | Type | Req | Description |
|---|---|---|---|
| dry_run | boolean | – | – |
| index | integer | – | 1 is the most recent write |
No output schema declared.
No examples provided.
What is the Store Builder MCP server?
Store Builder is an MCP server listed in the public MCP registry as io.github.vuluu2k/sbuilder-mcp. Design, fill with real store data, render and publish Store Builder pages from an AI agent. This page covers its npm package (sbuilder-mcp).
Is the Store Builder MCP server safe to use?
Store Builder scores 73 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 21 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Store Builder MCP server expose?
Store Builder exposes 31 tools: sb_connect, sb_site_list, sb_api_find, sb_api_call, sb_page_open, and 26 more. Their descriptions and schemas cost roughly 3,805 tokens of context every time the server is loaded.
Is the Store Builder MCP server still maintained?
Store Builder is still listed as active in the MCP registry. We last reached this channel on 21 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Store Builder MCP server under?
Store Builder declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.