Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

Store Builder

NPM · SBUILDER-MCP

Design, fill with real store data, render and publish Store Builder pages from an AI agent.

Available components

+16 this week 70 Trust /100

Last scanned (8 hours ago)

Scores higher than 38% of npm servers

Category E-commerce

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security81
  • No malware found by supply-chain analysis.Pass
  • CVE check failed: a known high-severity CVE affects zod 3.25.76, a direct dependency. A fixed version is available. View diagnostics → Fail
  • No install/post-install scripts declared.Pass
  • 30 of 94 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
Schema Quality & AI Usability56
  • AI-judged instruction clarity (good).Pass
  • Context-footprint check failed: tool/resource definitions use about 6151 tokens (~161/item across 38 items; 38 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management73
  • Stability observed for 22 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage79
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 38% of tool parameters carry a description.Partial
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
  • An AI judge read all 39 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 4 Nov 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 67 to 70. That category is still filling its 30-day observation window: 20 days of observed history at the previous scan, 21 at this one. The score rises as the window fills, whether or not the server changes.

  • 3 Nov 26 −5
    • Stability: pass → 0.67 functional
  • 31 Oct 26 +21
    • Known CVEs: unverified → fail ▼ security
    • Malware scan: unverified → pass ▲ security
    • Dependency health: unverified → 0.86 ▲ functional
  • 30 Oct 26 −1
    • Known CVEs: unverified → fail ▼ security
    • Malware scan: unverified → pass ▲ security
    • Dependency health: unverified → 0.86 ▲ functional
    • Package version: 0.101.3 → 0.104.0 functional
    • Package version: 0.101.3 → 0.103.0 functional
    • Package version: 0.101.3 → 0.102.1 functional
    • Package version: 0.101.3 → 0.101.4 functional
  • 29 Oct 26 −20
    • Malware scan: pass → unverified ▼ security
    • Known CVEs: fail → unverified ▼ security
    • Stability: pass → unverified ▼ security
    • Tool safety: pass → unverified ▼ security
    • Dependency health: 0.86 → unverified ▼ functional
    • Capabilities: pass → unverified ▼ functional
    • Tool coverage: 100 → unverified ▼ functional
    • Package version: 0.98.3 → 0.101.3 functional
    • Package version: 0.98.3 → 0.101.2 functional
    • Package version: 0.98.3 → 0.100.6 functional
    • Package version: 0.98.3 → 0.100.5 functional
    • Package version: 0.98.3 → 0.100.4 functional
    • Package version: 0.98.3 → 0.100.2 functional
    • Package version: 0.98.3 → 0.100.0 functional
    • Package version: 0.98.3 → 0.98.9 functional
    • Package version: 0.98.3 → 0.98.8 functional
    • Package version: 0.98.3 → 0.98.7 functional
    • Package version: 0.98.3 → 0.98.5 functional
    • Package version: 0.98.3 → 0.98.4 functional
  • 28 Oct 26 +15
    • Stability: pass → unverified ▼ security
    • Tool safety: pass → unverified ▼ security
    • Known CVEs: fail → unverified ▼ security
    • Malware scan: unverified → pass ▲ security
    • Capabilities: pass → unverified ▼ functional
    • Tool coverage: 100 → unverified ▼ functional
    • Dependency health: 0.86 → unverified ▼ functional
    • Package version: 0.96.0 → 0.98.3 functional
    • Package version: 0.96.0 → 0.98.2 functional
    • Package version: 0.96.0 → 0.98.0 functional
    • Package version: 0.96.0 → 0.97.0 functional
  • 27 Oct 26 0
    • Known CVEs: fail → unverified ▼ security
    • Malware scan: unverified → pass ▲ security
    • Dependency health: 0.86 → unverified ▼ functional
    • Package version: 0.93.0 → 0.96.0 functional
    • Package version: 0.93.0 → 0.95.4 functional
    • Package version: 0.93.0 → 0.95.3 functional
    • Package version: 0.93.0 → 0.95.2 functional
    • Package version: 0.93.0 → 0.95.1 functional
    • Package version: 0.93.0 → 0.94.0 functional
  • 26 Oct 26 −15
    • Malware scan: pass → unverified ▼ security
    • Stability: pass → unverified ▼ security
    • Tool safety: pass → unverified ▼ security
    • Capabilities: pass → unverified ▼ functional
    • Tool coverage: 100 → unverified ▼ functional
    • Package version: 0.91.0 → 0.93.0 functional
    • Package version: 0.91.0 → 0.92.0 functional
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 5 Nov 2026 · Analysed npm/sbuilder-mcp@0.104.0

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem npm

Background: How many MCP packages publish verified provenance →

Vulnerabilities 1 finding
ID CVE Severity Vector Fix available
GHSA-mrhx-c7xc-m3w5 CVE-2023-54404 high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yes

Background: What a vulnerability scan can and cannot prove →

Dependencies 94 packages
Packages resolved 94
Stale 30
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 38 exposed · ~5,920 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
sb_add ~88

Add an element — or a whole NESTED subtree — under a parent. One call builds a complete section: pass children rather than calling this once per node.

NameTypeReqDescription
dry_runboolean––
forceboolean–Override a render-inference guard; reported as forced
indexinteger––
parent_idstringyes–
specobjectyes–

No output schema declared.

No examples provided.

sb_api_call ~305

Call an operation from sb_api_find (id), or a route the catalog lacks (method+path); dry run by default. pick selects fields, max_items caps lists, item_offset skips items. Lists over 60 KB say so.

NameTypeReqDescription
body–––
dry_runboolean–Defaults to true. Pass false to actually send.
fileobject–Local file: multipart upload (field "file"); on a GET, saves the answer there
idstring–Operation id from sb_api_find, e.g. "get:/api/sites/{siteID}/menus"
if_matchstring|number–If-Match version; shipping-config reads it itself
item_offsetinteger–Offset within this response, after API paging. Reads only.
max_itemsinteger––
mergeboolean–PUT: deep-merge body over the current record (arrays replace)
methodstring–With path, when id is absent: GET|HEAD|POST|PUT|PATCH|DELETE
pathstring–Bare platform path, e.g. "/api/sites/{siteId}/published"; {siteId} defaults to SB_SITE
path_paramsobject––
pickarray–Fields per list item or in a {"product":{…}} answer; dotted: "variants.id"
queryobject––
site_idstring––

No output schema declared.

No examples provided.

sb_api_find ~125

Find API operations by intent (query), or get a call sheet (id): parameters, credential, body fields and handler caveats. Reaches all 949 operations.

NameTypeReqDescription
idstring–An id from a previous search — returns that operation's full call sheet
limitinteger–Default 8
querystring–What you want to do, in words: "create a menu", "list orders", "upload media"
tagstring–Narrow to one tag, e.g. "menus", "products", "theme"

No output schema declared.

No examples provided.

sb_bind ~150

Bind a node to real store data so the page shows actual products, not placeholder text. action makes a button a purchase control.

NameTypeReqDescription
actionstring–Pass product.id + specials.boundProductId
dry_runboolean––
fieldstringyesWhere the value lands, always "specials.<key>"
forceboolean–Override a render-inference guard; reported as forced
idstringyes–
sourcestringyese.g. article.author, article.categories, article.content, article.date; 96 in all, plus record.fld_<16 hex> / record.id for a Collections row; a wrong one is refused with the list

No output schema declared.

No examples provided.

sb_catalog_search ~97

Find an element type by what it does — or OMIT query to browse every type, the only way to meet one you would not have searched for. detail:true adds the AI hints, as does sb_traits_for. query "icon:<word>" lists icon names.

NameTypeReqDescription
detailboolean–Include useWhen / avoidWhen / contentTips per match
limitinteger–Default 8
querystring––

No output schema declared.

No examples provided.

sb_code ~228

The site's custom code files — tracking pixels, analytics, chat widgets, site-wide CSS — injected at head, body_start or body_end of every page (no page_id) or one page. Create infers language from the extension, placement from the language. scss/typescript compile on write (compile_error). json/text: placement "none" only; an enabled site-wide "none" file is served at its url. action:"list" | "set" (no id creates; with id merges the named fields over the stored row) | "remove". Not the custom-code element.

NameTypeReqDescription
actionstringyes–
contentstring––
dry_runboolean––
enabledboolean––
idstring––
languagestring––
namestring––
page_idstring–list: that page's files plus site-wide; set: scope to it ("" = site-wide)
placementstring––
positioninteger––
site_idstring––

No output schema declared.

No examples provided.

sb_connect ~51

Log in and list the sites this account can operate. Call this first. Reads SB_EMAIL and SB_PASSWORD from the environment unless you pass them.

NameTypeReqDescription
emailstring––
passwordstring––

No output schema declared.

No examples provided.

sb_duplicate ~177

Copy a node and everything under it, under fresh ids, right after the original. The move a designer makes constantly — build one card, duplicate it twice. to_page_id (and to_site_id) pastes the copy onto another page instead, as the editor's copy/paste does: a cross-site copy has its images copied into the target library and references that cannot travel blanked and listed; the open page becomes the target.

NameTypeReqDescription
dry_runboolean––
forceboolean–Override a render-inference guard; reported as forced
idstringyes–
indexinteger––
parent_idstring–with to_page_id: where on that page; default ROOT, before a footer
to_page_idstring––
to_site_idstring––

No output schema declared.

No examples provided.

sb_event ~117

Give a node a click action — open the cart, go to a page, open a pop-up. A purchase is not one: use sb_bind action.

NameTypeReqDescription
actionstringyesAn action this element allows, or "none" to clear. A wrong one is refused with the list
dry_runboolean––
forceboolean–Override a render-inference guard; reported as forced
idstringyes–
payloadobject––
triggerstring–Default "click"

No output schema declared.

No examples provided.

sb_function ~227

Backend functions: server-side TS/JS at /_wb/fn/<slug> with the site's secrets, collections and fetch ("_" slug = importable module). Not sb_code. action: list | get | set (no id creates; id merges) | remove (id, or secret key) | test (method/path/query/headers/cookies/body) | logs | usage | secret (no key lists; key+value sets). Owner/admin only.

NameTypeReqDescription
actionstringyes–
bodystring––
contentstring––
cookiesobject––
dry_runboolean––
enabledboolean––
headersobject––
idstring–logs: filters to it
keystring––
languagestring––
limitinteger––
methodstring––
pathstring––
querystring––
site_idstring––
slugstring––
valuestring––

No output schema declared.

No examples provided.

sb_import ~180

Read a page from any public URL and add its structure and content to the OPEN page as real elements, styled with this page's own tokens. Not a clone: the source's layout and CSS are not copied. Dry run returns what was found.

NameTypeReqDescription
dry_runboolean––
max_imagesinteger–Default 24 — every image is an upload
max_nodesinteger–No cap by default — bounds the whole import if given
max_sectionsinteger––
nav_timeout_msinteger–How long to wait for a page to answer at all. Default 30000; raise it for a slow origin
site_idstring––
upload_imagesboolean–Copy the images into this site's media library, default true
urlstringyesThe page to read

No output schema declared.

No examples provided.

sb_import_site ~270

Read a WHOLE site from one URL — its sitemap, or the links on that page — and give each page found its own DRAFT page here, built from this site's tokens. Not a clone. Dry run returns the page list before anything is created.

NameTypeReqDescription
depthinteger–No sitemap: link depth, default 1
dry_runboolean––
excludearray––
homepageboolean–Entry into this site's home page, default true
includearray–Path substrings to keep
max_imagesinteger–Default 24, whole import
max_nodesinteger–Per page. No cap by default
max_pagesinteger–Default 12
navboolean–Shared header linking the new pages, default true
nav_timeout_msinteger–How long to wait for a page to answer at all. Default 30000; raise it for a slow origin
site_idstring––
themeboolean–Patch this site's theme from the entry page's colours and type scale, default true — SITE-WIDE, affecting pages outside this import too
upload_imagesboolean––
urlstringyesAny page of the site

No output schema declared.

No examples provided.

sb_live_join ~79

Join the site's live-edit room as a visible peer: every write then appears in any open editor as it happens, with the agent shown by the API key's own name rather than a person's. Always yields, so it is safe beside a human. Works with SB_TOKEN or with SB_EMAIL / SB_PASSWORD.

NameTypeReqDescription
site_idstring––

No output schema declared.

No examples provided.

sb_look ~186

Save, render through the platform's own renderer, and return screenshots at desktop, tablet and mobile widths, measured boxes for the bands and their children, and any layout defect measured on the render (overflow, overlap, unreadable text). node_id frames one element. Judge your work from these, not from memory.

NameTypeReqDescription
box_depthinteger–Boxes down to this depth in the tree (default 2: bands and their children)
formatstring–jpeg (default) is smaller and faster; png for pixel-exact colour
node_idstring–Frame just this node instead of the whole page — how a designer looks at one card
urlstring–Shoot this address instead of the draft preview — use the PUBLISHED storefront URL to see real store data
widthsarray––
with_boxesboolean––

No output schema declared.

No examples provided.

sb_media_list ~78

The site's media library. Reuse an image before adding another; search by name, filter by type, page with limit/offset.

NameTypeReqDescription
limitinteger––
media_typestring–e.g. "image"
offsetinteger––
searchstring––
site_idstring––

No output schema declared.

No examples provided.

sb_media_upload ~201

Put an image into the media library and get its URL back, ready for sb_set. Takes a local path, a URL, or a SEARCH — `query` returns real photographs with their own descriptions, and `pick` uploads the one you chose, or several at once to stock a site you just built. The only way to add an image.

NameTypeReqDescription
dry_runboolean––
folder_idstring––
namestring––
orientationstring––
pathstring–A file on this machine
pathsarray–Several files; one failing does not stop the rest
pick––The id of the search result to upload — or several ids, which stocks a site in one call
querystring–Search real photographs; read the descriptions, then pick
site_idstring––
urlstring–Fetched, then uploaded

No output schema declared.

No examples provided.

sb_move ~65

Move a node to another parent at an index.

NameTypeReqDescription
dry_runboolean––
forceboolean–Override a render-inference guard; reported as forced
idstringyes–
indexintegeryes–
parent_idstringyes–

No output schema declared.

No examples provided.

sb_node_read ~34

One node in full — style, config, specials, per-breakpoint overrides, bindings.

NameTypeReqDescription
idstringyes–

No output schema declared.

No examples provided.

sb_outline ~79

The open page as a compressed tree — id, type, name, child count, band, and whether a node is a shared global or a site overlay. Never the raw document: a real page is hundreds of KB of JSON.

NameTypeReqDescription
chromeboolean–Expand shared chrome and overlays (default one line each)
depthinteger––

No output schema declared.

No examples provided.

sb_page_create ~235

A store type (product, category, search, blog, post, complete, account) arrives with the document the editor gives a merchant — product carries the whole bound buy box; seed:false for blank. Any other type is empty and sb_page_open seeds its ROOT. TYPE is the route: /checkout and /products/{slug} need a PUBLISHED page of that type or they 404.

NameTypeReqDescription
chromeboolean–Carry the site's header and footer, default true
dry_runboolean––
headlinestring–The complete page's thank-you line.
is_homepageboolean––
localestring–vi or en — a store seed's wording; defaults to the site's language, else vi.
namestringyes–
seedboolean–Default true; false creates a blank page.
settingsobject––
site_idstring––
slugstring––
typestring–omit: inferred from the name (about/contact/policy/faq), else page; sb_page_list lists every type

No output schema declared.

No examples provided.

sb_page_list ~32

Every page on the site, with its slug and whether it is live.

NameTypeReqDescription
site_idstring––

No output schema declared.

No examples provided.

sb_page_open ~89

Open a page for editing and return its outline. Call before any sb_add / sb_set / sb_move / sb_remove. Find page ids with sb_api_find "list pages". Or form_id: edit that form's field document (fields, specials.formRules on its root).

NameTypeReqDescription
form_idstring––
page_idstring––
site_idstring––

No output schema declared.

No examples provided.

sb_page_repair ~103

Rename a page root that is not "ROOT" (sppro_1, rt_<hex> — left by older seeds) to ROOT, for one page or, without page_id, every page on the site. Draft only; a published page is listed for re-publishing. dry_run (default true) lists what would change.

NameTypeReqDescription
dry_runboolean––
page_idstring––
site_idstring––

No output schema declared.

No examples provided.

sb_page_state ~135

Which of this page's three copies is which: the DRAFT the editor canvas shows, the PUBLISHED row the storefront serves, and what this session holds. Says whether the editor will render the canvas BLANK (its hydrate gate discards a document whose root is missing and shows an empty ROOT, silently — the Go renderer has no such gate, which is how "the live page has data but the canvas is empty" happens), whether the draft has changes the live page does not, and where the recovery points are.

NameTypeReqDescription
page_idstring–Defaults to the open page
site_idstring––

No output schema declared.

No examples provided.

sb_page_update ~200

Edit a page's name, slug, home flag, order, SEO (merged key by key) or members_only. Reads the page first and merges `settings`, so keys it does not name survive. On a template page (product, category, post, blog, course, brand): default_template makes it the type's default, render_for/render_default move entities onto it or back to the default.

NameTypeReqDescription
default_templateboolean––
dry_runboolean––
is_homepageboolean––
members_onlyboolean––
namestring––
page_idstringyes–
render_defaultarray–entity ids to return to the type default
render_forarray–entity ids that should render through this page
seoobject––
site_idstring––
slugstring––
sort_orderinteger––

No output schema declared.

No examples provided.

sb_page_version ~134

A page's platform recovery points, everyone's edits included (sb_undo covers this process only). action:"list" — named versions and autosave history; "save" {label} — snapshot the current draft; "restore" {version_id | history_id} — put the draft back. Writes are dry runs by default.

NameTypeReqDescription
actionstringyes–
dry_runboolean––
history_idstring––
labelstring––
page_idstring–Defaults to the open page
site_idstring––
version_idstring––

No output schema declared.

No examples provided.

sb_publish ~176

Compile the draft into the live page, and report which revision went live (id, publishedAt, fromVersionId). PUBLISH CASCADES to every page sharing a changed global section or overlay; the dry run lists them (would_cascade) and warns FIRST when it would ship shared edits nobody published. verify:true then fetches the live page and says whether the origin is serving that revision yet — the storefront caches for 60s, so a reload showing the old page is that, not a failed publish.

NameTypeReqDescription
dry_runboolean––
page_idstringyes–
publish_draftsboolean–Also publish the pages listed as unpublished_drafts and first_publish
site_idstring––
verifyboolean–Fetch the live page afterwards and report whether it serves this revision

No output schema declared.

No examples provided.

sb_remove ~48

Remove a node and its whole subtree.

NameTypeReqDescription
dry_runboolean––
forceboolean–Override a render-inference guard; reported as forced
idstringyes–

No output schema declared.

No examples provided.

sb_review ~72

What a VISITOR would meet on the open page (blank band, placeholder, dead binding) AND what stands between this store and a paid order (checkout page, gateway, delivery, a cart link). Run it before calling a page done; page_id: only that page.

NameTypeReqDescription
page_idstring––

No output schema declared.

No examples provided.

sb_set ~211

Write style, config or specials keys on one node, or on many through edits (one save, one live frame). Per BREAKPOINT by default; base:true writes the fallback layer, right for a value that should not vary.

NameTypeReqDescription
baseboolean––
breakpointstring––
dry_runboolean––
editsarray––
forceboolean–Override a render-inference guard; reported as forced
idstring––
keysobject––
namespacestring––
statestring–An interaction state — "hover", or "stuck" for how a pinned element looks once it is stuck (needs a sticky/fixed self-or-ancestor; a descendant styles itself through the host).
unsetarray–Keys to REMOVE from the same slot — the only way to undo a write. Setting null is not the same: null is a stored value, so the override still counts as present.

No output schema declared.

No examples provided.

sb_site_list ~17

List the sites this account can operate.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

sb_store ~939

Run a store flow that must happen in a fixed order. action:"checkout" makes the order form, configures it, saves its fields with this store's real payment and delivery options, then creates and PUBLISHES the checkout page — /checkout 404s without all four. action:"checkout_sync" re-reads the store's payment and delivery methods into every existing order form and republishes the checkout page — run it after adding a shipping method or switching on a gateway, since the form keeps the options it was saved with. action:"form" seeds any of the platform's other form templates (login, contact, booking, stay and more — settings merge into the record) with its own field document, which is the part that cannot be guessed. action:"chrome" gives every page ONE shared header (footer:true — footer) built on a real site menu of page/category/product references: site name, desktop menu, mobile drawer, search, cart and account icons — the gap sb_review reports as siteChrome. action:"menu" binds a menu node on the open page to the site's menu and resolves its links, the way the editor does. action:"overlay_attach" puts a pop-up on the open page (kind:"popup") or points a list-dataset at a quick-view panel (kind:"quickview", list_id), creating either from the platform's own seed when overlay_id is omitted, and re-reads the page afterwards as the editor must. action:"cart" creates the site's cart drawer from the editor's seed when it has none — without it every open_cart control opens nothing. action:"app" installs one of the platform's built-in apps (app_key) and creates the pages it needs that installing it does not — today only "courses" has any, from the platform's own scaffold; every other key installs with nothing further to build. action:"global_attach" puts an EXISTING shared section (global_id) on the open page and action:"global_detach" takes it off, writing the reference the platform reads and placing it in the band ROOT's child order demands — the answer for a page that is…

NameTypeReqDescription
actionstringyes–
app_keystring–action:"app" — which built-in app to install
dry_runboolean––
footerboolean–action:"chrome" — build a shared FOOTER instead of a header
global_idstring–action:"global_attach"/"global_detach" — the shared section; omitted on attach it lists the site's own
global_kindstring––
headlinestring––
kindstring–action:"overlay_attach" — which kind of overlay to attach
languagestring–Copy language, default vi
list_idstring–action:"overlay_attach" kind:"quickview" — the list-dataset node on the open page
menu_idstring––
namestring–action:"form" — the form's name in the merchant's list. action:"overlay_attach" with no overlay_id — the new pop-up/quick-view's name. "chrome" — the header's site name.
node_idstring–action:"menu" — the menu node; "global_promote"/"template_save" — the section; "form" — a node of the open page to place it in
overlay_idstring–action:"overlay_attach" — an existing overlay; omit to create one from the seed
page_namestring––
relocalizeboolean–action:"cart" — rewrite an EXISTING drawer's seed words that are in another language to the site locale's (edited text untouched), and turn a gallery line thumbnail into a single image; needs a page…
settingsobject–action:"form" {booking:{maxPerSlot:2}}
site_idstring––
templatestring–action:"form" — which of the platform's own form templates to seed
template_idstring–action:"template_save" — overwrite this template's content

No output schema declared.

No examples provided.

sb_template_use ~90

Add a section template to a page, above the footer — a sb_templates row (another site's is copied in first) or one of the BUILT-IN layouts sb_templates lists, which are composed against this page's own tokens rather than copied.

NameTypeReqDescription
dry_runboolean––
page_idstringyes–
site_idstring––
template_idstringyes–

No output schema declared.

No examples provided.

sb_templates ~46

The store's saved section templates — designed sections a person starts from rather than assembling one. Use sb_template_use to drop one into the open page.

NameTypeReqDescription
site_idstring––

No output schema declared.

No examples provided.

sb_theme ~275

The site's palette and type scale — the layer every element's style preset resolves from, so one token repaints every page at once. Call it with nothing to read what the site actually has. `colors` and `text_styles` PATCH the saved document: what you do not name is kept, and so does `presets` (a preset's own literal outranks the text style). A mobile/tablet/laptop object writes that breakpoint. `locale` sets the site's language (settings.locale, what <html lang> is served from) — site-wide, every other setting kept.

NameTypeReqDescription
colorsobject–Token id -> CSS colour, e.g. { "heading": "#2E2A3B", "primary": "#E8557A" }
dry_runboolean––
localestring–Site language tag, e.g. "vi" or "en"
presetsobject–Preset id -> declarations, e.g. { "heading-default": { "fontFamily": "Inter" } }
site_idstring––
text_stylesobject–Slug -> declarations, e.g. { "heading-3": { "fontSize": "20px", "mobile": { "fontSize": "18px" } } }

No output schema declared.

No examples provided.

sb_traits_for ~89

This element's INSPECTOR, as a person sees it: tabs, groups, and every control name — with what each DECLARED control writes, and the AI hints for using the element. Read this before styling an element; pass control to read one control in full.

NameTypeReqDescription
controlstring–Narrow to one control, e.g. "font_size"
typestringyes–

No output schema declared.

No examples provided.

sb_translate ~148

Multilingual, as the editor does it. status | locales (add/remove) | page (rows: missing, done, outdated) | write (node id+field+value; registry fields only) | auto (machine-fill missing) | review (approve).

NameTypeReqDescription
actionstringyes–
addarray––
allboolean––
dry_runboolean––
entriesarray––
fromstring––
localestring––
offsetinteger––
page_idstring––
removearray––
site_idstring––
sourcestring––

No output schema declared.

No examples provided.

sb_undo ~144

Put back what a write replaced — a page or form edit made here (sb_add, sb_set, sb_duplicate …), or a PUT through sb_api_call. An undo records what IT replaced, so the newest entry right after one is its redo. A page is refused if anyone else saved it since. IN THIS PROCESS ONLY, capped; the platform's own page history (GET .../pages/{pageId}/history) survives a restart. No argument lists what is undoable.

NameTypeReqDescription
allboolean–Every page, not just the open one
dry_runboolean––
indexinteger–1 is the most recent write

No output schema declared.

No examples provided.

Install

How do I install the Store Builder MCP server?

Store Builder runs locally as an npm package, launched with npx -y sbuilder-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · sbuilder-mcp

# add to Claude Code
claude mcp add vuluu2k-sbuilder-mcp -- npx -y sbuilder-mcp
Common questions

What is the Store Builder MCP server?

Store Builder is an MCP server listed in the public MCP registry as io.github.vuluu2k/sbuilder-mcp. Design, fill with real store data, render and publish Store Builder pages from an AI agent. This page covers its npm package (sbuilder-mcp).

Is the Store Builder MCP server safe to use?

Store Builder scores 70 out of 100 on VerifyMCP. We recorded 1 known advisory against it as of 5 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the Store Builder MCP server expose?

Store Builder exposes 38 tools: sb_connect, sb_site_list, sb_api_find, sb_api_call, sb_page_open, and 33 more. Their descriptions and schemas cost roughly 5,920 tokens of context every time the server is loaded.

Is the Store Builder MCP server still maintained?

Store Builder is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the Store Builder MCP server under?

Store Builder declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.