Store Builder
NPM · SBUILDER-MCP
Design, fill with real store data, render and publish Store Builder pages from an AI agent.
Available components
Last scanned (8 hours ago)
Scores higher than 38% of npm servers
Category E-commerce
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security81
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known high-severity CVE affects zod 3.25.76, a direct dependency. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- 30 of 94 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 5 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability56
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 6151 tokens (~161/item across 38 items; 38 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management73
- Stability observed for 22 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage79
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 38% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 39 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 67 to 70. That category is still filling its 30-day observation window: 20 days of observed history at the previous scan, 21 at this one. The score rises as the window fills, whether or not the server changes.
- 3 Nov 26 −5
- Stability: pass → 0.67 functional
- 31 Oct 26 +21
- Known CVEs: unverified → fail ▼ security
- Malware scan: unverified → pass ▲ security
- Dependency health: unverified → 0.86 ▲ functional
- 30 Oct 26 −1
- Known CVEs: unverified → fail ▼ security
- Malware scan: unverified → pass ▲ security
- Dependency health: unverified → 0.86 ▲ functional
- Package version: 0.101.3 → 0.104.0 functional
- Package version: 0.101.3 → 0.103.0 functional
- Package version: 0.101.3 → 0.102.1 functional
- Package version: 0.101.3 → 0.101.4 functional
- 29 Oct 26 −20
- Malware scan: pass → unverified ▼ security
- Known CVEs: fail → unverified ▼ security
- Stability: pass → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Dependency health: 0.86 → unverified ▼ functional
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Package version: 0.98.3 → 0.101.3 functional
- Package version: 0.98.3 → 0.101.2 functional
- Package version: 0.98.3 → 0.100.6 functional
- Package version: 0.98.3 → 0.100.5 functional
- Package version: 0.98.3 → 0.100.4 functional
- Package version: 0.98.3 → 0.100.2 functional
- Package version: 0.98.3 → 0.100.0 functional
- Package version: 0.98.3 → 0.98.9 functional
- Package version: 0.98.3 → 0.98.8 functional
- Package version: 0.98.3 → 0.98.7 functional
- Package version: 0.98.3 → 0.98.5 functional
- Package version: 0.98.3 → 0.98.4 functional
- 28 Oct 26 +15
- Stability: pass → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Known CVEs: fail → unverified ▼ security
- Malware scan: unverified → pass ▲ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Dependency health: 0.86 → unverified ▼ functional
- Package version: 0.96.0 → 0.98.3 functional
- Package version: 0.96.0 → 0.98.2 functional
- Package version: 0.96.0 → 0.98.0 functional
- Package version: 0.96.0 → 0.97.0 functional
- 27 Oct 26 0
- Known CVEs: fail → unverified ▼ security
- Malware scan: unverified → pass ▲ security
- Dependency health: 0.86 → unverified ▼ functional
- Package version: 0.93.0 → 0.96.0 functional
- Package version: 0.93.0 → 0.95.4 functional
- Package version: 0.93.0 → 0.95.3 functional
- Package version: 0.93.0 → 0.95.2 functional
- Package version: 0.93.0 → 0.95.1 functional
- Package version: 0.93.0 → 0.94.0 functional
- 26 Oct 26 −15
- Malware scan: pass → unverified ▼ security
- Stability: pass → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Package version: 0.91.0 → 0.93.0 functional
- Package version: 0.91.0 → 0.92.0 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed npm/sbuilder-mcp@0.104.0
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Vulnerabilities 1 finding
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-mrhx-c7xc-m3w5 | CVE-2023-54404 | high | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | yes |
Background: What a vulnerability scan can and cannot prove →
Dependencies 94 packages
| Packages resolved | 94 |
|---|---|
| Stale | 30 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
sb_add ~88
Add an element — or a whole NESTED subtree — under a parent. One call builds a complete section: pass children rather than calling this once per node.
| Name | Type | Req | Description |
|---|---|---|---|
| dry_run | boolean | – | – |
| force | boolean | – | Override a render-inference guard; reported as forced |
| index | integer | – | – |
| parent_id | string | yes | – |
| spec | object | yes | – |
No output schema declared.
No examples provided.
sb_api_call ~305
Call an operation from sb_api_find (id), or a route the catalog lacks (method+path); dry run by default. pick selects fields, max_items caps lists, item_offset skips items. Lists over 60 KB say so.
| Name | Type | Req | Description |
|---|---|---|---|
| body | – | – | – |
| dry_run | boolean | – | Defaults to true. Pass false to actually send. |
| file | object | – | Local file: multipart upload (field "file"); on a GET, saves the answer there |
| id | string | – | Operation id from sb_api_find, e.g. "get:/api/sites/{siteID}/menus" |
| if_match | string|number | – | If-Match version; shipping-config reads it itself |
| item_offset | integer | – | Offset within this response, after API paging. Reads only. |
| max_items | integer | – | – |
| merge | boolean | – | PUT: deep-merge body over the current record (arrays replace) |
| method | string | – | With path, when id is absent: GET|HEAD|POST|PUT|PATCH|DELETE |
| path | string | – | Bare platform path, e.g. "/api/sites/{siteId}/published"; {siteId} defaults to SB_SITE |
| path_params | object | – | – |
| pick | array | – | Fields per list item or in a {"product":{…}} answer; dotted: "variants.id" |
| query | object | – | – |
| site_id | string | – | – |
No output schema declared.
No examples provided.
sb_api_find ~125
Find API operations by intent (query), or get a call sheet (id): parameters, credential, body fields and handler caveats. Reaches all 949 operations.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | – | An id from a previous search — returns that operation's full call sheet |
| limit | integer | – | Default 8 |
| query | string | – | What you want to do, in words: "create a menu", "list orders", "upload media" |
| tag | string | – | Narrow to one tag, e.g. "menus", "products", "theme" |
No output schema declared.
No examples provided.
sb_bind ~150
Bind a node to real store data so the page shows actual products, not placeholder text. action makes a button a purchase control.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | – | Pass product.id + specials.boundProductId |
| dry_run | boolean | – | – |
| field | string | yes | Where the value lands, always "specials.<key>" |
| force | boolean | – | Override a render-inference guard; reported as forced |
| id | string | yes | – |
| source | string | yes | e.g. article.author, article.categories, article.content, article.date; 96 in all, plus record.fld_<16 hex> / record.id for a Collections row; a wrong one is refused with the list |
No output schema declared.
No examples provided.
sb_catalog_search ~97
Find an element type by what it does — or OMIT query to browse every type, the only way to meet one you would not have searched for. detail:true adds the AI hints, as does sb_traits_for. query "icon:<word>" lists icon names.
| Name | Type | Req | Description |
|---|---|---|---|
| detail | boolean | – | Include useWhen / avoidWhen / contentTips per match |
| limit | integer | – | Default 8 |
| query | string | – | – |
No output schema declared.
No examples provided.
sb_code ~228
The site's custom code files — tracking pixels, analytics, chat widgets, site-wide CSS — injected at head, body_start or body_end of every page (no page_id) or one page. Create infers language from the extension, placement from the language. scss/typescript compile on write (compile_error). json/text: placement "none" only; an enabled site-wide "none" file is served at its url. action:"list" | "set" (no id creates; with id merges the named fields over the stored row) | "remove". Not the custom-code element.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | – |
| content | string | – | – |
| dry_run | boolean | – | – |
| enabled | boolean | – | – |
| id | string | – | – |
| language | string | – | – |
| name | string | – | – |
| page_id | string | – | list: that page's files plus site-wide; set: scope to it ("" = site-wide) |
| placement | string | – | – |
| position | integer | – | – |
| site_id | string | – | – |
No output schema declared.
No examples provided.
sb_connect ~51
Log in and list the sites this account can operate. Call this first. Reads SB_EMAIL and SB_PASSWORD from the environment unless you pass them.
| Name | Type | Req | Description |
|---|---|---|---|
| string | – | – | |
| password | string | – | – |
No output schema declared.
No examples provided.
sb_duplicate ~177
Copy a node and everything under it, under fresh ids, right after the original. The move a designer makes constantly — build one card, duplicate it twice. to_page_id (and to_site_id) pastes the copy onto another page instead, as the editor's copy/paste does: a cross-site copy has its images copied into the target library and references that cannot travel blanked and listed; the open page becomes the target.
| Name | Type | Req | Description |
|---|---|---|---|
| dry_run | boolean | – | – |
| force | boolean | – | Override a render-inference guard; reported as forced |
| id | string | yes | – |
| index | integer | – | – |
| parent_id | string | – | with to_page_id: where on that page; default ROOT, before a footer |
| to_page_id | string | – | – |
| to_site_id | string | – | – |
No output schema declared.
No examples provided.
sb_event ~117
Give a node a click action — open the cart, go to a page, open a pop-up. A purchase is not one: use sb_bind action.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | An action this element allows, or "none" to clear. A wrong one is refused with the list |
| dry_run | boolean | – | – |
| force | boolean | – | Override a render-inference guard; reported as forced |
| id | string | yes | – |
| payload | object | – | – |
| trigger | string | – | Default "click" |
No output schema declared.
No examples provided.
sb_function ~227
Backend functions: server-side TS/JS at /_wb/fn/<slug> with the site's secrets, collections and fetch ("_" slug = importable module). Not sb_code. action: list | get | set (no id creates; id merges) | remove (id, or secret key) | test (method/path/query/headers/cookies/body) | logs | usage | secret (no key lists; key+value sets). Owner/admin only.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | – |
| body | string | – | – |
| content | string | – | – |
| cookies | object | – | – |
| dry_run | boolean | – | – |
| enabled | boolean | – | – |
| headers | object | – | – |
| id | string | – | logs: filters to it |
| key | string | – | – |
| language | string | – | – |
| limit | integer | – | – |
| method | string | – | – |
| path | string | – | – |
| query | string | – | – |
| site_id | string | – | – |
| slug | string | – | – |
| value | string | – | – |
No output schema declared.
No examples provided.
sb_import ~180
Read a page from any public URL and add its structure and content to the OPEN page as real elements, styled with this page's own tokens. Not a clone: the source's layout and CSS are not copied. Dry run returns what was found.
| Name | Type | Req | Description |
|---|---|---|---|
| dry_run | boolean | – | – |
| max_images | integer | – | Default 24 — every image is an upload |
| max_nodes | integer | – | No cap by default — bounds the whole import if given |
| max_sections | integer | – | – |
| nav_timeout_ms | integer | – | How long to wait for a page to answer at all. Default 30000; raise it for a slow origin |
| site_id | string | – | – |
| upload_images | boolean | – | Copy the images into this site's media library, default true |
| url | string | yes | The page to read |
No output schema declared.
No examples provided.
sb_import_site ~270
Read a WHOLE site from one URL — its sitemap, or the links on that page — and give each page found its own DRAFT page here, built from this site's tokens. Not a clone. Dry run returns the page list before anything is created.
| Name | Type | Req | Description |
|---|---|---|---|
| depth | integer | – | No sitemap: link depth, default 1 |
| dry_run | boolean | – | – |
| exclude | array | – | – |
| homepage | boolean | – | Entry into this site's home page, default true |
| include | array | – | Path substrings to keep |
| max_images | integer | – | Default 24, whole import |
| max_nodes | integer | – | Per page. No cap by default |
| max_pages | integer | – | Default 12 |
| nav | boolean | – | Shared header linking the new pages, default true |
| nav_timeout_ms | integer | – | How long to wait for a page to answer at all. Default 30000; raise it for a slow origin |
| site_id | string | – | – |
| theme | boolean | – | Patch this site's theme from the entry page's colours and type scale, default true — SITE-WIDE, affecting pages outside this import too |
| upload_images | boolean | – | – |
| url | string | yes | Any page of the site |
No output schema declared.
No examples provided.
sb_live_join ~79
Join the site's live-edit room as a visible peer: every write then appears in any open editor as it happens, with the agent shown by the API key's own name rather than a person's. Always yields, so it is safe beside a human. Works with SB_TOKEN or with SB_EMAIL / SB_PASSWORD.
| Name | Type | Req | Description |
|---|---|---|---|
| site_id | string | – | – |
No output schema declared.
No examples provided.
sb_look ~186
Save, render through the platform's own renderer, and return screenshots at desktop, tablet and mobile widths, measured boxes for the bands and their children, and any layout defect measured on the render (overflow, overlap, unreadable text). node_id frames one element. Judge your work from these, not from memory.
| Name | Type | Req | Description |
|---|---|---|---|
| box_depth | integer | – | Boxes down to this depth in the tree (default 2: bands and their children) |
| format | string | – | jpeg (default) is smaller and faster; png for pixel-exact colour |
| node_id | string | – | Frame just this node instead of the whole page — how a designer looks at one card |
| url | string | – | Shoot this address instead of the draft preview — use the PUBLISHED storefront URL to see real store data |
| widths | array | – | – |
| with_boxes | boolean | – | – |
No output schema declared.
No examples provided.
sb_media_list ~78
The site's media library. Reuse an image before adding another; search by name, filter by type, page with limit/offset.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | – |
| media_type | string | – | e.g. "image" |
| offset | integer | – | – |
| search | string | – | – |
| site_id | string | – | – |
No output schema declared.
No examples provided.
sb_media_upload ~201
Put an image into the media library and get its URL back, ready for sb_set. Takes a local path, a URL, or a SEARCH — `query` returns real photographs with their own descriptions, and `pick` uploads the one you chose, or several at once to stock a site you just built. The only way to add an image.
| Name | Type | Req | Description |
|---|---|---|---|
| dry_run | boolean | – | – |
| folder_id | string | – | – |
| name | string | – | – |
| orientation | string | – | – |
| path | string | – | A file on this machine |
| paths | array | – | Several files; one failing does not stop the rest |
| pick | – | – | The id of the search result to upload — or several ids, which stocks a site in one call |
| query | string | – | Search real photographs; read the descriptions, then pick |
| site_id | string | – | – |
| url | string | – | Fetched, then uploaded |
No output schema declared.
No examples provided.
sb_move ~65
Move a node to another parent at an index.
| Name | Type | Req | Description |
|---|---|---|---|
| dry_run | boolean | – | – |
| force | boolean | – | Override a render-inference guard; reported as forced |
| id | string | yes | – |
| index | integer | yes | – |
| parent_id | string | yes | – |
No output schema declared.
No examples provided.
sb_node_read ~34
One node in full — style, config, specials, per-breakpoint overrides, bindings.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | – |
No output schema declared.
No examples provided.
sb_outline ~79
The open page as a compressed tree — id, type, name, child count, band, and whether a node is a shared global or a site overlay. Never the raw document: a real page is hundreds of KB of JSON.
| Name | Type | Req | Description |
|---|---|---|---|
| chrome | boolean | – | Expand shared chrome and overlays (default one line each) |
| depth | integer | – | – |
No output schema declared.
No examples provided.
sb_page_create ~235
A store type (product, category, search, blog, post, complete, account) arrives with the document the editor gives a merchant — product carries the whole bound buy box; seed:false for blank. Any other type is empty and sb_page_open seeds its ROOT. TYPE is the route: /checkout and /products/{slug} need a PUBLISHED page of that type or they 404.
| Name | Type | Req | Description |
|---|---|---|---|
| chrome | boolean | – | Carry the site's header and footer, default true |
| dry_run | boolean | – | – |
| headline | string | – | The complete page's thank-you line. |
| is_homepage | boolean | – | – |
| locale | string | – | vi or en — a store seed's wording; defaults to the site's language, else vi. |
| name | string | yes | – |
| seed | boolean | – | Default true; false creates a blank page. |
| settings | object | – | – |
| site_id | string | – | – |
| slug | string | – | – |
| type | string | – | omit: inferred from the name (about/contact/policy/faq), else page; sb_page_list lists every type |
No output schema declared.
No examples provided.
sb_page_list ~32
Every page on the site, with its slug and whether it is live.
| Name | Type | Req | Description |
|---|---|---|---|
| site_id | string | – | – |
No output schema declared.
No examples provided.
sb_page_open ~89
Open a page for editing and return its outline. Call before any sb_add / sb_set / sb_move / sb_remove. Find page ids with sb_api_find "list pages". Or form_id: edit that form's field document (fields, specials.formRules on its root).
| Name | Type | Req | Description |
|---|---|---|---|
| form_id | string | – | – |
| page_id | string | – | – |
| site_id | string | – | – |
No output schema declared.
No examples provided.
sb_page_repair ~103
Rename a page root that is not "ROOT" (sppro_1, rt_<hex> — left by older seeds) to ROOT, for one page or, without page_id, every page on the site. Draft only; a published page is listed for re-publishing. dry_run (default true) lists what would change.
| Name | Type | Req | Description |
|---|---|---|---|
| dry_run | boolean | – | – |
| page_id | string | – | – |
| site_id | string | – | – |
No output schema declared.
No examples provided.
sb_page_state ~135
Which of this page's three copies is which: the DRAFT the editor canvas shows, the PUBLISHED row the storefront serves, and what this session holds. Says whether the editor will render the canvas BLANK (its hydrate gate discards a document whose root is missing and shows an empty ROOT, silently — the Go renderer has no such gate, which is how "the live page has data but the canvas is empty" happens), whether the draft has changes the live page does not, and where the recovery points are.
| Name | Type | Req | Description |
|---|---|---|---|
| page_id | string | – | Defaults to the open page |
| site_id | string | – | – |
No output schema declared.
No examples provided.
sb_page_update ~200
Edit a page's name, slug, home flag, order, SEO (merged key by key) or members_only. Reads the page first and merges `settings`, so keys it does not name survive. On a template page (product, category, post, blog, course, brand): default_template makes it the type's default, render_for/render_default move entities onto it or back to the default.
| Name | Type | Req | Description |
|---|---|---|---|
| default_template | boolean | – | – |
| dry_run | boolean | – | – |
| is_homepage | boolean | – | – |
| members_only | boolean | – | – |
| name | string | – | – |
| page_id | string | yes | – |
| render_default | array | – | entity ids to return to the type default |
| render_for | array | – | entity ids that should render through this page |
| seo | object | – | – |
| site_id | string | – | – |
| slug | string | – | – |
| sort_order | integer | – | – |
No output schema declared.
No examples provided.
sb_page_version ~134
A page's platform recovery points, everyone's edits included (sb_undo covers this process only). action:"list" — named versions and autosave history; "save" {label} — snapshot the current draft; "restore" {version_id | history_id} — put the draft back. Writes are dry runs by default.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | – |
| dry_run | boolean | – | – |
| history_id | string | – | – |
| label | string | – | – |
| page_id | string | – | Defaults to the open page |
| site_id | string | – | – |
| version_id | string | – | – |
No output schema declared.
No examples provided.
sb_publish ~176
Compile the draft into the live page, and report which revision went live (id, publishedAt, fromVersionId). PUBLISH CASCADES to every page sharing a changed global section or overlay; the dry run lists them (would_cascade) and warns FIRST when it would ship shared edits nobody published. verify:true then fetches the live page and says whether the origin is serving that revision yet — the storefront caches for 60s, so a reload showing the old page is that, not a failed publish.
| Name | Type | Req | Description |
|---|---|---|---|
| dry_run | boolean | – | – |
| page_id | string | yes | – |
| publish_drafts | boolean | – | Also publish the pages listed as unpublished_drafts and first_publish |
| site_id | string | – | – |
| verify | boolean | – | Fetch the live page afterwards and report whether it serves this revision |
No output schema declared.
No examples provided.
sb_remove ~48
Remove a node and its whole subtree.
| Name | Type | Req | Description |
|---|---|---|---|
| dry_run | boolean | – | – |
| force | boolean | – | Override a render-inference guard; reported as forced |
| id | string | yes | – |
No output schema declared.
No examples provided.
sb_review ~72
What a VISITOR would meet on the open page (blank band, placeholder, dead binding) AND what stands between this store and a paid order (checkout page, gateway, delivery, a cart link). Run it before calling a page done; page_id: only that page.
| Name | Type | Req | Description |
|---|---|---|---|
| page_id | string | – | – |
No output schema declared.
No examples provided.
sb_set ~211
Write style, config or specials keys on one node, or on many through edits (one save, one live frame). Per BREAKPOINT by default; base:true writes the fallback layer, right for a value that should not vary.
| Name | Type | Req | Description |
|---|---|---|---|
| base | boolean | – | – |
| breakpoint | string | – | – |
| dry_run | boolean | – | – |
| edits | array | – | – |
| force | boolean | – | Override a render-inference guard; reported as forced |
| id | string | – | – |
| keys | object | – | – |
| namespace | string | – | – |
| state | string | – | An interaction state — "hover", or "stuck" for how a pinned element looks once it is stuck (needs a sticky/fixed self-or-ancestor; a descendant styles itself through the host). |
| unset | array | – | Keys to REMOVE from the same slot — the only way to undo a write. Setting null is not the same: null is a stored value, so the override still counts as present. |
No output schema declared.
No examples provided.
sb_site_list ~17
List the sites this account can operate.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
sb_store ~939
Run a store flow that must happen in a fixed order. action:"checkout" makes the order form, configures it, saves its fields with this store's real payment and delivery options, then creates and PUBLISHES the checkout page — /checkout 404s without all four. action:"checkout_sync" re-reads the store's payment and delivery methods into every existing order form and republishes the checkout page — run it after adding a shipping method or switching on a gateway, since the form keeps the options it was saved with. action:"form" seeds any of the platform's other form templates (login, contact, booking, stay and more — settings merge into the record) with its own field document, which is the part that cannot be guessed. action:"chrome" gives every page ONE shared header (footer:true — footer) built on a real site menu of page/category/product references: site name, desktop menu, mobile drawer, search, cart and account icons — the gap sb_review reports as siteChrome. action:"menu" binds a menu node on the open page to the site's menu and resolves its links, the way the editor does. action:"overlay_attach" puts a pop-up on the open page (kind:"popup") or points a list-dataset at a quick-view panel (kind:"quickview", list_id), creating either from the platform's own seed when overlay_id is omitted, and re-reads the page afterwards as the editor must. action:"cart" creates the site's cart drawer from the editor's seed when it has none — without it every open_cart control opens nothing. action:"app" installs one of the platform's built-in apps (app_key) and creates the pages it needs that installing it does not — today only "courses" has any, from the platform's own scaffold; every other key installs with nothing further to build. action:"global_attach" puts an EXISTING shared section (global_id) on the open page and action:"global_detach" takes it off, writing the reference the platform reads and placing it in the band ROOT's child order demands — the answer for a page that is…
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | – |
| app_key | string | – | action:"app" — which built-in app to install |
| dry_run | boolean | – | – |
| footer | boolean | – | action:"chrome" — build a shared FOOTER instead of a header |
| global_id | string | – | action:"global_attach"/"global_detach" — the shared section; omitted on attach it lists the site's own |
| global_kind | string | – | – |
| headline | string | – | – |
| kind | string | – | action:"overlay_attach" — which kind of overlay to attach |
| language | string | – | Copy language, default vi |
| list_id | string | – | action:"overlay_attach" kind:"quickview" — the list-dataset node on the open page |
| menu_id | string | – | – |
| name | string | – | action:"form" — the form's name in the merchant's list. action:"overlay_attach" with no overlay_id — the new pop-up/quick-view's name. "chrome" — the header's site name. |
| node_id | string | – | action:"menu" — the menu node; "global_promote"/"template_save" — the section; "form" — a node of the open page to place it in |
| overlay_id | string | – | action:"overlay_attach" — an existing overlay; omit to create one from the seed |
| page_name | string | – | – |
| relocalize | boolean | – | action:"cart" — rewrite an EXISTING drawer's seed words that are in another language to the site locale's (edited text untouched), and turn a gallery line thumbnail into a single image; needs a page… |
| settings | object | – | action:"form" {booking:{maxPerSlot:2}} |
| site_id | string | – | – |
| template | string | – | action:"form" — which of the platform's own form templates to seed |
| template_id | string | – | action:"template_save" — overwrite this template's content |
No output schema declared.
No examples provided.
sb_template_use ~90
Add a section template to a page, above the footer — a sb_templates row (another site's is copied in first) or one of the BUILT-IN layouts sb_templates lists, which are composed against this page's own tokens rather than copied.
| Name | Type | Req | Description |
|---|---|---|---|
| dry_run | boolean | – | – |
| page_id | string | yes | – |
| site_id | string | – | – |
| template_id | string | yes | – |
No output schema declared.
No examples provided.
sb_templates ~46
The store's saved section templates — designed sections a person starts from rather than assembling one. Use sb_template_use to drop one into the open page.
| Name | Type | Req | Description |
|---|---|---|---|
| site_id | string | – | – |
No output schema declared.
No examples provided.
sb_theme ~275
The site's palette and type scale — the layer every element's style preset resolves from, so one token repaints every page at once. Call it with nothing to read what the site actually has. `colors` and `text_styles` PATCH the saved document: what you do not name is kept, and so does `presets` (a preset's own literal outranks the text style). A mobile/tablet/laptop object writes that breakpoint. `locale` sets the site's language (settings.locale, what <html lang> is served from) — site-wide, every other setting kept.
| Name | Type | Req | Description |
|---|---|---|---|
| colors | object | – | Token id -> CSS colour, e.g. { "heading": "#2E2A3B", "primary": "#E8557A" } |
| dry_run | boolean | – | – |
| locale | string | – | Site language tag, e.g. "vi" or "en" |
| presets | object | – | Preset id -> declarations, e.g. { "heading-default": { "fontFamily": "Inter" } } |
| site_id | string | – | – |
| text_styles | object | – | Slug -> declarations, e.g. { "heading-3": { "fontSize": "20px", "mobile": { "fontSize": "18px" } } } |
No output schema declared.
No examples provided.
sb_traits_for ~89
This element's INSPECTOR, as a person sees it: tabs, groups, and every control name — with what each DECLARED control writes, and the AI hints for using the element. Read this before styling an element; pass control to read one control in full.
| Name | Type | Req | Description |
|---|---|---|---|
| control | string | – | Narrow to one control, e.g. "font_size" |
| type | string | yes | – |
No output schema declared.
No examples provided.
sb_translate ~148
Multilingual, as the editor does it. status | locales (add/remove) | page (rows: missing, done, outdated) | write (node id+field+value; registry fields only) | auto (machine-fill missing) | review (approve).
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | – |
| add | array | – | – |
| all | boolean | – | – |
| dry_run | boolean | – | – |
| entries | array | – | – |
| from | string | – | – |
| locale | string | – | – |
| offset | integer | – | – |
| page_id | string | – | – |
| remove | array | – | – |
| site_id | string | – | – |
| source | string | – | – |
No output schema declared.
No examples provided.
sb_undo ~144
Put back what a write replaced — a page or form edit made here (sb_add, sb_set, sb_duplicate …), or a PUT through sb_api_call. An undo records what IT replaced, so the newest entry right after one is its redo. A page is refused if anyone else saved it since. IN THIS PROCESS ONLY, capped; the platform's own page history (GET .../pages/{pageId}/history) survives a restart. No argument lists what is undoable.
| Name | Type | Req | Description |
|---|---|---|---|
| all | boolean | – | Every page, not just the open one |
| dry_run | boolean | – | – |
| index | integer | – | 1 is the most recent write |
No output schema declared.
No examples provided.
How do I install the Store Builder MCP server?
Store Builder runs locally as an npm package, launched with npx -y sbuilder-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · sbuilder-mcp
claude mcp add vuluu2k-sbuilder-mcp -- npx -y sbuilder-mcp
What is the Store Builder MCP server?
Store Builder is an MCP server listed in the public MCP registry as io.github.vuluu2k/sbuilder-mcp. Design, fill with real store data, render and publish Store Builder pages from an AI agent. This page covers its npm package (sbuilder-mcp).
Is the Store Builder MCP server safe to use?
Store Builder scores 70 out of 100 on VerifyMCP. We recorded 1 known advisory against it as of 5 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Store Builder MCP server expose?
Store Builder exposes 38 tools: sb_connect, sb_site_list, sb_api_find, sb_api_call, sb_page_open, and 33 more. Their descriptions and schemas cost roughly 5,920 tokens of context every time the server is loaded.
Is the Store Builder MCP server still maintained?
Store Builder is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Store Builder MCP server under?
Store Builder declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.