Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

Store Builder

NPM · SBUILDER-MCP · SCANNED SEP 21

Design, fill with real store data, render and publish Store Builder pages from an AI agent.

Available components

+28 this week 73 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security98
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • No install/post-install scripts declared.Pass
  • 31 of 97 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
Schema Quality & AI Usability63
  • AI-judged instruction clarity (good).Pass
  • Context-footprint check failed: tool/resource definitions use about 4043 tokens (~130/item across 31 items; 31 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management47
  • Stability observed for 14 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage82
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 46% of tool parameters carry a description.Partial
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
  • An AI judge read all 32 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

How do I install the Store Builder MCP server?

Store Builder runs locally as an npm package, launched with npx -y sbuilder-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · sbuilder-mcp

# add to Claude Code
claude mcp add vuluu2k-sbuilder-mcp -- npx -y sbuilder-mcp
// .cursor/mcp.json
{
  "mcpServers": {
    "vuluu2k-sbuilder-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "sbuilder-mcp"
      ]
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "vuluu2k-sbuilder-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "sbuilder-mcp"
      ]
    }
  }
}
# add to Codex CLI
codex mcp add vuluu2k-sbuilder-mcp -- npx -y sbuilder-mcp
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "vuluu2k-sbuilder-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "sbuilder-mcp"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add vuluu2k-sbuilder-mcp --command npx --arg -y --arg sbuilder-mcp
# ~/.hermes/config.yaml
mcp_servers:
  vuluu2k-sbuilder-mcp:
    command: "npx"
    args: ["-y", "sbuilder-mcp"]
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "vuluu2k-sbuilder-mcp": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "sbuilder-mcp"
      ]
    }
  }
}
# add to Vellum
assistant mcp add vuluu2k-sbuilder-mcp -t stdio -c npx -a -y sbuilder-mcp
// mcp.json
{
  "mcpServers": {
    "vuluu2k-sbuilder-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "sbuilder-mcp"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 21 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 43 to 47. That category is still filling its 30-day observation window: 13 days of observed history at the previous scan, 14 at this one. The score rises as the window fills, whether or not the server changes.

  • 20 Sept 26 0
    • Schema quality: 115 → 130 functional
    • Security disclosure: unverified → fail functional
    • Tool coverage: 40% → 46% functional
    • Package version: 0.61.1 → 0.62.0 functional
  • 19 Sept 26 0
    • Security disclosure: fail → unverified functional
  • 18 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 33 to 37. That category is still filling its 30-day observation window: 10 days of observed history at the previous scan, 11 at this one. The score rises as the window fills, whether or not the server changes.

  • 17 Sept 26 +10
    • Known CVEs: unverified → pass security
    • Dependency health: unverified → 0.85 functional
    • Package version: 0.61.0 → 0.61.1 functional
  • 16 Sept 26 +5
    • Stability: 0.27 → unverified security
    • Tool safety: pass → unverified security
    • Known CVEs: pass → unverified security
    • Malware scan: unverified → pass security
    • Capabilities: pass → unverified functional
    • Tool coverage: 100 → unverified functional
    • Dependency health: 0.85 → unverified functional
    • First check of Schema quality: unverified functional
    • Package version: 0.59.3 → 0.61.0 functional
    • Package version: 0.59.3 → 0.60.4 functional
    • Package version: 0.59.3 → 0.60.3 functional
    • Package version: 0.59.3 → 0.60.2 functional
    • Package version: 0.59.3 → 0.60.1 functional
    • Package version: 0.59.3 → 0.60.0 functional
  • 15 Sept 26 +11
    • Stability: 0.23 → unverified security
    • Tool safety: pass → unverified security
    • Malware scan: unverified → pass security
    • Known CVEs: unverified → pass security
    • Capabilities: pass → unverified functional
    • Tool coverage: 100 → unverified functional
    • Dependency health: unverified → 0.85 functional
    • First check of Schema quality: unverified functional
    • Package version: 0.48.1 → 0.59.3 functional
    • Package version: 0.48.1 → 0.59.2 functional
    • Package version: 0.48.1 → 0.59.1 functional
    • Package version: 0.48.1 → 0.59.0 functional
    • Package version: 0.48.1 → 0.57.0 functional
    • Package version: 0.48.1 → 0.52.0 functional
    • Package version: 0.48.1 → 0.50.0 functional
    • Package version: 0.48.1 → 0.49.0 functional
  • 14 Sept 26 −10
    • Known CVEs: pass → unverified security
    • Stability: 0.20 → unverified security
    • Tool safety: pass → unverified security
    • Malware scan: unverified → pass security
    • Dependency health: 0.85 → unverified functional
    • Capabilities: pass → unverified functional
    • Tool coverage: 100 → unverified functional
    • First check of Schema quality: unverified functional
    • Package version: 0.41.0 → 0.48.1 functional
    • Package version: 0.41.0 → 0.47.2 functional
    • Package version: 0.41.0 → 0.47.0 functional
    • Package version: 0.41.0 → 0.46.3 functional
    • Package version: 0.41.0 → 0.46.2 functional
    • Package version: 0.41.0 → 0.46.0 functional
    • Package version: 0.41.0 → 0.45.0 functional
    • Package version: 0.41.0 → 0.42.0 functional
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 21 Sept 2026 · Analysed npm/sbuilder-mcp@0.62.0

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem npm

Background: How many MCP packages publish verified provenance →

Dependencies 97 packages
Packages resolved 97
Stale 31
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 31 exposed · ~3,805 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
sb_add ~88

Add an element — or a whole NESTED subtree — under a parent. One call builds a complete section: pass children rather than calling this once per node.

NameTypeReqDescription
dry_runboolean
forcebooleanOverride a render-inference guard; reported as forced
indexinteger
parent_idstringyes
specobjectyes

No output schema declared.

No examples provided.

sb_api_call ~212

Call an operation from sb_api_find (id), or a route the catalog lacks (method+path); dry run by default. pick selects fields, max_items caps lists, item_offset skips items. Lists over 60 KB say so.

NameTypeReqDescription
body
dry_runbooleanDefaults to true. Pass false to actually send.
idstringOperation id from sb_api_find, e.g. "get:/api/sites/{siteID}/menus"
item_offsetintegerOffset within this response, after API paging. Reads only.
max_itemsinteger
methodstringWith path, when id is absent: GET|HEAD|POST|PUT|PATCH|DELETE
pathstringBare platform path, e.g. "/api/sites/{siteId}/published"; {siteId} defaults to SB_SITE
path_paramsobject
pickarray
queryobject

No output schema declared.

No examples provided.

sb_api_find ~125

Find API operations by intent (query), or get a call sheet (id): parameters, credential, body fields and handler caveats. Reaches all 560 operations.

NameTypeReqDescription
idstringAn id from a previous search — returns that operation's full call sheet
limitintegerDefault 8
querystringWhat you want to do, in words: "create a menu", "list orders", "upload media"
tagstringNarrow to one tag, e.g. "menus", "products", "theme"

No output schema declared.

No examples provided.

sb_bind ~135

Bind a node to real store data so the page shows actual products, not placeholder text. action makes a button a purchase control.

NameTypeReqDescription
actionstringPass product.id + specials.boundProductId
dry_runboolean
fieldstringyesWhere the value lands, always "specials.<key>"
forcebooleanOverride a render-inference guard; reported as forced
idstringyes
sourcestringyese.g. article.author, article.categories, article.content, article.date; 79 in all, and a wrong one is refused with the list

No output schema declared.

No examples provided.

sb_catalog_search ~87

Find an element type by what it does — or OMIT query to browse every type, the only way to meet one you would not have searched for. detail:true adds the AI hints, as does sb_traits_for.

NameTypeReqDescription
detailbooleanInclude useWhen / avoidWhen / contentTips per match
limitintegerDefault 8
querystring

No output schema declared.

No examples provided.

sb_connect ~51

Log in and list the sites this account can operate. Call this first. Reads SB_EMAIL and SB_PASSWORD from the environment unless you pass them.

NameTypeReqDescription
emailstring
passwordstring

No output schema declared.

No examples provided.

sb_duplicate ~72

Copy a node and everything under it, under fresh ids, right after the original. The move a designer makes constantly — build one card, duplicate it twice.

NameTypeReqDescription
dry_runboolean
forcebooleanOverride a render-inference guard; reported as forced
idstringyes

No output schema declared.

No examples provided.

sb_event ~117

Give a node a click action — open the cart, go to a page, open a pop-up. A purchase is not one: use sb_bind action.

NameTypeReqDescription
actionstringyesAn action this element allows, or "none" to clear. A wrong one is refused with the list
dry_runboolean
forcebooleanOverride a render-inference guard; reported as forced
idstringyes
payloadobject
triggerstringDefault "click"

No output schema declared.

No examples provided.

sb_import ~180

Read a page from any public URL and add its structure and content to the OPEN page as real elements, styled with this page's own tokens. Not a clone: the source's layout and CSS are not copied. Dry run returns what was found.

NameTypeReqDescription
dry_runboolean
max_imagesintegerDefault 24 — every image is an upload
max_nodesintegerNo cap by default — bounds the whole import if given
max_sectionsinteger
nav_timeout_msintegerHow long to wait for a page to answer at all. Default 30000; raise it for a slow origin
site_idstring
upload_imagesbooleanCopy the images into this site's media library, default true
urlstringyesThe page to read

No output schema declared.

No examples provided.

sb_import_site ~270

Read a WHOLE site from one URL — its sitemap, or the links on that page — and give each page found its own DRAFT page here, built from this site's tokens. Not a clone. Dry run returns the page list before anything is created.

NameTypeReqDescription
depthintegerNo sitemap: link depth, default 1
dry_runboolean
excludearray
homepagebooleanEntry into this site's home page, default true
includearrayPath substrings to keep
max_imagesintegerDefault 24, whole import
max_nodesintegerPer page. No cap by default
max_pagesintegerDefault 12
navbooleanShared header linking the new pages, default true
nav_timeout_msintegerHow long to wait for a page to answer at all. Default 30000; raise it for a slow origin
site_idstring
themebooleanPatch this site's theme from the entry page's colours and type scale, default true — SITE-WIDE, affecting pages outside this import too
upload_imagesboolean
urlstringyesAny page of the site

No output schema declared.

No examples provided.

sb_live_join ~79

Join the site's live-edit room as a visible peer: every write then appears in any open editor as it happens, with the agent shown by the API key's own name rather than a person's. Always yields, so it is safe beside a human. Works with SB_TOKEN or with SB_EMAIL / SB_PASSWORD.

NameTypeReqDescription
site_idstring

No output schema declared.

No examples provided.

sb_look ~186

Save, render through the platform's own renderer, and return screenshots at desktop, tablet and mobile widths, measured boxes for the bands and their children, and any layout defect measured on the render (overflow, overlap, unreadable text). node_id frames one element. Judge your work from these, not from memory.

NameTypeReqDescription
box_depthintegerBoxes down to this depth in the tree (default 2: bands and their children)
formatstringjpeg (default) is smaller and faster; png for pixel-exact colour
node_idstringFrame just this node instead of the whole page — how a designer looks at one card
urlstringShoot this address instead of the draft preview — use the PUBLISHED storefront URL to see real store data
widthsarray
with_boxesboolean

No output schema declared.

No examples provided.

sb_media_list ~78

The site's media library. Reuse an image before adding another; search by name, filter by type, page with limit/offset.

NameTypeReqDescription
limitinteger
media_typestringe.g. "image"
offsetinteger
searchstring
site_idstring

No output schema declared.

No examples provided.

sb_media_upload ~184

Put an image into the media library and get its URL back, ready for sb_set. Takes a local path, a URL, or a SEARCH — `query` returns real photographs with their own descriptions, and `pick` uploads the one you chose, or several at once to stock a site you just built. The only way to add an image.

NameTypeReqDescription
dry_runboolean
folder_idstring
namestring
orientationstring
pathstringA file on this machine
pickThe id of the search result to upload — or several ids, which stocks a site in one call
querystringSearch real photographs; read the descriptions, then pick
site_idstring
urlstringFetched, then uploaded

No output schema declared.

No examples provided.

sb_move ~65

Move a node to another parent at an index.

NameTypeReqDescription
dry_runboolean
forcebooleanOverride a render-inference guard; reported as forced
idstringyes
indexintegeryes
parent_idstringyes

No output schema declared.

No examples provided.

sb_node_read ~34

One node in full — style, config, specials, per-breakpoint overrides, bindings.

NameTypeReqDescription
idstringyes

No output schema declared.

No examples provided.

sb_outline ~62

The open page as a compressed tree — id, type, name, child count, band, and whether a node is a shared global or a site overlay. Never the raw document: a real page is hundreds of KB of JSON.

NameTypeReqDescription
depthinteger

No output schema declared.

No examples provided.

sb_page_create ~219

A store type (product, category, search, blog, post, complete) arrives with the document the editor gives a merchant — product carries the whole bound buy box; seed:false for blank. Any other type is empty and sb_page_open seeds its ROOT. TYPE is the route: /checkout and /products/{slug} need a PUBLISHED page of that type or they 404.

NameTypeReqDescription
chromebooleanCarry the site's header and footer, default true
dry_runboolean
headlinestringThe complete page's thank-you line.
is_homepageboolean
localestringvi (default) or en — the complete page's wording.
namestringyes
seedbooleanDefault true; false creates a blank page.
settingsobject
site_idstring
slugstring
typestringpage (default); sb_page_list lists every type and where each is served

No output schema declared.

No examples provided.

sb_page_list ~32

Every page on the site, with its slug and whether it is live.

NameTypeReqDescription
site_idstring

No output schema declared.

No examples provided.

sb_page_open ~61

Open a page for editing and return its outline. Call before any sb_add / sb_set / sb_move / sb_remove. Find page ids with sb_api_find "list pages".

NameTypeReqDescription
page_idstringyes
site_idstring

No output schema declared.

No examples provided.

sb_publish ~78

Compile the draft into the live page. PUBLISH CASCADES: a page sharing a global section with others republishes them too, because a header edited once must not go live on one page and stay stale on the rest.

NameTypeReqDescription
dry_runboolean
page_idstringyes
site_idstring

No output schema declared.

No examples provided.

sb_remove ~48

Remove a node and its whole subtree.

NameTypeReqDescription
dry_runboolean
forcebooleanOverride a render-inference guard; reported as forced
idstringyes

No output schema declared.

No examples provided.

sb_review ~60

What a VISITOR would meet on the open page (blank band, placeholder, dead binding) AND what stands between this store and a paid order (checkout page, gateway, delivery, a way back to the cart). Run it before calling a page finished.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

sb_set ~211

Write style, config or specials keys on one node, or on many through edits (one save, one live frame). Per BREAKPOINT by default; base:true writes the fallback layer, right for a value that should not vary.

NameTypeReqDescription
baseboolean
breakpointstring
dry_runboolean
editsarray
forcebooleanOverride a render-inference guard; reported as forced
idstring
keysobject
namespacestring
statestringAn interaction state — "hover", or "stuck" for how a pinned element looks once it is stuck (needs a sticky/fixed self-or-ancestor; a descendant styles itself through the host).
unsetarrayKeys to REMOVE from the same slot — the only way to undo a write. Setting null is not the same: null is a stored value, so the override still counts as present.

No output schema declared.

No examples provided.

sb_site_list ~17

List the sites this account can operate.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

sb_store ~547

Run a store flow that must happen in a fixed order. action:"checkout" makes the order form, configures it, saves its fields with this store's real payment and delivery options, then creates and PUBLISHES the checkout page — /checkout 404s without all four. action:"form" seeds any of the platform's other form templates (login, register, forgot, reset, verify, contact, subscribe, booking, review and more) with its own field document, which is the part that cannot be guessed. action:"chrome" gives every page ONE shared header, built from the pages this site already has — the gap sb_review reports as siteChrome. action:"menu" binds a menu node on the open page to the site's menu and resolves its links, the way the editor does. action:"overlay_attach" puts a pop-up on the open page (kind:"popup") or points a list-dataset at a quick-view panel (kind:"quickview", list_id), creating either from the platform's own seed when overlay_id is omitted, and re-reads the page afterwards as the editor must. action:"app" installs one of the platform's built-in apps (app_key) and creates the pages it needs that installing it does not — today only "courses" has any, from the platform's own scaffold; every other key installs with nothing further to build. Dry run returns the plan.

NameTypeReqDescription
actionstringyes
app_keystringaction:"app" — which built-in app to install
dry_runboolean
footerbooleanaction:"chrome" — build a shared FOOTER instead of a header
headlinestring
kindstringaction:"overlay_attach" — which kind of overlay to attach
languagestringCopy language, default vi
list_idstringaction:"overlay_attach" kind:"quickview" — the list-dataset node on the open page
menu_idstring
namestringaction:"form" — the form's name in the merchant's list. action:"overlay_attach" with no overlay_id — the new pop-up/quick-view's name.
node_idstringaction:"menu" — the menu node on the open page
overlay_idstringaction:"overlay_attach" — an existing overlay; omit to create one from the seed
page_namestring
site_idstring
templatestringaction:"form" — which of the platform's own form templates to seed

No output schema declared.

No examples provided.

sb_template_use ~83

Instantiate a section template into a page — the site's own (the server copies it) or one of the BUILT-IN layouts sb_templates lists, which are composed against this page's own tokens rather than copied.

NameTypeReqDescription
dry_runboolean
page_idstringyes
site_idstring
template_idstringyes

No output schema declared.

No examples provided.

sb_templates ~46

The store's saved section templates — designed sections a person starts from rather than assembling one. Use sb_template_use to drop one into the open page.

NameTypeReqDescription
site_idstring

No output schema declared.

No examples provided.

sb_theme ~154

The site's palette and type scale — the layer every element's style preset resolves from, so one token repaints every page at once. Call it with nothing to read what the site actually has. `colors` and `text_styles` PATCH the saved document: what you do not name is kept.

NameTypeReqDescription
colorsobjectToken id -> CSS colour, e.g. { "heading": "#2E2A3B", "primary": "#E8557A" }
dry_runboolean
site_idstring
text_stylesobjectText style slug -> base declarations, e.g. { "h1": { "fontSize": "48px" } }

No output schema declared.

No examples provided.

sb_traits_for ~89

This element's INSPECTOR, as a person sees it: tabs, groups, and every control name — with what each DECLARED control writes, and the AI hints for using the element. Read this before styling an element; pass control to read one control in full.

NameTypeReqDescription
controlstringNarrow to one control, e.g. "font_size"
typestringyes

No output schema declared.

No examples provided.

sb_undo ~135

Put back what a PUT through sb_api_call replaced — settings, a product, a form, anything with a shape. IN THIS PROCESS ONLY, capped, and gone when it exits. For a PAGE the platform keeps its own: GET .../pages/{pageId}/history lists the autosave checkpoint it writes on every draft save, versions lists the labelled snapshots, and either restores. That one survives everything and is the better answer whenever the thing to recover is a page. No argument lists what is undoable here.

NameTypeReqDescription
dry_runboolean
indexinteger1 is the most recent write

No output schema declared.

No examples provided.

Common questions

What is the Store Builder MCP server?

Store Builder is an MCP server listed in the public MCP registry as io.github.vuluu2k/sbuilder-mcp. Design, fill with real store data, render and publish Store Builder pages from an AI agent. This page covers its npm package (sbuilder-mcp).

Is the Store Builder MCP server safe to use?

Store Builder scores 73 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 21 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the Store Builder MCP server expose?

Store Builder exposes 31 tools: sb_connect, sb_site_list, sb_api_find, sb_api_call, sb_page_open, and 26 more. Their descriptions and schemas cost roughly 3,805 tokens of context every time the server is loaded.

Is the Store Builder MCP server still maintained?

Store Builder is still listed as active in the MCP registry. We last reached this channel on 21 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the Store Builder MCP server under?

Store Builder declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.