Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

WebCake Storefront

NPM · WEBCAKE-STOREFRONT-MCP · 2 COMPONENTS

Build pages and manage products, orders, and content on the WebCake/StoreCake storefront builder.

0 this week 75 Trust /100

Last scanned (21 hours ago)

Scores higher than 50% of npm servers

Category E-commerce

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security81
  • No malware found by supply-chain analysis.Pass
  • CVE check failed: a known high-severity CVE affects sharp 0.34.5, a direct dependency. A fixed version is available. View diagnostics → Fail
  • No install/post-install scripts declared.Pass
  • 39 of 155 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
Schema Quality & AI Usability75
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 17244 tokens (~130/item across 132 items; 132 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management96
  • Stability check failed: the tool surface changed between 1.31.11 and 1.37.0: 6 tool removals, 0 breaking changes, 3 additions. See how to fix → Fail
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Tool Safety47
  • Injection-marker check failed: the server instructions contains an instruction to conceal the call from the user, the text "NEVER tell the user", at byte 5715 of that field. See how to fix → Fail
  • 8 of 9 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "publish_site" implies "publish" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Partial
  • An AI judge read all 133 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 4 Nov 26 0
    • Package version: 1.36.2 → 1.37.0 functional
  • 29 Oct 26 0
    • Package version: 1.36.1 → 1.36.2 functional
  • 28 Oct 26 +15
    • Malware scan: unverified → pass ▲ security
  • 27 Oct 26 −15
    • Malware scan: pass → unverified ▼ security
    • Package version: 1.36.0 → 1.36.1 functional
  • 24 Oct 26 0
    • CVE-2023-54404 affects this package: high ▼ security
  • 22 Oct 26 0
    • CVE-2026-114113 affects this package: high ▼ security
    • CVE-2026-114111 affects this package: high ▼ security
    • CVE-2026-114112 affects this package: high ▼ security
    • Tool safety: fail → unverified ▼ security
    • Stability: fail → unverified ▼ security
    • GHSA-wq5f-xc86-pv6w no longer affects this package ▲ security
    • GHSA-rgj7-g3m4-5g8c no longer affects this package ▲ security
    • GHSA-f88m-g3jw-g9cj no longer affects this package ▲ security
    • Capabilities: pass → unverified ▼ functional
    • Tool coverage: 100 → unverified ▼ functional
    • Package version: 1.34.1 → 1.36.0 functional
  • 17 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 89 to 92.

  • 15 Oct 26 +41
    • Injection markers: unverified → fail ▼ security
    • Stability: unverified → fail ▼ security
    • Destructive annotations: 0% → 89% ▲ functional
    • Tool coverage: unverified → 100 ▲ functional
    • MCP protocol: unverified → pass ▲ functional
    • Package version: 1.31.11 → 1.34.1 functional
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 4 Nov 2026 · Analysed npm/webcake-storefront-mcp@1.37.0

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem npm

Background: How many MCP packages publish verified provenance →

Vulnerabilities 4 findings
ID CVE Severity Vector Fix available
GHSA-f88m-g3jw-g9cj CVE-2026-114113 high yes
GHSA-rgj7-g3m4-5g8c CVE-2026-114112 high yes
GHSA-wq5f-xc86-pv6w CVE-2026-114111 high yes
GHSA-mrhx-c7xc-m3w5 CVE-2023-54404 high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yes

Background: What a vulnerability scan can and cannot prove →

Dependencies 155 packages
Packages resolved 155
Stale 39
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 132 exposed · ~15,596 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
add_draft_section ~96

Append ONE section to a local page draft (NO network — this is the durable per-section cache step that can't time out). The section is re-id'd to avoid collisions and quick-validated; warnings are surfaced but never block. Build the section with new_section.

NameTypeReqDescription
draft_idstringyesDraft id from start_page_draft
section––A section node (from new_section) — object or JSON string

No output schema declared.

No examples provided.

add_section ~157

Append a section to an EXISTING page's source. Reads the current source, appends your section, validates, and (when dry_run=false) saves. The section is re-id'd to avoid collisions. Pass a section built with new_section, OR template:{ category_id, id } to insert a library section (list_section_templates). Two-step safety: dry_run=true (default) previews; dry_run=false saves.

NameTypeReqDescription
dry_runboolean–Preview only (true) or save (false)
page_idstringyesTarget page id
section––A section node (from new_section) — object or JSON string
templateobject–Insert a library section instead (ids from list_section_templates)

No output schema declared.

No examples provided.

append_site_custom_code ~172

Append or prepend code to a custom code field. LAST RESORT: use native elements, their settings or an app first; a special feature uses the CMS app (collection + HTTP function) with only a small glue script here. See get_build_guide → NATIVE FIRST. Oversized code or UI/data in code is refused unless native_gap explains why. For full rewrites, use update_site_custom_code instead.

NameTypeReqDescription
codestringyesCode to add
fieldstringyesWhich code field to modify
native_gapstring–Only when the code was refused and no native way exists: the need, the elements/apps you checked, and what each one lacks. Tell the user first.
positionstring–Add to end (append) or beginning (prepend)

No output schema declared.

No examples provided.

build_page ~431

Create a brand-new page AND set its full content source in one step. Two-step safety: call with dry_run=true (default) to validate and preview, then dry_run=false to actually create + save. The source must be { sections: [...] } — build sections with new_section. Validation errors block the real save. ONE page per site for type main (homepage) / error / maintain, and slugs are unique per site: a duplicate is refused (dry_run reports blocked:true) and you get the existing page_id to edit instead. Only 'custom' pages can be created over and over.

NameTypeReqDescription
dry_runboolean–Preview+validate only (true) or create+save (false)
is_homepageboolean–Set as the site homepage
namestringyesPage name
seoobject–SEO for this page → settings.seo. Without it the page publishes with an EMPTY title/description. For a store page a good default title is '{{name_product}} | {{name_site}}' (product) or '{{name_categ…
slugstringyesURL slug WITHOUT a leading slash, e.g. 'about', 'collections', 'cart'. A leading '/' is stripped automatically (the storefront matches the bare path segment, so '/cart' would 404). Store pages MUST u…
source––Full page source { sections: [...] } (object or JSON string)
typestring–Page kind. SPECIAL pages need a site data-source enabled — build_page does this automatically: store→use_store (product/cart bindings), member→use_member (customer/order bindings), blog→use_blog, err…

No output schema declared.

No examples provided.

clear_page_draft ~37

Delete a local page draft (does NOT delete any backend page already created from it).

NameTypeReqDescription
draft_idstringyesDraft id

No output schema declared.

No examples provided.

commit_page_draft ~150

Persist a local page draft to the backend INCREMENTALLY (one section per request, 120s timeout each) so no single huge request can time out. dry_run=true (default) validates the assembled page and previews stats. dry_run=false creates the page then appends sections one at a time, saving progress after each. RESUMABLE: if a request fails mid-commit, the draft keeps its page_id + committed_count — just call commit_page_draft again to continue from where it stopped.

NameTypeReqDescription
draft_idstringyesDraft id from start_page_draft
dry_runboolean–Validate+preview only (true) or create+persist incrementally (false)

No output schema declared.

No examples provided.

count_orders_by_status ~22

Get order count grouped by status. Useful for dashboard overview

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

create_article ~190

Create a blog article so blog/post pages (post-list, grid-blog, post-overlay) have content. Built via the dashboard command pipeline: title + optional summary, HTML content, image URLs, and category linkage. Pass category_ids from create_blog_category / list articles' categories so the post shows up under those categories (it is also auto-filed under the default category). Image URLs must be hosted (search_images / upload_images). The backend generates the id and slug. SEO: set it afterwards with update_article({ id, seo }).

NameTypeReqDescription
category_idsarray–Blog category IDs to file the post under (from create_blog_category)
contentstring–HTML content of the post
imagesarray–Hosted image URLs; the first is the cover image
namestringyesArticle title
summarystring–Short summary / excerpt

No output schema declared.

No examples provided.

create_blog_category ~94

Create a blog/article category. Returns the new category id — pass it to create_article's category_id so posts are grouped (post-list / blog pages bind to it). Image must be a hosted URL. SEO: set it afterwards with update_blog_category({ id, seo }).

NameTypeReqDescription
descriptionstring–Category description
imagestring–Hosted image URL
namestringyesBlog category name

No output schema declared.

No examples provided.

create_cms_file ~61

Create a new CMS file. Types: "http_function", "jobs_config", "default"

NameTypeReqDescription
contentstringyesCode content (JavaScript or JSON)
namestringyesFile name
typestring–File type

No output schema declared.

No examples provided.

create_collection ~150

Create a new collection (custom data TABLE). It starts with the system columns (id/inserted_at/updated_at/creator_id); pass `columns` to add custom fields. NOTE: to WRITE records into it, use an HTTP function (webcake-data: db.model(table).create({...})) — the dashboard has no direct record-insert API. See get_http_function for the SDK guide.

NameTypeReqDescription
columnsarray–Custom columns to add, e.g. [{name:'email',type:'text'},{name:'amount',type:'integer'}].
namestringyesDisplay name.
table_namestring–Table name (snake_case, unique). Defaults to name.

No output schema declared.

No examples provided.

create_global_section ~235

Create a reusable global section (Header / Footer / shared block) the way the builder does: persists a global_section record AND embeds the same section node into page sources so it actually renders across the site (header → top of every page, footer → bottom). Build the section first with new_section (give it a real bg/padding + logo/menu/links), then pass it here. Two-step safety: dry_run=true (default) previews which pages change; dry_run=false performs the atomic save.

NameTypeReqDescription
dry_runboolean–Preview which pages would change (true) or perform the atomic save (false).
namestringyesDisplay name in the editor (e.g. 'Header', 'Footer')
page_idsarray–Pages to embed into. Omit to apply to ALL pages of the site (typical for header/footer).
section––A section node from new_section (object or JSON string) — the content of the header/footer.
typestringyesheader = top chrome (logo/nav/cart), footer = bottom chrome, section = reusable content block

No output schema declared.

No examples provided.

create_global_source ~81

Create a new global source component. Component types: "cart-droppable" (cart), "popup", or any custom type.

NameTypeReqDescription
componentstringyesComponent type (e.g. "cart-droppable", "popup")
source––Source configuration (sections/elements JSON)
typestring–Type variant (default: "default")

No output schema declared.

No examples provided.

create_page ~274

Create a new (empty) page. For a page with content use build_page instead. type is a KIND (main/store/member/blog/custom/error/maintain) mapped to the numeric backend type; pass seo so it doesn't publish with an empty title. ONE page per site for main (homepage) / error / maintain, and slugs are unique per site — a duplicate is refused with the existing page_id to edit instead; only 'custom' pages can be created over and over.

NameTypeReqDescription
is_homepageboolean–Set as homepage
namestringyesPage name
seoobject–SEO → settings.seo (title/description/keyword/favicon/thumbnail). Tokens {{name_page}}/{{name_site}} allowed.
slugstringyesURL slug WITHOUT a leading slash, e.g. 'about', 'collections', 'cart'. A leading '/' is stripped automatically (the storefront matches the bare path segment, so '/cart' would 404). Homepage needs no…
typestring–Page kind (main/store/member/blog/custom/error/maintain). store/member/blog need their data-source flag enabled — prefer build_page which auto-enables it. main/error/maintain are one-per-site; use 'c…

No output schema declared.

No examples provided.

create_product ~375

Create a product so the storefront has real merchandise (grid-product / slider-product bindings need this). Simple use: pass name + price (+ images, category_ids). One default variation with the price/stock is created for you. Advanced use: pass attributes (e.g. Color/Size) + variations for a multi-SKU product. Images must be HOSTED URLs — get them from search_images or upload_images first. The backend generates id, slug and publishes the product. SEO: set it afterwards with update_product({ product_id, seo }).

NameTypeReqDescription
attributesarray–Variant axes, e.g. [{name:'Color',values:['Đen','Trắng']},{name:'Size',values:['S','M','L']}]
category_idsarray–Product category IDs to file the product under (from create_product_category / list_categories)
descriptionstring–Full product description (HTML allowed) — binds to product::description on the detail page.
imagesarray–Hosted image URLs (search_images/upload_images). First image becomes the product thumbnail.
namestringyesProduct name
original_pricenumber–List/compare-at price for the simple single-variation case
pricenumber–Selling price (used when you don't pass variations). Required unless variations are given.
short_descriptionstring–Short description / tagline (HTML allowed) — binds to product::short_description on cards + the detail page. Set this so cards aren't blank.
skustring–SKU / custom_id for the simple case (auto-generated if omitted)
stocknumber–Stock quantity for the simple single-variation case
variationsarray–Explicit per-SKU variations. Omit to auto-build one from price/stock/sku.

No output schema declared.

No examples provided.

create_product_category ~118

Create a product category (so grid-category / a category page has something to show, and products can be filed under it). Returns the new category id — pass it to create_product's category_ids. Image must be a hosted URL. SEO: set it afterwards with update_product_category({ id, seo }).

NameTypeReqDescription
descriptionstring–Category description
imagestring–Hosted image URL for the category card
namestringyesCategory name
parent_idstring–Parent category id for a sub-category

No output schema declared.

No examples provided.

create_site ~290

Create a brand-new storefront site for the current account, then (by default) switch to it and return an EMPTY, CLEAN site (no sample products/categories) ready for element composition. The backend auto-seeds off-theme sample products + categories (and a sample blog); by default this tool DELETES that seed right after creating the site (keep the non-deletable default "All" category) so you start from a blank, on-theme store. Pass keep_seed:true to keep the sample data. The site has NO pages — after this, compose a homepage from elements: get_build_guide → new_section/new_element → build_page (type:'main', is_homepage:true). Note: free accounts are limited to 4 sites (creation fails with a quota error past that).

NameTypeReqDescription
keep_seedboolean–Keep the backend's sample products/categories/blog instead of auto-deleting them. Default false = start from a clean, empty site.
namestringyesDisplay name of the new site, e.g. 'My Coffee Shop'
slugstringyesURL-safe site slug (lowercase letters, digits, hyphens), e.g. 'my-coffee-shop'. Becomes the preview subdomain and must be unique.
switch_toboolean–Switch the session to the new site after creating it (saved for next session). Default true.

No output schema declared.

No examples provided.

create_site_from_template ~182

Create a NEW site from a marketplace TEMPLATE (the dedicated "use this template" API). Clones the template's pages, global sections, cart, popups, styles and fonts into a fresh site. Pick a template with semantic_search_themes / list_template_themes, then pass its theme_id here. Switches to the new site so you can immediately edit layout/content with update_page_element(s), colours/fonts via the site-style tools, then publish_site.

NameTypeReqDescription
namestringyesName for the new site
slugstring–URL-safe slug for the new site (auto-generated if omitted)
switch_toboolean–Switch the session to the new site after creating it (saved for next session)
theme_idstringyesMarketplace theme id (from semantic_search_themes / list_template_themes)

No output schema declared.

No examples provided.

debug_function ~57

Run JS code in debug mode (without deploying). Returns execution result and console logs

NameTypeReqDescription
contentstringyesJS code to debug
function_namestringyesFunction name to run
paramsobject–Test parameters

No output schema declared.

No examples provided.

delete_article ~45

Delete blog articles (soft delete — they disappear from the site)

NameTypeReqDescription
idstring–Article ID
idsarray–Several article IDs to delete in one call

No output schema declared.

No examples provided.

delete_collection ~35

Delete a collection (table) and all its records by id. Irreversible.

NameTypeReqDescription
collection_idstringyesCollection id.

No output schema declared.

No examples provided.

delete_global_section ~97

Delete a global section (Header/Footer/block) and remove its node from every page source. Two-step safety: dry_run=true (default) shows which pages would change; dry_run=false performs the atomic save.

NameTypeReqDescription
dry_runboolean–Preview (true) or perform the delete + page cleanup (false).
section_idstringyesThe global section's section_id (the section node id) — from list_global_sections.

No output schema declared.

No examples provided.

delete_global_source ~32

Delete a global source and its published version

NameTypeReqDescription
global_source_idstringyesGlobal source ID to delete

No output schema declared.

No examples provided.

delete_page ~24

Delete a page

NameTypeReqDescription
page_idstringyesPage ID to delete

No output schema declared.

No examples provided.

delete_product ~28

Delete one or more products by id.

NameTypeReqDescription
product_idsarrayyesProduct ids to delete

No output schema declared.

No examples provided.

delete_product_category ~29

Delete one or more product categories by id.

NameTypeReqDescription
idsarrayyesCategory ids to delete

No output schema declared.

No examples provided.

edit_http_function ~174

Edit the HTTP function file by function name — best for targeted changes (fix a bug, rename, add one function). For writing multiple new functions or major refactors, use update_http_function with full content instead. Actions: - "replace_function": replace an ENTIRE function by name with new code. Server finds function boundaries automatically. - "add": append new function code at end of file. - "remove": remove a function by name. - "update_imports": replace the import block (lines before first export). Returns updated function list after edit.

NameTypeReqDescription
actionstringyesEdit action
codestring–New function code (for replace_function and add) or new import block (for update_imports)
function_namestring–Target function name (for replace_function and remove)

No output schema declared.

No examples provided.

find_customer ~38

Find a customer by ID, phone number, or email

NameTypeReqDescription
bystringyesSearch field
valuestringyesSearch value

No output schema declared.

No examples provided.

get_active_promotions ~28

Get all currently active promotions (is_activated=true and within start_time/end_time range)

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

get_app ~281

Get one installed app by its type code (returns null if not installed). App type codes: 0=product_review, 1=articles_review, 2=automation, 3=telegram, 4=affiliates, 5=multilingual, 6=appointment, 7=send_email, 8=botcake, 9=sale_channel, 10=product_design, 11=auth_otp, 12=personal_product_design, 14=course, 15=zalo_mini_app, 16=cms, 17=recaptcha, 18=pwa. You may pass the number or the name.

NameTypeReqDescription
typenumber|stringyesApp type — a code (e.g. 2) or a name (e.g. "automation"). Codes: 0=product_review, 1=articles_review, 2=automation, 3=telegram, 4=affiliates, 5=multilingual, 6=appointment, 7=send_email, 8=botcake, 9…

No output schema declared.

No examples provided.

get_article ~29

Get article details by ID (includes the full HTML content)

NameTypeReqDescription
idstringyesArticle ID

No output schema declared.

No examples provided.

get_build_guide ~50

Get the BuilderX page authoring guide: page shape, the grid layout model, styling, breakpoints, forms/data, and the build workflow. Read this before building or heavily editing a page.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

get_collection ~39

Get a specific collection's details including full schema (field names, types, constraints, references) and records

NameTypeReqDescription
idstringyesCollection ID

No output schema declared.

No examples provided.

get_combo_items ~69

Get items (products/variations) and bonus products that compose a combo. Returns combo_items (required items with count) and bonus_items (free gifts)

NameTypeReqDescription
combo_product_idstringyesCombo product ID
is_variation_bonusboolean–Whether bonus items are variation-based

No output schema declared.

No examples provided.

get_current_context ~39

Show current connection context: which site_id, API URL, session, and account info. Call this first to confirm you're working on the right site

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

get_element ~103

Get the full detail of an element type: category, container flag, summary, an ATTRIBUTES reference (the meaningful specials/config keys + their purpose/allowed values, events, and dataset binding targets), and a live skeleton node (the authoritative default shape) you can copy and edit. Read this before authoring/editing an element so you set the right keys.

NameTypeReqDescription
typestringyesElement type, e.g. 'text', 'button', 'grid-product'

No output schema declared.

No examples provided.

get_file_versions ~65

View version history of a CMS file. Each version includes its saved content — to restore, pass that content back to update_http_function (the http_function file) or update_cms_file, or use restore_file_version.

NameTypeReqDescription
cms_file_idstringyesCMS file ID

No output schema declared.

No examples provided.

get_global_section ~124

Get one global section as a COMPACT tree (3-5x fewer tokens than raw JSON). Each line: ID [type] "text" .class [Nbind] [Nev] (children_count). Use this to learn how a real Header/Footer/block is composed before building your own.

NameTypeReqDescription
global_section_idstringyesGlobal section ID (from list_global_sections)
rawboolean–Return the FULL raw section JSON (large) instead of the compact tree — delivered via the large-result cache so you can split-read it with read_cached_result.

No output schema declared.

No examples provided.

get_global_section_element ~78

Get full detail (style, config, specials, events, bindings, responsive bp1..bp4, children IDs) of a single element inside a global section.

NameTypeReqDescription
element_idstringyesElement ID (e.g. 'MENU-1', 'TEXT-3')
global_section_idstringyesGlobal section ID

No output schema declared.

No examples provided.

get_global_source_contents ~40

Get multilingual contents for global sources by component type

NameTypeReqDescription
componentstringyesComponent type (e.g. "cart-droppable", "popup")

No output schema declared.

No examples provided.

get_global_source_detail ~97

Get full detail of a global source — compact tree view showing all elements. Each line: ID [type] "text" .class [events] [bindings] (children_count). Provide component for faster lookup; omit if you already called list_global_sources.

NameTypeReqDescription
componentstring–Component hint for faster lookup (e.g. "popup", "cart-droppable")
global_source_idstringyesGlobal source ID

No output schema declared.

No examples provided.

get_global_source_element ~79

Get full detail of a single element (style, config, specials, events, bindings, responsive, children).

NameTypeReqDescription
componentstring–Component hint for faster lookup
element_idstringyesElement ID (e.g. 'TEXT-3', 'BUTTON-1')
global_source_idstringyesGlobal source ID

No output schema declared.

No examples provided.

get_http_function ~148

Get the main HTTP function file. Choose the right mode for your task: - overview=true: function names + line ranges only, NO code body. Use for: browsing, understanding structure, finding which function to read. - overview=false (DEFAULT): full code + collection schemas. Use for: writing new features, refactoring, understanding full context. Tip: for small fixes, use overview first then get_http_function_snippet to read just that function. Add include_guide=true on first call to get the coding guide

NameTypeReqDescription
include_guideboolean–Include coding guide (only needed once)
overviewboolean–true=function list only, false=full code (default)

No output schema declared.

No examples provided.

get_http_function_snippet ~52

Read specific function(s) by name. Much more token-efficient than reading the full file

NameTypeReqDescription
function_namesarrayyesFunction names (e.g. ['get_Products', 'post_CreateOrder'])

No output schema declared.

No examples provided.

get_intake_guide ~90

Get the INTAKE questionnaire + build flow to run BEFORE creating a new site/store/page. Call this at the start of any fresh build: ask the user this one short batch (plain words, with defaults), restate the plan, get a yes, THEN build. Skip only for tiny edits, data questions, or when the user already gave the brief / says 'just do it'.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

get_order ~37

Get full order details by ID: customer info, items, payment, shipping, discounts, etc.

NameTypeReqDescription
idstringyesOrder ID

No output schema declared.

No examples provided.

get_page_draft ~53

Inspect a local page draft: its meta, the section ids, total section count, and (if a commit is in progress) the page_id + committed_count.

NameTypeReqDescription
draft_idstringyesDraft id

No output schema declared.

No examples provided.

get_page_element ~88

Get full detail of a single element by its ID (e.g. 'TEXT-3', 'BUTTON-1', 'SECTION-2'). Returns style, config, specials, events, bindings, responsive, and children IDs

NameTypeReqDescription
element_idstringyesElement ID (e.g. 'TEXT-3', 'BUTTON-1')
page_idstringyesPage ID

No output schema declared.

No examples provided.

get_page_schema ~79

Get the authoritative JSON Schema (Draft 2020-12) for a page source `{ sections: [...] }` — the structural contract for every node (id/type/specials/runtime{style,config}/children/events/bindings) in the CSS-grid model. Use it as the shape to emit; validate_page enforces the semantic rules.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

get_page_source ~51

Get page source overview: section count, element type counts, and all custom CSS classes. Use this first, then use search_page_elements to find specific elements

NameTypeReqDescription
page_idstringyesPage ID

No output schema declared.

No examples provided.

Install

How do I install the WebCake Storefront MCP server?

WebCake Storefront runs locally as an npm package, launched with npx -y webcake-storefront-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · webcake-storefront-mcp

# add to Claude Code
claude mcp add vuluu2k-webcake-storefront-mcp -- npx -y webcake-storefront-mcp
Common questions

What is the WebCake Storefront MCP server?

WebCake Storefront is an MCP server listed in the public MCP registry as io.github.vuluu2k/webcake-storefront-mcp. Build pages and manage products, orders, and content on the WebCake/StoreCake storefront builder. This page covers its npm package (webcake-storefront-mcp).

Is the WebCake Storefront MCP server safe to use?

WebCake Storefront scores 75 out of 100 on VerifyMCP. We recorded 4 known advisories against it as of 4 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the WebCake Storefront MCP server expose?

WebCake Storefront exposes 132 tools: get_intake_guide, get_current_context, list_my_sites, create_site, switch_site, and 127 more. Their descriptions and schemas cost roughly 15,596 tokens of context every time the server is loaded.

Is the WebCake Storefront MCP server still maintained?

WebCake Storefront is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the WebCake Storefront MCP server under?

WebCake Storefront declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.