WebCake Storefront
NPM · WEBCAKE-STOREFRONT-MCP · 2 COMPONENTS
Build pages and manage products, orders, and content on the WebCake/StoreCake storefront builder.
Available components
Last scanned (3 hours ago)
Scores higher than 50% of npm servers
Category E-commerce
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security81
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known high-severity CVE affects sharp 0.34.5, a direct dependency. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- 39 of 155 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 0 days ago).Pass
- Security-disclosure policy not yet verified: we couldn't inspect the source repository.Unverified
Schema Quality & AI Usability75
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 17244 tokens (~130/item across 132 items; 132 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management96
- Stability check failed: the tool surface changed between 1.31.11 and 1.38.0: 6 tool removals, 0 breaking changes, 3 additions. See how to fix → Fail
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety47
- Injection-marker check failed: the server instructions contains an instruction to conceal the call from the user, the text "NEVER tell the user", at byte 5715 of that field. See how to fix → Fail
- 8 of 9 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "publish_site" implies "publish" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Partial
- An AI judge read all 133 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 0
- Security disclosure: fail → unverified ▼ functional
- Package version: 1.37.0 → 1.38.0 functional
- 4 Nov 26 0
- Package version: 1.36.2 → 1.37.0 functional
- 29 Oct 26 0
- Package version: 1.36.1 → 1.36.2 functional
- 28 Oct 26 +15
- Malware scan: unverified → pass ▲ security
- 27 Oct 26 −15
- Malware scan: pass → unverified ▼ security
- Package version: 1.36.0 → 1.36.1 functional
- 24 Oct 26 0
- CVE-2023-54404 affects this package: high ▼ security
- 22 Oct 26 0
- CVE-2026-114113 affects this package: high ▼ security
- CVE-2026-114111 affects this package: high ▼ security
- CVE-2026-114112 affects this package: high ▼ security
- Stability: fail → unverified ▼ security
- Tool safety: fail → unverified ▼ security
- GHSA-wq5f-xc86-pv6w no longer affects this package ▲ security
- GHSA-rgj7-g3m4-5g8c no longer affects this package ▲ security
- GHSA-f88m-g3jw-g9cj no longer affects this package ▲ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Package version: 1.34.1 → 1.36.0 functional
- 17 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 89 to 92.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed npm/webcake-storefront-mcp@1.38.0
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Vulnerabilities 4 findings
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-f88m-g3jw-g9cj | CVE-2026-114113 | high | yes | |
| GHSA-rgj7-g3m4-5g8c | CVE-2026-114112 | high | yes | |
| GHSA-wq5f-xc86-pv6w | CVE-2026-114111 | high | yes | |
| GHSA-mrhx-c7xc-m3w5 | CVE-2023-54404 | high | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | yes |
Background: What a vulnerability scan can and cannot prove →
Dependencies 155 packages
| Packages resolved | 155 |
|---|---|
| Stale | 39 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
get_page_versions ~26
View version history of a page
| Name | Type | Req | Description |
|---|---|---|---|
| page_id | string | yes | Page ID |
No output schema declared.
No examples provided.
get_product ~40
Get full product details by ID: name, description, price, variations, images, attributes, SEO, etc.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Product ID |
No output schema declared.
No examples provided.
get_promotion ~44
Get full promotion details by ID: name, type, schedule, discount rules, coupon settings, items, bonus products, etc.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Promotion ID |
No output schema declared.
No examples provided.
get_promotion_items ~65
Get products/variations/categories attached to a promotion. Returns items with discount details (fixed_prices, level_info, coupon_item_info)
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Promotion ID |
| limit | number | – | Items per page |
| page | number | – | Page number |
No output schema declared.
No examples provided.
get_site_custom_code ~154
Get custom code of the site (CSS/JS). Two modes: - Default: returns ALL 4 code fields (full content) - With field filter: returns only the specified field(s) — saves tokens when you only need CSS or JS Add include_guide=true on first call to get the coding guide. Custom code is the last resort: see get_build_guide → NATIVE FIRST before adding any. All-fields reads include _budget (usage vs limits).
| Name | Type | Req | Description |
|---|---|---|---|
| fields | array | – | Only return specific fields (e.g. ['code_custom_css']). Omit to get all 4 fields |
| include_guide | boolean | – | Include the custom code coding guide (only needed on first call) |
No output schema declared.
No examples provided.
get_site_info ~60
Get full site information: name, domain, settings (colors, typography, layout, language, payment methods, etc.) and preview_img — the latest homepage screenshots (1920_1080 desktop / 430_932 mobile), refreshed after publish_site.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_source_cart ~34
Get all cart global sources with compact tree view. Shows full element hierarchy — no need to call get_global_source_detail separately.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
ingest_html ~128
Parse reference HTML (e.g. a Google Stitch / Figma / Codex export) into a structural blueprint (title, headings, paragraphs, images, buttons, colour palette) you can rebuild as native BuilderX sections with new_section. Not a 1:1 clone. Rebuild every part native elements can do; use an embed only for a piece no element can (third-party widget, custom animation) — never paste the whole HTML into one (sandboxed iframe: no SEO, broken links, dead forms; rejected on save).
| Name | Type | Req | Description |
|---|---|---|---|
| html | string | yes | Raw HTML to analyse |
No output schema declared.
No examples provided.
ingest_url ~52
Fetch a public URL and parse it into a structural blueprint (see ingest_html). Note: client-rendered (React/Vue) pages may return little content.
| Name | Type | Req | Description |
|---|---|---|---|
| url | string | yes | Public page URL to analyse |
No output schema declared.
No examples provided.
install_app ~174
Install (register) an application on the current site so its features become usable. For example, automations need the "automation" app installed first. App types: 0=product_review, 1=articles_review, 2=automation, 3=telegram, 4=affiliates, 5=multilingual, 6=appointment, 7=send_email, 8=botcake, 9=sale_channel, 10=product_design, 11=auth_otp, 12=personal_product_design, 14=course, 15=zalo_mini_app, 16=cms, 17=recaptcha, 18=pwa.
| Name | Type | Req | Description |
|---|---|---|---|
| app | string | yes | App to install (by name) |
| is_active | boolean | – | Activate the app on install |
No output schema declared.
No examples provided.
invoke_read_tool ~91
Run a READ-ONLY WebCake tool (list_*/get_*/search_*/count_*… — annotations.readOnlyHint in search_tools) by exact name with its arguments. Prefer this over invoke_tool for lookups. Refuses tools that change data.
| Name | Type | Req | Description |
|---|---|---|---|
| arguments | object | – | Arguments object matching the tool's input schema |
| name | string | yes | Exact tool name (from search_tools) |
No output schema declared.
No examples provided.
invoke_tool ~72
Run any WebCake tool by exact name with its arguments (discover names + schemas via search_tools). Arguments are validated before running. For read-only tools prefer invoke_read_tool.
| Name | Type | Req | Description |
|---|---|---|---|
| arguments | object | – | Arguments object matching the tool's input schema |
| name | string | yes | Exact tool name (from search_tools) |
No output schema declared.
No examples provided.
list_apps ~185
Which applications are installed / enabled on the site — and which are not — in ONE call. Returns installed[] (id, type, name, enabled) plus not_installed[] (app names). Do NOT call get_app per type to answer "which apps are on"; use get_app only for one app's settings. App type codes: 0=product_review, 1=articles_review, 2=automation, 3=telegram, 4=affiliates, 5=multilingual, 6=appointment, 7=send_email, 8=botcake, 9=sale_channel, 10=product_design, 11=auth_otp, 12=personal_product_design, 14=course, 15=zalo_mini_app, 16=cms, 17=recaptcha, 18=pwa.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_articles ~122
List blog articles (metadata only, without HTML content). Use get_article for the full content. Pass term to search by title/slug. Pass category_id to list the posts filed under one blog category — that view is the public one, so hidden posts and posts scheduled in the future are left out.
| Name | Type | Req | Description |
|---|---|---|---|
| category_id | string | – | Filter by blog category id |
| limit | number | – | Items per page (default 20) |
| page | number | – | Page number (default 1) |
| term | string | – | Search articles by title or slug |
No output schema declared.
No examples provided.
list_bindings ~114
List every dynamic-data BINDING target: the datasets (product, cart_item, order, order_item, post, category, customer, customer_address, …) and their exact field names ('product::product_price', …), which page type each needs (store/member/blog), and how repeater children (grid-product, cart-items, post-list) bind per-item. Attach via new_element opts.bindings (ids auto-minted, e.g. opts.bindings=[{ target:'product::product_price' }]).
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_cached_results ~28
List the large results currently held in the session cache (id, label, size, age).
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_categories ~16
List all product categories of the site
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_cms_files ~26
List all CMS files (HTTP functions, cron jobs, ...) for the site
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_collections ~69
List all database collections (tables) for the site. Returns collection names, table names, and field counts. Use get_collection for full schema details
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | – | Items per page |
| page | number | – | Page number |
| term | string | – | Search by collection name |
No output schema declared.
No examples provided.
list_combos ~82
List all combo/bundle products of the site. Use get_combo_items for combo composition details
| Name | Type | Req | Description |
|---|---|---|---|
| include_guide | boolean | – | Include combo type reference guide |
| limit | number | – | Items per page (default: 20) |
| page | number | – | Page number (default: 1) |
| term | string | – | Search by combo name |
No output schema declared.
No examples provided.
list_customers ~107
List/search the site's customers (browse or segment). Pass `term` to search by name/phone/email. Returns name, phone, email, order_count, purchased_amount, reward_point, tags, last_order_at. Use find_customer for an exact id/phone/email lookup.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | – | Items per page (default 50) |
| page | number | – | Page number (default 1) |
| term | string | – | Keyword — searches name / phone / email |
No output schema declared.
No examples provided.
list_elements ~37
List all BuilderX element/component types you can place on a page, grouped by category with a one-line summary and whether each is a container.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_events ~108
List every interaction EVENT you can attach to a node: the triggers (eventName: click/hover/success/submit/…) and the actions (open_page, scroll_to, toggle, open_popup, add_to_cart, buy_now, phone_call, open_link, …) with the exact extra fields each action needs. Attach via new_element/new_section opts.events (ids are auto-minted, e.g. opts.events=[{ action:'add_to_cart', open_page:'cart' }]).
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_global_sections ~86
List reusable global sections (Header, Footer, shared content blocks) — SLIM summary only. Each entry: id, name, slot (header/footer/block), element count + type histogram + custom classes. The full element tree is large, so it is NOT returned here — drill in with get_global_section (compact tree), search_global_section_elements, or get_global_section_element.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_global_sources ~71
List global sources (cart, popup, etc.). Returns compact summary per source. Always provide component to filter by type — the API may not return all types without a filter.
| Name | Type | Req | Description |
|---|---|---|---|
| component | string | – | Filter by component type (e.g. "cart-droppable", "popup"). Recommended to always provide |
No output schema declared.
No examples provided.
list_my_sites ~154
List the current account's PERSONAL sites (team sites are not included). Use this to find a site_id before switching. filter: "all" = active sites (default), "removed" = sites in trash. Each site has status, published_at (set at creation — not proof of publishing), slug, primary domain and has_custom_domain (verified, live, non-default domain). For plans use get_site_subscription / count_my_sites.
| Name | Type | Req | Description |
|---|---|---|---|
| filter | string | – | "all" (active, default) or "removed" (trash) |
| limit | number | – | Items per page |
| page | number | – | Page number |
| term | string | – | Search by site name, site id or domain |
No output schema declared.
No examples provided.
list_orders ~170
List orders of the site (metadata only). Use get_order for full details including items
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | – | Items per page |
| page | number | – | Page number |
| status | number | – | Filter by status: 0=new, 1=submitted, 2=shipped, 3=delivered, 4=returning, 5=returned, 6=canceled, 7=removed, 8=packing, 9=pending, 11=waiting, 12=wait_print, 13=printed, 15=part_returned, 16=receive… |
No output schema declared.
No examples provided.
list_page_contents ~74
List multi-language contents (translations) of the site's pages and global sections. Pass page_id + language_code to read one page's translation.
| Name | Type | Req | Description |
|---|---|---|---|
| language_code | string | – | With page_id: return just that language's content map |
| page_id | string | – | Page ID — narrows the result to that page |
No output schema declared.
No examples provided.
list_page_drafts ~40
List local page drafts for the current site (summaries only: id, name, slug, type, section count, commit progress, updated_at).
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_pages ~21
List all pages of the site (metadata only, without source)
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_products ~66
List products of the site (metadata only: id, name, slug, price, image, status). Use get_product for full details
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | – | Items per page |
| page | number | – | Page number |
| term | string | – | Search by product name |
No output schema declared.
No examples provided.
list_promotions ~115
List ALL promotions/discounts of the site (every page is fetched for you). Each row has id, name, type, is_activated, pos_id (non-null = linked/synced with POS), start/end time. The summary answers "how many promotions / how many synced with POS / how many active" in ONE call — do not call get_promotion per row for that. Use get_promotion only for one promotion's full rules.
| Name | Type | Req | Description |
|---|---|---|---|
| include_guide | boolean | – | Include promotion type reference guide |
No output schema declared.
No examples provided.
list_section_templates ~164
Browse the designer-made section library (the editor's template picker): ready, styled blocks (hero, product showcase, testimonials, footer…) to start from instead of composing from scratch. No args → categories. With category_id and/or term → templates { id, name, thumbnail, kind }. Look at a thumbnail with invoke_tool('read_image', { url }), then insert a kind:"section" template with add_section({ page_id, template:{ category_id, id } }) and restyle it to the brand.
| Name | Type | Req | Description |
|---|---|---|---|
| category_id | string | – | Category id (from the no-arg call) |
| limit | number | – | Per page (default 12) |
| page | number | – | Page (default 1) |
| term | string | – | Search template names |
No output schema declared.
No examples provided.
list_template_themes ~98
Search/list the public Webcake template marketplace (api.storecake.io). Use to match customer brief against existing templates by keyword. Returns id, name, preview_url, thumbnail, categories
| Name | Type | Req | Description |
|---|---|---|---|
| lang | string | – | Language code (default 'vi') |
| limit | number | – | Items per page (default 12) |
| page | number | – | Page number (default 1) |
| q | string | – | Keyword to search themes |
No output schema declared.
No examples provided.
list_themes ~34
List all custom themes of the site. Returns theme name, colors, typographies, transitions, and which one is active
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_tool_groups ~40
List every WebCake tool group, how many tools it has, and whether it is loaded natively or reached on-demand via search_tools + invoke_tool.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
new_element ~132
Build a single structurally-valid element node from the real builder factory. Returns the node — edit its specials/style, then place it in a section's children.
| Name | Type | Req | Description |
|---|---|---|---|
| opts | object | – | Factory opts: { text, src, width, height, style, config, specials, events, bindings, responsive, align }. align = horizontal placement in the grid cell: 'left'|'center'|'right'|'fill' (works on any e… |
| type | string | yes | Element type (see list_elements) |
No output schema declared.
No examples provided.
new_page_skeleton ~36
Return an empty but valid page source: { sections: [] }. Add sections built with new_section, then save with build_page.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
new_row ~312
Build a multi-column ROW container: children laid out SIDE BY SIDE (not stacked). This is how real pages build feature cards, category tiles, footer columns, a 2-col hero, etc. The row is RESPONSIVE — it auto-collapses to fewer columns on tablet/mobile (default tablet 2, mobile 1) so cards never become cramped slivers. Place the returned node as a child inside a section (section children still stack vertically; nest a row for horizontal layout). Example children: [{ "type":"container", "children":[{"type":"image","opts":{...}},{"type":"text","opts":{...}}] }, { ... }, { ... }]
| Name | Type | Req | Description |
|---|---|---|---|
| children | array | – | Child specs, one per column (laid out left-to-right) |
| col_widths | array | – | Explicit per-column unit objects (length = #children), e.g. [{unit:'fr',value:2},{unit:'fr',value:1}]. Default: equal columns. |
| collapse | object | – | Columns to show per breakpoint, e.g. {bp3:2,bp4:1}. Default: tablet 2, mobile 1. |
| column_gap | number | – | Horizontal gap (px) between columns (default 24) |
| container_opts | object | – | Optional factory opts for the row container node itself (e.g. { style:{...} }) |
| row_gap | number | – | Vertical gap (px) between wrapped rows (default 24) |
No output schema declared.
No examples provided.
new_section ~120
Build a complete section node with children laid out in the builder's vertical grid. Pass an array of element specs; each child is stacked top-to-bottom. Nest containers via the child's own 'children'. Example children: [{ "type":"text", "opts":{"text":"Welcome","style":{"fontSize":"40px"}} }, { "type":"button", "opts":{"text":"Shop now"} }]
| Name | Type | Req | Description |
|---|---|---|---|
| children | array | – | Child element specs, stacked vertically in the section |
| section_opts | object | – | Optional factory opts for the section node itself |
No output schema declared.
No examples provided.
publish_site ~88
Publish the whole site live — snapshots all current page sources into the live (published) version. Note: BuilderX publishes at the SITE level, not per page; publishing makes every saved page go live. Two-step safety: dry_run=true (default) describes what will happen; dry_run=false actually publishes.
| Name | Type | Req | Description |
|---|---|---|---|
| dry_run | boolean | – | Preview (true) or publish for real (false) |
No output schema declared.
No examples provided.
query_collection_records ~145
Query records from a collection (custom data table) by table name. Supports paging + an optional `where` filter and `order_by` sort. (Uses the CMS api-key auth the records endpoint requires.)
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | – | Items per page |
| order_by | string | – | Field to sort by (e.g. 'inserted_at'). |
| page | number | – | Page number |
| table_name | string | yes | Collection table name (e.g. 'subscribers', 'custom_orders') — from get_collection.table_name |
| where | object | – | Filter object, e.g. { status: 'active' } — matches records by field value. |
No output schema declared.
No examples provided.
read_cached_result ~109
Read a slice of a large cached result produced by another tool (look for "cached":true + a cache_id in its output). Page through with offset/length; the response reports next_offset + remaining_chars until done.
| Name | Type | Req | Description |
|---|---|---|---|
| cache_id | string | yes | The cache_id returned by the producing tool (e.g. "cache-3") |
| length | number | – | Number of characters to return (default 12000) |
| offset | number | – | Start character offset (default 0) |
No output schema declared.
No examples provided.
restore_file_version ~100
Roll a CMS file back to a saved version in one step: reads the version's content and writes it back to the file. Omit version_id to restore the most recent snapshot. Tip: save_file_version on the current content first if you want an undo point.
| Name | Type | Req | Description |
|---|---|---|---|
| cms_file_id | string | yes | CMS file ID to restore |
| version_id | string | – | Which version to restore (from get_file_versions). Omit = latest snapshot. |
No output schema declared.
No examples provided.
run_function ~73
Run a deployed HTTP function. function_name excludes method prefix. Example: "get_Products" → function_name="Products", method="GET"
| Name | Type | Req | Description |
|---|---|---|---|
| function_name | string | yes | Function name without method prefix (e.g. 'Products') |
| method | string | – | HTTP method |
| params | object | – | Parameters |
No output schema declared.
No examples provided.
save_file_version ~54
Save a version snapshot of a CMS file for rollback
| Name | Type | Req | Description |
|---|---|---|---|
| cms_file_id | string | yes | CMS file ID |
| content | string | yes | Content to save |
| is_public | boolean | – | Mark as public version |
No output schema declared.
No examples provided.
search_global_section_elements ~183
Search/filter elements within a global section (Header/Footer/block) without dumping the whole tree. Filter by type, id substring, custom_class, text, or has_bind / has_events / has_custom_class.
| Name | Type | Req | Description |
|---|---|---|---|
| custom_class | string | – | Filter by custom class substring |
| global_section_id | string | yes | Global section ID |
| has_bind | boolean | – | Only elements with data bindings |
| has_custom_class | boolean | – | Only elements with a custom class |
| has_events | boolean | – | Only elements with events |
| id | string | – | Filter by element ID substring |
| limit | number | – | Max results (default 50) |
| text | string | – | Filter by text content substring |
| type | string | – | Filter by element type (e.g. 'menu', 'menu-item', 'container', 'image', 'text') |
No output schema declared.
No examples provided.
search_global_source_elements ~243
Search/filter elements within a global source. No component param needed. Examples: - Find all buttons: type="button" - Find by class: custom_class="hero" - Find text: text="subscribe" - Data-bound only: has_bind=true - With events: has_events=true - With custom class: has_custom_class=true
| Name | Type | Req | Description |
|---|---|---|---|
| component | string | – | Component hint for faster lookup (e.g. "popup", "cart-droppable") |
| custom_class | string | – | Filter by custom class substring |
| global_source_id | string | yes | Global source ID |
| has_bind | boolean | – | Only elements with data bindings |
| has_custom_class | boolean | – | Only elements with custom class |
| has_events | boolean | – | Only elements with events |
| id | string | – | Filter by element ID substring (e.g. 'TEXT', 'BUTTON-3') |
| limit | number | – | Max results (default 50) |
| text | string | – | Filter by text content substring |
| type | string | – | Filter by element type (e.g. 'text', 'button', 'image', 'container', 'section') |
No output schema declared.
No examples provided.
search_images ~187
Search stock photos (Pexels) for a page/product. IMPORTANT: the storefront only renders images served from the WebCake CDN (image domains are whitelisted) — raw Pexels URLs will NOT display. By default this re-hosts each result on the WebCake CDN and returns a ready-to-use cdn_url (cached, so repeats are free). Use cdn_url for image src / product images. Requires the PEXELS_API_KEY environment variable.
| Name | Type | Req | Description |
|---|---|---|---|
| orientation | string | – | Preferred orientation |
| per_page | number | – | How many results (default 6) |
| query | string | yes | Subject to search, e.g. 'coffee shop interior' |
| upload | boolean | – | Re-host each result on the WebCake CDN and return cdn_url (default true — required for the image to show). Set false to only browse Pexels URLs. |
No output schema declared.
No examples provided.
search_page_elements ~268
Search/filter elements within a page source. Returns matching elements with full detail (id, type, style, text, classes, etc.). Examples: - Find all buttons: type="button" - Find elements with custom class: custom_class="hero" - Find text containing "subscribe": text="subscribe" - Find all data-bound elements: has_bind=true - Find all elements with events: has_events=true - Find all elements with custom CSS classes: has_custom_class=true
| Name | Type | Req | Description |
|---|---|---|---|
| custom_class | string | – | Filter by custom class substring |
| has_bind | boolean | – | Only elements with data bindings (product, category, blog) |
| has_custom_class | boolean | – | Only elements that have a custom class |
| has_events | boolean | – | Only elements with events (click, submit, mouseenter, etc.) |
| id | string | – | Filter by element ID substring (e.g. 'TEXT', 'BUTTON-3') |
| limit | number | – | Max results (default 50) |
| page_id | string | yes | Page ID |
| text | string | – | Filter by text content substring |
| type | string | – | Filter by element type (e.g. 'text', 'button', 'image', 'container', 'section', 'form', 'input') |
No output schema declared.
No examples provided.
How do I install the WebCake Storefront MCP server?
WebCake Storefront runs locally as an npm package, launched with npx -y webcake-storefront-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · webcake-storefront-mcp
claude mcp add vuluu2k-webcake-storefront-mcp -- npx -y webcake-storefront-mcp
What is the WebCake Storefront MCP server?
WebCake Storefront is an MCP server listed in the public MCP registry as io.github.vuluu2k/webcake-storefront-mcp. Build pages and manage products, orders, and content on the WebCake/StoreCake storefront builder. This page covers its npm package (webcake-storefront-mcp).
Is the WebCake Storefront MCP server safe to use?
WebCake Storefront scores 75 out of 100 on VerifyMCP. We recorded 4 known advisories against it as of 5 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the WebCake Storefront MCP server expose?
WebCake Storefront exposes 132 tools: get_intake_guide, get_current_context, list_my_sites, create_site, switch_site, and 127 more. Their descriptions and schemas cost roughly 15,596 tokens of context every time the server is loaded.
Is the WebCake Storefront MCP server still maintained?
WebCake Storefront is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the WebCake Storefront MCP server under?
WebCake Storefront declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.