Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

WebCake Storefront

NPM · WEBCAKE-STOREFRONT-MCP · 2 COMPONENTS

Build pages and manage products, orders, and content on the WebCake/StoreCake storefront builder.

0 this week 75 Trust /100

Last scanned (3 hours ago)

Scores higher than 50% of npm servers

Category E-commerce

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security81
  • No malware found by supply-chain analysis.Pass
  • CVE check failed: a known high-severity CVE affects sharp 0.34.5, a direct dependency. A fixed version is available. View diagnostics → Fail
  • No install/post-install scripts declared.Pass
  • 39 of 155 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 0 days ago).Pass
  • Security-disclosure policy not yet verified: we couldn't inspect the source repository.Unverified
Schema Quality & AI Usability75
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 17244 tokens (~130/item across 132 items; 132 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management96
  • Stability check failed: the tool surface changed between 1.31.11 and 1.38.0: 6 tool removals, 0 breaking changes, 3 additions. See how to fix → Fail
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Tool Safety47
  • Injection-marker check failed: the server instructions contains an instruction to conceal the call from the user, the text "NEVER tell the user", at byte 5715 of that field. See how to fix → Fail
  • 8 of 9 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "publish_site" implies "publish" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Partial
  • An AI judge read all 133 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 5 Nov 26 0
    • Security disclosure: fail → unverified ▼ functional
    • Package version: 1.37.0 → 1.38.0 functional
  • 4 Nov 26 0
    • Package version: 1.36.2 → 1.37.0 functional
  • 29 Oct 26 0
    • Package version: 1.36.1 → 1.36.2 functional
  • 28 Oct 26 +15
    • Malware scan: unverified → pass ▲ security
  • 27 Oct 26 −15
    • Malware scan: pass → unverified ▼ security
    • Package version: 1.36.0 → 1.36.1 functional
  • 24 Oct 26 0
    • CVE-2023-54404 affects this package: high ▼ security
  • 22 Oct 26 0
    • CVE-2026-114113 affects this package: high ▼ security
    • CVE-2026-114111 affects this package: high ▼ security
    • CVE-2026-114112 affects this package: high ▼ security
    • Stability: fail → unverified ▼ security
    • Tool safety: fail → unverified ▼ security
    • GHSA-wq5f-xc86-pv6w no longer affects this package ▲ security
    • GHSA-rgj7-g3m4-5g8c no longer affects this package ▲ security
    • GHSA-f88m-g3jw-g9cj no longer affects this package ▲ security
    • Capabilities: pass → unverified ▼ functional
    • Tool coverage: 100 → unverified ▼ functional
    • Package version: 1.34.1 → 1.36.0 functional
  • 17 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 89 to 92.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 5 Nov 2026 · Analysed npm/webcake-storefront-mcp@1.38.0

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem npm

Background: How many MCP packages publish verified provenance →

Vulnerabilities 4 findings
ID CVE Severity Vector Fix available
GHSA-f88m-g3jw-g9cj CVE-2026-114113 high yes
GHSA-rgj7-g3m4-5g8c CVE-2026-114112 high yes
GHSA-wq5f-xc86-pv6w CVE-2026-114111 high yes
GHSA-mrhx-c7xc-m3w5 CVE-2023-54404 high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yes

Background: What a vulnerability scan can and cannot prove →

Dependencies 155 packages
Packages resolved 155
Stale 39
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 132 exposed · ~15,596 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
get_page_versions ~26

View version history of a page

NameTypeReqDescription
page_idstringyesPage ID

No output schema declared.

No examples provided.

get_product ~40

Get full product details by ID: name, description, price, variations, images, attributes, SEO, etc.

NameTypeReqDescription
idstringyesProduct ID

No output schema declared.

No examples provided.

get_promotion ~44

Get full promotion details by ID: name, type, schedule, discount rules, coupon settings, items, bonus products, etc.

NameTypeReqDescription
idstringyesPromotion ID

No output schema declared.

No examples provided.

get_promotion_items ~65

Get products/variations/categories attached to a promotion. Returns items with discount details (fixed_prices, level_info, coupon_item_info)

NameTypeReqDescription
idstringyesPromotion ID
limitnumber–Items per page
pagenumber–Page number

No output schema declared.

No examples provided.

get_site_custom_code ~154

Get custom code of the site (CSS/JS). Two modes: - Default: returns ALL 4 code fields (full content) - With field filter: returns only the specified field(s) — saves tokens when you only need CSS or JS Add include_guide=true on first call to get the coding guide. Custom code is the last resort: see get_build_guide → NATIVE FIRST before adding any. All-fields reads include _budget (usage vs limits).

NameTypeReqDescription
fieldsarray–Only return specific fields (e.g. ['code_custom_css']). Omit to get all 4 fields
include_guideboolean–Include the custom code coding guide (only needed on first call)

No output schema declared.

No examples provided.

get_site_info ~60

Get full site information: name, domain, settings (colors, typography, layout, language, payment methods, etc.) and preview_img — the latest homepage screenshots (1920_1080 desktop / 430_932 mobile), refreshed after publish_site.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

get_source_cart ~34

Get all cart global sources with compact tree view. Shows full element hierarchy — no need to call get_global_source_detail separately.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

ingest_html ~128

Parse reference HTML (e.g. a Google Stitch / Figma / Codex export) into a structural blueprint (title, headings, paragraphs, images, buttons, colour palette) you can rebuild as native BuilderX sections with new_section. Not a 1:1 clone. Rebuild every part native elements can do; use an embed only for a piece no element can (third-party widget, custom animation) — never paste the whole HTML into one (sandboxed iframe: no SEO, broken links, dead forms; rejected on save).

NameTypeReqDescription
htmlstringyesRaw HTML to analyse

No output schema declared.

No examples provided.

ingest_url ~52

Fetch a public URL and parse it into a structural blueprint (see ingest_html). Note: client-rendered (React/Vue) pages may return little content.

NameTypeReqDescription
urlstringyesPublic page URL to analyse

No output schema declared.

No examples provided.

install_app ~174

Install (register) an application on the current site so its features become usable. For example, automations need the "automation" app installed first. App types: 0=product_review, 1=articles_review, 2=automation, 3=telegram, 4=affiliates, 5=multilingual, 6=appointment, 7=send_email, 8=botcake, 9=sale_channel, 10=product_design, 11=auth_otp, 12=personal_product_design, 14=course, 15=zalo_mini_app, 16=cms, 17=recaptcha, 18=pwa.

NameTypeReqDescription
appstringyesApp to install (by name)
is_activeboolean–Activate the app on install

No output schema declared.

No examples provided.

invoke_read_tool ~91

Run a READ-ONLY WebCake tool (list_*/get_*/search_*/count_*… — annotations.readOnlyHint in search_tools) by exact name with its arguments. Prefer this over invoke_tool for lookups. Refuses tools that change data.

NameTypeReqDescription
argumentsobject–Arguments object matching the tool's input schema
namestringyesExact tool name (from search_tools)

No output schema declared.

No examples provided.

invoke_tool ~72

Run any WebCake tool by exact name with its arguments (discover names + schemas via search_tools). Arguments are validated before running. For read-only tools prefer invoke_read_tool.

NameTypeReqDescription
argumentsobject–Arguments object matching the tool's input schema
namestringyesExact tool name (from search_tools)

No output schema declared.

No examples provided.

list_apps ~185

Which applications are installed / enabled on the site — and which are not — in ONE call. Returns installed[] (id, type, name, enabled) plus not_installed[] (app names). Do NOT call get_app per type to answer "which apps are on"; use get_app only for one app's settings. App type codes: 0=product_review, 1=articles_review, 2=automation, 3=telegram, 4=affiliates, 5=multilingual, 6=appointment, 7=send_email, 8=botcake, 9=sale_channel, 10=product_design, 11=auth_otp, 12=personal_product_design, 14=course, 15=zalo_mini_app, 16=cms, 17=recaptcha, 18=pwa.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

list_articles ~122

List blog articles (metadata only, without HTML content). Use get_article for the full content. Pass term to search by title/slug. Pass category_id to list the posts filed under one blog category — that view is the public one, so hidden posts and posts scheduled in the future are left out.

NameTypeReqDescription
category_idstring–Filter by blog category id
limitnumber–Items per page (default 20)
pagenumber–Page number (default 1)
termstring–Search articles by title or slug

No output schema declared.

No examples provided.

list_bindings ~114

List every dynamic-data BINDING target: the datasets (product, cart_item, order, order_item, post, category, customer, customer_address, …) and their exact field names ('product::product_price', …), which page type each needs (store/member/blog), and how repeater children (grid-product, cart-items, post-list) bind per-item. Attach via new_element opts.bindings (ids auto-minted, e.g. opts.bindings=[{ target:'product::product_price' }]).

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

list_cached_results ~28

List the large results currently held in the session cache (id, label, size, age).

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

list_categories ~16

List all product categories of the site

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

list_cms_files ~26

List all CMS files (HTTP functions, cron jobs, ...) for the site

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

list_collections ~69

List all database collections (tables) for the site. Returns collection names, table names, and field counts. Use get_collection for full schema details

NameTypeReqDescription
limitnumber–Items per page
pagenumber–Page number
termstring–Search by collection name

No output schema declared.

No examples provided.

list_combos ~82

List all combo/bundle products of the site. Use get_combo_items for combo composition details

NameTypeReqDescription
include_guideboolean–Include combo type reference guide
limitnumber–Items per page (default: 20)
pagenumber–Page number (default: 1)
termstring–Search by combo name

No output schema declared.

No examples provided.

list_customers ~107

List/search the site's customers (browse or segment). Pass `term` to search by name/phone/email. Returns name, phone, email, order_count, purchased_amount, reward_point, tags, last_order_at. Use find_customer for an exact id/phone/email lookup.

NameTypeReqDescription
limitnumber–Items per page (default 50)
pagenumber–Page number (default 1)
termstring–Keyword — searches name / phone / email

No output schema declared.

No examples provided.

list_elements ~37

List all BuilderX element/component types you can place on a page, grouped by category with a one-line summary and whether each is a container.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

list_events ~108

List every interaction EVENT you can attach to a node: the triggers (eventName: click/hover/success/submit/…) and the actions (open_page, scroll_to, toggle, open_popup, add_to_cart, buy_now, phone_call, open_link, …) with the exact extra fields each action needs. Attach via new_element/new_section opts.events (ids are auto-minted, e.g. opts.events=[{ action:'add_to_cart', open_page:'cart' }]).

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

list_global_sections ~86

List reusable global sections (Header, Footer, shared content blocks) — SLIM summary only. Each entry: id, name, slot (header/footer/block), element count + type histogram + custom classes. The full element tree is large, so it is NOT returned here — drill in with get_global_section (compact tree), search_global_section_elements, or get_global_section_element.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

list_global_sources ~71

List global sources (cart, popup, etc.). Returns compact summary per source. Always provide component to filter by type — the API may not return all types without a filter.

NameTypeReqDescription
componentstring–Filter by component type (e.g. "cart-droppable", "popup"). Recommended to always provide

No output schema declared.

No examples provided.

list_my_sites ~154

List the current account's PERSONAL sites (team sites are not included). Use this to find a site_id before switching. filter: "all" = active sites (default), "removed" = sites in trash. Each site has status, published_at (set at creation — not proof of publishing), slug, primary domain and has_custom_domain (verified, live, non-default domain). For plans use get_site_subscription / count_my_sites.

NameTypeReqDescription
filterstring–"all" (active, default) or "removed" (trash)
limitnumber–Items per page
pagenumber–Page number
termstring–Search by site name, site id or domain

No output schema declared.

No examples provided.

list_orders ~170

List orders of the site (metadata only). Use get_order for full details including items

NameTypeReqDescription
limitnumber–Items per page
pagenumber–Page number
statusnumber–Filter by status: 0=new, 1=submitted, 2=shipped, 3=delivered, 4=returning, 5=returned, 6=canceled, 7=removed, 8=packing, 9=pending, 11=waiting, 12=wait_print, 13=printed, 15=part_returned, 16=receive…

No output schema declared.

No examples provided.

list_page_contents ~74

List multi-language contents (translations) of the site's pages and global sections. Pass page_id + language_code to read one page's translation.

NameTypeReqDescription
language_codestring–With page_id: return just that language's content map
page_idstring–Page ID — narrows the result to that page

No output schema declared.

No examples provided.

list_page_drafts ~40

List local page drafts for the current site (summaries only: id, name, slug, type, section count, commit progress, updated_at).

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

list_pages ~21

List all pages of the site (metadata only, without source)

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

list_products ~66

List products of the site (metadata only: id, name, slug, price, image, status). Use get_product for full details

NameTypeReqDescription
limitnumber–Items per page
pagenumber–Page number
termstring–Search by product name

No output schema declared.

No examples provided.

list_promotions ~115

List ALL promotions/discounts of the site (every page is fetched for you). Each row has id, name, type, is_activated, pos_id (non-null = linked/synced with POS), start/end time. The summary answers "how many promotions / how many synced with POS / how many active" in ONE call — do not call get_promotion per row for that. Use get_promotion only for one promotion's full rules.

NameTypeReqDescription
include_guideboolean–Include promotion type reference guide

No output schema declared.

No examples provided.

list_section_templates ~164

Browse the designer-made section library (the editor's template picker): ready, styled blocks (hero, product showcase, testimonials, footer…) to start from instead of composing from scratch. No args → categories. With category_id and/or term → templates { id, name, thumbnail, kind }. Look at a thumbnail with invoke_tool('read_image', { url }), then insert a kind:"section" template with add_section({ page_id, template:{ category_id, id } }) and restyle it to the brand.

NameTypeReqDescription
category_idstring–Category id (from the no-arg call)
limitnumber–Per page (default 12)
pagenumber–Page (default 1)
termstring–Search template names

No output schema declared.

No examples provided.

list_template_themes ~98

Search/list the public Webcake template marketplace (api.storecake.io). Use to match customer brief against existing templates by keyword. Returns id, name, preview_url, thumbnail, categories

NameTypeReqDescription
langstring–Language code (default 'vi')
limitnumber–Items per page (default 12)
pagenumber–Page number (default 1)
qstring–Keyword to search themes

No output schema declared.

No examples provided.

list_themes ~34

List all custom themes of the site. Returns theme name, colors, typographies, transitions, and which one is active

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

list_tool_groups ~40

List every WebCake tool group, how many tools it has, and whether it is loaded natively or reached on-demand via search_tools + invoke_tool.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

new_element ~132

Build a single structurally-valid element node from the real builder factory. Returns the node — edit its specials/style, then place it in a section's children.

NameTypeReqDescription
optsobject–Factory opts: { text, src, width, height, style, config, specials, events, bindings, responsive, align }. align = horizontal placement in the grid cell: 'left'|'center'|'right'|'fill' (works on any e…
typestringyesElement type (see list_elements)

No output schema declared.

No examples provided.

new_page_skeleton ~36

Return an empty but valid page source: { sections: [] }. Add sections built with new_section, then save with build_page.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

new_row ~312

Build a multi-column ROW container: children laid out SIDE BY SIDE (not stacked). This is how real pages build feature cards, category tiles, footer columns, a 2-col hero, etc. The row is RESPONSIVE — it auto-collapses to fewer columns on tablet/mobile (default tablet 2, mobile 1) so cards never become cramped slivers. Place the returned node as a child inside a section (section children still stack vertically; nest a row for horizontal layout). Example children: [{ "type":"container", "children":[{"type":"image","opts":{...}},{"type":"text","opts":{...}}] }, { ... }, { ... }]

NameTypeReqDescription
childrenarray–Child specs, one per column (laid out left-to-right)
col_widthsarray–Explicit per-column unit objects (length = #children), e.g. [{unit:'fr',value:2},{unit:'fr',value:1}]. Default: equal columns.
collapseobject–Columns to show per breakpoint, e.g. {bp3:2,bp4:1}. Default: tablet 2, mobile 1.
column_gapnumber–Horizontal gap (px) between columns (default 24)
container_optsobject–Optional factory opts for the row container node itself (e.g. { style:{...} })
row_gapnumber–Vertical gap (px) between wrapped rows (default 24)

No output schema declared.

No examples provided.

new_section ~120

Build a complete section node with children laid out in the builder's vertical grid. Pass an array of element specs; each child is stacked top-to-bottom. Nest containers via the child's own 'children'. Example children: [{ "type":"text", "opts":{"text":"Welcome","style":{"fontSize":"40px"}} }, { "type":"button", "opts":{"text":"Shop now"} }]

NameTypeReqDescription
childrenarray–Child element specs, stacked vertically in the section
section_optsobject–Optional factory opts for the section node itself

No output schema declared.

No examples provided.

publish_site ~88

Publish the whole site live — snapshots all current page sources into the live (published) version. Note: BuilderX publishes at the SITE level, not per page; publishing makes every saved page go live. Two-step safety: dry_run=true (default) describes what will happen; dry_run=false actually publishes.

NameTypeReqDescription
dry_runboolean–Preview (true) or publish for real (false)

No output schema declared.

No examples provided.

query_collection_records ~145

Query records from a collection (custom data table) by table name. Supports paging + an optional `where` filter and `order_by` sort. (Uses the CMS api-key auth the records endpoint requires.)

NameTypeReqDescription
limitnumber–Items per page
order_bystring–Field to sort by (e.g. 'inserted_at').
pagenumber–Page number
table_namestringyesCollection table name (e.g. 'subscribers', 'custom_orders') — from get_collection.table_name
whereobject–Filter object, e.g. { status: 'active' } — matches records by field value.

No output schema declared.

No examples provided.

read_cached_result ~109

Read a slice of a large cached result produced by another tool (look for "cached":true + a cache_id in its output). Page through with offset/length; the response reports next_offset + remaining_chars until done.

NameTypeReqDescription
cache_idstringyesThe cache_id returned by the producing tool (e.g. "cache-3")
lengthnumber–Number of characters to return (default 12000)
offsetnumber–Start character offset (default 0)

No output schema declared.

No examples provided.

restore_file_version ~100

Roll a CMS file back to a saved version in one step: reads the version's content and writes it back to the file. Omit version_id to restore the most recent snapshot. Tip: save_file_version on the current content first if you want an undo point.

NameTypeReqDescription
cms_file_idstringyesCMS file ID to restore
version_idstring–Which version to restore (from get_file_versions). Omit = latest snapshot.

No output schema declared.

No examples provided.

run_function ~73

Run a deployed HTTP function. function_name excludes method prefix. Example: "get_Products" → function_name="Products", method="GET"

NameTypeReqDescription
function_namestringyesFunction name without method prefix (e.g. 'Products')
methodstring–HTTP method
paramsobject–Parameters

No output schema declared.

No examples provided.

save_file_version ~54

Save a version snapshot of a CMS file for rollback

NameTypeReqDescription
cms_file_idstringyesCMS file ID
contentstringyesContent to save
is_publicboolean–Mark as public version

No output schema declared.

No examples provided.

search_global_section_elements ~183

Search/filter elements within a global section (Header/Footer/block) without dumping the whole tree. Filter by type, id substring, custom_class, text, or has_bind / has_events / has_custom_class.

NameTypeReqDescription
custom_classstring–Filter by custom class substring
global_section_idstringyesGlobal section ID
has_bindboolean–Only elements with data bindings
has_custom_classboolean–Only elements with a custom class
has_eventsboolean–Only elements with events
idstring–Filter by element ID substring
limitnumber–Max results (default 50)
textstring–Filter by text content substring
typestring–Filter by element type (e.g. 'menu', 'menu-item', 'container', 'image', 'text')

No output schema declared.

No examples provided.

search_global_source_elements ~243

Search/filter elements within a global source. No component param needed. Examples: - Find all buttons: type="button" - Find by class: custom_class="hero" - Find text: text="subscribe" - Data-bound only: has_bind=true - With events: has_events=true - With custom class: has_custom_class=true

NameTypeReqDescription
componentstring–Component hint for faster lookup (e.g. "popup", "cart-droppable")
custom_classstring–Filter by custom class substring
global_source_idstringyesGlobal source ID
has_bindboolean–Only elements with data bindings
has_custom_classboolean–Only elements with custom class
has_eventsboolean–Only elements with events
idstring–Filter by element ID substring (e.g. 'TEXT', 'BUTTON-3')
limitnumber–Max results (default 50)
textstring–Filter by text content substring
typestring–Filter by element type (e.g. 'text', 'button', 'image', 'container', 'section')

No output schema declared.

No examples provided.

search_images ~187

Search stock photos (Pexels) for a page/product. IMPORTANT: the storefront only renders images served from the WebCake CDN (image domains are whitelisted) — raw Pexels URLs will NOT display. By default this re-hosts each result on the WebCake CDN and returns a ready-to-use cdn_url (cached, so repeats are free). Use cdn_url for image src / product images. Requires the PEXELS_API_KEY environment variable.

NameTypeReqDescription
orientationstring–Preferred orientation
per_pagenumber–How many results (default 6)
querystringyesSubject to search, e.g. 'coffee shop interior'
uploadboolean–Re-host each result on the WebCake CDN and return cdn_url (default true — required for the image to show). Set false to only browse Pexels URLs.

No output schema declared.

No examples provided.

search_page_elements ~268

Search/filter elements within a page source. Returns matching elements with full detail (id, type, style, text, classes, etc.). Examples: - Find all buttons: type="button" - Find elements with custom class: custom_class="hero" - Find text containing "subscribe": text="subscribe" - Find all data-bound elements: has_bind=true - Find all elements with events: has_events=true - Find all elements with custom CSS classes: has_custom_class=true

NameTypeReqDescription
custom_classstring–Filter by custom class substring
has_bindboolean–Only elements with data bindings (product, category, blog)
has_custom_classboolean–Only elements that have a custom class
has_eventsboolean–Only elements with events (click, submit, mouseenter, etc.)
idstring–Filter by element ID substring (e.g. 'TEXT', 'BUTTON-3')
limitnumber–Max results (default 50)
page_idstringyesPage ID
textstring–Filter by text content substring
typestring–Filter by element type (e.g. 'text', 'button', 'image', 'container', 'section', 'form', 'input')

No output schema declared.

No examples provided.

Install

How do I install the WebCake Storefront MCP server?

WebCake Storefront runs locally as an npm package, launched with npx -y webcake-storefront-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · webcake-storefront-mcp

# add to Claude Code
claude mcp add vuluu2k-webcake-storefront-mcp -- npx -y webcake-storefront-mcp
Common questions

What is the WebCake Storefront MCP server?

WebCake Storefront is an MCP server listed in the public MCP registry as io.github.vuluu2k/webcake-storefront-mcp. Build pages and manage products, orders, and content on the WebCake/StoreCake storefront builder. This page covers its npm package (webcake-storefront-mcp).

Is the WebCake Storefront MCP server safe to use?

WebCake Storefront scores 75 out of 100 on VerifyMCP. We recorded 4 known advisories against it as of 5 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the WebCake Storefront MCP server expose?

WebCake Storefront exposes 132 tools: get_intake_guide, get_current_context, list_my_sites, create_site, switch_site, and 127 more. Their descriptions and schemas cost roughly 15,596 tokens of context every time the server is loaded.

Is the WebCake Storefront MCP server still maintained?

WebCake Storefront is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the WebCake Storefront MCP server under?

WebCake Storefront declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.