WebCake Storefront
NPM · WEBCAKE-STOREFRONT-MCP · 2 COMPONENTS · SCANNED AUG 3
Build pages and manage products, orders, and content on the WebCake/StoreCake storefront builder.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →
Supply Chain Security70
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known high-severity CVE affects sharp 0.34.5, a direct dependency. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- Only part of the dependency tree could be resolved (157 of 161), so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 35 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability41
- AI-judged instruction clarity (poor).Fail
- Context-footprint check failed: tool/resource definitions use about 16012 tokens (~118/item across 135 items; 135 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management27
- Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 99% of tool parameters carry a description.Partial
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
npm · webcake-storefront-mcp
claude mcp add vuluu2k-webcake-storefront-mcp -- npx -y webcake-storefront-mcp
codex mcp add vuluu2k-webcake-storefront-mcp -- npx -y webcake-storefront-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"vuluu2k-webcake-storefront-mcp": {
"type": "local",
"command": [
"npx",
"-y",
"webcake-storefront-mcp"
],
"enabled": true
}
}
} openclaw mcp add vuluu2k-webcake-storefront-mcp --command npx --arg -y --arg webcake-storefront-mcp
mcp_servers:
vuluu2k-webcake-storefront-mcp:
command: "npx"
args: ["-y", "webcake-storefront-mcp"] {
"mcpServers": {
"vuluu2k-webcake-storefront-mcp": {
"command": "npx",
"args": [
"-y",
"webcake-storefront-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 2 Aug 26 +37
- GHSA-f88m-g3jw-g9cj affects this package: high ▼ security
- Provenance: unverified → fail ▼ security
- Known CVEs: unverified → fail ▼ security
- Install scripts: unverified → pass ▲ security
- Malware scan: unverified → pass ▲ security
- Tool coverage: 100 → unverified ▼ functional
- Schema quality: unverified → poor ▲ functional
- MCP protocol: unverified → pass ▲ functional
- Stability: unverified → 0.23 ▲ functional
- License: unverified → pass ▲ functional
- Dependency health: unverified → partial ▲ functional
- Maintenance: unverified → pass ▲ functional
- Licence: MIT functional
- 1 Aug 26 −7
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 31 Jul 26 +2
- Malware scan: pass → unverified ▼ security
- Security disclosure: unverified → fail ▼ functional
- Dependency health: partial → unverified ▼ functional
- Tool coverage: unverified → 100 ▲ functional
- 29 Jul 26 −20
- Tool coverage: 100 → unverified ▼ functional
- Security disclosure: fail → unverified ▼ functional
- Dependency health: unverified → partial ▲ functional
- First check of Schema quality: unverified functional
- 27 Jul 26 45
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 3 Aug 2026 · Analysed npm/[email protected]
Provenance none
Ecosystem: npm · Outcome: none
Vulnerabilities 1 finding
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-f88m-g3jw-g9cj | high | yes |
Dependencies 157 packages
157 packages in the resolved dependency tree · 157 deprecated · 38 stale.
The dependency tree was only partially resolved, so these counts may be incomplete.
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
get_page_source ~51
Get page source overview: section count, element type counts, and all custom CSS classes. Use this first, then use search_page_elements to find specific elements
| Name | Type | Req | Description |
|---|---|---|---|
| page_id | string | yes | Page ID |
No output schema declared.
No examples provided.
get_page_versions ~26
View version history of a page
| Name | Type | Req | Description |
|---|---|---|---|
| page_id | string | yes | Page ID |
No output schema declared.
No examples provided.
get_product ~40
Get full product details by ID: name, description, price, variations, images, attributes, SEO, etc.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Product ID |
No output schema declared.
No examples provided.
get_promotion ~44
Get full promotion details by ID: name, type, schedule, discount rules, coupon settings, items, bonus products, etc.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Promotion ID |
No output schema declared.
No examples provided.
get_promotion_items ~65
Get products/variations/categories attached to a promotion. Returns items with discount details (fixed_prices, level_info, coupon_item_info)
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Promotion ID |
| limit | number | — | Items per page |
| page | number | — | Page number |
No output schema declared.
No examples provided.
get_site_custom_code ~123
Get custom code of the site (CSS/JS). Two modes: - Default: returns ALL 4 code fields (full content) - With field filter: returns only the specified field(s) — saves tokens when you only need CSS or JS Add include_guide=true on first call to get the coding guide
| Name | Type | Req | Description |
|---|---|---|---|
| fields | array | — | Only return specific fields (e.g. ['code_custom_css']). Omit to get all 4 fields |
| include_guide | boolean | — | Include the custom code coding guide (only needed on first call) |
No output schema declared.
No examples provided.
get_site_info ~33
Get full site information: name, domain, settings (colors, typography, layout, language, payment methods, etc.)
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_source_cart ~34
Get all cart global sources with compact tree view. Shows full element hierarchy — no need to call get_global_source_detail separately.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
ingest_html ~59
Parse reference HTML into a structural blueprint (title, headings, paragraphs, images, buttons, colour palette) you can rebuild as BuilderX sections with new_section. Not a 1:1 clone.
| Name | Type | Req | Description |
|---|---|---|---|
| html | string | yes | Raw HTML to analyse |
No output schema declared.
No examples provided.
ingest_url ~52
Fetch a public URL and parse it into a structural blueprint (see ingest_html). Note: client-rendered (React/Vue) pages may return little content.
| Name | Type | Req | Description |
|---|---|---|---|
| url | string | yes | Public page URL to analyse |
No output schema declared.
No examples provided.
install_app ~174
Install (register) an application on the current site so its features become usable. For example, automations need the "automation" app installed first. App types: 0=product_review, 1=articles_review, 2=automation, 3=telegram, 4=affiliates, 5=multilingual, 6=appointment, 7=send_email, 8=botcake, 9=sale_channel, 10=product_design, 11=auth_otp, 12=personal_product_design, 14=course, 15=zalo_mini_app, 16=cms, 17=recaptcha, 18=pwa.
| Name | Type | Req | Description |
|---|---|---|---|
| app | string | yes | App to install (by name) |
| is_active | boolean | — | Activate the app on install |
No output schema declared.
No examples provided.
invoke_tool ~74
Run any WebCake tool by exact name with its arguments (discover names + schemas via search_tools). Arguments are validated before running. Use this for tools that are not loaded natively.
| Name | Type | Req | Description |
|---|---|---|---|
| arguments | object | — | Arguments object matching the tool's input schema |
| name | string | yes | Exact tool name (from search_tools) |
No output schema declared.
No examples provided.
list_apps ~131
List the site's installed applications (type, status, settings). App type codes: 0=product_review, 1=articles_review, 2=automation, 3=telegram, 4=affiliates, 5=multilingual, 6=appointment, 7=send_email, 8=botcake, 9=sale_channel, 10=product_design, 11=auth_otp, 12=personal_product_design, 14=course, 15=zalo_mini_app, 16=cms, 17=recaptcha, 18=pwa.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_articles ~57
List blog articles (metadata only, without HTML content). Use get_article to get full content
| Name | Type | Req | Description |
|---|---|---|---|
| category_id | string | — | Filter by category |
| limit | number | — | Items per page |
| page | number | — | Page number |
No output schema declared.
No examples provided.
list_bindings ~114
List every dynamic-data BINDING target: the datasets (product, cart_item, order, order_item, post, category, customer, customer_address, …) and their exact field names ('product::product_price', …), which page type each needs (store/member/blog), and how repeater children (grid-product, cart-items, post-list) bind per-item. Attach via new_element opts.bindings (ids auto-minted, e.g. opts.bindings=[{ target:'product::product_price' }]).
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_cached_results ~28
List the large results currently held in the session cache (id, label, size, age).
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_categories ~16
List all product categories of the site
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_cms_files ~26
List all CMS files (HTTP functions, cron jobs, ...) for the site
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_collections ~69
List all database collections (tables) for the site. Returns collection names, table names, and field counts. Use get_collection for full schema details
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | — | Items per page |
| page | number | — | Page number |
| term | string | — | Search by collection name |
No output schema declared.
No examples provided.
list_combos ~82
List all combo/bundle products of the site. Use get_combo_items for combo composition details
| Name | Type | Req | Description |
|---|---|---|---|
| include_guide | boolean | — | Include combo type reference guide |
| limit | number | — | Items per page (default: 20) |
| page | number | — | Page number (default: 1) |
| term | string | — | Search by combo name |
No output schema declared.
No examples provided.
list_customers ~107
List/search the site's customers (browse or segment). Pass `term` to search by name/phone/email. Returns name, phone, email, order_count, purchased_amount, reward_point, tags, last_order_at. Use find_customer for an exact id/phone/email lookup.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | — | Items per page (default 50) |
| page | number | — | Page number (default 1) |
| term | string | — | Keyword — searches name / phone / email |
No output schema declared.
No examples provided.
list_elements ~37
List all BuilderX element/component types you can place on a page, grouped by category with a one-line summary and whether each is a container.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_events ~108
List every interaction EVENT you can attach to a node: the triggers (eventName: click/hover/success/submit/…) and the actions (open_page, scroll_to, toggle, open_popup, add_to_cart, buy_now, phone_call, open_link, …) with the exact extra fields each action needs. Attach via new_element/new_section opts.events (ids are auto-minted, e.g. opts.events=[{ action:'add_to_cart', open_page:'cart' }]).
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_global_sections ~86
List reusable global sections (Header, Footer, shared content blocks) — SLIM summary only. Each entry: id, name, slot (header/footer/block), element count + type histogram + custom classes. The full element tree is large, so it is NOT returned here — drill in with get_global_section (compact tree), search_global_section_elements, or get_global_section_element.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_global_sources ~71
List global sources (cart, popup, etc.). Returns compact summary per source. Always provide component to filter by type — the API may not return all types without a filter.
| Name | Type | Req | Description |
|---|---|---|---|
| component | string | — | Filter by component type (e.g. "cart-droppable", "popup"). Recommended to always provide |
No output schema declared.
No examples provided.
list_image_elements ~141
Find all image elements across pages + global sources, with element_id, current alt, src, and the field path where alt is/should be written. Use as the first step before generating alt text via vision (read_image) and writing back with set_image_alts. Note: global_sections are read-only via the API and are not included.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | — | Max elements to return |
| only_missing_alt | boolean | — | Return only elements whose alt is empty |
| page_id | string | — | Limit to one page (only used when scope is 'pages' or 'all') |
| scope | string | — | Which sources to inspect |
No output schema declared.
No examples provided.
list_my_sites ~58
List all sites accessible by the current account. Use this to find a site_id before switching
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | — | Items per page |
| page | number | — | Page number |
| term | string | — | Search by site name |
No output schema declared.
No examples provided.
list_orders ~81
List orders of the site (metadata only). Use get_order for full details including items
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | — | Items per page |
| page | number | — | Page number |
| status | number | — | Filter by status (0=pending, 50=confirmed, 100=shipping, 150=delivered, -1=cancelled) |
No output schema declared.
No examples provided.
list_page_contents ~29
List multi-language contents of a page
| Name | Type | Req | Description |
|---|---|---|---|
| page_id | string | — | Filter by Page ID |
No output schema declared.
No examples provided.
list_page_drafts ~40
List local page drafts for the current site (summaries only: id, name, slug, type, section count, commit progress, updated_at).
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_pages ~21
List all pages of the site (metadata only, without source)
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_products ~66
List products of the site (metadata only: id, name, slug, price, image, status). Use get_product for full details
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | — | Items per page |
| page | number | — | Page number |
| term | string | — | Search by product name |
No output schema declared.
No examples provided.
list_promotions ~73
List all promotions/discounts of the site (metadata only). Use get_promotion for full details
| Name | Type | Req | Description |
|---|---|---|---|
| include_guide | boolean | — | Include promotion type reference guide |
| limit | number | — | Items per page (default: 20) |
| page | number | — | Page number (default: 1) |
No output schema declared.
No examples provided.
list_template_themes ~98
Search/list the public Webcake template marketplace (api.storecake.io). Use to match customer brief against existing templates by keyword. Returns id, name, preview_url, thumbnail, categories
| Name | Type | Req | Description |
|---|---|---|---|
| lang | string | — | Language code (default 'vi') |
| limit | number | — | Items per page (default 12) |
| page | number | — | Page number (default 1) |
| q | string | — | Keyword to search themes |
No output schema declared.
No examples provided.
list_themes ~34
List all custom themes of the site. Returns theme name, colors, typographies, transitions, and which one is active
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_tool_groups ~40
List every WebCake tool group, how many tools it has, and whether it is loaded natively or reached on-demand via search_tools + invoke_tool.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
new_element ~132
Build a single structurally-valid element node from the real builder factory. Returns the node — edit its specials/style, then place it in a section's children.
| Name | Type | Req | Description |
|---|---|---|---|
| opts | object | — | Factory opts: { text, src, width, height, style, config, specials, events, bindings, responsive, align }. align = horizontal placement in the grid cell: 'left'|'center'|'right'|'fill' (works on any e… |
| type | string | yes | Element type (see list_elements) |
No output schema declared.
No examples provided.
new_page_skeleton ~36
Return an empty but valid page source: { sections: [] }. Add sections built with new_section, then save with build_page.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
new_row ~312
Build a multi-column ROW container: children laid out SIDE BY SIDE (not stacked). This is how real pages build feature cards, category tiles, footer columns, a 2-col hero, etc. The row is RESPONSIVE — it auto-collapses to fewer columns on tablet/mobile (default tablet 2, mobile 1) so cards never become cramped slivers. Place the returned node as a child inside a section (section children still stack vertically; nest a row for horizontal layout). Example children: [{ "type":"container", "children":[{"type":"image","opts":{...}},{"type":"text","opts":{...}}] }, { ... }, { ... }]
| Name | Type | Req | Description |
|---|---|---|---|
| children | array | — | Child specs, one per column (laid out left-to-right) |
| col_widths | array | — | Explicit per-column unit objects (length = #children), e.g. [{unit:'fr',value:2},{unit:'fr',value:1}]. Default: equal columns. |
| collapse | object | — | Columns to show per breakpoint, e.g. {bp3:2,bp4:1}. Default: tablet 2, mobile 1. |
| column_gap | number | — | Horizontal gap (px) between columns (default 24) |
| container_opts | object | — | Optional factory opts for the row container node itself (e.g. { style:{...} }) |
| row_gap | number | — | Vertical gap (px) between wrapped rows (default 24) |
No output schema declared.
No examples provided.
new_section ~120
Build a complete section node with children laid out in the builder's vertical grid. Pass an array of element specs; each child is stacked top-to-bottom. Nest containers via the child's own 'children'. Example children: [{ "type":"text", "opts":{"text":"Welcome","style":{"fontSize":"40px"}} }, { "type":"button", "opts":{"text":"Shop now"} }]
| Name | Type | Req | Description |
|---|---|---|---|
| children | array | — | Child element specs, stacked vertically in the section |
| section_opts | object | — | Optional factory opts for the section node itself |
No output schema declared.
No examples provided.
publish_site ~88
Publish the whole site live — snapshots all current page sources into the live (published) version. Note: BuilderX publishes at the SITE level, not per page; publishing makes every saved page go live. Two-step safety: dry_run=true (default) describes what will happen; dry_run=false actually publishes.
| Name | Type | Req | Description |
|---|---|---|---|
| dry_run | boolean | — | Preview (true) or publish for real (false) |
No output schema declared.
No examples provided.
query_collection_records ~145
Query records from a collection (custom data table) by table name. Supports paging + an optional `where` filter and `order_by` sort. (Uses the CMS api-key auth the records endpoint requires.)
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | — | Items per page |
| order_by | string | — | Field to sort by (e.g. 'inserted_at'). |
| page | number | — | Page number |
| table_name | string | yes | Collection table name (e.g. 'subscribers', 'custom_orders') — from get_collection.table_name |
| where | object | — | Filter object, e.g. { status: 'active' } — matches records by field value. |
No output schema declared.
No examples provided.
read_cached_result ~109
Read a slice of a large cached result produced by another tool (look for "cached":true + a cache_id in its output). Page through with offset/length; the response reports next_offset + remaining_chars until done.
| Name | Type | Req | Description |
|---|---|---|---|
| cache_id | string | yes | The cache_id returned by the producing tool (e.g. "cache-3") |
| length | number | — | Number of characters to return (default 12000) |
| offset | number | — | Start character offset (default 0) |
No output schema declared.
No examples provided.
read_image ~222
Fetch an image URL and return its bytes for vision analysis by the AI client. Pair with scan_unique_images to inspect images already on the site. After receiving the image, describe it (subject, style, palette, composition, mood, lighting, background, notable_details) to build an image-generation brief. Describe the image with these fields, useful as input for new image generation: - subject: main object / scene / person - style: photography, illustration, 3D render, flat vector, watercolor, ... - palette: 3–5 dominant colors (hex or names) - composition: layout, framing, focal point - mood: emotion or atmosphere - lighting: natural / studio / golden hour / dramatic / soft / ... - background: setting / environment - notable_details: props, textures, typography, brand elements Use these as building blocks when drafting an image-gen brief.
| Name | Type | Req | Description |
|---|---|---|---|
| max_size_mb | number | — | Reject images larger than this (default 8MB) |
| url | string | yes | Absolute http(s) image URL |
No output schema declared.
No examples provided.
read_images ~217
Batch fetch multiple image URLs in parallel. Use when comparing several references or extracting motifs across a set. Capped at 5 images per call to keep context manageable. For each image, describe subject/style/palette/composition/mood; then synthesize common themes for the brief. Describe the image with these fields, useful as input for new image generation: - subject: main object / scene / person - style: photography, illustration, 3D render, flat vector, watercolor, ... - palette: 3–5 dominant colors (hex or names) - composition: layout, framing, focal point - mood: emotion or atmosphere - lighting: natural / studio / golden hour / dramatic / soft / ... - background: setting / environment - notable_details: props, textures, typography, brand elements Use these as building blocks when drafting an image-gen brief.
| Name | Type | Req | Description |
|---|---|---|---|
| max_size_mb | number | — | Per-image size cap in MB |
| urls | array | yes | 1–5 absolute http(s) image URLs |
No output schema declared.
No examples provided.
restore_file_version ~100
Roll a CMS file back to a saved version in one step: reads the version's content and writes it back to the file. Omit version_id to restore the most recent snapshot. Tip: save_file_version on the current content first if you want an undo point.
| Name | Type | Req | Description |
|---|---|---|---|
| cms_file_id | string | yes | CMS file ID to restore |
| version_id | string | — | Which version to restore (from get_file_versions). Omit = latest snapshot. |
No output schema declared.
No examples provided.
run_function ~73
Run a deployed HTTP function. function_name excludes method prefix. Example: "get_Products" → function_name="Products", method="GET"
| Name | Type | Req | Description |
|---|---|---|---|
| function_name | string | yes | Function name without method prefix (e.g. 'Products') |
| method | string | — | HTTP method |
| params | object | — | Parameters |
No output schema declared.
No examples provided.
save_file_version ~54
Save a version snapshot of a CMS file for rollback
| Name | Type | Req | Description |
|---|---|---|---|
| cms_file_id | string | yes | CMS file ID |
| content | string | yes | Content to save |
| is_public | boolean | — | Mark as public version |
No output schema declared.
No examples provided.
scan_unique_images ~172
Scan all images used across page sources, global sources, and global sections. Returns a unique list of image URLs with which elements use each one. Useful for: image audit, finding broken/duplicated CDN URLs, bulk replace planning, theme migration. Scans every string field in the source tree (config.src, style.background-image, etc.) and CSS url(...) refs — wide net catches all variants.
| Name | Type | Req | Description |
|---|---|---|---|
| include_relative | boolean | — | Include relative-path images (e.g. /uploads/...). Default only http(s) URLs |
| lazy | boolean | — | Return only unique URL list, no usage tracking — faster for large sites |
| page_id | string | — | Limit to one page (only used when scope is 'pages' or 'all') |
| scope | string | — | Which sources to scan |
No output schema declared.
No examples provided.
search_global_section_elements ~183
Search/filter elements within a global section (Header/Footer/block) without dumping the whole tree. Filter by type, id substring, custom_class, text, or has_bind / has_events / has_custom_class.
| Name | Type | Req | Description |
|---|---|---|---|
| custom_class | string | — | Filter by custom class substring |
| global_section_id | string | yes | Global section ID |
| has_bind | boolean | — | Only elements with data bindings |
| has_custom_class | boolean | — | Only elements with a custom class |
| has_events | boolean | — | Only elements with events |
| id | string | — | Filter by element ID substring |
| limit | number | — | Max results (default 50) |
| text | string | — | Filter by text content substring |
| type | string | — | Filter by element type (e.g. 'menu', 'menu-item', 'container', 'image', 'text') |
No output schema declared.
No examples provided.