Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, email [email protected] and we’ll put it right.

WebCake Storefront

NPM · WEBCAKE-STOREFRONT-MCP · 2 COMPONENTS · SCANNED AUG 3

Build pages and manage products, orders, and content on the WebCake/StoreCake storefront builder.

+12 this week 57 Trust /100
Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security70
  • No malware found by supply-chain analysis.Pass
  • CVE check failed: a known high-severity CVE affects sharp 0.34.5, a direct dependency. A fixed version is available. View diagnostics → Fail
  • No install/post-install scripts declared.Pass
  • Only part of the dependency tree could be resolved (157 of 161), so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency45
Schema Quality & AI Usability41
  • AI-judged instruction clarity (poor).Fail
  • Context-footprint check failed: tool/resource definitions use about 16012 tokens (~118/item across 135 items; 135 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management27
  • Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 99% of tool parameters carry a description.Partial
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · webcake-storefront-mcp

# add to Claude Code
claude mcp add vuluu2k-webcake-storefront-mcp -- npx -y webcake-storefront-mcp
# add to Codex CLI
codex mcp add vuluu2k-webcake-storefront-mcp -- npx -y webcake-storefront-mcp
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "vuluu2k-webcake-storefront-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "webcake-storefront-mcp"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add vuluu2k-webcake-storefront-mcp --command npx --arg -y --arg webcake-storefront-mcp
# ~/.hermes/config.yaml
mcp_servers:
  vuluu2k-webcake-storefront-mcp:
    command: "npx"
    args: ["-y", "webcake-storefront-mcp"]
// mcp.json
{
  "mcpServers": {
    "vuluu2k-webcake-storefront-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "webcake-storefront-mcp"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 2 Aug 26 +37
    • GHSA-f88m-g3jw-g9cj affects this package: high security
    • Provenance: unverified → fail security
    • Known CVEs: unverified → fail security
    • Install scripts: unverified → pass security
    • Malware scan: unverified → pass security
    • Tool coverage: 100 → unverified functional
    • Schema quality: unverified → poor functional
    • MCP protocol: unverified → pass functional
    • Stability: unverified → 0.23 functional
    • License: unverified → pass functional
    • Dependency health: unverified → partial functional
    • Maintenance: unverified → pass functional
    • Licence: MIT functional
  • 1 Aug 26 −7
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 31 Jul 26 +2
    • Malware scan: pass → unverified security
    • Security disclosure: unverified → fail functional
    • Dependency health: partial → unverified functional
    • Tool coverage: unverified → 100 functional
  • 29 Jul 26 −20
    • Tool coverage: 100 → unverified functional
    • Security disclosure: fail → unverified functional
    • Dependency health: unverified → partial functional
    • First check of Schema quality: unverified functional
  • 27 Jul 26 45

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed npm/[email protected]

Provenance none

Ecosystem: npm · Outcome: none

Vulnerabilities 1 finding
ID CVE Severity Vector Fix available
GHSA-f88m-g3jw-g9cj high yes
Dependencies 157 packages

157 packages in the resolved dependency tree · 157 deprecated · 38 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 135 exposed · ~14,627 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens
get_page_source ~51

Get page source overview: section count, element type counts, and all custom CSS classes. Use this first, then use search_page_elements to find specific elements

NameTypeReqDescription
page_idstringyesPage ID

No output schema declared.

No examples provided.

get_page_versions ~26

View version history of a page

NameTypeReqDescription
page_idstringyesPage ID

No output schema declared.

No examples provided.

get_product ~40

Get full product details by ID: name, description, price, variations, images, attributes, SEO, etc.

NameTypeReqDescription
idstringyesProduct ID

No output schema declared.

No examples provided.

get_promotion ~44

Get full promotion details by ID: name, type, schedule, discount rules, coupon settings, items, bonus products, etc.

NameTypeReqDescription
idstringyesPromotion ID

No output schema declared.

No examples provided.

get_promotion_items ~65

Get products/variations/categories attached to a promotion. Returns items with discount details (fixed_prices, level_info, coupon_item_info)

NameTypeReqDescription
idstringyesPromotion ID
limitnumberItems per page
pagenumberPage number

No output schema declared.

No examples provided.

get_site_custom_code ~123

Get custom code of the site (CSS/JS). Two modes: - Default: returns ALL 4 code fields (full content) - With field filter: returns only the specified field(s) — saves tokens when you only need CSS or JS Add include_guide=true on first call to get the coding guide

NameTypeReqDescription
fieldsarrayOnly return specific fields (e.g. ['code_custom_css']). Omit to get all 4 fields
include_guidebooleanInclude the custom code coding guide (only needed on first call)

No output schema declared.

No examples provided.

get_site_info ~33

Get full site information: name, domain, settings (colors, typography, layout, language, payment methods, etc.)

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

get_source_cart ~34

Get all cart global sources with compact tree view. Shows full element hierarchy — no need to call get_global_source_detail separately.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

ingest_html ~59

Parse reference HTML into a structural blueprint (title, headings, paragraphs, images, buttons, colour palette) you can rebuild as BuilderX sections with new_section. Not a 1:1 clone.

NameTypeReqDescription
htmlstringyesRaw HTML to analyse

No output schema declared.

No examples provided.

ingest_url ~52

Fetch a public URL and parse it into a structural blueprint (see ingest_html). Note: client-rendered (React/Vue) pages may return little content.

NameTypeReqDescription
urlstringyesPublic page URL to analyse

No output schema declared.

No examples provided.

install_app ~174

Install (register) an application on the current site so its features become usable. For example, automations need the "automation" app installed first. App types: 0=product_review, 1=articles_review, 2=automation, 3=telegram, 4=affiliates, 5=multilingual, 6=appointment, 7=send_email, 8=botcake, 9=sale_channel, 10=product_design, 11=auth_otp, 12=personal_product_design, 14=course, 15=zalo_mini_app, 16=cms, 17=recaptcha, 18=pwa.

NameTypeReqDescription
appstringyesApp to install (by name)
is_activebooleanActivate the app on install

No output schema declared.

No examples provided.

invoke_tool ~74

Run any WebCake tool by exact name with its arguments (discover names + schemas via search_tools). Arguments are validated before running. Use this for tools that are not loaded natively.

NameTypeReqDescription
argumentsobjectArguments object matching the tool's input schema
namestringyesExact tool name (from search_tools)

No output schema declared.

No examples provided.

list_apps ~131

List the site's installed applications (type, status, settings). App type codes: 0=product_review, 1=articles_review, 2=automation, 3=telegram, 4=affiliates, 5=multilingual, 6=appointment, 7=send_email, 8=botcake, 9=sale_channel, 10=product_design, 11=auth_otp, 12=personal_product_design, 14=course, 15=zalo_mini_app, 16=cms, 17=recaptcha, 18=pwa.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

list_articles ~57

List blog articles (metadata only, without HTML content). Use get_article to get full content

NameTypeReqDescription
category_idstringFilter by category
limitnumberItems per page
pagenumberPage number

No output schema declared.

No examples provided.

list_bindings ~114

List every dynamic-data BINDING target: the datasets (product, cart_item, order, order_item, post, category, customer, customer_address, …) and their exact field names ('product::product_price', …), which page type each needs (store/member/blog), and how repeater children (grid-product, cart-items, post-list) bind per-item. Attach via new_element opts.bindings (ids auto-minted, e.g. opts.bindings=[{ target:'product::product_price' }]).

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

list_cached_results ~28

List the large results currently held in the session cache (id, label, size, age).

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

list_categories ~16

List all product categories of the site

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

list_cms_files ~26

List all CMS files (HTTP functions, cron jobs, ...) for the site

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

list_collections ~69

List all database collections (tables) for the site. Returns collection names, table names, and field counts. Use get_collection for full schema details

NameTypeReqDescription
limitnumberItems per page
pagenumberPage number
termstringSearch by collection name

No output schema declared.

No examples provided.

list_combos ~82

List all combo/bundle products of the site. Use get_combo_items for combo composition details

NameTypeReqDescription
include_guidebooleanInclude combo type reference guide
limitnumberItems per page (default: 20)
pagenumberPage number (default: 1)
termstringSearch by combo name

No output schema declared.

No examples provided.

list_customers ~107

List/search the site's customers (browse or segment). Pass `term` to search by name/phone/email. Returns name, phone, email, order_count, purchased_amount, reward_point, tags, last_order_at. Use find_customer for an exact id/phone/email lookup.

NameTypeReqDescription
limitnumberItems per page (default 50)
pagenumberPage number (default 1)
termstringKeyword — searches name / phone / email

No output schema declared.

No examples provided.

list_elements ~37

List all BuilderX element/component types you can place on a page, grouped by category with a one-line summary and whether each is a container.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

list_events ~108

List every interaction EVENT you can attach to a node: the triggers (eventName: click/hover/success/submit/…) and the actions (open_page, scroll_to, toggle, open_popup, add_to_cart, buy_now, phone_call, open_link, …) with the exact extra fields each action needs. Attach via new_element/new_section opts.events (ids are auto-minted, e.g. opts.events=[{ action:'add_to_cart', open_page:'cart' }]).

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

list_global_sections ~86

List reusable global sections (Header, Footer, shared content blocks) — SLIM summary only. Each entry: id, name, slot (header/footer/block), element count + type histogram + custom classes. The full element tree is large, so it is NOT returned here — drill in with get_global_section (compact tree), search_global_section_elements, or get_global_section_element.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

list_global_sources ~71

List global sources (cart, popup, etc.). Returns compact summary per source. Always provide component to filter by type — the API may not return all types without a filter.

NameTypeReqDescription
componentstringFilter by component type (e.g. "cart-droppable", "popup"). Recommended to always provide

No output schema declared.

No examples provided.

list_image_elements ~141

Find all image elements across pages + global sources, with element_id, current alt, src, and the field path where alt is/should be written. Use as the first step before generating alt text via vision (read_image) and writing back with set_image_alts. Note: global_sections are read-only via the API and are not included.

NameTypeReqDescription
limitnumberMax elements to return
only_missing_altbooleanReturn only elements whose alt is empty
page_idstringLimit to one page (only used when scope is 'pages' or 'all')
scopestringWhich sources to inspect

No output schema declared.

No examples provided.

list_my_sites ~58

List all sites accessible by the current account. Use this to find a site_id before switching

NameTypeReqDescription
limitnumberItems per page
pagenumberPage number
termstringSearch by site name

No output schema declared.

No examples provided.

list_orders ~81

List orders of the site (metadata only). Use get_order for full details including items

NameTypeReqDescription
limitnumberItems per page
pagenumberPage number
statusnumberFilter by status (0=pending, 50=confirmed, 100=shipping, 150=delivered, -1=cancelled)

No output schema declared.

No examples provided.

list_page_contents ~29

List multi-language contents of a page

NameTypeReqDescription
page_idstringFilter by Page ID

No output schema declared.

No examples provided.

list_page_drafts ~40

List local page drafts for the current site (summaries only: id, name, slug, type, section count, commit progress, updated_at).

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

list_pages ~21

List all pages of the site (metadata only, without source)

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

list_products ~66

List products of the site (metadata only: id, name, slug, price, image, status). Use get_product for full details

NameTypeReqDescription
limitnumberItems per page
pagenumberPage number
termstringSearch by product name

No output schema declared.

No examples provided.

list_promotions ~73

List all promotions/discounts of the site (metadata only). Use get_promotion for full details

NameTypeReqDescription
include_guidebooleanInclude promotion type reference guide
limitnumberItems per page (default: 20)
pagenumberPage number (default: 1)

No output schema declared.

No examples provided.

list_template_themes ~98

Search/list the public Webcake template marketplace (api.storecake.io). Use to match customer brief against existing templates by keyword. Returns id, name, preview_url, thumbnail, categories

NameTypeReqDescription
langstringLanguage code (default 'vi')
limitnumberItems per page (default 12)
pagenumberPage number (default 1)
qstringKeyword to search themes

No output schema declared.

No examples provided.

list_themes ~34

List all custom themes of the site. Returns theme name, colors, typographies, transitions, and which one is active

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

list_tool_groups ~40

List every WebCake tool group, how many tools it has, and whether it is loaded natively or reached on-demand via search_tools + invoke_tool.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

new_element ~132

Build a single structurally-valid element node from the real builder factory. Returns the node — edit its specials/style, then place it in a section's children.

NameTypeReqDescription
optsobjectFactory opts: { text, src, width, height, style, config, specials, events, bindings, responsive, align }. align = horizontal placement in the grid cell: 'left'|'center'|'right'|'fill' (works on any e…
typestringyesElement type (see list_elements)

No output schema declared.

No examples provided.

new_page_skeleton ~36

Return an empty but valid page source: { sections: [] }. Add sections built with new_section, then save with build_page.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

new_row ~312

Build a multi-column ROW container: children laid out SIDE BY SIDE (not stacked). This is how real pages build feature cards, category tiles, footer columns, a 2-col hero, etc. The row is RESPONSIVE — it auto-collapses to fewer columns on tablet/mobile (default tablet 2, mobile 1) so cards never become cramped slivers. Place the returned node as a child inside a section (section children still stack vertically; nest a row for horizontal layout). Example children: [{ "type":"container", "children":[{"type":"image","opts":{...}},{"type":"text","opts":{...}}] }, { ... }, { ... }]

NameTypeReqDescription
childrenarrayChild specs, one per column (laid out left-to-right)
col_widthsarrayExplicit per-column unit objects (length = #children), e.g. [{unit:'fr',value:2},{unit:'fr',value:1}]. Default: equal columns.
collapseobjectColumns to show per breakpoint, e.g. {bp3:2,bp4:1}. Default: tablet 2, mobile 1.
column_gapnumberHorizontal gap (px) between columns (default 24)
container_optsobjectOptional factory opts for the row container node itself (e.g. { style:{...} })
row_gapnumberVertical gap (px) between wrapped rows (default 24)

No output schema declared.

No examples provided.

new_section ~120

Build a complete section node with children laid out in the builder's vertical grid. Pass an array of element specs; each child is stacked top-to-bottom. Nest containers via the child's own 'children'. Example children: [{ "type":"text", "opts":{"text":"Welcome","style":{"fontSize":"40px"}} }, { "type":"button", "opts":{"text":"Shop now"} }]

NameTypeReqDescription
childrenarrayChild element specs, stacked vertically in the section
section_optsobjectOptional factory opts for the section node itself

No output schema declared.

No examples provided.

publish_site ~88

Publish the whole site live — snapshots all current page sources into the live (published) version. Note: BuilderX publishes at the SITE level, not per page; publishing makes every saved page go live. Two-step safety: dry_run=true (default) describes what will happen; dry_run=false actually publishes.

NameTypeReqDescription
dry_runbooleanPreview (true) or publish for real (false)

No output schema declared.

No examples provided.

query_collection_records ~145

Query records from a collection (custom data table) by table name. Supports paging + an optional `where` filter and `order_by` sort. (Uses the CMS api-key auth the records endpoint requires.)

NameTypeReqDescription
limitnumberItems per page
order_bystringField to sort by (e.g. 'inserted_at').
pagenumberPage number
table_namestringyesCollection table name (e.g. 'subscribers', 'custom_orders') — from get_collection.table_name
whereobjectFilter object, e.g. { status: 'active' } — matches records by field value.

No output schema declared.

No examples provided.

read_cached_result ~109

Read a slice of a large cached result produced by another tool (look for "cached":true + a cache_id in its output). Page through with offset/length; the response reports next_offset + remaining_chars until done.

NameTypeReqDescription
cache_idstringyesThe cache_id returned by the producing tool (e.g. "cache-3")
lengthnumberNumber of characters to return (default 12000)
offsetnumberStart character offset (default 0)

No output schema declared.

No examples provided.

read_image ~222

Fetch an image URL and return its bytes for vision analysis by the AI client. Pair with scan_unique_images to inspect images already on the site. After receiving the image, describe it (subject, style, palette, composition, mood, lighting, background, notable_details) to build an image-generation brief. Describe the image with these fields, useful as input for new image generation: - subject: main object / scene / person - style: photography, illustration, 3D render, flat vector, watercolor, ... - palette: 3–5 dominant colors (hex or names) - composition: layout, framing, focal point - mood: emotion or atmosphere - lighting: natural / studio / golden hour / dramatic / soft / ... - background: setting / environment - notable_details: props, textures, typography, brand elements Use these as building blocks when drafting an image-gen brief.

NameTypeReqDescription
max_size_mbnumberReject images larger than this (default 8MB)
urlstringyesAbsolute http(s) image URL

No output schema declared.

No examples provided.

read_images ~217

Batch fetch multiple image URLs in parallel. Use when comparing several references or extracting motifs across a set. Capped at 5 images per call to keep context manageable. For each image, describe subject/style/palette/composition/mood; then synthesize common themes for the brief. Describe the image with these fields, useful as input for new image generation: - subject: main object / scene / person - style: photography, illustration, 3D render, flat vector, watercolor, ... - palette: 3–5 dominant colors (hex or names) - composition: layout, framing, focal point - mood: emotion or atmosphere - lighting: natural / studio / golden hour / dramatic / soft / ... - background: setting / environment - notable_details: props, textures, typography, brand elements Use these as building blocks when drafting an image-gen brief.

NameTypeReqDescription
max_size_mbnumberPer-image size cap in MB
urlsarrayyes1–5 absolute http(s) image URLs

No output schema declared.

No examples provided.

restore_file_version ~100

Roll a CMS file back to a saved version in one step: reads the version's content and writes it back to the file. Omit version_id to restore the most recent snapshot. Tip: save_file_version on the current content first if you want an undo point.

NameTypeReqDescription
cms_file_idstringyesCMS file ID to restore
version_idstringWhich version to restore (from get_file_versions). Omit = latest snapshot.

No output schema declared.

No examples provided.

run_function ~73

Run a deployed HTTP function. function_name excludes method prefix. Example: "get_Products" → function_name="Products", method="GET"

NameTypeReqDescription
function_namestringyesFunction name without method prefix (e.g. 'Products')
methodstringHTTP method
paramsobjectParameters

No output schema declared.

No examples provided.

save_file_version ~54

Save a version snapshot of a CMS file for rollback

NameTypeReqDescription
cms_file_idstringyesCMS file ID
contentstringyesContent to save
is_publicbooleanMark as public version

No output schema declared.

No examples provided.

scan_unique_images ~172

Scan all images used across page sources, global sources, and global sections. Returns a unique list of image URLs with which elements use each one. Useful for: image audit, finding broken/duplicated CDN URLs, bulk replace planning, theme migration. Scans every string field in the source tree (config.src, style.background-image, etc.) and CSS url(...) refs — wide net catches all variants.

NameTypeReqDescription
include_relativebooleanInclude relative-path images (e.g. /uploads/...). Default only http(s) URLs
lazybooleanReturn only unique URL list, no usage tracking — faster for large sites
page_idstringLimit to one page (only used when scope is 'pages' or 'all')
scopestringWhich sources to scan

No output schema declared.

No examples provided.

search_global_section_elements ~183

Search/filter elements within a global section (Header/Footer/block) without dumping the whole tree. Filter by type, id substring, custom_class, text, or has_bind / has_events / has_custom_class.

NameTypeReqDescription
custom_classstringFilter by custom class substring
global_section_idstringyesGlobal section ID
has_bindbooleanOnly elements with data bindings
has_custom_classbooleanOnly elements with a custom class
has_eventsbooleanOnly elements with events
idstringFilter by element ID substring
limitnumberMax results (default 50)
textstringFilter by text content substring
typestringFilter by element type (e.g. 'menu', 'menu-item', 'container', 'image', 'text')

No output schema declared.

No examples provided.