WebCake Storefront
NPM · WEBCAKE-STOREFRONT-MCP · 2 COMPONENTS · SCANNED SEP 20
Build pages and manage products, orders, and content on the WebCake/StoreCake storefront builder.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security81
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known high-severity CVE affects sharp 0.34.5, a direct dependency. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- 40 of 158 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 9 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability78
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 16436 tokens (~121/item across 135 items; 135 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management90
- Stability observed for 27 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 99% of tool parameters carry a description.Partial
Tool Safety25
- Injection-marker check failed: the server instructions contains an instruction to conceal the call from the user, the text "NEVER tell the user", at byte 4675 of that field. See how to fix → Fail
- 0 of 9 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "delete_page" implies "delete" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 136 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the WebCake Storefront MCP server?
WebCake Storefront runs locally as an npm package, launched with npx -y webcake-storefront-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · webcake-storefront-mcp
claude mcp add vuluu2k-webcake-storefront-mcp -- npx -y webcake-storefront-mcp
{
"mcpServers": {
"vuluu2k-webcake-storefront-mcp": {
"command": "npx",
"args": [
"-y",
"webcake-storefront-mcp"
]
}
}
} {
"servers": {
"vuluu2k-webcake-storefront-mcp": {
"command": "npx",
"args": [
"-y",
"webcake-storefront-mcp"
]
}
}
} codex mcp add vuluu2k-webcake-storefront-mcp -- npx -y webcake-storefront-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"vuluu2k-webcake-storefront-mcp": {
"type": "local",
"command": [
"npx",
"-y",
"webcake-storefront-mcp"
],
"enabled": true
}
}
} openclaw mcp add vuluu2k-webcake-storefront-mcp --command npx --arg -y --arg webcake-storefront-mcp
mcp_servers:
vuluu2k-webcake-storefront-mcp:
command: "npx"
args: ["-y", "webcake-storefront-mcp"] {
"McpServers": {
"vuluu2k-webcake-storefront-mcp": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"webcake-storefront-mcp"
]
}
}
} assistant mcp add vuluu2k-webcake-storefront-mcp -t stdio -c npx -a -y webcake-storefront-mcp
{
"mcpServers": {
"vuluu2k-webcake-storefront-mcp": {
"command": "npx",
"args": [
"-y",
"webcake-storefront-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 19 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 18 Sept 26 0
- Security disclosure: unverified → fail ▼ functional
- 17 Sept 26 0
- Security disclosure: fail → unverified ▼ functional
- 16 Sept 26 −3
- Stability: pass → 0.77 functional
- 15 Sept 26 +1
- Stability: 0.97 → pass security
- 13 Sept 26 +16
- Malware scan: unverified → pass ▲ security
- 11 Sept 26 −14
- Malware scan: pass → unverified ▼ security
- Package version: 1.31.10 → 1.31.11 functional
- 10 Sept 26 −3
- Stability: pass → 0.83 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/webcake-storefront-mcp@1.31.11
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Vulnerabilities 2 findings
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-f88m-g3jw-g9cj | high | yes | ||
| GHSA-rgj7-g3m4-5g8c | high | yes |
Background: What a vulnerability scan can and cannot prove →
Dependencies 158 packages
| Packages resolved | 158 |
|---|---|
| Stale | 40 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
search_global_source_elements ~243
Search/filter elements within a global source. No component param needed. Examples: - Find all buttons: type="button" - Find by class: custom_class="hero" - Find text: text="subscribe" - Data-bound only: has_bind=true - With events: has_events=true - With custom class: has_custom_class=true
| Name | Type | Req | Description |
|---|---|---|---|
| component | string | – | Component hint for faster lookup (e.g. "popup", "cart-droppable") |
| custom_class | string | – | Filter by custom class substring |
| global_source_id | string | yes | Global source ID |
| has_bind | boolean | – | Only elements with data bindings |
| has_custom_class | boolean | – | Only elements with custom class |
| has_events | boolean | – | Only elements with events |
| id | string | – | Filter by element ID substring (e.g. 'TEXT', 'BUTTON-3') |
| limit | number | – | Max results (default 50) |
| text | string | – | Filter by text content substring |
| type | string | – | Filter by element type (e.g. 'text', 'button', 'image', 'container', 'section') |
No output schema declared.
No examples provided.
search_images ~187
Search stock photos (Pexels) for a page/product. IMPORTANT: the storefront only renders images served from the WebCake CDN (image domains are whitelisted) — raw Pexels URLs will NOT display. By default this re-hosts each result on the WebCake CDN and returns a ready-to-use cdn_url (cached, so repeats are free). Use cdn_url for image src / product images. Requires the PEXELS_API_KEY environment variable.
| Name | Type | Req | Description |
|---|---|---|---|
| orientation | string | – | Preferred orientation |
| per_page | number | – | How many results (default 6) |
| query | string | yes | Subject to search, e.g. 'coffee shop interior' |
| upload | boolean | – | Re-host each result on the WebCake CDN and return cdn_url (default true — required for the image to show). Set false to only browse Pexels URLs. |
No output schema declared.
No examples provided.
search_page_elements ~268
Search/filter elements within a page source. Returns matching elements with full detail (id, type, style, text, classes, etc.). Examples: - Find all buttons: type="button" - Find elements with custom class: custom_class="hero" - Find text containing "subscribe": text="subscribe" - Find all data-bound elements: has_bind=true - Find all elements with events: has_events=true - Find all elements with custom CSS classes: has_custom_class=true
| Name | Type | Req | Description |
|---|---|---|---|
| custom_class | string | – | Filter by custom class substring |
| has_bind | boolean | – | Only elements with data bindings (product, category, blog) |
| has_custom_class | boolean | – | Only elements that have a custom class |
| has_events | boolean | – | Only elements with events (click, submit, mouseenter, etc.) |
| id | string | – | Filter by element ID substring (e.g. 'TEXT', 'BUTTON-3') |
| limit | number | – | Max results (default 50) |
| page_id | string | yes | Page ID |
| text | string | – | Filter by text content substring |
| type | string | – | Filter by element type (e.g. 'text', 'button', 'image', 'container', 'section', 'form', 'input') |
No output schema declared.
No examples provided.
search_products ~48
Search products by keyword. Returns matching products with basic info
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | – | Items per page |
| page | number | – | Page number |
| term | string | yes | Search keyword |
No output schema declared.
No examples provided.
search_promotions ~148
Search/filter promotions with advanced filters: by type, status (coming_soon/in_progress/finished), keyword, date range
| Name | Type | Req | Description |
|---|---|---|---|
| is_activated | boolean | – | Filter by active status |
| limit | number | – | Items per page |
| page | number | – | Page number |
| status | number | – | Filter by time status: 1=coming_soon, 2=in_progress, 3=finished |
| term | string | – | Search by promotion name |
| type | string | – | Filter by type: normal, same_price, coupon, coupon_id_multiple_times, discount_by_coupon_id, promotion_order, promotion_category, x_get_y_prod, x_get_y_category |
No output schema declared.
No examples provided.
search_tools ~137
Find WebCake tools by keyword across the FULL catalog — including capabilities NOT loaded natively (marketing/CRM, translations, media, appointments, affiliate, reviews, domains/SEO/shipping, brands/tags/ribbons, courses, sale channels, automation…). Returns name, group, description and JSON input schema. Then run one with invoke_tool.
| Name | Type | Req | Description |
|---|---|---|---|
| group | string | – | Restrict to a group name (see list_tool_groups) |
| limit | number | – | Max results (default 8) |
| query | string | yes | Keywords, e.g. 'affiliate payout', 'translate product', 'add domain ssl', 'block phone' |
No output schema declared.
No examples provided.
semantic_search_themes ~118
Semantic search across the theme marketplace using bge-m3 embeddings (cosine similarity). Use when the brief is a natural-language description of industry + features (e.g. 'website mỹ phẩm có popup minigame và loyalty'), not just keywords. Returns top matches with theme_id, score, name, preview_url, thumbnail, description_vi/en
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | – | Number of matches to return (default 5, max 10) |
| query | string | yes | Natural-language description of the desired website (industry + features) |
No output schema declared.
No examples provided.
set_image_alts ~113
Batch-write alt text for image elements across pages + global sources. Groups updates by source so each source is fetched + saved exactly once. Workflow: list_image_elements → read_image (per src) → describe → set_image_alts(items). If alt_path is omitted, it is auto-detected via the same probe used by list_image_elements (config.image.alt → config.alt → specials.alt).
| Name | Type | Req | Description |
|---|---|---|---|
| dry_run | boolean | – | Preview the diff without saving |
| items | array | yes | List of alt updates |
No output schema declared.
No examples provided.
set_product_published ~53
Publish or unpublish one or more products quickly (without a full update).
| Name | Type | Req | Description |
|---|---|---|---|
| is_published | boolean | yes | true = publish (visible), false = hide |
| product_ids | array | yes | Product ids |
No output schema declared.
No examples provided.
start_page_draft ~350
Start a page draft (no network). Build a multi-section page safely: cache each section with add_draft_section, then commit_page_draft persists it to the backend INCREMENTALLY (resumable on timeout). Use this instead of build_page for large/multi-section pages. The draft cache is DISPOSABLE (Redis on the remote server when REDIS_URL is set, in-memory otherwise; sliding ~2h TTL) — if a draft is ever lost, just re-send the sections, never a failure. ONE page per site for type main (homepage) / error / maintain, and slugs are unique per site: the draft is refused up-front with the existing page_id to edit instead. Only 'custom' pages can be created over and over.
| Name | Type | Req | Description |
|---|---|---|---|
| is_homepage | boolean | – | Set as the site homepage on commit |
| name | string | yes | Page name |
| seo | object | – | SEO for this page → settings.seo (applied on commit). |
| slug | string | yes | URL slug WITHOUT a leading slash, e.g. 'about', 'collections', 'cart'. A leading '/' is stripped automatically (the storefront matches the bare path segment, so '/cart' would 404). Store pages MUST u… |
| type | string | – | Page kind. SPECIAL pages need a site data-source enabled on commit: store→use_store, member→use_member, blog→use_blog, error→use_error, maintain→use_maintain. 'main'/'custom' need nothing. |
No output schema declared.
No examples provided.
switch_site ~69
Switch to a different site by site_id. All subsequent tool calls will target the new site. The choice is saved to local database — next session will auto-connect to this site. Use list_my_sites first to find the site_id
| Name | Type | Req | Description |
|---|---|---|---|
| site_id | string | yes | The site ID to switch to |
No output schema declared.
No examples provided.
toggle_confirm_mode ~221
Toggle update confirmation mode. Controls whether update tools ask for user confirmation before saving. - "always_confirm" (default): Shows diff first, requires user approval before saving. Safer. - "auto_apply": Applies changes immediately without preview. Faster but riskier. Current mode is saved to database and persists across sessions. Call this tool when the user says things like: → "tự động xác nhận" / "auto confirm" / "không cần hỏi" / "don't ask" / "apply directly" → mode: "auto_apply" → "hỏi trước khi lưu" / "luôn hỏi" / "always ask" / "confirm before saving" / "xác nhận trước" → mode: "always_confirm"
| Name | Type | Req | Description |
|---|---|---|---|
| mode | string | yes | Set to "always_confirm" (safe) or "auto_apply" (fast). Map user intent: "tự động"/"auto"/"không cần hỏi" → auto_apply, "hỏi lại"/"confirm"/"luôn hỏi" → always_confirm |
No output schema declared.
No examples provided.
toggle_debug_render ~30
Toggle debug render mode for a CMS file
| Name | Type | Req | Description |
|---|---|---|---|
| cms_file_id | string | yes | CMS file ID |
No output schema declared.
No examples provided.
uninstall_app ~61
Uninstall (remove) an installed application from the current site. Pass the app's subscription id — get it from list_apps (the `id` field) or get_app.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | App subscription id (from list_apps / get_app) |
No output schema declared.
No examples provided.
update_app ~108
Update an installed app's configuration. Pass the app subscription id and an `attrs` object that is merged onto the subscription — usually `{ settings: {...} }`, optionally `{ status }`. For the product-review app, prefer update_app_review (it also propagates shop_info).
| Name | Type | Req | Description |
|---|---|---|---|
| attrs | object | yes | Fields to update, e.g. { "settings": { ... }, "status": 1 } |
| id | string | yes | App subscription id (from list_apps / get_app) |
No output schema declared.
No examples provided.
update_app_review ~101
Update the product-review app's settings (e.g. shop_info, auto-approve, display options). Pass the review app's subscription id (get_app with type "product_review") and the full `settings` object.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Review app subscription id (get_app type=product_review) |
| settings | object | yes | Review app settings object, e.g. { "shop_info": { ... }, "auto_approve": true } |
No output schema declared.
No examples provided.
update_article ~246
Update a blog article. Only the fields you pass are changed — each one becomes a command in the same dashboard pipeline create_article uses. NOTE: renaming regenerates the slug, so pass slug in the SAME call if you want a custom one (it is applied after the rename).
| Name | Type | Req | Description |
|---|---|---|---|
| category_ids | array | – | Blog category IDs to file the post under (added, existing ones are kept) |
| content | string | – | New HTML content (replaces the old content) |
| id | string | yes | Article ID |
| images | array | – | Hosted image URLs; the first is the cover image |
| is_hidden | boolean | – | Hide from public |
| name | string | – | New title (regenerates the slug unless slug is also passed) |
| published_at | string | – | Publish date, ISO/naive datetime (render_inserted_at) |
| remove_category_ids | array | – | Blog category IDs to unfile the post from |
| slug | string | – | New custom slug |
| summary | string | – | New summary / excerpt |
| tags | array | – | Article TAG IDs (uuids from the blog tag list) — not free text |
No output schema declared.
No examples provided.
update_auth ~99
Update authentication credentials. All values are saved to local database — next session auto-restores them. Get token and session_id from browser DevTools → Network tab → copy from any API request headers
| Name | Type | Req | Description |
|---|---|---|---|
| api_url | string | – | API base URL (e.g. https://api.storecake.io) |
| session_id | string | – | Session ID (from x-session-id header) |
| token | string | – | JWT Bearer token (from Authorization header) |
No output schema declared.
No examples provided.
update_cms_file ~49
Update the code content of an existing CMS file
| Name | Type | Req | Description |
|---|---|---|---|
| content | string | yes | New code content |
| id | string | yes | CMS file ID |
| name | string | – | Rename file |
No output schema declared.
No examples provided.
update_collection_columns ~86
Add or change a collection's custom columns. Reads the current schema, then PATCHes it with the system columns + your custom columns (the PATCH replaces the whole schema, so omitting a column drops it).
| Name | Type | Req | Description |
|---|---|---|---|
| collection_id | string | yes | Collection id (from list_collections / get_collection). |
| columns | array | yes | The FULL set of custom columns the table should have. |
No output schema declared.
No examples provided.
update_global_source ~118
Replace full source of a global source. IMPORTANT: Before calling this tool, you MUST: 1. Read existing source with get_global_source_detail first 2. Show the user what will change and get explicit confirmation 3. NEVER call without user approval — this replaces the ENTIRE source Safeguarded: blocks if new source is <50% of existing size. For element-level changes, prefer update_global_source_element instead.
| Name | Type | Req | Description |
|---|---|---|---|
| global_source_id | string | yes | Global source ID |
| source | – | – | New source configuration (JSON object) |
No output schema declared.
No examples provided.
update_global_source_contents ~78
Update multilingual contents (upsert). Each entry: global_source_id, language_code, content. IMPORTANT: Before calling, you MUST read existing contents with get_global_source_contents first, then show the user what will change and get explicit confirmation. NEVER update without user approval.
| Name | Type | Req | Description |
|---|---|---|---|
| contents | array | yes | Array of content entries to upsert |
No output schema declared.
No examples provided.
update_global_source_element ~341
Update a single element within a global source. Two-step process: STEP 1: Call with dry_run=true (default) → returns diff of what will change. STEP 2: Show the diff to the user and ask for confirmation. NEVER proceed without explicit user approval. STEP 3: Only after user confirms, call again with dry_run=false to apply. IMPORTANT: You MUST show the diff to the user and get explicit "yes/ok/confirm" before calling with dry_run=false. Skipping confirmation risks data loss. Merge rules: style/config/specials = shallow merge, responsive = merge by bp key. events/bindings = REPLACE the whole array — pass the COMPLETE list (read it first); entries are auto-normalized (id + eventName filled in).
| Name | Type | Req | Description |
|---|---|---|---|
| bindings | array | – | Complete bindings array (replaces existing) |
| component | string | – | Component hint for faster lookup |
| config | object | – | Config properties to merge |
| dry_run | boolean | – | Preview only (true) or apply changes (false). Defaults to confirm_mode setting. Use toggle_confirm_mode to change default. |
| element_id | string | yes | Element ID to update (e.g. 'TEXT-3', 'BUTTON-1') |
| events | array | – | Complete events array (replaces existing) |
| global_source_id | string | yes | Global source ID |
| responsive | object | – | Responsive overrides (e.g. {bp1: {style: {...}}}) |
| specials | object | – | Specials to merge (text, custom_class, custom_css) |
| style | object | – | CSS style properties to merge |
No output schema declared.
No examples provided.
update_global_source_elements ~195
Batch update multiple elements in one global source. Two-step process: STEP 1: Call with dry_run=true (default) → returns per-element diff. STEP 2: Show all diffs to the user and ask for confirmation. NEVER proceed without explicit user approval. STEP 3: Only after user confirms, call again with dry_run=false to apply. IMPORTANT: You MUST show the diff to the user and get explicit "yes/ok/confirm" before calling with dry_run=false. Skipping confirmation risks data loss. Same merge rules: style/config/specials = shallow merge, events/bindings = replace.
| Name | Type | Req | Description |
|---|---|---|---|
| component | string | – | Component hint for faster lookup |
| dry_run | boolean | – | Preview only (true) or apply changes (false). Defaults to confirm_mode setting. |
| global_source_id | string | yes | Global source ID |
| updates | array | yes | Array of element updates |
No output schema declared.
No examples provided.
update_http_function ~77
Write the FULL HTTP function file content. Best for: writing new features, major refactors, or changes that touch multiple functions. For small targeted edits (fix one function, add one function), use edit_http_function instead. After update, auto-deploys to the bundle service
| Name | Type | Req | Description |
|---|---|---|---|
| content | string | yes | Full JS code content |
No output schema declared.
No examples provided.
update_page ~100
Update page properties (name, slug, settings, custom code)
| Name | Type | Req | Description |
|---|---|---|---|
| is_homepage | boolean | – | Set as homepage |
| name | string | – | New name |
| page_id | string | yes | Page ID |
| settings | object | – | Page settings |
| slug | string | – | New slug WITHOUT a leading slash (e.g. 'about', 'cart'). A leading '/' is stripped automatically — '/cart' would 404 on the storefront. |
No output schema declared.
No examples provided.
update_page_content ~101
Create/update page content for a specific language. IMPORTANT: Before calling, you MUST read existing content with list_page_contents first, then show the user what will change and get explicit confirmation. NEVER update without user approval.
| Name | Type | Req | Description |
|---|---|---|---|
| content | object | yes | Page content |
| language_code | string | yes | Language code (e.g. 'en', 'vi') |
| meta_tags | array | – | SEO meta tags |
| page_id | string | yes | Page ID |
No output schema declared.
No examples provided.
update_page_element ~377
Update properties of a specific element in page source. Two-step process: STEP 1: Call with dry_run=true (default) → returns diff of what will change. STEP 2: Show the diff to the user and ask for confirmation. NEVER proceed without explicit user approval. STEP 3: Only after user confirms, call again with dry_run=false to apply. IMPORTANT: You MUST show the diff to the user and get explicit "yes/ok/confirm" before calling with dry_run=false. Skipping confirmation risks data loss. Merge rules: style/config/specials = shallow merge, responsive = merge by bp key. events/bindings = REPLACE the whole array — pass the COMPLETE list (read it first with get_page_element so you don't drop the others); entries are auto-normalized (id + eventName filled in, so you can pass just { action, ...fields } / { target }).
| Name | Type | Req | Description |
|---|---|---|---|
| bindings | array | – | Complete bindings array (replaces existing) |
| config | object | – | Config properties to merge |
| dry_run | boolean | – | Preview only (true) or apply changes (false). Defaults to confirm_mode setting. Use toggle_confirm_mode to change default. |
| element_id | string | yes | Element ID to update (e.g. 'TEXT-3', 'BUTTON-1') |
| events | array | – | Complete events array (replaces existing) |
| page_id | string | yes | Page ID |
| responsive | object | – | Responsive breakpoint overrides (e.g. {bp1: {style: {...}, config: {...}}}) |
| specials | object | – | Specials to merge (text, custom_class, custom_css, etc.) |
| style | object | – | CSS style properties to merge (e.g. {color: '#fff', 'font-size': '16px'}) |
No output schema declared.
No examples provided.
update_page_elements ~179
Batch update multiple elements in one page. Two-step process: STEP 1: Call with dry_run=true (default) → returns per-element diff. STEP 2: Show all diffs to the user and ask for confirmation. NEVER proceed without explicit user approval. STEP 3: Only after user confirms, call again with dry_run=false to apply. IMPORTANT: You MUST show the diff to the user and get explicit "yes/ok/confirm" before calling with dry_run=false. Skipping confirmation risks data loss. Same merge rules: style/config/specials = shallow merge, events/bindings = replace.
| Name | Type | Req | Description |
|---|---|---|---|
| dry_run | boolean | – | Preview only (true) or apply changes (false). Defaults to confirm_mode setting. |
| page_id | string | yes | Page ID |
| updates | array | yes | Array of element updates |
No output schema declared.
No examples provided.
update_page_source ~128
Directly update the full page source JSON. IMPORTANT: Before calling this tool, you MUST: 1. Read existing source with get_page_source first 2. Show the user what will change and get explicit confirmation 3. NEVER call without user approval — this replaces the ENTIRE page source Safeguarded: blocks if new source is <50% of existing size.
| Name | Type | Req | Description |
|---|---|---|---|
| custom_code | string | – | Custom code (CSS/JS) for this page |
| page_id | string | yes | Page ID |
| source | – | – | Full page source object (sections tree) or JSON string |
No output schema declared.
No examples provided.
update_product ~165
Update an existing product. Pass product_id + only the fields to change. To change price/stock, pass variations (get_product first to see the existing variation shape). Images must be hosted CDN urls (search_images cdn_url / upload_images).
| Name | Type | Req | Description |
|---|---|---|---|
| category_ids | array | – | Replace the product's categories |
| description | string | – | New description (HTML allowed) |
| images | array | – | New hosted image URLs; first becomes the thumbnail |
| is_published | boolean | – | Publish/unpublish the product |
| name | string | – | New name |
| product_id | string | yes | Product id to update |
| variations | array | – | Replace variations (price/stock/SKU per variant). Reuse existing custom_ids from get_product to edit in place. |
No output schema declared.
No examples provided.
update_product_category ~86
Update a product category (name, image, description, or visibility). Pass id + fields to change.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | – | New description |
| hidden | boolean | – | Hide (true) or show (false) the category |
| id | string | yes | Category id |
| image | string | – | New hosted image URL |
| name | string | – | New name |
No output schema declared.
No examples provided.
update_site_custom_code ~179
Update custom code (CSS/JS) for the entire site. Only sends fields you specify — others remain unchanged. IMPORTANT: Before calling, you MUST read existing code with get_site_custom_code first, then show the user what will change and get explicit confirmation. NEVER update without user approval. - code_before_head: HTML/script inserted before </head> - code_before_body: HTML/script inserted before </body> - code_custom_css: Custom CSS (auto-wrapped in <style>) - code_custom_javascript: Custom JavaScript
| Name | Type | Req | Description |
|---|---|---|---|
| code_before_body | string | – | HTML/script to insert before </body> |
| code_before_head | string | – | HTML/script to insert in <head> |
| code_custom_css | string | – | Custom CSS for the site |
| code_custom_javascript | string | – | Custom JavaScript for the site |
No output schema declared.
No examples provided.
upload_images ~342
Convert external image URLs, data: URIs, or LOCAL FILE PATHS into site-hosted CDN URLs by reading/downloading each image and re-uploading it to the WebCake backend. Use this whenever the user supplies their OWN images (their URLs or files from their machine), or a page is built from a reference HTML/URL. The returned CDN URLs go straight into an image element's specials.src / runtime.config.src, or a product/category image. This is REQUIRED for any external image (incl. Pexels search results) because the storefront only renders whitelisted WebCake-CDN image domains. Results are cached per site, so re-uploading the same source is free. Processes up to 20 entries per call in parallel; non jpeg/png/webp inputs are converted to JPEG. UPLOADS BY DEFAULT (dry_run defaults to FALSE — this touches no account data): returns an "images" map (original source → hosted URL). Pass dry_run:true to only preview the entries that WOULD be processed (local paths report whether the file exists + its size) without any network/filesystem upload. Local file paths are only permitted when the MCP server runs locally (stdio); on the remote HTTP transport they are rejected per-entry.
| Name | Type | Req | Description |
|---|---|---|---|
| dry_run | boolean | – | Default FALSE — actually reads/downloads and uploads, returning hosted URLs. Set true to only preview what would be processed. |
| urls | array | yes | Image sources — 1–20 per call. Accepts: http(s) URLs, data:image/...;base64,... URIs, or local file paths (absolute /path, ~/path, file:// — stdio mode only). |
No output schema declared.
No examples provided.
validate_page ~68
Validate a page source ({ sections: [...] }). Returns errors (block saving: duplicate/missing ids, missing types) and warnings (unknown types, form fields without field_name, dangling event targets) plus stats. Always run this before build_page.
| Name | Type | Req | Description |
|---|---|---|---|
| source | – | – | Page source object or JSON string |
No output schema declared.
No examples provided.
What is the WebCake Storefront MCP server?
WebCake Storefront is an MCP server listed in the public MCP registry as io.github.vuluu2k/webcake-storefront-mcp. Build pages and manage products, orders, and content on the WebCake/StoreCake storefront builder. This page covers its npm package (webcake-storefront-mcp).
Is the WebCake Storefront MCP server safe to use?
WebCake Storefront scores 73 out of 100 on VerifyMCP. We recorded 2 known advisories against it as of 20 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the WebCake Storefront MCP server expose?
WebCake Storefront exposes 135 tools: get_intake_guide, get_current_context, list_my_sites, create_site, switch_site, and 130 more. Their descriptions and schemas cost roughly 15,051 tokens of context every time the server is loaded.
Is the WebCake Storefront MCP server still maintained?
WebCake Storefront is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the WebCake Storefront MCP server under?
WebCake Storefront declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.