Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

WebCake Storefront

NPM · WEBCAKE-STOREFRONT-MCP · 2 COMPONENTS · SCANNED SEP 20

Build pages and manage products, orders, and content on the WebCake/StoreCake storefront builder.

−1 this week 73 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security81
  • No malware found by supply-chain analysis.Pass
  • CVE check failed: a known high-severity CVE affects sharp 0.34.5, a direct dependency. A fixed version is available. View diagnostics → Fail
  • No install/post-install scripts declared.Pass
  • 40 of 158 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
Schema Quality & AI Usability78
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 16436 tokens (~121/item across 135 items; 135 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management90
  • Stability observed for 27 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 99% of tool parameters carry a description.Partial
Tool Safety25
  • Injection-marker check failed: the server instructions contains an instruction to conceal the call from the user, the text "NEVER tell the user", at byte 4675 of that field. See how to fix → Fail
  • 0 of 9 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "delete_page" implies "delete" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
  • An AI judge read all 136 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

How do I install the WebCake Storefront MCP server?

WebCake Storefront runs locally as an npm package, launched with npx -y webcake-storefront-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · webcake-storefront-mcp

# add to Claude Code
claude mcp add vuluu2k-webcake-storefront-mcp -- npx -y webcake-storefront-mcp
// .cursor/mcp.json
{
  "mcpServers": {
    "vuluu2k-webcake-storefront-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "webcake-storefront-mcp"
      ]
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "vuluu2k-webcake-storefront-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "webcake-storefront-mcp"
      ]
    }
  }
}
# add to Codex CLI
codex mcp add vuluu2k-webcake-storefront-mcp -- npx -y webcake-storefront-mcp
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "vuluu2k-webcake-storefront-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "webcake-storefront-mcp"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add vuluu2k-webcake-storefront-mcp --command npx --arg -y --arg webcake-storefront-mcp
# ~/.hermes/config.yaml
mcp_servers:
  vuluu2k-webcake-storefront-mcp:
    command: "npx"
    args: ["-y", "webcake-storefront-mcp"]
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "vuluu2k-webcake-storefront-mcp": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "webcake-storefront-mcp"
      ]
    }
  }
}
# add to Vellum
assistant mcp add vuluu2k-webcake-storefront-mcp -t stdio -c npx -a -y webcake-storefront-mcp
// mcp.json
{
  "mcpServers": {
    "vuluu2k-webcake-storefront-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "webcake-storefront-mcp"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 19 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.

  • 18 Sept 26 0
    • Security disclosure: unverified → fail functional
  • 17 Sept 26 0
    • Security disclosure: fail → unverified functional
  • 16 Sept 26 −3
    • Stability: pass → 0.77 functional
  • 15 Sept 26 +1
    • Stability: 0.97 → pass security
  • 13 Sept 26 +16
    • Malware scan: unverified → pass security
  • 11 Sept 26 −14
    • Malware scan: pass → unverified security
    • Package version: 1.31.10 → 1.31.11 functional
  • 10 Sept 26 −3
    • Stability: pass → 0.83 functional
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 20 Sept 2026 · Analysed npm/webcake-storefront-mcp@1.31.11

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem npm

Background: How many MCP packages publish verified provenance →

Vulnerabilities 2 findings
ID CVE Severity Vector Fix available
GHSA-f88m-g3jw-g9cj high yes
GHSA-rgj7-g3m4-5g8c high yes

Background: What a vulnerability scan can and cannot prove →

Dependencies 158 packages
Packages resolved 158
Stale 40
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 135 exposed · ~15,051 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
search_global_source_elements ~243

Search/filter elements within a global source. No component param needed. Examples: - Find all buttons: type="button" - Find by class: custom_class="hero" - Find text: text="subscribe" - Data-bound only: has_bind=true - With events: has_events=true - With custom class: has_custom_class=true

NameTypeReqDescription
componentstringComponent hint for faster lookup (e.g. "popup", "cart-droppable")
custom_classstringFilter by custom class substring
global_source_idstringyesGlobal source ID
has_bindbooleanOnly elements with data bindings
has_custom_classbooleanOnly elements with custom class
has_eventsbooleanOnly elements with events
idstringFilter by element ID substring (e.g. 'TEXT', 'BUTTON-3')
limitnumberMax results (default 50)
textstringFilter by text content substring
typestringFilter by element type (e.g. 'text', 'button', 'image', 'container', 'section')

No output schema declared.

No examples provided.

search_images ~187

Search stock photos (Pexels) for a page/product. IMPORTANT: the storefront only renders images served from the WebCake CDN (image domains are whitelisted) — raw Pexels URLs will NOT display. By default this re-hosts each result on the WebCake CDN and returns a ready-to-use cdn_url (cached, so repeats are free). Use cdn_url for image src / product images. Requires the PEXELS_API_KEY environment variable.

NameTypeReqDescription
orientationstringPreferred orientation
per_pagenumberHow many results (default 6)
querystringyesSubject to search, e.g. 'coffee shop interior'
uploadbooleanRe-host each result on the WebCake CDN and return cdn_url (default true — required for the image to show). Set false to only browse Pexels URLs.

No output schema declared.

No examples provided.

search_page_elements ~268

Search/filter elements within a page source. Returns matching elements with full detail (id, type, style, text, classes, etc.). Examples: - Find all buttons: type="button" - Find elements with custom class: custom_class="hero" - Find text containing "subscribe": text="subscribe" - Find all data-bound elements: has_bind=true - Find all elements with events: has_events=true - Find all elements with custom CSS classes: has_custom_class=true

NameTypeReqDescription
custom_classstringFilter by custom class substring
has_bindbooleanOnly elements with data bindings (product, category, blog)
has_custom_classbooleanOnly elements that have a custom class
has_eventsbooleanOnly elements with events (click, submit, mouseenter, etc.)
idstringFilter by element ID substring (e.g. 'TEXT', 'BUTTON-3')
limitnumberMax results (default 50)
page_idstringyesPage ID
textstringFilter by text content substring
typestringFilter by element type (e.g. 'text', 'button', 'image', 'container', 'section', 'form', 'input')

No output schema declared.

No examples provided.

search_products ~48

Search products by keyword. Returns matching products with basic info

NameTypeReqDescription
limitnumberItems per page
pagenumberPage number
termstringyesSearch keyword

No output schema declared.

No examples provided.

search_promotions ~148

Search/filter promotions with advanced filters: by type, status (coming_soon/in_progress/finished), keyword, date range

NameTypeReqDescription
is_activatedbooleanFilter by active status
limitnumberItems per page
pagenumberPage number
statusnumberFilter by time status: 1=coming_soon, 2=in_progress, 3=finished
termstringSearch by promotion name
typestringFilter by type: normal, same_price, coupon, coupon_id_multiple_times, discount_by_coupon_id, promotion_order, promotion_category, x_get_y_prod, x_get_y_category

No output schema declared.

No examples provided.

search_tools ~137

Find WebCake tools by keyword across the FULL catalog — including capabilities NOT loaded natively (marketing/CRM, translations, media, appointments, affiliate, reviews, domains/SEO/shipping, brands/tags/ribbons, courses, sale channels, automation…). Returns name, group, description and JSON input schema. Then run one with invoke_tool.

NameTypeReqDescription
groupstringRestrict to a group name (see list_tool_groups)
limitnumberMax results (default 8)
querystringyesKeywords, e.g. 'affiliate payout', 'translate product', 'add domain ssl', 'block phone'

No output schema declared.

No examples provided.

semantic_search_themes ~118

Semantic search across the theme marketplace using bge-m3 embeddings (cosine similarity). Use when the brief is a natural-language description of industry + features (e.g. 'website mỹ phẩm có popup minigame và loyalty'), not just keywords. Returns top matches with theme_id, score, name, preview_url, thumbnail, description_vi/en

NameTypeReqDescription
limitnumberNumber of matches to return (default 5, max 10)
querystringyesNatural-language description of the desired website (industry + features)

No output schema declared.

No examples provided.

set_image_alts ~113

Batch-write alt text for image elements across pages + global sources. Groups updates by source so each source is fetched + saved exactly once. Workflow: list_image_elements → read_image (per src) → describe → set_image_alts(items). If alt_path is omitted, it is auto-detected via the same probe used by list_image_elements (config.image.alt → config.alt → specials.alt).

NameTypeReqDescription
dry_runbooleanPreview the diff without saving
itemsarrayyesList of alt updates

No output schema declared.

No examples provided.

set_product_published ~53

Publish or unpublish one or more products quickly (without a full update).

NameTypeReqDescription
is_publishedbooleanyestrue = publish (visible), false = hide
product_idsarrayyesProduct ids

No output schema declared.

No examples provided.

start_page_draft ~350

Start a page draft (no network). Build a multi-section page safely: cache each section with add_draft_section, then commit_page_draft persists it to the backend INCREMENTALLY (resumable on timeout). Use this instead of build_page for large/multi-section pages. The draft cache is DISPOSABLE (Redis on the remote server when REDIS_URL is set, in-memory otherwise; sliding ~2h TTL) — if a draft is ever lost, just re-send the sections, never a failure. ONE page per site for type main (homepage) / error / maintain, and slugs are unique per site: the draft is refused up-front with the existing page_id to edit instead. Only 'custom' pages can be created over and over.

NameTypeReqDescription
is_homepagebooleanSet as the site homepage on commit
namestringyesPage name
seoobjectSEO for this page → settings.seo (applied on commit).
slugstringyesURL slug WITHOUT a leading slash, e.g. 'about', 'collections', 'cart'. A leading '/' is stripped automatically (the storefront matches the bare path segment, so '/cart' would 404). Store pages MUST u…
typestringPage kind. SPECIAL pages need a site data-source enabled on commit: store→use_store, member→use_member, blog→use_blog, error→use_error, maintain→use_maintain. 'main'/'custom' need nothing.

No output schema declared.

No examples provided.

switch_site ~69

Switch to a different site by site_id. All subsequent tool calls will target the new site. The choice is saved to local database — next session will auto-connect to this site. Use list_my_sites first to find the site_id

NameTypeReqDescription
site_idstringyesThe site ID to switch to

No output schema declared.

No examples provided.

toggle_confirm_mode ~221

Toggle update confirmation mode. Controls whether update tools ask for user confirmation before saving. - "always_confirm" (default): Shows diff first, requires user approval before saving. Safer. - "auto_apply": Applies changes immediately without preview. Faster but riskier. Current mode is saved to database and persists across sessions. Call this tool when the user says things like: → "tự động xác nhận" / "auto confirm" / "không cần hỏi" / "don't ask" / "apply directly" → mode: "auto_apply" → "hỏi trước khi lưu" / "luôn hỏi" / "always ask" / "confirm before saving" / "xác nhận trước" → mode: "always_confirm"

NameTypeReqDescription
modestringyesSet to "always_confirm" (safe) or "auto_apply" (fast). Map user intent: "tự động"/"auto"/"không cần hỏi" → auto_apply, "hỏi lại"/"confirm"/"luôn hỏi" → always_confirm

No output schema declared.

No examples provided.

toggle_debug_render ~30

Toggle debug render mode for a CMS file

NameTypeReqDescription
cms_file_idstringyesCMS file ID

No output schema declared.

No examples provided.

uninstall_app ~61

Uninstall (remove) an installed application from the current site. Pass the app's subscription id — get it from list_apps (the `id` field) or get_app.

NameTypeReqDescription
idstringyesApp subscription id (from list_apps / get_app)

No output schema declared.

No examples provided.

update_app ~108

Update an installed app's configuration. Pass the app subscription id and an `attrs` object that is merged onto the subscription — usually `{ settings: {...} }`, optionally `{ status }`. For the product-review app, prefer update_app_review (it also propagates shop_info).

NameTypeReqDescription
attrsobjectyesFields to update, e.g. { "settings": { ... }, "status": 1 }
idstringyesApp subscription id (from list_apps / get_app)

No output schema declared.

No examples provided.

update_app_review ~101

Update the product-review app's settings (e.g. shop_info, auto-approve, display options). Pass the review app's subscription id (get_app with type "product_review") and the full `settings` object.

NameTypeReqDescription
idstringyesReview app subscription id (get_app type=product_review)
settingsobjectyesReview app settings object, e.g. { "shop_info": { ... }, "auto_approve": true }

No output schema declared.

No examples provided.

update_article ~246

Update a blog article. Only the fields you pass are changed — each one becomes a command in the same dashboard pipeline create_article uses. NOTE: renaming regenerates the slug, so pass slug in the SAME call if you want a custom one (it is applied after the rename).

NameTypeReqDescription
category_idsarrayBlog category IDs to file the post under (added, existing ones are kept)
contentstringNew HTML content (replaces the old content)
idstringyesArticle ID
imagesarrayHosted image URLs; the first is the cover image
is_hiddenbooleanHide from public
namestringNew title (regenerates the slug unless slug is also passed)
published_atstringPublish date, ISO/naive datetime (render_inserted_at)
remove_category_idsarrayBlog category IDs to unfile the post from
slugstringNew custom slug
summarystringNew summary / excerpt
tagsarrayArticle TAG IDs (uuids from the blog tag list) — not free text

No output schema declared.

No examples provided.

update_auth ~99

Update authentication credentials. All values are saved to local database — next session auto-restores them. Get token and session_id from browser DevTools → Network tab → copy from any API request headers

NameTypeReqDescription
api_urlstringAPI base URL (e.g. https://api.storecake.io)
session_idstringSession ID (from x-session-id header)
tokenstringJWT Bearer token (from Authorization header)

No output schema declared.

No examples provided.

update_cms_file ~49

Update the code content of an existing CMS file

NameTypeReqDescription
contentstringyesNew code content
idstringyesCMS file ID
namestringRename file

No output schema declared.

No examples provided.

update_collection_columns ~86

Add or change a collection's custom columns. Reads the current schema, then PATCHes it with the system columns + your custom columns (the PATCH replaces the whole schema, so omitting a column drops it).

NameTypeReqDescription
collection_idstringyesCollection id (from list_collections / get_collection).
columnsarrayyesThe FULL set of custom columns the table should have.

No output schema declared.

No examples provided.

update_global_source ~118

Replace full source of a global source. IMPORTANT: Before calling this tool, you MUST: 1. Read existing source with get_global_source_detail first 2. Show the user what will change and get explicit confirmation 3. NEVER call without user approval — this replaces the ENTIRE source Safeguarded: blocks if new source is <50% of existing size. For element-level changes, prefer update_global_source_element instead.

NameTypeReqDescription
global_source_idstringyesGlobal source ID
sourceNew source configuration (JSON object)

No output schema declared.

No examples provided.

update_global_source_contents ~78

Update multilingual contents (upsert). Each entry: global_source_id, language_code, content. IMPORTANT: Before calling, you MUST read existing contents with get_global_source_contents first, then show the user what will change and get explicit confirmation. NEVER update without user approval.

NameTypeReqDescription
contentsarrayyesArray of content entries to upsert

No output schema declared.

No examples provided.

update_global_source_element ~341

Update a single element within a global source. Two-step process: STEP 1: Call with dry_run=true (default) → returns diff of what will change. STEP 2: Show the diff to the user and ask for confirmation. NEVER proceed without explicit user approval. STEP 3: Only after user confirms, call again with dry_run=false to apply. IMPORTANT: You MUST show the diff to the user and get explicit "yes/ok/confirm" before calling with dry_run=false. Skipping confirmation risks data loss. Merge rules: style/config/specials = shallow merge, responsive = merge by bp key. events/bindings = REPLACE the whole array — pass the COMPLETE list (read it first); entries are auto-normalized (id + eventName filled in).

NameTypeReqDescription
bindingsarrayComplete bindings array (replaces existing)
componentstringComponent hint for faster lookup
configobjectConfig properties to merge
dry_runbooleanPreview only (true) or apply changes (false). Defaults to confirm_mode setting. Use toggle_confirm_mode to change default.
element_idstringyesElement ID to update (e.g. 'TEXT-3', 'BUTTON-1')
eventsarrayComplete events array (replaces existing)
global_source_idstringyesGlobal source ID
responsiveobjectResponsive overrides (e.g. {bp1: {style: {...}}})
specialsobjectSpecials to merge (text, custom_class, custom_css)
styleobjectCSS style properties to merge

No output schema declared.

No examples provided.

update_global_source_elements ~195

Batch update multiple elements in one global source. Two-step process: STEP 1: Call with dry_run=true (default) → returns per-element diff. STEP 2: Show all diffs to the user and ask for confirmation. NEVER proceed without explicit user approval. STEP 3: Only after user confirms, call again with dry_run=false to apply. IMPORTANT: You MUST show the diff to the user and get explicit "yes/ok/confirm" before calling with dry_run=false. Skipping confirmation risks data loss. Same merge rules: style/config/specials = shallow merge, events/bindings = replace.

NameTypeReqDescription
componentstringComponent hint for faster lookup
dry_runbooleanPreview only (true) or apply changes (false). Defaults to confirm_mode setting.
global_source_idstringyesGlobal source ID
updatesarrayyesArray of element updates

No output schema declared.

No examples provided.

update_http_function ~77

Write the FULL HTTP function file content. Best for: writing new features, major refactors, or changes that touch multiple functions. For small targeted edits (fix one function, add one function), use edit_http_function instead. After update, auto-deploys to the bundle service

NameTypeReqDescription
contentstringyesFull JS code content

No output schema declared.

No examples provided.

update_page ~100

Update page properties (name, slug, settings, custom code)

NameTypeReqDescription
is_homepagebooleanSet as homepage
namestringNew name
page_idstringyesPage ID
settingsobjectPage settings
slugstringNew slug WITHOUT a leading slash (e.g. 'about', 'cart'). A leading '/' is stripped automatically — '/cart' would 404 on the storefront.

No output schema declared.

No examples provided.

update_page_content ~101

Create/update page content for a specific language. IMPORTANT: Before calling, you MUST read existing content with list_page_contents first, then show the user what will change and get explicit confirmation. NEVER update without user approval.

NameTypeReqDescription
contentobjectyesPage content
language_codestringyesLanguage code (e.g. 'en', 'vi')
meta_tagsarraySEO meta tags
page_idstringyesPage ID

No output schema declared.

No examples provided.

update_page_element ~377

Update properties of a specific element in page source. Two-step process: STEP 1: Call with dry_run=true (default) → returns diff of what will change. STEP 2: Show the diff to the user and ask for confirmation. NEVER proceed without explicit user approval. STEP 3: Only after user confirms, call again with dry_run=false to apply. IMPORTANT: You MUST show the diff to the user and get explicit "yes/ok/confirm" before calling with dry_run=false. Skipping confirmation risks data loss. Merge rules: style/config/specials = shallow merge, responsive = merge by bp key. events/bindings = REPLACE the whole array — pass the COMPLETE list (read it first with get_page_element so you don't drop the others); entries are auto-normalized (id + eventName filled in, so you can pass just { action, ...fields } / { target }).

NameTypeReqDescription
bindingsarrayComplete bindings array (replaces existing)
configobjectConfig properties to merge
dry_runbooleanPreview only (true) or apply changes (false). Defaults to confirm_mode setting. Use toggle_confirm_mode to change default.
element_idstringyesElement ID to update (e.g. 'TEXT-3', 'BUTTON-1')
eventsarrayComplete events array (replaces existing)
page_idstringyesPage ID
responsiveobjectResponsive breakpoint overrides (e.g. {bp1: {style: {...}, config: {...}}})
specialsobjectSpecials to merge (text, custom_class, custom_css, etc.)
styleobjectCSS style properties to merge (e.g. {color: '#fff', 'font-size': '16px'})

No output schema declared.

No examples provided.

update_page_elements ~179

Batch update multiple elements in one page. Two-step process: STEP 1: Call with dry_run=true (default) → returns per-element diff. STEP 2: Show all diffs to the user and ask for confirmation. NEVER proceed without explicit user approval. STEP 3: Only after user confirms, call again with dry_run=false to apply. IMPORTANT: You MUST show the diff to the user and get explicit "yes/ok/confirm" before calling with dry_run=false. Skipping confirmation risks data loss. Same merge rules: style/config/specials = shallow merge, events/bindings = replace.

NameTypeReqDescription
dry_runbooleanPreview only (true) or apply changes (false). Defaults to confirm_mode setting.
page_idstringyesPage ID
updatesarrayyesArray of element updates

No output schema declared.

No examples provided.

update_page_source ~128

Directly update the full page source JSON. IMPORTANT: Before calling this tool, you MUST: 1. Read existing source with get_page_source first 2. Show the user what will change and get explicit confirmation 3. NEVER call without user approval — this replaces the ENTIRE page source Safeguarded: blocks if new source is <50% of existing size.

NameTypeReqDescription
custom_codestringCustom code (CSS/JS) for this page
page_idstringyesPage ID
sourceFull page source object (sections tree) or JSON string

No output schema declared.

No examples provided.

update_product ~165

Update an existing product. Pass product_id + only the fields to change. To change price/stock, pass variations (get_product first to see the existing variation shape). Images must be hosted CDN urls (search_images cdn_url / upload_images).

NameTypeReqDescription
category_idsarrayReplace the product's categories
descriptionstringNew description (HTML allowed)
imagesarrayNew hosted image URLs; first becomes the thumbnail
is_publishedbooleanPublish/unpublish the product
namestringNew name
product_idstringyesProduct id to update
variationsarrayReplace variations (price/stock/SKU per variant). Reuse existing custom_ids from get_product to edit in place.

No output schema declared.

No examples provided.

update_product_category ~86

Update a product category (name, image, description, or visibility). Pass id + fields to change.

NameTypeReqDescription
descriptionstringNew description
hiddenbooleanHide (true) or show (false) the category
idstringyesCategory id
imagestringNew hosted image URL
namestringNew name

No output schema declared.

No examples provided.

update_site_custom_code ~179

Update custom code (CSS/JS) for the entire site. Only sends fields you specify — others remain unchanged. IMPORTANT: Before calling, you MUST read existing code with get_site_custom_code first, then show the user what will change and get explicit confirmation. NEVER update without user approval. - code_before_head: HTML/script inserted before </head> - code_before_body: HTML/script inserted before </body> - code_custom_css: Custom CSS (auto-wrapped in <style>) - code_custom_javascript: Custom JavaScript

NameTypeReqDescription
code_before_bodystringHTML/script to insert before </body>
code_before_headstringHTML/script to insert in <head>
code_custom_cssstringCustom CSS for the site
code_custom_javascriptstringCustom JavaScript for the site

No output schema declared.

No examples provided.

upload_images ~342

Convert external image URLs, data: URIs, or LOCAL FILE PATHS into site-hosted CDN URLs by reading/downloading each image and re-uploading it to the WebCake backend. Use this whenever the user supplies their OWN images (their URLs or files from their machine), or a page is built from a reference HTML/URL. The returned CDN URLs go straight into an image element's specials.src / runtime.config.src, or a product/category image. This is REQUIRED for any external image (incl. Pexels search results) because the storefront only renders whitelisted WebCake-CDN image domains. Results are cached per site, so re-uploading the same source is free. Processes up to 20 entries per call in parallel; non jpeg/png/webp inputs are converted to JPEG. UPLOADS BY DEFAULT (dry_run defaults to FALSE — this touches no account data): returns an "images" map (original source → hosted URL). Pass dry_run:true to only preview the entries that WOULD be processed (local paths report whether the file exists + its size) without any network/filesystem upload. Local file paths are only permitted when the MCP server runs locally (stdio); on the remote HTTP transport they are rejected per-entry.

NameTypeReqDescription
dry_runbooleanDefault FALSE — actually reads/downloads and uploads, returning hosted URLs. Set true to only preview what would be processed.
urlsarrayyesImage sources — 1–20 per call. Accepts: http(s) URLs, data:image/...;base64,... URIs, or local file paths (absolute /path, ~/path, file:// — stdio mode only).

No output schema declared.

No examples provided.

validate_page ~68

Validate a page source ({ sections: [...] }). Returns errors (block saving: duplicate/missing ids, missing types) and warnings (unknown types, form fields without field_name, dangling event targets) plus stats. Always run this before build_page.

NameTypeReqDescription
sourcePage source object or JSON string

No output schema declared.

No examples provided.

Common questions

What is the WebCake Storefront MCP server?

WebCake Storefront is an MCP server listed in the public MCP registry as io.github.vuluu2k/webcake-storefront-mcp. Build pages and manage products, orders, and content on the WebCake/StoreCake storefront builder. This page covers its npm package (webcake-storefront-mcp).

Is the WebCake Storefront MCP server safe to use?

WebCake Storefront scores 73 out of 100 on VerifyMCP. We recorded 2 known advisories against it as of 20 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the WebCake Storefront MCP server expose?

WebCake Storefront exposes 135 tools: get_intake_guide, get_current_context, list_my_sites, create_site, switch_site, and 130 more. Their descriptions and schemas cost roughly 15,051 tokens of context every time the server is loaded.

Is the WebCake Storefront MCP server still maintained?

WebCake Storefront is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the WebCake Storefront MCP server under?

WebCake Storefront declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.