WebCake Storefront MCP (vuluu2k/webcake-storefront-mcp) is an MCP server listed on the M8ven Trust Index. It scores 63 out of 100, grade C. It declares 286 tools. No publisher has claimed this listing.
Enables AI assistants to build, validate, and publish storefront pages to WebCake/StoreCake sites based on natural language descriptions.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
vuluu2k
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
get_affiliate_programsGet the affiliate commission programs (order-level and product-level) configured for the site.
get_affiliate_statisticGet aggregate affiliate statistics (clicks, orders, commission, payouts) for the site.
list_affiliate_productsList products enrolled in the affiliate program (with their commission settings).
list_affiliate_ordersList affiliate-attributed orders (referrals that converted).
list_affiliate_accountsList affiliate accounts (registered affiliates / referrers).
list_affiliate_payoutsList affiliate payout requests/records.
update_affiliate_order_programCreate/update the order-level affiliate commission program. `payload` is the program object (e.g. { "is_activated": true, "commission_type": ..., "commission_value": ... }).
update_affiliate_product_programCreate/update the product-level affiliate commission program. `payload` is the program object.
upsert_affiliate_productEnroll/update a product in the affiliate program with its own commission. `payload` includes the product id and commission fields (e.g. { "product_id": "...", "commission_type": ..., "commission_value": ... }).
delete_affiliate_productsRemove products from the affiliate program. `payload` typically { ids: [...] }.
update_affiliate_payout_statusUpdate the status of affiliate payout(s). `payload` typically { ids: [...], status: <code> }.
delete_affiliate_accountsRemove affiliate accounts. `payload` typically { ids: [...] }.
update_affiliate_accountUpdate an affiliate account (e.g. commission rate, status). `payload` is the account object incl. its id.
list_appointment_calendarsList booking calendars (services with availability rules) for the current site.
create_appointment_calendarCreate a booking calendar. `config_weekdays`/`config_days` describe availability windows. `appointment_classifies` links service classifies by id ([{ "id": "..." }]). `assignee_id` = employee, `appointment_address_id` = location.
update_appointment_calendarUpdate a booking calendar. Pass `id` plus any fields to change (same shape as create).
delete_appointment_calendarsDelete booking calendars by id.
duplicate_appointment_calendarsDuplicate booking calendars by id (creates copies).
list_appointmentsList booked appointments for the current site.
list_appointment_addressesList appointment locations/addresses.
create_appointment_addressCreate an appointment location. Region ids are optional (Vietnamese geo ids).
update_appointment_addressUpdate an appointment location. Pass `id` plus fields to change.
delete_appointment_addressesDelete appointment locations by id.
list_appointment_classifiesList appointment classifies (service categories/types).
create_appointment_classifyCreate an appointment classify (service type).
update_appointment_classifyUpdate an appointment classify. Pass `id` plus fields to change.
delete_appointment_classifiesDelete appointment classifies by id.
list_appointment_employeesList appointment employees (people that appointments can be assigned to).
create_appointment_employeeCreate an appointment employee (assignee).
update_appointment_employeeUpdate an appointment employee. Pass `id` plus fields to change.
delete_appointment_employeesDelete appointment employees by id.
get_device_templatesGet the device-template groups for the Product Design app.
create_products_from_device_templatesCreate products from selected device-template groups (Product Design app).
list_ppdList Personal Product Design assignments (products enabled for personalization).
upsert_ppdEnable/update Personal Product Design for products (bulk).
remove_ppdDisable Personal Product Design for the given ids.
get_ppd_variation_templateGet the per-variation print/design templates for a product (PPD app).
list_coursesList courses (Course app).
get_courseGet a course by id (tracks, downloads, etc.).
create_courseCreate a course linked to a product. `tracks` are lessons; `file_downloads` are attachments. Note: video tracks trigger async HLS processing. A product can only link to one course.
update_courseUpdate a course by id (partial). Pass `id` plus fields to change.
delete_courseDelete a course by id (also deletes its tracks).
delete_coursesDelete multiple courses by id.
get_course_membersList members (enrolled customers) of a course.
list_appsget_appinstall_appuninstall_appUninstall (remove) an installed application from the current site. Pass the app's subscription id — get it from list_apps (the `id` field) or get_app.
update_appUpdate an installed app's configuration. Pass the app subscription id and an `attrs` object that is merged onto the subscription — usually `{ settings: {...} }`, optionally `{ status }`. For the product-review app, prefer update_app_review (it also propagates shop_info).
update_app_reviewUpdate the product-review app's settings (e.g. shop_info, auto-approve, display options). Pass the review app's subscription id (get_app with type "product_review") and the full `settings` object.
list_articlesList blog articles (metadata only, without HTML content). Use get_article to get full content
get_articleGet article details by ID
create_articleCreate a blog article so blog/post pages (post-list, grid-blog, post-overlay) have content. Built via the dashboard command pipeline: title + optional summary, HTML content, image URLs, and category linkage. Pass category_ids from create_blog_category / list articles' categories so the post shows up…
update_articleUpdate a blog article
delete_articleDelete a blog article
list_automationsList the site's automations so you can find an automation_id (e.g. to call send_mail, or to trigger from an HTTP function via @webcake/app/automation sendMail). Returns each automation's id, name, status and trigger info. Filter with 'term'. The id is what send_mail / the cms automation flow needs.
create_automationCreate an automation. Checks the Automation app is installed first and installs it if needed. An automation = { name, type, status, rule }. 'rule' holds the trigger + actions (a map; shape depends on the trigger). Returns the new automation id (use it with send_mail for cms-triggered email).
update_automationUpdate an automation by id. Pass only the fields to change (name, description, type, status, rule).
delete_automationDelete one or more automations by id.
send_mailTrigger a CMS automation to send an email (same endpoint @webcake/app/automation sendMail uses). Requires the automation_id — get it from list_automations. 'data' is the payload passed to that automation/email template.
search_imagesSearch stock photos (Pexels) for a page/product. IMPORTANT: the storefront only renders images served from the WebCake CDN (image domains are whitelisted) — raw Pexels URLs will NOT display. By default this re-hosts each result on the WebCake CDN and returns a ready-to-use cdn_url (cached, so repeat…
upload_imagesConvert external image URLs, data: URIs, or LOCAL FILE PATHS into site-hosted CDN URLs by reading/downloading each image and re-uploading it to the WebCake backend. Use this whenever the user supplies their OWN images (their URLs or files from their machine), or a page is built from a reference HTML…
publish_sitePublish the whole site live — snapshots all current page sources into the live (published) version. Note: BuilderX publishes at the SITE level, not per page; publishing makes every saved page go live. Two-step safety: dry_run=true (default) describes what will happen; dry_run=false actually publishe…
ingest_htmlParse reference HTML into a structural blueprint (title, headings, paragraphs, images, buttons, colour palette) you can rebuild as BuilderX sections with new_section. Not a 1:1 clone.
ingest_urlFetch a public URL and parse it into a structural blueprint (see ingest_html). Note: client-rendered (React/Vue) pages may return little content.
get_build_guideGet the BuilderX page authoring guide: page shape, the grid layout model, styling, breakpoints, forms/data, and the build workflow. Read this before building or heavily editing a page.
get_page_schemaGet the authoritative JSON Schema (Draft 2020-12) for a page source `{ sections: [...] }` — the structural contract for every node (id/type/specials/runtime{style,config}/children/events/bindings) in the CSS-grid model. Use it as the shape to emit; validate_page enforces the semantic rules.
list_elementsList all BuilderX element/component types you can place on a page, grouped by category with a one-line summary and whether each is a container.
get_elementGet the full detail of an element type: category, container flag, summary, an ATTRIBUTES reference (the meaningful specials/config keys + their purpose/allowed values, events, and dataset binding targets), and a live skeleton node (the authoritative default shape) you can copy and edit. Read this be…
list_eventsList every interaction EVENT you can attach to a node: the triggers (eventName: click/hover/success/submit/…) and the actions (open_page, scroll_to, toggle, open_popup, add_to_cart, buy_now, phone_call, open_link, …) with the exact extra fields each action needs. Attach via new_element/new_section o…
list_bindingsList every dynamic-data BINDING target: the datasets (product, cart_item, order, order_item, post, category, customer, customer_address, …) and their exact field names ('product::product_price', …), which page type each needs (store/member/blog), and how repeater children (grid-product, cart-items, …
new_elementBuild a single structurally-valid element node from the real builder factory. Returns the node — edit its specials/style, then place it in a section's children.
new_sectionBuild a complete section node with children laid out in the builder's vertical grid. Pass an array of element specs; each child is stacked top-to-bottom. Nest containers via the child's own 'children'. Example children: [{ "type":"text", "opts":{"text":"Welcome","style":{"fontSize":"40px"}} }, { "ty…
new_rowBuild a multi-column ROW container: children laid out SIDE BY SIDE (not stacked). This is how real pages build feature cards, category tiles, footer columns, a 2-col hero, etc. The row is RESPONSIVE — it auto-collapses to fewer columns on tablet/mobile (default tablet 2, mobile 1) so cards never bec…
new_page_skeletonReturn an empty but valid page source: { sections: [] }. Add sections built with new_section, then save with build_page.
validate_pageValidate a page source ({ sections: [...] }). Returns errors (block saving: duplicate/missing ids, missing types) and warnings (unknown types, form fields without field_name, dangling event targets) plus stats. Always run this before build_page.
build_pageCreate a brand-new page AND set its full content source in one step. Two-step safety: call with dry_run=true (default) to validate and preview, then dry_run=false to actually create + save. The source must be { sections: [...] } — build sections with new_section. Validation errors block the real sav…
add_sectionAppend a section to an EXISTING page's source. Reads the current source, appends your section, validates, and (when dry_run=false) saves. The section is re-id'd to avoid collisions. Build it with new_section. Two-step safety: dry_run=true (default) previews; dry_run=false saves.
list_product_brandsList product brand tags for the site.
upsert_product_brandCreate or update a product brand. Omit `id` to create; pass `is_removed:true` with an `id` to delete.
list_product_suppliersList product supplier tags for the site.
upsert_product_supplierCreate or update a product supplier. Omit `id` to create; `is_removed:true` to delete.
list_product_tagsList product tags (paginated, searchable by name).
upsert_product_tagCreate or update a product tag. Omit `id` to create; `is_removed:true` to delete (also detaches from products).
list_ribbonsList ribbons (product sale badges) for the site.
upsert_ribbonCreate or update a ribbon (sale badge). `type` and `name` are unique per site. Omit `id` to create; `is_removed:true` to delete.
list_materialsList product materials for the site.
upsert_materialCreate or update a product material. Supports nesting via parent_id. Omit `id` to create; `is_removed:true` to delete.
get_variationGet a single product variation by its id.
get_product_measurementGet the product measurement-unit tree (units with exchange values).
update_product_measurementUpsert product measurement units (full list). Each unit upserts by id; pass is_removed:true to delete one.
list_blocked_phonesList blocked phone numbers (e.g. blacklisted customers).
block_phone_customersBlock customer phone numbers (upsert the given list).
unblock_all_phone_customersRemove all blocked customer phone numbers for the site.
get_price_contactGet the "contact for price" config. type 1 = applied to products, 2 = applied to categories.
update_price_contactSet which products/categories are "contact for price" (full replace within the given type). type 1 → pass product_ids; type 2 → pass category_ids.
get_categoryGet a single product category by id (includes custom sort product ids).
create_productCreate a product so the storefront has real merchandise (grid-product / slider-product bindings need this). Simple use: pass name + price (+ images, category_ids). One default variation with the price/stock is created for you. Advanced use: pass attributes (e.g. Color/Size) + variations for a multi-…
create_product_categoryCreate a product category (so grid-category / a category page has something to show, and products can be filed under it). Returns the new category id — pass it to create_product's category_ids. Image must be a hosted URL.
create_blog_categoryCreate a blog/article category. Returns the new category id — pass it to create_article's category_id so posts are grouped (post-list / blog pages bind to it). Image must be a hosted URL.
186 further tools are not listed here. The complete surface is in the source.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591
WEBCAKE_API_URLOverride a preset with / WEBCAKE_APP_URL. Optional, configured server-side:WEBCAKE_CONFIG_DIRWEBCAKE_DRAFT_TTL_MSWEBCAKE_ENVBase URLs come from a named environment — set (or --env) and you never type a URL:WEBCAKE_OAUTHWEBCAKE_OAUTH_ACCESS_TTL_MSWEBCAKE_OAUTH_REFRESH_TTL_MSWEBCAKE_PG_POOL_MAXWEBCAKE_PG_SSLWEBCAKE_POSTGRES_URLWEBCAKE_REDIS_URLWEBCAKE_SESSION_IDTwo values are required: WEBCAKE_TOKEN (Bearer JWT) and (sent asWEBCAKE_SITE_IDswitch_site (your choice is saved and reused next session), so no is needed.WEBCAKE_SUPPORT_EMAILWEBCAKE_TOKENTwo values are required: (Bearer JWT) and WEBCAKE_SESSION_ID (sent asWEBCAKE_TOOLSDATABASE_URLPORTREDIS_URLWEBCAKE_APP_URLTool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
286/286 tools missing one or more hints — get_affiliate_programs (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_affiliate_statistic (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); list_affiliate_products (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +283 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Descriptions match behaviour
1 tool describes read intent but its handler mutates — scan_unique_images (line 56: URL_IN_CSS_RE.exec(value))
Rename the tool, rewrite the description, or move the side-effect into a separate clearly-named tool.
Tool inputs are validated
282/286 tool handlers declare input schemas (99%)
Declare an inputSchema with zod/joi/yup on every tool definition.
Tool test coverage
Only 14/286 tools referenced in tests (5%)
Write tests that reference each tool by name so every tool has at least one test.
Production dependencies are patched
0 critical, 1 high severity in production deps — sharp@0.34.5 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Tool description accuracy
scan_unique_images: description implies read-only but handler writes/deletes/executes
Update tool descriptions to accurately reflect all capabilities — especially write, delete, or execute operations.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/vuluu2k/webcake-storefront-mcp)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check