WebCake Storefront MCP (vuluu2k/webcake-storefront-mcp) is an MCP server listed on the M8ven Trust Index. It scores 63 out of 100, grade C. It declares 286 tools. No publisher has claimed this listing.

C
Caution
63/100

WebCake Storefront MCP

Enables AI assistants to build, validate, and publish storefront pages to WebCake/StoreCake sites based on natural language descriptions.

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

vuluu2k

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
🚨
Secret credentials may flow to a network call
1 flow detected: PEXELS_API_KEY. We can’t prove the destination matches the brand the credential belongs to.
⚠️
Tool descriptions don’t match what handlers do
1 tool describes read intent but its handler mutates — scan_unique_images (line 56: URL_IN_CSS_RE.exec(value))
⚠️
Known vulnerabilities in dependencies: 1 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
🔐
You'll be asked for 1 credential: WEBCAKE_TOKEN
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes286 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

get_affiliate_programs

Get the affiliate commission programs (order-level and product-level) configured for the site.

get_affiliate_statistic

Get aggregate affiliate statistics (clicks, orders, commission, payouts) for the site.

list_affiliate_products

List products enrolled in the affiliate program (with their commission settings).

list_affiliate_orders

List affiliate-attributed orders (referrals that converted).

list_affiliate_accounts

List affiliate accounts (registered affiliates / referrers).

list_affiliate_payouts

List affiliate payout requests/records.

update_affiliate_order_program

Create/update the order-level affiliate commission program. `payload` is the program object (e.g. { "is_activated": true, "commission_type": ..., "commission_value": ... }).

update_affiliate_product_program

Create/update the product-level affiliate commission program. `payload` is the program object.

upsert_affiliate_product

Enroll/update a product in the affiliate program with its own commission. `payload` includes the product id and commission fields (e.g. { "product_id": "...", "commission_type": ..., "commission_value": ... }).

delete_affiliate_products

Remove products from the affiliate program. `payload` typically { ids: [...] }.

update_affiliate_payout_status

Update the status of affiliate payout(s). `payload` typically { ids: [...], status: <code> }.

delete_affiliate_accounts

Remove affiliate accounts. `payload` typically { ids: [...] }.

update_affiliate_account

Update an affiliate account (e.g. commission rate, status). `payload` is the account object incl. its id.

list_appointment_calendars

List booking calendars (services with availability rules) for the current site.

create_appointment_calendar

Create a booking calendar. `config_weekdays`/`config_days` describe availability windows. `appointment_classifies` links service classifies by id ([{ "id": "..." }]). `assignee_id` = employee, `appointment_address_id` = location.

update_appointment_calendar

Update a booking calendar. Pass `id` plus any fields to change (same shape as create).

delete_appointment_calendars

Delete booking calendars by id.

duplicate_appointment_calendars

Duplicate booking calendars by id (creates copies).

list_appointments

List booked appointments for the current site.

list_appointment_addresses

List appointment locations/addresses.

create_appointment_address

Create an appointment location. Region ids are optional (Vietnamese geo ids).

update_appointment_address

Update an appointment location. Pass `id` plus fields to change.

delete_appointment_addresses

Delete appointment locations by id.

list_appointment_classifies

List appointment classifies (service categories/types).

create_appointment_classify

Create an appointment classify (service type).

update_appointment_classify

Update an appointment classify. Pass `id` plus fields to change.

delete_appointment_classifies

Delete appointment classifies by id.

list_appointment_employees

List appointment employees (people that appointments can be assigned to).

create_appointment_employee

Create an appointment employee (assignee).

update_appointment_employee

Update an appointment employee. Pass `id` plus fields to change.

delete_appointment_employees

Delete appointment employees by id.

get_device_templates

Get the device-template groups for the Product Design app.

create_products_from_device_templates

Create products from selected device-template groups (Product Design app).

list_ppd

List Personal Product Design assignments (products enabled for personalization).

upsert_ppd

Enable/update Personal Product Design for products (bulk).

remove_ppd

Disable Personal Product Design for the given ids.

get_ppd_variation_template

Get the per-variation print/design templates for a product (PPD app).

list_courses

List courses (Course app).

get_course

Get a course by id (tracks, downloads, etc.).

create_course

Create a course linked to a product. `tracks` are lessons; `file_downloads` are attachments. Note: video tracks trigger async HLS processing. A product can only link to one course.

update_course

Update a course by id (partial). Pass `id` plus fields to change.

delete_course

Delete a course by id (also deletes its tracks).

delete_courses

Delete multiple courses by id.

get_course_members

List members (enrolled customers) of a course.

list_apps
get_app
install_app
uninstall_app

Uninstall (remove) an installed application from the current site. Pass the app's subscription id — get it from list_apps (the `id` field) or get_app.

update_app

Update an installed app's configuration. Pass the app subscription id and an `attrs` object that is merged onto the subscription — usually `{ settings: {...} }`, optionally `{ status }`. For the product-review app, prefer update_app_review (it also propagates shop_info).

update_app_review

Update the product-review app's settings (e.g. shop_info, auto-approve, display options). Pass the review app's subscription id (get_app with type "product_review") and the full `settings` object.

list_articles

List blog articles (metadata only, without HTML content). Use get_article to get full content

get_article

Get article details by ID

create_article

Create a blog article so blog/post pages (post-list, grid-blog, post-overlay) have content. Built via the dashboard command pipeline: title + optional summary, HTML content, image URLs, and category linkage. Pass category_ids from create_blog_category / list articles' categories so the post shows up

update_article

Update a blog article

delete_article

Delete a blog article

list_automations

List the site's automations so you can find an automation_id (e.g. to call send_mail, or to trigger from an HTTP function via @webcake/app/automation sendMail). Returns each automation's id, name, status and trigger info. Filter with 'term'. The id is what send_mail / the cms automation flow needs.

create_automation

Create an automation. Checks the Automation app is installed first and installs it if needed. An automation = { name, type, status, rule }. 'rule' holds the trigger + actions (a map; shape depends on the trigger). Returns the new automation id (use it with send_mail for cms-triggered email).

update_automation

Update an automation by id. Pass only the fields to change (name, description, type, status, rule).

delete_automation

Delete one or more automations by id.

send_mail

Trigger a CMS automation to send an email (same endpoint @webcake/app/automation sendMail uses). Requires the automation_id — get it from list_automations. 'data' is the payload passed to that automation/email template.

search_images

Search stock photos (Pexels) for a page/product. IMPORTANT: the storefront only renders images served from the WebCake CDN (image domains are whitelisted) — raw Pexels URLs will NOT display. By default this re-hosts each result on the WebCake CDN and returns a ready-to-use cdn_url (cached, so repeat

upload_images

Convert external image URLs, data: URIs, or LOCAL FILE PATHS into site-hosted CDN URLs by reading/downloading each image and re-uploading it to the WebCake backend. Use this whenever the user supplies their OWN images (their URLs or files from their machine), or a page is built from a reference HTML

publish_site

Publish the whole site live — snapshots all current page sources into the live (published) version. Note: BuilderX publishes at the SITE level, not per page; publishing makes every saved page go live. Two-step safety: dry_run=true (default) describes what will happen; dry_run=false actually publishe

ingest_html

Parse reference HTML into a structural blueprint (title, headings, paragraphs, images, buttons, colour palette) you can rebuild as BuilderX sections with new_section. Not a 1:1 clone.

ingest_url

Fetch a public URL and parse it into a structural blueprint (see ingest_html). Note: client-rendered (React/Vue) pages may return little content.

get_build_guide

Get the BuilderX page authoring guide: page shape, the grid layout model, styling, breakpoints, forms/data, and the build workflow. Read this before building or heavily editing a page.

get_page_schema

Get the authoritative JSON Schema (Draft 2020-12) for a page source `{ sections: [...] }` — the structural contract for every node (id/type/specials/runtime{style,config}/children/events/bindings) in the CSS-grid model. Use it as the shape to emit; validate_page enforces the semantic rules.

list_elements

List all BuilderX element/component types you can place on a page, grouped by category with a one-line summary and whether each is a container.

get_element

Get the full detail of an element type: category, container flag, summary, an ATTRIBUTES reference (the meaningful specials/config keys + their purpose/allowed values, events, and dataset binding targets), and a live skeleton node (the authoritative default shape) you can copy and edit. Read this be

list_events

List every interaction EVENT you can attach to a node: the triggers (eventName: click/hover/success/submit/…) and the actions (open_page, scroll_to, toggle, open_popup, add_to_cart, buy_now, phone_call, open_link, …) with the exact extra fields each action needs. Attach via new_element/new_section o

list_bindings

List every dynamic-data BINDING target: the datasets (product, cart_item, order, order_item, post, category, customer, customer_address, …) and their exact field names ('product::product_price', …), which page type each needs (store/member/blog), and how repeater children (grid-product, cart-items,

new_element

Build a single structurally-valid element node from the real builder factory. Returns the node — edit its specials/style, then place it in a section's children.

new_section

Build a complete section node with children laid out in the builder's vertical grid. Pass an array of element specs; each child is stacked top-to-bottom. Nest containers via the child's own 'children'. Example children: [{ "type":"text", "opts":{"text":"Welcome","style":{"fontSize":"40px"}} }, { "ty

new_row

Build a multi-column ROW container: children laid out SIDE BY SIDE (not stacked). This is how real pages build feature cards, category tiles, footer columns, a 2-col hero, etc. The row is RESPONSIVE — it auto-collapses to fewer columns on tablet/mobile (default tablet 2, mobile 1) so cards never bec

new_page_skeleton

Return an empty but valid page source: { sections: [] }. Add sections built with new_section, then save with build_page.

validate_page

Validate a page source ({ sections: [...] }). Returns errors (block saving: duplicate/missing ids, missing types) and warnings (unknown types, form fields without field_name, dangling event targets) plus stats. Always run this before build_page.

build_page

Create a brand-new page AND set its full content source in one step. Two-step safety: call with dry_run=true (default) to validate and preview, then dry_run=false to actually create + save. The source must be { sections: [...] } — build sections with new_section. Validation errors block the real sav

add_section

Append a section to an EXISTING page's source. Reads the current source, appends your section, validates, and (when dry_run=false) saves. The section is re-id'd to avoid collisions. Build it with new_section. Two-step safety: dry_run=true (default) previews; dry_run=false saves.

list_product_brands

List product brand tags for the site.

upsert_product_brand

Create or update a product brand. Omit `id` to create; pass `is_removed:true` with an `id` to delete.

list_product_suppliers

List product supplier tags for the site.

upsert_product_supplier

Create or update a product supplier. Omit `id` to create; `is_removed:true` to delete.

list_product_tags

List product tags (paginated, searchable by name).

upsert_product_tag

Create or update a product tag. Omit `id` to create; `is_removed:true` to delete (also detaches from products).

list_ribbons

List ribbons (product sale badges) for the site.

upsert_ribbon

Create or update a ribbon (sale badge). `type` and `name` are unique per site. Omit `id` to create; `is_removed:true` to delete.

list_materials

List product materials for the site.

upsert_material

Create or update a product material. Supports nesting via parent_id. Omit `id` to create; `is_removed:true` to delete.

get_variation

Get a single product variation by its id.

get_product_measurement

Get the product measurement-unit tree (units with exchange values).

update_product_measurement

Upsert product measurement units (full list). Each unit upserts by id; pass is_removed:true to delete one.

list_blocked_phones

List blocked phone numbers (e.g. blacklisted customers).

block_phone_customers

Block customer phone numbers (upsert the given list).

unblock_all_phone_customers

Remove all blocked customer phone numbers for the site.

get_price_contact

Get the "contact for price" config. type 1 = applied to products, 2 = applied to categories.

update_price_contact

Set which products/categories are "contact for price" (full replace within the given type). type 1 → pass product_ids; type 2 → pass category_ids.

get_category

Get a single product category by id (includes custom sort product ids).

create_product

Create a product so the storefront has real merchandise (grid-product / slider-product bindings need this). Simple use: pass name + price (+ images, category_ids). One default variation with the price/stock is created for you. Advanced use: pass attributes (e.g. Color/Size) + variations for a multi-

create_product_category

Create a product category (so grid-category / a category page has something to show, and products can be filed under it). Returns the new category id — pass it to create_product's category_ids. Image must be a hosted URL.

create_blog_category

Create a blog/article category. Returns the new category id — pass it to create_article's category_id so posts are grouped (post-list / blog pages bind to it). Image must be a hosted URL.

186 further tools are not listed here. The complete surface is in the source.

// known CVEs in dependencies1 high

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

highsharp@0.34.5GHSA-f88m-g3jw-g9cj

sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configWEBCAKE_API_URLOverride a preset with / WEBCAKE_APP_URL. Optional, configured server-side:
configWEBCAKE_CONFIG_DIR
configWEBCAKE_DRAFT_TTL_MS
configWEBCAKE_ENVBase URLs come from a named environment — set (or --env) and you never type a URL:
configWEBCAKE_OAUTH
configWEBCAKE_OAUTH_ACCESS_TTL_MS
configWEBCAKE_OAUTH_REFRESH_TTL_MS
configWEBCAKE_PG_POOL_MAX
configWEBCAKE_PG_SSL
configWEBCAKE_POSTGRES_URL
configWEBCAKE_REDIS_URL
configWEBCAKE_SESSION_IDTwo values are required: WEBCAKE_TOKEN (Bearer JWT) and (sent as
configWEBCAKE_SITE_IDswitch_site (your choice is saved and reused next session), so no is needed.
configWEBCAKE_SUPPORT_EMAIL
🔐 secretWEBCAKE_TOKENTwo values are required: (Bearer JWT) and WEBCAKE_SESSION_ID (sent as
configWEBCAKE_TOOLS
Deployment configuration, supplied by whoever hosts the server. Users are not asked for these.
deployDATABASE_URL
deployPORT
deployREDIS_URL
deployWEBCAKE_APP_URL
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

286/286 tools missing one or more hints — get_affiliate_programs (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_affiliate_statistic (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); list_affiliate_products (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +283 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Descriptions match behaviour

1 tool describes read intent but its handler mutates — scan_unique_images (line 56: URL_IN_CSS_RE.exec(value))

Rename the tool, rewrite the description, or move the side-effect into a separate clearly-named tool.

Tool inputs are validated

282/286 tool handlers declare input schemas (99%)

Declare an inputSchema with zod/joi/yup on every tool definition.

Tool test coverage

Only 14/286 tools referenced in tests (5%)

Write tests that reference each tool by name so every tool has at least one test.

Production dependencies are patched

0 critical, 1 high severity in production deps — sharp@0.34.5 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Tool description accuracy

scan_unique_images: description implies read-only but handler writes/deletes/executes

Update tool descriptions to accurately reflect all capabilities — especially write, delete, or execute operations.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 7 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/vuluu2k/webcake-storefront-mcp?variant=verified)](https://m8ven.ai/mcp/vuluu2k/webcake-storefront-mcp)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: b28c296617d3eb8927f172641a76a2415e59c197
code hash: f0b18e511cab80a2f1480ce499067aca8e8c090f5368acb97a956b9d5869e913
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client