Atlas / MCP servers / vuluu2k / sbuilder-mcp

sbuilder-mcpBLOCK

mcp/vuluu2k/sbuilder-mcp

Design and operate a Store Builder site from an AI agent — pages, data, live editing and a screenshot feedback loop, over MCP.

Verdict
BLOCK
Grade
D
Trust score
69 /100
Exposed tools
37 27r · 9w · 1d
Transport
stdio
License
MIT
Stars
0
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

An MCP stdio server that lets an AI agent operate a Store Builder site end to end — design its pages, fill them with real data, look at the result, and publish it — with no human clicking anything.

Tiếng Việt

Install

One command writes this server into every agent client on your machine:

npx -y sbuilder-mcp install --token wbk_... --api https://your-host --site site_...

It knows Claude Code, Claude Desktop, Cursor, Windsurf, VS Code and Codex, and installs into the ones it finds. Name them with --client cursor,codex, or rehearse with --dry-run. An option it does not know is refused, not ignored — a flag that silently does nothing is worse than one that does not exist.

--site is optional and worth passing: a key belongs to exactly one site, so it is written as SB_SITE and every tool then defaults to it. Without it the model has to carry the id through the session, which it can only get by listing pages and reading one back.

--site-name "Your Store" rides alongside it as SB_SITE_NAME. It is a label, never an address — nothing resolves by it — but it lets the agent say the store's name back to you instead of a 32-character id you did not choose. The Apps → AI agent screen appends it whenever the store has a name.

It merges: the servers already in those files stay, whatever it replaces is copied to .sbuilder-backup, and a config it cannot parse is refused rather than overwritten — a file with a trailing comma is far likelier than one worth discarding, and it is what you need to fix it.

The store's Apps → AI agent screen hands you this command with the key already in it.

Or configure a client by hand

{
"mcpServers": {
"sbuilder": {
"command": "npx",
"args": ["-y", "sbuilder-mcp"],
"env": { "SB_API": "https://api.your-host", "SB_TOKEN": "wbk_...", "SB_SITE": "site_..." }
}
}
}
``
Read from source at commit d9e2528c2d6cOBSERVED · 2026-10-12
Advertisement
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code (npm)
claude mcp add sbuilder-mcp --env SB_TOKEN=${SB_TOKEN} --env SB_PASSWORD=${SB_PASSWORD} -- npx -y [email protected]
03

Exposed tools (37)

27 read · 9 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

ToolRiskDescription
sb_addwrite
sb_api_callread
sb_api_findread
sb_bindread
sb_catalog_searchread
sb_coderead
sb_connectread
sb_duplicateread
sb_eventread
sb_importwrite
sb_import_sitewrite
sb_live_joinread
sb_lookread
sb_media_listread
sb_media_uploadwrite
sb_movewrite
sb_node_readread
sb_outlineread
sb_page_createwrite
sb_page_listread
sb_page_openread
sb_page_repairread
sb_page_stateread
sb_page_updatewrite
sb_page_versionread
sb_publishwrite
sb_removedestructive
sb_reviewread
sb_setwrite
sb_site_listread
sb_storeread
sb_template_useread
sb_templatesread
sb_themeread
sb_traits_forread
sb_translateread
sb_undoread
04

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryWARN
L1Static analysis of the codePASS
L2Instruction surface (what it tells the agent)FAIL
L3Class-specific surfaceWARN
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (1 observation(s))
Network
declared (2 observation(s))
Shell
declared (5 observation(s))
Dependencies
not all pinned
Secrets in source
none-found

Findings (25)

HIGHPrompt injection · prompt.zero_width · CWE-94, CWE-1427
.claude/skills/sbuilder-document-model/SKILL.md:420
correctly. A live header had `#....wb-stuck{box-shadow:...}` in its desktop lane, its transition
Why it matters. invisible characters in instruction text
Fix. strip non-printing characters
MEDIUMInventory / provenance · inv.binary · CWE-1104
.DS_Store
.DS_Store
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
src/.DS_Store
.DS_Store
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMPrompt injection · prompt.hidden_style · CWE-94, CWE-1427
docs/superpowers/plans/2026-09-12-source-tokens.md:139
'<a href="/x" style="display:block;background:#b3123a;color:#fff;border-radius:999px;padding:12px 28px">Mua ngay</a>' +
MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59
sb_remove
Why it matters. 1 tool(s) can delete or overwrite
Fix. prefer a read-only mode or scoped tokens; the page states the blast radius
LOWInventory / provenance · inv.hidden_file · CWE-1104
.DS_Store
.DS_Store
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
src/.DS_Store
.DS_Store
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWFilesystem / path · fs.credential_store · CWE-22, CWE-59
test/api-call-store.test.ts:306
const key = join(d, 'id_rsa');
Why it matters. touches a credential store
LOWFilesystem / path · fs.credential_store · CWE-22, CWE-59
test/localfile.test.ts:20
const key = join(d, 'id_rsa');
Why it matters. touches a credential store
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/domains/site/baseonly.ts:1
import { BASE_ONLY_CONFIG, BASE_ONLY_EXCEPTIONS } from '../../catalog/elements.generated.js';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/domains/site/builder.ts:1
import type { Patch } from '../../core/patch.js';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/domains/site/builder.ts:10
} from '../../core/tree.js';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/domains/site/builder.ts:11
import { ELEMENTS, ELEMENT_SEEDS, SATELLITE_RULES } from '../../catalog/elements.generated.js';
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/domains/site/cartlang.ts:1
import { walk, type DocLike } from '../../core/tree.js';
LOWNetwork egress · net.metadata_ip · CWE-200, CWE-319
test/localfile.test.ts:49
'http://169.254.169.254/latest/meta-data/iam/x',
Why it matters. cloud metadata endpoint: the classic SSRF credential grab
LOWNetwork egress · net.metadata_ip · CWE-200, CWE-319
test/localfile.test.ts:76
if (u.startsWith('http://public.example')) return new Response(null, { status: 302, headers: { location: 'http://169.254.169.254/x' } });
Why it matters. cloud metadata endpoint: the classic SSRF credential grab
LOWNetwork egress · net.metadata_ip · CWE-200, CWE-319
test/media.test.ts:372
uploadMedia(ctxWith(f), 's1', { url: 'http://169.254.169.254/latest/meta-data/' }),
Why it matters. cloud metadata endpoint: the classic SSRF credential grab
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
test/import.test.ts:1161
base = `http://127.0.0.1:${addr.port}`;
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
test/import.test.ts:1195
const got = await captureMany([`${base}/a`, 'http://127.0.0.1:1/nope']);
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
test/localfile.test.ts:49
'http://169.254.169.254/latest/meta-data/iam/x',
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
test/localfile.test.ts:51
'http://127.0.0.1/a.png',
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
test/localfile.test.ts:52
'http://192.168.1.10/a.png',
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
@modelcontextprotocol/sdk, playwright-core, zod, @types/node, tsx, typescript, vitest
Why it matters. 7 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
CHANGELOG.md:767
- The `/apps` call sheet now explains marketplace app installation as two separate questions: suggesting one is always possible on any credential (`GET /api/sites/{siteId}/apps` plus `GET /oauth/autho
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine
LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
CHANGELOG.md:1248
- sb_media_upload now accepts an API key, instead of refusing it and requiring a session; the platform's upload endpoint moved behind the same gate as sb_sites, and a 401 with a key present now report
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine

Gates applied: no_behavioural_pass.

Audited 2026-10-12 · audit v0.4.1 · source sha d9e2528c2d6cfull audit observations/trust-audit/mcp-server/vuluu2k__sbuilder-mcp.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-12d9e2528c2d6cBLOCKD69first audit
06

Questions

What is the sbuilder-mcp MCP server?

Design and operate a Store Builder site from an AI agent — pages, data, live editing and a screenshot feedback loop, over MCP.

What tools does sbuilder-mcp expose?

37 in total: 27 read-only, 9 that write, and 1 that can delete or overwrite (sb_remove). Every one is listed on this page with its risk.

Is sbuilder-mcp safe to connect to an agent?

No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does sbuilder-mcp need?

It reads SB_PASSWORD and SB_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does sbuilder-mcp run?

It speaks stdio, so it runs as a local process your client starts. It is published on npm as sbuilder-mcp at 0.88.1.

How current is this page?

The grade is for one exact copy of the source (d9e2528c2d6c), read on 2026-10-12. The repository is watched and re-audited when it changes.

Advertisement