sbuilder-mcpBLOCK
Design and operate a Store Builder site from an AI agent — pages, data, live editing and a screenshot feedback loop, over MCP.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
An MCP stdio server that lets an AI agent operate a Store Builder site end to end — design its pages, fill them with real data, look at the result, and publish it — with no human clicking anything.
Tiếng Việt
Install
One command writes this server into every agent client on your machine:
npx -y sbuilder-mcp install --token wbk_... --api https://your-host --site site_...
It knows Claude Code, Claude Desktop, Cursor, Windsurf, VS Code and Codex, and installs into the ones it finds. Name them with --client cursor,codex, or rehearse with --dry-run. An option it does not know is refused, not ignored — a flag that silently does nothing is worse than one that does not exist.
--site is optional and worth passing: a key belongs to exactly one site, so it is written as SB_SITE and every tool then defaults to it. Without it the model has to carry the id through the session, which it can only get by listing pages and reading one back.
--site-name "Your Store" rides alongside it as SB_SITE_NAME. It is a label, never an address — nothing resolves by it — but it lets the agent say the store's name back to you instead of a 32-character id you did not choose. The Apps → AI agent screen appends it whenever the store has a name.
It merges: the servers already in those files stay, whatever it replaces is copied to .sbuilder-backup, and a config it cannot parse is refused rather than overwritten — a file with a trailing comma is far likelier than one worth discarding, and it is what you need to fix it.
The store's Apps → AI agent screen hands you this command with the key already in it.
Or configure a client by hand
{
"mcpServers": {
"sbuilder": {
"command": "npx",
"args": ["-y", "sbuilder-mcp"],
"env": { "SB_API": "https://api.your-host", "SB_TOKEN": "wbk_...", "SB_SITE": "site_..." }
}
}
}
``d9e2528c2d6cOBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add sbuilder-mcp --env SB_TOKEN=${SB_TOKEN} --env SB_PASSWORD=${SB_PASSWORD} -- npx -y [email protected]Exposed tools (37)
27 read · 9 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
sb_add | write | |
sb_api_call | read | |
sb_api_find | read | |
sb_bind | read | |
sb_catalog_search | read | |
sb_code | read | |
sb_connect | read | |
sb_duplicate | read | |
sb_event | read | |
sb_import | write | |
sb_import_site | write | |
sb_live_join | read | |
sb_look | read | |
sb_media_list | read | |
sb_media_upload | write | |
sb_move | write | |
sb_node_read | read | |
sb_outline | read | |
sb_page_create | write | |
sb_page_list | read | |
sb_page_open | read | |
sb_page_repair | read | |
sb_page_state | read | |
sb_page_update | write | |
sb_page_version | read | |
sb_publish | write | |
sb_remove | destructive | |
sb_review | read | |
sb_set | write | |
sb_site_list | read | |
sb_store | read | |
sb_template_use | read | |
sb_templates | read | |
sb_theme | read | |
sb_traits_for | read | |
sb_translate | read | |
sb_undo | read |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (2 observation(s))
- Shell
- declared (5 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (25)
correctly. A live header had `#....wb-stuck{box-shadow:...}` in its desktop lane, its transition.DS_Store
.DS_Store
'<a href="/x" style="display:block;background:#b3123a;color:#fff;border-radius:999px;padding:12px 28px">Mua ngay</a>' +
sb_remove
.DS_Store
.DS_Store
const key = join(d, 'id_rsa');
const key = join(d, 'id_rsa');
import { BASE_ONLY_CONFIG, BASE_ONLY_EXCEPTIONS } from '../../catalog/elements.generated.js';import type { Patch } from '../../core/patch.js';} from '../../core/tree.js';
import { ELEMENTS, ELEMENT_SEEDS, SATELLITE_RULES } from '../../catalog/elements.generated.js';import { walk, type DocLike } from '../../core/tree.js';'http://169.254.169.254/latest/meta-data/iam/x',
if (u.startsWith('http://public.example')) return new Response(null, { status: 302, headers: { location: 'http://169.254.169.254/x' } });uploadMedia(ctxWith(f), 's1', { url: 'http://169.254.169.254/latest/meta-data/' }),base = `http://127.0.0.1:${addr.port}`;const got = await captureMany([`${base}/a`, 'http://127.0.0.1:1/nope']);'http://169.254.169.254/latest/meta-data/iam/x',
'http://127.0.0.1/a.png',
'http://192.168.1.10/a.png',
@modelcontextprotocol/sdk, playwright-core, zod, @types/node, tsx, typescript, vitest
- The `/apps` call sheet now explains marketplace app installation as two separate questions: suggesting one is always possible on any credential (`GET /api/sites/{siteId}/apps` plus `GET /oauth/autho- sb_media_upload now accepts an API key, instead of refusing it and requiring a session; the platform's upload endpoint moved behind the same gate as sb_sites, and a 401 with a key present now report
Gates applied: no_behavioural_pass.
d9e2528c2d6cfull audit observations/trust-audit/mcp-server/vuluu2k__sbuilder-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | d9e2528c2d6c | BLOCK | D | 69 | first audit |
Questions
What is the sbuilder-mcp MCP server?
Design and operate a Store Builder site from an AI agent — pages, data, live editing and a screenshot feedback loop, over MCP.
What tools does sbuilder-mcp expose?
37 in total: 27 read-only, 9 that write, and 1 that can delete or overwrite (sb_remove). Every one is listed on this page with its risk.
Is sbuilder-mcp safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does sbuilder-mcp need?
It reads SB_PASSWORD and SB_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does sbuilder-mcp run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as sbuilder-mcp at 0.88.1.
How current is this page?
The grade is for one exact copy of the source (d9e2528c2d6c), read on 2026-10-12. The repository is watched and re-audited when it changes.