ModelsAtlas
Explore
Atlas / MCP servers / webflow / Webflow

WebflowSAFE

mcp/webflow/webflow-3
MCP server by webflow · built with fern · business critical yes · generated from openapi · Audited 2026-10-07
⚑ Report / re-scanSource ↗

Model Context Protocol (MCP) server for the Webflow Data API.

Verdict
SAFE
Grade
B
Trust score
89 /100
Exposed tools
23 23r · 0w · 0d
Transport
stdio · streamable-http
License
MIT
Stars
140
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

A Node.js server implementing Model Context Protocol (MCP) for Webflow using the Webflow JavaScript SDK. Enable AI agents to interact with Webflow APIs. Learn more about Webflow's Data API in the developer documentation.

[](https://www.npmjs.com/package/webflow-mcp-server)

Prerequisites

🚀 Remote installation

Get started by installing Webflow's remote MCP server. The remote server uses OAuth to authenticate with your Webflow sites, and a companion app that syncs your live canvas with your AI agent.

Requirements

  • Node.js 22.3.0 or higher
Note: The MCP server currently supports Node.js 22.3.0 or higher. If you run into version issues, see the Node.js compatibility guidance.

Cursor

Add MCP server to Cursor

  1. Go to Settings → Cursor Settings → MCP & Integrations.
  2. Under MCP Tools, click + New MCP Server.
  3. Paste the following configuration into .cursor/mcp.json (or add the webflow part to your existing configuration):
{
"mcpServers": {
"webflow": {
"url": "https://mcp.webflow.com/sse"
}
}
}
Tip: You can create a project-level mcp.json to avoid repeated auth prompts across multiple Cursor windows. See Cursor’s docs on configuration locations.
  1. Save and close the file. Cursor will automatically open an OAuth login page where you can authorize Webflow sites to
Read from source at commit 3f8e661c6b0cOBSERVED · 2026-10-07
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code
claude mcp add webflow-mcp-server --env WEBFLOW_TOKEN=${WEBFLOW_TOKEN} -- npx -y [email protected]
claude-desktop
{
  "mcpServers": {
    "webflow-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "WEBFLOW_TOKEN": "${WEBFLOW_TOKEN}"
      }
    }
  }
}
03

Exposed tools (23)

23 read · 0 write · 0 destructive.

ToolRiskDescription
ask_webflow_airead
asset_toolread
component_builderread
data_cms_toolread
data_comments_toolread
data_components_toolread
data_enterprise_toolread
data_pages_toolread
data_scripts_toolread
data_sites_toolread
data_webhook_toolread
data_workflows_toolread
de_component_toolread
de_page_toolread
element_builderread
element_snapshot_toolread
element_toolread
get_designer_app_connection_inforead
get_image_previewread
style_toolread
variable_toolread
webflow_guide_toolread
whtml_builderread
04

Trust audit

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codePASS
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
declared (4 observation(s))
Shell
none-observed
Dependencies
not all pinned
Secrets in source
none-found

Findings (1)

LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
cors, express, socket.io, @types/cors, @types/express, @types/node, concurrently, nodemon
Why it matters. 10 dependency range(s) float
Fix. pin exact versions or ship a lockfile

Gates applied: no_behavioural_pass.

Audited 2026-10-07 · audit v0.4.1 · source sha 3f8e661c6b0cfull audit observations/trust-audit/mcp-server/webflow__webflow-3.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-073f8e661c6b0cSAFEB89first audit
06

Questions

What is the Webflow MCP server?

Model Context Protocol (MCP) server for the Webflow Data API.

What tools does Webflow expose?

23 in total: 23 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is Webflow safe to connect to an agent?

The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.

What credentials does Webflow need?

It reads WEBFLOW_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does Webflow run?

It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as webflow-mcp-server at 1.0.1.

How current is this page?

The grade is for one exact copy of the source (3f8e661c6b0c), read on 2026-10-07. The repository is watched and re-audited when it changes.

Advertisement