sbuilder-mcp
io.github.vuluu2k/sbuilder-mcp · version 0.104.0 · 7,998 weekly npm downloads · audited 2026-11-03
Notes
Findings
No hidden-instruction or invisible-character findings in any tool, prompt, or resource description.
Claude Connectors Directory readiness
- ❌ Every tool has a title Missing on 38 of 38: sb_connect, sb_site_list, sb_api_find, sb_api_call and 34 more
- ✅ Every tool declares readOnlyHint or destructiveHint 38 of 38 tools
- ✅ Tool names are 64 characters or fewer All within limit
- ❌ Descriptions avoid instructions about model behavior or other tools 12 of 38 descriptions reference other tools or tell the model what it must do: sb_api_call, sb_page_open, sb_catalog_search, sb_templates and 8 more
- ✅ No hidden instructions or invisible characters in tool metadata None found
Checks the directory's published tool requirements that are visible from tools/list. Passing them does not guarantee acceptance.
What this server's tools can do
- Has delete or destructive operations:
sb_remove
Not a vulnerability by itself. It tells you what an injected prompt could ask this server to do, so you can decide which tools need approval.
Supply chain
- Install scripts: none
- npm provenance: no
- Source repository linked: yes
- License: MIT
- Direct dependencies: 3
Tools (38)
| Name | Title | Hint | Description |
|---|---|---|---|
sb_connect | read-only | Log in and list the sites this account can operate. Call this first. Reads SB_EMAIL and SB_PASSWORD from the environment unless you pass them. | |
sb_site_list | read-only | List the sites this account can operate. | |
sb_api_find | read-only | Find API operations by intent (query), or get a call sheet (id): parameters, credential, body fields and handler caveats. Reaches all 949 operations. | |
sb_api_call | destructive | Call an operation from sb_api_find (id), or a route the catalog lacks (method+path); dry run by default. pick selects fields, max_items caps lists, item_offset skips items. Lists over 60 KB say so. | |
sb_page_open | read-only | Open a page for editing and return its outline. Call before any sb_add / sb_set / sb_move / sb_remove. Find page ids with sb_api_find "list pages". Or form_id: edit that form's field document (fields, specials.formRules … | |
sb_page_repair | writes | Rename a page root that is not "ROOT" (sppro_1, rt_<hex> — left by older seeds) to ROOT, for one page or, without page_id, every page on the site. Draft only; a published page is listed for re-publishing. dry_run (defaul… | |
sb_outline | read-only | The open page as a compressed tree — id, type, name, child count, band, and whether a node is a shared global or a site overlay. Never the raw document: a real page is hundreds of KB of JSON. | |
sb_node_read | read-only | One node in full — style, config, specials, per-breakpoint overrides, bindings. | |
sb_catalog_search | read-only | Find an element type by what it does — or OMIT query to browse every type, the only way to meet one you would not have searched for. detail:true adds the AI hints, as does sb_traits_for. query "icon:<word>" lists icon na… | |
sb_traits_for | read-only | This element's INSPECTOR, as a person sees it: tabs, groups, and every control name — with what each DECLARED control writes, and the AI hints for using the element. Read this before styling an element; pass control to r… | |
sb_add | writes | Add an element — or a whole NESTED subtree — under a parent. One call builds a complete section: pass children rather than calling this once per node. | |
sb_set | writes | Write style, config or specials keys on one node, or on many through edits (one save, one live frame). Per BREAKPOINT by default; base:true writes the fallback layer, right for a value that should not vary. | |
sb_move | writes | Move a node to another parent at an index. | |
sb_remove | destructive | Remove a node and its whole subtree. | |
sb_review | read-only | What a VISITOR would meet on the open page (blank band, placeholder, dead binding) AND what stands between this store and a paid order (checkout page, gateway, delivery, a cart link). Run it before calling a page done; p… | |
sb_duplicate | writes | Copy a node and everything under it, under fresh ids, right after the original. The move a designer makes constantly — build one card, duplicate it twice. to_page_id (and to_site_id) pastes the copy onto another page ins… | |
sb_templates | read-only | The store's saved section templates — designed sections a person starts from rather than assembling one. Use sb_template_use to drop one into the open page. | |
sb_template_use | writes | Add a section template to a page, above the footer — a sb_templates row (another site's is copied in first) or one of the BUILT-IN layouts sb_templates lists, which are composed against this page's own tokens rather than… | |
sb_page_list | read-only | Every page on the site, with its slug and whether it is live. | |
sb_page_create | writes | A store type (product, category, search, blog, post, complete, account) arrives with the document the editor gives a merchant — product carries the whole bound buy box; seed:false for blank. Any other type is empty and s… | |
sb_publish | destructive | Compile the draft into the live page, and report which revision went live (id, publishedAt, fromVersionId). PUBLISH CASCADES to every page sharing a changed global section or overlay; the dry run lists them (would_cascad… | |
sb_page_state | read-only | Which of this page's three copies is which: the DRAFT the editor canvas shows, the PUBLISHED row the storefront serves, and what this session holds. Says whether the editor will render the canvas BLANK (its hydrate gate … | |
sb_page_update | writes | Edit a page's name, slug, home flag, order, SEO (merged key by key) or members_only. Reads the page first and merges `settings`, so keys it does not name survive. On a template page (product, category, post, blog, course… | |
sb_page_version | destructive | A page's platform recovery points, everyone's edits included (sb_undo covers this process only). action:"list" — named versions and autosave history; "save" {label} — snapshot the current draft; "restore" {version_id | h… | |
sb_code | destructive | The site's custom code files — tracking pixels, analytics, chat widgets, site-wide CSS — injected at head, body_start or body_end of every page (no page_id) or one page. Create infers language from the extension, placeme… | |
sb_function | destructive | Backend functions: server-side TS/JS at /_wb/fn/<slug> with the site's secrets, collections and fetch ("_" slug = importable module). Not sb_code. action: list | get | set (no id creates; id merges) | remove (id, or secr… | |
sb_live_join | writes | Join the site's live-edit room as a visible peer: every write then appears in any open editor as it happens, with the agent shown by the API key's own name rather than a person's. Always yields, so it is safe beside a hu… | |
sb_look | writes | Save, render through the platform's own renderer, and return screenshots at desktop, tablet and mobile widths, measured boxes for the bands and their children, and any layout defect measured on the render (overflow, over… | |
sb_media_list | read-only | The site's media library. Reuse an image before adding another; search by name, filter by type, page with limit/offset. | |
sb_media_upload | writes | Put an image into the media library and get its URL back, ready for sb_set. Takes a local path, a URL, or a SEARCH — `query` returns real photographs with their own descriptions, and `pick` uploads the one you chose, or … | |
sb_event | writes | Give a node a click action — open the cart, go to a page, open a pop-up. A purchase is not one: use sb_bind action. | |
sb_bind | writes | Bind a node to real store data so the page shows actual products, not placeholder text. action makes a button a purchase control. | |
sb_store | writes | Run a store flow that must happen in a fixed order. action:"checkout" makes the order form, configures it, saves its fields with this store's real payment and delivery options, then creates and PUBLISHES the checkout pag… | |
sb_theme | writes | The site's palette and type scale — the layer every element's style preset resolves from, so one token repaints every page at once. Call it with nothing to read what the site actually has. `colors` and `text_styles` PATC… | |
sb_translate | writes | Multilingual, as the editor does it. status | locales (add/remove) | page (rows: missing, done, outdated) | write (node id+field+value; registry fields only) | auto (machine-fill missing) | review (approve). | |
sb_import | writes | Read a page from any public URL and add its structure and content to the OPEN page as real elements, styled with this page's own tokens. Not a clone: the source's layout and CSS are not copied. Dry run returns what was f… | |
sb_import_site | writes | Read a WHOLE site from one URL — its sitemap, or the links on that page — and give each page found its own DRAFT page here, built from this site's tokens. Not a clone. Dry run returns the page list before anything is cre… | |
sb_undo | destructive | Put back what a write replaced — a page or form edit made here (sb_add, sb_set, sb_duplicate …), or a PUT through sb_api_call. An undo records what IT replaced, so the newest entry right after one is its redo. A page is … |
Check your own setup
npx mcpvetter scan --liveBadge
Add this to a README:
[](https://mcpvetter.com/servers/sbuilder-mcp)Publish this server?
Get the MCPVetter verified badge, a re-audit within 24 hours of every npm release, and an email whenever tools, findings, or Claude directory readiness change. $29 per server per month. You prove ownership first, free.