sfcc-dev-mcp 1.0.15 → 1.0.19

package/docs-site-v2/public/llms.txt

@@ -0,0 +1,44 @@
+# SFCC Development MCP Server
+
+> A comprehensive Model Context Protocol (MCP) server that provides AI assistants with direct access to Salesforce B2C Commerce Cloud development tools, documentation, curated agent skills, and real-time debugging capabilities.
+
+This server bridges the gap between AI assistants and SFCC development workflows, offering both documentation-only mode (no credentials required) and full mode (with live SFCC instance access). It provides a broad tool surface across documentation, log analysis, system objects, cartridge generation, and script debugging.
+
+Key architectural principles:
+- **Capability-gated**: Tools requiring SFCC credentials are only exposed when valid configuration is provided
+- **Modular handlers**: Clean separation between tool routing and domain logic
+- **Dependency injection**: Testable architecture with service abstractions
+- **Performance optimized**: Efficient caching and range request optimization for log analysis
+
+## Core Documentation
+
+- [Getting Started](https://sfcc-mcp-dev.rhino-inquisitor.com/guide/): Introduction and modes
+- [AI Interface Setup](https://sfcc-mcp-dev.rhino-inquisitor.com/guide/ai-interfaces/): Platform-specific setup for Copilot, Claude, and Cursor
+- [Configuration Guide](https://sfcc-mcp-dev.rhino-inquisitor.com/guide/configuration/): dw.json, environment variables, and auto-discovery
+- [Features Overview](https://sfcc-mcp-dev.rhino-inquisitor.com/features/): Complete feature breakdown
+- [Tools Catalog](https://sfcc-mcp-dev.rhino-inquisitor.com/tools/): All tools organized by category with examples
+- [Examples](https://sfcc-mcp-dev.rhino-inquisitor.com/examples/): Practical prompts and workflows
+- [Script Debugger](https://sfcc-mcp-dev.rhino-inquisitor.com/script-debugger/): Sandbox evaluation via debugger API
+- [Skills](https://sfcc-mcp-dev.rhino-inquisitor.com/skills/): Bundled skills and instruction packs
+- [Security](https://sfcc-mcp-dev.rhino-inquisitor.com/security/): Credential and data handling guidance
+- [Development Guide](https://sfcc-mcp-dev.rhino-inquisitor.com/development/): Architecture, testing, and contribution workflow
+- [Troubleshooting](https://sfcc-mcp-dev.rhino-inquisitor.com/troubleshooting/): Common issues and fixes
+
+## Tool Categories
+
+- **SFCC Documentation Tools**: Class information, method search, and namespace exploration
+- **SFRA Documentation Tools**: Enhanced Storefront Reference Architecture docs
+- **ISML Documentation Tools**: ISML element reference and search
+- **Agent Instruction Tools**: Sync AGENTS.md + bundled skills into a workspace
+- **Log & Job Log Tools**: Log search, summaries, and job execution debugging
+- **System Object Tools**: Attribute discovery and site preference management
+- **Cartridge Generation Tools**: Cartridge and project scaffolding
+- **Code Version Tools**: Listing and activation
+- **Script Debugger Tools**: Execute JavaScript on sandbox instances
+
+## Optional
+
+- [GitHub Repository](https://github.com/taurgis/sfcc-dev-mcp)
+- [NPM Package](https://www.npmjs.com/package/sfcc-dev-mcp)
+- [CHANGELOG](https://github.com/taurgis/sfcc-dev-mcp/blob/main/CHANGELOG.md)
+- [Contributing Guidelines](https://github.com/taurgis/sfcc-dev-mcp/blob/main/CONTRIBUTING.md)

package/docs-site-v2/public/logo-dark.svg

@@ -0,0 +1,8 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="160" height="160" viewBox="0 0 160 160" role="img" aria-label="SFCC MCP">
+  <rect x="18" y="18" width="124" height="124" rx="28" fill="none" stroke="#FFFFFF" stroke-width="10" />
+  <rect x="44" y="60" width="18" height="56" rx="8" fill="#FFFFFF" />
+  <rect x="71" y="44" width="18" height="84" rx="8" fill="#FFFFFF" />
+  <rect x="98" y="70" width="18" height="46" rx="8" fill="#FFFFFF" />
+  <circle cx="53" cy="52" r="6" fill="#FFFFFF" />
+  <circle cx="107" cy="52" r="6" fill="#FFFFFF" />
+</svg>

package/docs-site-v2/public/logo.svg

@@ -0,0 +1,8 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="160" height="160" viewBox="0 0 160 160" role="img" aria-label="SFCC MCP">
+  <rect x="18" y="18" width="124" height="124" rx="28" fill="none" stroke="currentColor" stroke-width="10" />
+  <rect x="44" y="60" width="18" height="56" rx="8" fill="currentColor" />
+  <rect x="71" y="44" width="18" height="84" rx="8" fill="currentColor" />
+  <rect x="98" y="70" width="18" height="46" rx="8" fill="currentColor" />
+  <circle cx="53" cy="52" r="6" fill="currentColor" />
+  <circle cx="107" cy="52" r="6" fill="currentColor" />
+</svg>

package/{docs-site → docs-site-v2}/public/robots.txt

@@ -7,7 +7,6 @@ Sitemap: https://sfcc-mcp-dev.rhino-inquisitor.com/sitemap.xml
 # Crawl-delay for respectful crawling
 Crawl-delay: 1
 
-# Allow all common search engines
 User-agent: Googlebot
 Allow: /
 
@@ -18,8 +17,4 @@ User-agent: Slurp
 Allow: /
 
 User-agent: DuckDuckBot
-Allow: /
-
-# Block certain paths if needed
-# Disallow: /temp/
-# Disallow: /private/
+Allow: /

package/{docs-site → docs-site-v2}/public/site.webmanifest

@@ -1,7 +1,7 @@
 {
   "name": "SFCC Development MCP Server",
   "short_name": "SFCC MCP",
-  "description": "Model Context Protocol server for Salesforce B2C Commerce Cloud development with AI-powered documentation access, log analysis, and development best practices",
+  "description": "Model Context Protocol server for Salesforce B2C Commerce Cloud development with AI-powered documentation access, log analysis, and curated agent skills",
   "start_url": "/",
   "scope": "/",
   "display": "standalone",

package/{docs-site → docs-site-v2}/public/sitemap.xml

@@ -6,63 +6,84 @@
     <!-- SFCC Development MCP Server Homepage -->
     <url>
         <loc>https://sfcc-mcp-dev.rhino-inquisitor.com</loc>
-        <lastmod>2025-09-20</lastmod>
+        <lastmod>2026-02-13</lastmod>
         <changefreq>weekly</changefreq>
         <priority>1.0</priority>
     </url>    
-    <!-- Configuration Guide -->
+    <!-- Getting Started -->
     <url>
-        <loc>https://sfcc-mcp-dev.rhino-inquisitor.com/configuration/</loc>
-        <lastmod>2025-09-20</lastmod>
+        <loc>https://sfcc-mcp-dev.rhino-inquisitor.com/guide/</loc>
+        <lastmod>2026-02-13</lastmod>
         <changefreq>monthly</changefreq>
         <priority>0.9</priority>
     </url>    
     <!-- AI Interface Setup Guide -->
     <url>
-        <loc>https://sfcc-mcp-dev.rhino-inquisitor.com/ai-interfaces/</loc>
-        <lastmod>2025-09-20</lastmod>
+        <loc>https://sfcc-mcp-dev.rhino-inquisitor.com/guide/ai-interfaces/</loc>
+        <lastmod>2026-02-13</lastmod>
         <changefreq>monthly</changefreq>
         <priority>0.8</priority>
     </url>    
+    <!-- Configuration Guide -->
+    <url>
+        <loc>https://sfcc-mcp-dev.rhino-inquisitor.com/guide/configuration/</loc>
+        <lastmod>2026-02-13</lastmod>
+        <changefreq>monthly</changefreq>
+        <priority>0.9</priority>
+    </url>    
     <!-- Features Overview -->
     <url>
         <loc>https://sfcc-mcp-dev.rhino-inquisitor.com/features/</loc>
-        <lastmod>2025-09-20</lastmod>
+        <lastmod>2026-02-13</lastmod>
         <changefreq>monthly</changefreq>
         <priority>0.8</priority>
     </url>    
     <!-- Available Tools -->
     <url>
         <loc>https://sfcc-mcp-dev.rhino-inquisitor.com/tools/</loc>
-        <lastmod>2025-09-20</lastmod>
+        <lastmod>2026-02-13</lastmod>
         <changefreq>monthly</changefreq>
         <priority>0.8</priority>
     </url>    
     <!-- Examples and Use Cases -->
     <url>
         <loc>https://sfcc-mcp-dev.rhino-inquisitor.com/examples/</loc>
-        <lastmod>2025-09-20</lastmod>
+        <lastmod>2026-02-13</lastmod>
+        <changefreq>monthly</changefreq>
+        <priority>0.8</priority>
+    </url>    
+    <!-- Script Debugger -->
+    <url>
+        <loc>https://sfcc-mcp-dev.rhino-inquisitor.com/script-debugger/</loc>
+        <lastmod>2026-02-13</lastmod>
+        <changefreq>monthly</changefreq>
+        <priority>0.7</priority>
+    </url>    
+    <!-- Agent Skills -->
+    <url>
+        <loc>https://sfcc-mcp-dev.rhino-inquisitor.com/skills/</loc>
+        <lastmod>2026-02-13</lastmod>
         <changefreq>monthly</changefreq>
         <priority>0.8</priority>
     </url>    
     <!-- Security Guidelines -->
     <url>
         <loc>https://sfcc-mcp-dev.rhino-inquisitor.com/security/</loc>
-        <lastmod>2025-09-20</lastmod>
+        <lastmod>2026-02-13</lastmod>
         <changefreq>monthly</changefreq>
         <priority>0.7</priority>
     </url>    
     <!-- Development Guide -->
     <url>
         <loc>https://sfcc-mcp-dev.rhino-inquisitor.com/development/</loc>
-        <lastmod>2025-09-20</lastmod>
+        <lastmod>2026-02-13</lastmod>
         <changefreq>monthly</changefreq>
         <priority>0.6</priority>
     </url>    
     <!-- Troubleshooting Guide -->
     <url>
         <loc>https://sfcc-mcp-dev.rhino-inquisitor.com/troubleshooting/</loc>
-        <lastmod>2025-09-20</lastmod>
+        <lastmod>2026-02-13</lastmod>
         <changefreq>monthly</changefreq>
         <priority>0.7</priority>
     </url>

package/docs-site-v2/script-debugger/index.md

@@ -0,0 +1,105 @@
+---
+title: Script Debugger Guide
+description: Execute JavaScript safely in SFCC sandboxes with evaluate_script, debugger prerequisites, and troubleshooting guidance.
+---
+
+# Script debugger
+
+Use `evaluate_script` to execute JavaScript on a sandbox instance via the script debugger API.
+
+## Quick start
+
+Prompt:
+
+```
+What is the current site ID on my sandbox?
+```
+
+Example script:
+
+```javascript
+dw.system.Site.current.ID
+```
+
+## Requirements
+
+- Valid `dw.json` credentials
+- Script debugger enabled in Business Manager
+- SFRA or SiteGenesis storefront in the cartridge path, or a custom `breakpointFile`
+
+<Callout title="Username is case-sensitive" variant="warn">
+The debug API requires the username to match Business Manager casing exactly.
+</Callout>
+
+<Callout title="Sandbox only" variant="danger">
+Only use the script debugger on sandbox or development instances.
+</Callout>
+
+## Parameters
+
+| Parameter | Required | Default | Description |
+| --- | --- | --- | --- |
+| `script` | Yes | - | JavaScript expression to evaluate |
+| `siteId` | No | RefArch | Site ID for the request |
+| `locale` | No | default | Locale segment (fallback if locale-less fails) |
+| `timeout` | No | 30000 | Execution timeout in ms |
+| `breakpointFile` | No | Auto | Custom controller file for breakpoint |
+| `breakpointLine` | No | Auto | Specific breakpoint line |
+
+## Script rules
+
+- Do not use `return` at the top level. Use expressions.
+- Do not use `require()`; use the global `dw.*` namespace.
+- Wrap multi-step logic in an IIFE.
+- Use `JSON.stringify()` for objects or arrays.
+
+Example IIFE:
+
+```javascript
+(function() {
+  var p = dw.catalog.ProductMgr.getProduct('25518704M');
+  if (!p) return 'Not found';
+  return JSON.stringify({ id: p.ID, name: p.name, online: p.onlineFlag });
+})()
+```
+
+## Common use cases
+
+### Site information
+
+```javascript
+dw.system.Site.current.ID
+```
+
+### Product lookup
+
+```javascript
+(function() {
+  var p = dw.catalog.ProductMgr.getProduct('25518704M');
+  if (!p) return 'Not found';
+  return JSON.stringify({ id: p.ID, name: p.name, online: p.onlineFlag });
+})()
+```
+
+### Site preferences
+
+```javascript
+JSON.stringify(Object.keys(dw.system.Site.current.preferences.custom))
+```
+
+## Troubleshooting
+
+| Error | Cause | Fix |
+| --- | --- | --- |
+| `invalid return` | Top-level `return` | Use expression or IIFE |
+| `Cannot call method of null` | Using `require()` | Use `dw.*` globals |
+| Timeout waiting for breakpoint | Wrong siteId or debugger disabled | Verify siteId and enable debugger |
+| NotAuthorizedException | Missing permissions | Enable Script Debugger permission |
+| No compatible storefront cartridge | Missing SFRA/SiteGenesis | Deploy storefront or set `breakpointFile` |
+
+## Best practices
+
+- Keep scripts short and synchronous
+- Use IIFEs for multi-step logic
+- Always null-check objects
+- Use `JSON.stringify()` for readable output

package/docs-site-v2/scripts/generate-llms.js

@@ -0,0 +1,71 @@
+#!/usr/bin/env node
+
+/**
+ * llms.txt Generator for SFCC Development MCP Server (VitePress)
+ *
+ * Usage: node scripts/generate-llms.js
+ */
+
+import fs from 'fs';
+import path from 'path';
+import { fileURLToPath } from 'url';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+const baseUrl = 'https://sfcc-mcp-dev.rhino-inquisitor.com';
+
+const content = `# SFCC Development MCP Server
+
+> A comprehensive Model Context Protocol (MCP) server that provides AI assistants with direct access to Salesforce B2C Commerce Cloud development tools, documentation, curated agent skills, and real-time debugging capabilities.
+
+This server bridges the gap between AI assistants and SFCC development workflows, offering both documentation-only mode (no credentials required) and full mode (with live SFCC instance access). It provides a broad tool surface across documentation, log analysis, system objects, cartridge generation, and script debugging.
+
+Key architectural principles:
+- **Capability-gated**: Tools requiring SFCC credentials are only exposed when valid configuration is provided
+- **Modular handlers**: Clean separation between tool routing and domain logic
+- **Dependency injection**: Testable architecture with service abstractions
+- **Performance optimized**: Efficient caching and range request optimization for log analysis
+
+## Core Documentation
+
+- [Getting Started](${baseUrl}/guide/): Introduction and modes
+- [AI Interface Setup](${baseUrl}/guide/ai-interfaces/): Platform-specific setup for Copilot, Claude, and Cursor
+- [Configuration Guide](${baseUrl}/guide/configuration/): dw.json, environment variables, and auto-discovery
+- [Features Overview](${baseUrl}/features/): Complete feature breakdown
+- [Tools Catalog](${baseUrl}/tools/): All tools organized by category with examples
+- [Examples](${baseUrl}/examples/): Practical prompts and workflows
+- [Script Debugger](${baseUrl}/script-debugger/): Sandbox evaluation via debugger API
+- [Skills](${baseUrl}/skills/): Bundled skills and instruction packs
+- [Security](${baseUrl}/security/): Credential and data handling guidance
+- [Development Guide](${baseUrl}/development/): Architecture, testing, and contribution workflow
+- [Troubleshooting](${baseUrl}/troubleshooting/): Common issues and fixes
+
+## Tool Categories
+
+- **SFCC Documentation Tools**: Class information, method search, and namespace exploration
+- **SFRA Documentation Tools**: Enhanced Storefront Reference Architecture docs
+- **ISML Documentation Tools**: ISML element reference and search
+- **Agent Instruction Tools**: Sync AGENTS.md + bundled skills into a workspace
+- **Log & Job Log Tools**: Log search, summaries, and job execution debugging
+- **System Object Tools**: Attribute discovery and site preference management
+- **Cartridge Generation Tools**: Cartridge and project scaffolding
+- **Code Version Tools**: Listing and activation
+- **Script Debugger Tools**: Execute JavaScript on sandbox instances
+
+## Optional
+
+- [GitHub Repository](https://github.com/taurgis/sfcc-dev-mcp)
+- [NPM Package](https://www.npmjs.com/package/sfcc-dev-mcp)
+- [CHANGELOG](https://github.com/taurgis/sfcc-dev-mcp/blob/main/CHANGELOG.md)
+- [Contributing Guidelines](https://github.com/taurgis/sfcc-dev-mcp/blob/main/CONTRIBUTING.md)
+`;
+
+const publicDir = path.join(__dirname, '..', 'public');
+if (!fs.existsSync(publicDir)) {
+  fs.mkdirSync(publicDir, { recursive: true });
+}
+
+fs.writeFileSync(path.join(publicDir, 'llms.txt'), content);
+
+console.log('llms.txt generated successfully.');

package/docs-site-v2/scripts/generate-sitemap.js

@@ -0,0 +1,97 @@
+#!/usr/bin/env node
+
+/**
+ * Sitemap Generator for SFCC Development MCP Server (VitePress)
+ *
+ * Usage: node scripts/generate-sitemap.js
+ */
+
+import fs from 'fs';
+import path from 'path';
+import { fileURLToPath } from 'url';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+const baseUrl = 'https://sfcc-mcp-dev.rhino-inquisitor.com';
+const currentDate = new Date().toISOString().split('T')[0];
+
+const pages = [
+  { path: '/', priority: '1.0', changefreq: 'weekly', description: 'SFCC Development MCP Server Homepage' },
+  { path: '/guide/', priority: '0.9', changefreq: 'monthly', description: 'Getting Started' },
+  { path: '/guide/ai-interfaces/', priority: '0.8', changefreq: 'monthly', description: 'AI Interface Setup Guide' },
+  { path: '/guide/configuration/', priority: '0.9', changefreq: 'monthly', description: 'Configuration Guide' },
+  { path: '/features/', priority: '0.8', changefreq: 'monthly', description: 'Features Overview' },
+  { path: '/tools/', priority: '0.8', changefreq: 'monthly', description: 'Available Tools' },
+  { path: '/examples/', priority: '0.8', changefreq: 'monthly', description: 'Examples and Use Cases' },
+  { path: '/script-debugger/', priority: '0.7', changefreq: 'monthly', description: 'Script Debugger' },
+  { path: '/skills/', priority: '0.8', changefreq: 'monthly', description: 'Agent Skills' },
+  { path: '/security/', priority: '0.7', changefreq: 'monthly', description: 'Security Guidelines' },
+  { path: '/development/', priority: '0.6', changefreq: 'monthly', description: 'Development Guide' },
+  { path: '/troubleshooting/', priority: '0.7', changefreq: 'monthly', description: 'Troubleshooting Guide' }
+];
+
+const generateSitemap = () => {
+  const header = `<?xml version="1.0" encoding="UTF-8"?>
+<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="http://www.sitemaps.org/schemas/sitemap/0.9
+        http://www.sitemaps.org/schemas/sitemap/0.9/sitemap.xsd">`;
+
+  const footer = `
+</urlset>`;
+
+  const urls = pages
+    .map((page) => {
+      const url = page.path === '/' ? baseUrl : `${baseUrl}${page.path}`;
+      return `    
+    <!-- ${page.description} -->
+    <url>
+        <loc>${url}</loc>
+        <lastmod>${currentDate}</lastmod>
+        <changefreq>${page.changefreq}</changefreq>
+        <priority>${page.priority}</priority>
+    </url>`;
+    })
+    .join('');
+
+  return header + urls + footer;
+};
+
+const generateRobotsTxt = () => {
+  return `User-agent: *
+Allow: /
+
+# Sitemap
+Sitemap: ${baseUrl}/sitemap.xml
+
+# Crawl-delay for respectful crawling
+Crawl-delay: 1
+
+User-agent: Googlebot
+Allow: /
+
+User-agent: Bingbot
+Allow: /
+
+User-agent: Slurp
+Allow: /
+
+User-agent: DuckDuckBot
+Allow: /`;
+};
+
+const sitemap = generateSitemap();
+const robots = generateRobotsTxt();
+
+const publicDir = path.join(__dirname, '..', 'public');
+if (!fs.existsSync(publicDir)) {
+  fs.mkdirSync(publicDir, { recursive: true });
+}
+
+fs.writeFileSync(path.join(publicDir, 'sitemap.xml'), sitemap);
+fs.writeFileSync(path.join(publicDir, 'robots.txt'), robots);
+
+console.log('Sitemap and robots.txt generated successfully.');
+console.log(`Generated ${pages.length} URLs in sitemap.xml`);
+console.log(`Last modified: ${currentDate}`);

package/docs-site-v2/security/index.md

@@ -0,0 +1,115 @@
+---
+title: Security and Privacy
+description: Review credential handling, threat model, hardening steps, and secure operating practices for SFCC Dev MCP.
+---
+
+# Security and privacy
+
+This server is designed for local, single-developer use. It does not store credentials on disk or transmit them to third-party services.
+
+## Modes and security characteristics
+
+Both modes are designed for **local single-developer use**. Docs mode has a zero credential surface. Full mode is effectively the same risk profile as your existing local SFCC workflow using `dw.json` for WebDAV + OCAPI access.
+
+<table>
+	<thead>
+		<tr>
+			<th>Mode</th>
+			<th>Characteristics</th>
+			<th>Risk profile</th>
+		</tr>
+	</thead>
+	<tbody>
+		<tr>
+			<td>Docs mode</td>
+			<td>No auth, static docs, scaffolding only</td>
+			<td>Minimal</td>
+		</tr>
+		<tr>
+			<td>Full mode</td>
+			<td>WebDAV + OCAPI credentials</td>
+			<td>Same as local SFCC dev</td>
+		</tr>
+	</tbody>
+</table>
+
+<div class="vp-grid vp-grid--2" style="margin-top: 16px;">
+	<div class="vp-card">
+		<h3>Docs mode (default)</h3>
+		<ul>
+			<li>No credentials required</li>
+			<li>Static docs + scaffolding only</li>
+			<li>Safe for discovery and AI prompt prototyping</li>
+		</ul>
+	</div>
+	<div class="vp-card">
+		<h3>Full mode (<code>--dw-json</code>)</h3>
+		<ul>
+			<li>Uses the same credentials you already use locally</li>
+			<li>WebDAV (logs + job logs) and OCAPI Data API tooling</li>
+			<li>Capability-gated: tools only register if required credentials exist</li>
+		</ul>
+	</div>
+</div>
+
+## Baseline hardening checklist
+
+<div class="vp-card">
+	<ol>
+		<li>Confirm sandbox hostname (never production domain).</li>
+		<li>Add <code>dw.json</code> + <code>*.dw.json</code> to <code>.gitignore</code>.</li>
+		<li>Use <code>chmod 600 dw.json</code> (owner read/write only).</li>
+		<li>Remove unused OAuth fields if only using logs.</li>
+		<li>Grant only required OCAPI resources (add incrementally).</li>
+		<li>Use env vars to override secrets in CI contexts.</li>
+		<li>Start in docs mode and validate tool surface.</li>
+		<li>Rotate client secrets and passwords on a schedule.</li>
+	</ol>
+</div>
+
+## Credential handling
+
+<div class="vp-grid vp-grid--3">
+	<div class="vp-card">
+		<strong>Minimize scope:</strong> start with no Data API resources, add only what you need.
+	</div>
+	<div class="vp-card">
+		<strong>Protect files:</strong> avoid synced/shared directories, never email secrets.
+	</div>
+	<div class="vp-card">
+		<strong>Rotate & audit:</strong> remove orphaned API clients and track creation dates.
+	</div>
+</div>
+
+## Threat model (local context)
+
+<div class="vp-grid vp-grid--2">
+	<div class="vp-card">
+		<strong>Mitigated by design:</strong>
+		<ul>
+			<li>Path validation and schema checks</li>
+			<li>Read-only log operations</li>
+			<li>Scoped tool registration based on credentials</li>
+			<li>Memory-only caching</li>
+		</ul>
+	</div>
+	<div class="vp-card">
+		<strong>Your responsibilities:</strong>
+		<ul>
+			<li>Do not run on shared multi-user servers</li>
+			<li>Keep secrets out of version control</li>
+			<li>Limit OCAPI resources to active feature work</li>
+			<li>Rotate credentials regularly</li>
+		</ul>
+	</div>
+</div>
+
+## Data handling
+
+- Log tools read a bounded tail of log files
+- Site preference searches mask password values
+- System object tools return metadata, not record data
+
+## Reporting
+
+If you discover a vulnerability, report it privately to the maintainers and avoid posting details in public issues.

package/docs-site-v2/skills/index.md

@@ -0,0 +1,40 @@
+---
+title: Agent Skills
+description: Install and use reusable SFCC instruction packs to keep AI assistants consistent across Copilot, Claude, and Cursor.
+---
+
+# Agent skills
+
+Skills are portable instruction packs that help your AI assistant follow consistent SFCC patterns.
+
+## Install with the MCP tool
+
+Prompt:
+
+```
+Install bundled agent instructions into my repo.
+```
+
+Example call:
+
+```json
+{
+  "tool": "sync_agent_instructions",
+  "params": {
+    "destinationType": "project",
+    "dryRun": false
+  }
+}
+```
+
+## Manual install
+
+- GitHub Copilot: copy `ai-instructions/github-copilot/copilot-instructions.md` into `.github/copilot-instructions.md`
+- Claude Desktop: use `ai-instructions/claude-desktop/claude_custom_instructions.md`
+- Cursor: copy `ai-instructions/cursor/.cursor` into your repo
+
+## Browse skills
+
+Repository: https://github.com/taurgis/sfcc-dev-mcp/tree/main/ai-instructions/skills
+
+<SkillsList />

package/docs-site-v2/tools/index.md

@@ -0,0 +1,36 @@
+---
+title: Tools Catalog
+description: Browse all SFCC Dev MCP tools by category, mode, and practical prompt examples for daily development workflows.
+---
+
+# Tools catalog
+
+Browse the full tool surface, filter by category, and copy example prompts.
+
+<Callout title="Legend" variant="info">
+Docs mode tools are available without credentials. Full mode tools require `dw.json`.
+</Callout>
+
+<ToolExplorer />
+
+<div class="vp-card" style="margin-top: 24px;">
+	<strong>Legend</strong>
+	<ul>
+		<li><span class="vp-tool-card__mode" data-mode="full">Full</span> Requires credentials</li>
+		<li><span class="vp-tool-card__mode" data-mode="both">Docs + Full</span> Available in both modes</li>
+	</ul>
+</div>
+
+<div class="vp-card" style="margin-top: 24px;">
+	<strong>Mode recommendation</strong>
+	<p>Explore freely in Documentation Mode first. Add <code>--dw-json</code> later to unlock log analysis, system and custom objects, job log insights, and code version management.</p>
+</div>
+
+<div class="vp-card" style="margin-top: 24px;">
+	<strong>Next steps</strong>
+	<p>Move from raw tool surface into practical flows or reinforce secure patterns before enabling full-mode capabilities.</p>
+	<div class="home-cta-row" style="justify-content: flex-start;">
+		<a class="home-button home-button--primary" href="/examples">Examples & Use Cases</a>
+		<a class="home-button" href="/security">Security Guidance</a>
+	</div>
+</div>