webcake-storefront-mcp 1.31.13 → 1.33.0

package/dist/changelog.json

@@ -1,4 +1,18 @@
 [
+  {
+    "v": "1.33.0",
+    "d": "14/10/2026",
+    "type": "Added",
+    "en": "Every tool, whether registered natively or reached through the search gateway (search_tools/invoke_tool/list_tool_groups), now reports readOnlyHint…",
+    "vi": "Mọi tool, dù được đăng ký native hay được tiếp cận qua search gateway (search_tools/invoke_tool/list_tool_groups), nay đều có thêm annotation…"
+  },
+  {
+    "v": "1.32.0",
+    "d": "14/10/2026",
+    "type": "Changed",
+    "en": "The server now serves a raster PNG icon (/favicon.ico, /favicon.png, /icon.png, /apple-touch-icon.png) alongside the existing SVG favicon, and…",
+    "vi": "Server nay phục vụ thêm icon dạng raster PNG (/favicon.ico, /favicon.png, /icon.png, /apple-touch-icon.png) bên cạnh favicon SVG hiện có, và khai…"
+  },
   {
     "v": "1.31.13",
     "d": "09/10/2026",
@@ -26,19 +40,5 @@
     "type": "Added",
     "en": "list_articles accepts a term parameter to search articles by title or slug, and its response now includes page and limit alongside total.",
     "vi": "list_articles nay nhận thêm tham số term để tìm bài viết theo tiêu đề hoặc slug, và kết quả trả về nay có thêm page và limit bên cạnh total."
-  },
-  {
-    "v": "1.31.9",
-    "d": "07/09/2026",
-    "type": "Added",
-    "en": "Pages created by create_page, build_page, and commit_page_draft are now stamped with by_ai: \"mcp\" (persisted to the backend pages.by_ai column) so…",
-    "vi": "Các trang được tạo bởi create_page, build_page và commit_page_draft nay được đánh dấu by_ai: \"mcp\" (lưu vào cột pages.by_ai ở backend) để builder có…"
-  },
-  {
-    "v": "1.31.8",
-    "d": "29/06/2026",
-    "type": "Fixed",
-    "en": "Elements placed by new_section, new_row, and build_page that fill their grid cell (text, image, container, columns, repeaters) now receive…",
-    "vi": "Các phần tử được đặt bởi new_section, new_row và build_page mà lấp đầy ô lưới (text, image, container, columns, repeaters) nay nhận constraintX:…"
   }
 ]

package/dist/http.js

@@ -11,7 +11,7 @@ import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/
 import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
 import { createServer } from "./server.js";
 import { makeApi, resolveEnv, ENVIRONMENTS, DEFAULT_ENV } from "./config.js";
-import { landingHtml, faviconSvg, ogImageSvg, normalizeLang } from "./web-guide.js";
+import { landingHtml, faviconSvg, ogImageSvg, normalizeLang, ICON_PNG } from "./web-guide.js";
 import { privacyHtml, termsHtml } from "./legal.js";
 import { registerClient, startAuthorize, completeAuthorize, exchangeToken, resolveAccessToken, revokeToken, authServerMetadata, protectedResourceMetadata, } from "./auth/oauth-server.js";
 const MCP_PATH = "/mcp";
@@ -291,7 +291,14 @@ export async function startHttpServer(port) {
     const httpServer = createHttpServer(async (req, res) => {
         const path = (req.url ?? "").split("?")[0];
         // ---- Favicon / brand icon ----
-        if (req.method === "GET" && (path === "/favicon.ico" || path === "/favicon.svg")) {
+        // Google s2 (what the claude.ai connector list uses) skips SVG favicons and shows a
+        // globe, so /favicon.ico and friends serve the raster src/icon.png (→ dist/icon.png).
+        if ((req.method === "GET" || req.method === "HEAD") && ["/favicon.ico", "/favicon.png", "/icon.png", "/apple-touch-icon.png"].includes(path)) {
+            res.writeHead(200, { "content-type": "image/png", "cache-control": "public, max-age=86400" });
+            res.end(ICON_PNG);
+            return;
+        }
+        if (req.method === "GET" && path === "/favicon.svg") {
             res.writeHead(200, { "content-type": "image/svg+xml", "cache-control": "public, max-age=86400" });
             res.end(faviconSvg());
             return;

package/dist/server.js

@@ -1,6 +1,7 @@
 import { readFileSync } from "node:fs";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { installTools, buildToolGroupIndex } from "./tools/registry.js";
+import { ICON_PNG } from "./web-guide.js";
 /** Server version, read from package.json so it always tracks the published release. */
 export const SERVER_VERSION = (() => {
     try {
@@ -36,7 +37,14 @@ function makeResult(data) {
 /** Build a fully-wired MCP server bound to the given API client. */
 export function createServer(api, opts = {}) {
     const toolsSpec = opts.tools ?? process.env.WEBCAKE_TOOLS;
-    const server = new McpServer({ name: "webcake-storefront", version: SERVER_VERSION }, { instructions: `${INSTRUCTIONS}\n\n${buildToolGroupIndex(toolsSpec)}` });
+    const server = new McpServer({
+        name: "webcake-storefront",
+        version: SERVER_VERSION,
+        // Shown by MCP clients (e.g. claude.ai connectors) instead of a generic globe.
+        title: "WebCake Storefront",
+        websiteUrl: "https://webcake.io",
+        icons: [{ src: `data:image/png;base64,${ICON_PNG.toString("base64")}`, mimeType: "image/png", sizes: ["192x192"] }],
+    }, { instructions: `${INSTRUCTIONS}\n\n${buildToolGroupIndex(toolsSpec)}` });
     const handle = async (fn) => {
         try {
             return makeResult(await fn());

package/dist/tools/registry.js

@@ -49,6 +49,7 @@ export const GROUPS = [
     { name: "apps_advanced", title: "Advanced apps", desc: "Product design, personal product design (PPD), course app" },
     { name: "channels", title: "Sale channels", desc: "Sitemap sync, partner product feeds, Google merchants" },
     { name: "automation", title: "Automation", desc: "Marketing automations and send-mail" },
+    { name: "image_seo", title: "Image alt / SEO audit", desc: "Scan site images, read them, bulk-fill and set alt text" },
 ];
 /** Each tool module mapped to its group. Order matches the original registration order. */
 const MODULES = [
@@ -80,7 +81,7 @@ const MODULES = [
     ["web", registerGlobalSectionTools],
     ["web", registerGlobalSectionWriteTools],
     ["session", registerResultCacheTools],
-    ["web", registerImageTools],
+    ["image_seo", registerImageTools],
     ["web", registerBuilderTools],
     ["web", registerBuilderExtraTools],
     ["web", registerPageDraftTools],
@@ -119,6 +120,21 @@ export function resolveNativeGroups(spec) {
     }
     return set;
 }
+/** MCP tool annotations derived from the verb prefix, so clients can auto-allow read-only
+ *  tools and warn on destructive ones. Unlisted verbs (update/upsert/set/publish…) keep the
+ *  spec defaults (a non-read-only tool is assumed possibly destructive). */
+const READ_ONLY = /^(list|get|search|read|query|find|count|semantic|check|validate|scan|fetch|new|ingest)_/;
+const DESTRUCTIVE = /^(delete|remove|uninstall|empty|clear|block|unblock|refuse)_/;
+const ADDITIVE = /^(create|add|upload|install|invite|duplicate|save)_/;
+export function toolAnnotations(name) {
+    if (READ_ONLY.test(name))
+        return { readOnlyHint: true };
+    if (DESTRUCTIVE.test(name))
+        return { readOnlyHint: false, destructiveHint: true };
+    if (ADDITIVE.test(name))
+        return { readOnlyHint: false, destructiveHint: false };
+    return { readOnlyHint: false };
+}
 const errorResult = (text) => ({ content: [{ type: "text", text }], isError: true });
 /** Build a compact capability index (group list with loaded/on-demand tags) to inject into the
  *  system prompt so the model always knows which domains exist and when to use search_tools. */
@@ -150,7 +166,7 @@ export function installTools(server, api, handle, opts = {}) {
     let nativeCount = 0;
     for (const e of collector.entries) {
         if (native.has(e.group)) {
-            server.tool(e.name, e.description, e.shape, e.handler);
+            server.tool(e.name, e.description, e.shape, toolAnnotations(e.name), e.handler);
             nativeCount++;
         }
     }
@@ -167,7 +183,7 @@ export function installTools(server, api, handle, opts = {}) {
         }
         return schemaCache.get(e.name);
     };
-    server.tool("list_tool_groups", "List every WebCake tool group, how many tools it has, and whether it is loaded natively or reached on-demand via search_tools + invoke_tool.", {}, () => handle(async () => GROUPS.map((g) => ({
+    server.tool("list_tool_groups", "List every WebCake tool group, how many tools it has, and whether it is loaded natively or reached on-demand via search_tools + invoke_tool.", {}, toolAnnotations("list_tool_groups"), () => handle(async () => GROUPS.map((g) => ({
         name: g.name,
         title: g.title,
         description: g.desc,
@@ -180,7 +196,7 @@ courses, sale channels, automation…). Returns name, group, description and JSO
         query: z.string().describe("Keywords, e.g. 'affiliate payout', 'translate product', 'add domain ssl', 'block phone'"),
         group: z.string().optional().describe("Restrict to a group name (see list_tool_groups)"),
         limit: z.number().optional().describe("Max results (default 8)"),
-    }, ({ query, group, limit }) => handle(async () => {
+    }, toolAnnotations("search_tools"), ({ query, group, limit }) => handle(async () => {
         const ql = query.toLowerCase();
         const terms = ql.split(/\s+/).filter(Boolean);
         const PREFIX_MIN = 4;
@@ -230,6 +246,7 @@ courses, sale channels, automation…). Returns name, group, description and JSO
             name: e.name,
             group: e.group,
             native: native.has(e.group),
+            annotations: toolAnnotations(e.name),
             description: e.description,
             input_schema: jsonSchema(e),
         }));
@@ -238,7 +255,8 @@ courses, sale channels, automation…). Returns name, group, description and JSO
 Arguments are validated before running. Use this for tools that are not loaded natively.`, {
         name: z.string().describe("Exact tool name (from search_tools)"),
         arguments: z.record(z.any()).optional().describe("Arguments object matching the tool's input schema"),
-    }, async ({ name, arguments: args }) => {
+    }, toolAnnotations("invoke_tool"), // runs any tool, so never read-only
+    async ({ name, arguments: args }) => {
         const e = registry.get(name);
         if (!e)
             return errorResult(`Error: unknown tool "${name}". Use search_tools to find available tools.`);

package/dist/web-guide.js

@@ -564,6 +564,7 @@ export function guideHtml(origin, lang = "vi") {
 <link rel="alternate" hreflang="vi" href="${origin}/">
 <link rel="alternate" hreflang="en" href="${origin}/?lang=en">
 <link rel="alternate" hreflang="x-default" href="${origin}/">
+<link rel="icon" type="image/png" sizes="192x192" href="/favicon.png">
 <link rel="icon" type="image/svg+xml" href="/favicon.svg">
 <meta property="og:type" content="website">
 <meta property="og:site_name" content="WebCake Storefront MCP">
@@ -1032,6 +1033,8 @@ export function ogImageSvg() {
  * Favicon SVG — the branded "S" mark with yellow dot.
  * Served at /favicon.svg and /favicon.ico by http.ts.
  */
+// Raster icon (192px, generated from ICON_SVG) — shared by /favicon.ico and serverInfo.icons.
+export const ICON_PNG = readFileSync(new URL("./icon.png", import.meta.url));
 export function faviconSvg() {
     return ICON_SVG;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "webcake-storefront-mcp",
-  "version": "1.31.13",
+  "version": "1.33.0",
   "description": "MCP server for the WebCake/StoreCake storefront builder — page CRUD, page authoring, products, orders, and more",
   "mcpName": "io.github.vuluu2k/webcake-storefront-mcp",
   "license": "MIT",