webcake-storefront-mcp 1.32.0 → 1.33.0

package/dist/changelog.json

@@ -1,4 +1,11 @@
 [
+  {
+    "v": "1.33.0",
+    "d": "14/10/2026",
+    "type": "Added",
+    "en": "Every tool, whether registered natively or reached through the search gateway (search_tools/invoke_tool/list_tool_groups), now reports readOnlyHint…",
+    "vi": "Mọi tool, dù được đăng ký native hay được tiếp cận qua search gateway (search_tools/invoke_tool/list_tool_groups), nay đều có thêm annotation…"
+  },
   {
     "v": "1.32.0",
     "d": "14/10/2026",
@@ -33,12 +40,5 @@
     "type": "Added",
     "en": "list_articles accepts a term parameter to search articles by title or slug, and its response now includes page and limit alongside total.",
     "vi": "list_articles nay nhận thêm tham số term để tìm bài viết theo tiêu đề hoặc slug, và kết quả trả về nay có thêm page và limit bên cạnh total."
-  },
-  {
-    "v": "1.31.9",
-    "d": "07/09/2026",
-    "type": "Added",
-    "en": "Pages created by create_page, build_page, and commit_page_draft are now stamped with by_ai: \"mcp\" (persisted to the backend pages.by_ai column) so…",
-    "vi": "Các trang được tạo bởi create_page, build_page và commit_page_draft nay được đánh dấu by_ai: \"mcp\" (lưu vào cột pages.by_ai ở backend) để builder có…"
   }
 ]

package/dist/tools/registry.js

@@ -49,6 +49,7 @@ export const GROUPS = [
     { name: "apps_advanced", title: "Advanced apps", desc: "Product design, personal product design (PPD), course app" },
     { name: "channels", title: "Sale channels", desc: "Sitemap sync, partner product feeds, Google merchants" },
     { name: "automation", title: "Automation", desc: "Marketing automations and send-mail" },
+    { name: "image_seo", title: "Image alt / SEO audit", desc: "Scan site images, read them, bulk-fill and set alt text" },
 ];
 /** Each tool module mapped to its group. Order matches the original registration order. */
 const MODULES = [
@@ -80,7 +81,7 @@ const MODULES = [
     ["web", registerGlobalSectionTools],
     ["web", registerGlobalSectionWriteTools],
     ["session", registerResultCacheTools],
-    ["web", registerImageTools],
+    ["image_seo", registerImageTools],
     ["web", registerBuilderTools],
     ["web", registerBuilderExtraTools],
     ["web", registerPageDraftTools],
@@ -119,6 +120,21 @@ export function resolveNativeGroups(spec) {
     }
     return set;
 }
+/** MCP tool annotations derived from the verb prefix, so clients can auto-allow read-only
+ *  tools and warn on destructive ones. Unlisted verbs (update/upsert/set/publish…) keep the
+ *  spec defaults (a non-read-only tool is assumed possibly destructive). */
+const READ_ONLY = /^(list|get|search|read|query|find|count|semantic|check|validate|scan|fetch|new|ingest)_/;
+const DESTRUCTIVE = /^(delete|remove|uninstall|empty|clear|block|unblock|refuse)_/;
+const ADDITIVE = /^(create|add|upload|install|invite|duplicate|save)_/;
+export function toolAnnotations(name) {
+    if (READ_ONLY.test(name))
+        return { readOnlyHint: true };
+    if (DESTRUCTIVE.test(name))
+        return { readOnlyHint: false, destructiveHint: true };
+    if (ADDITIVE.test(name))
+        return { readOnlyHint: false, destructiveHint: false };
+    return { readOnlyHint: false };
+}
 const errorResult = (text) => ({ content: [{ type: "text", text }], isError: true });
 /** Build a compact capability index (group list with loaded/on-demand tags) to inject into the
  *  system prompt so the model always knows which domains exist and when to use search_tools. */
@@ -150,7 +166,7 @@ export function installTools(server, api, handle, opts = {}) {
     let nativeCount = 0;
     for (const e of collector.entries) {
         if (native.has(e.group)) {
-            server.tool(e.name, e.description, e.shape, e.handler);
+            server.tool(e.name, e.description, e.shape, toolAnnotations(e.name), e.handler);
             nativeCount++;
         }
     }
@@ -167,7 +183,7 @@ export function installTools(server, api, handle, opts = {}) {
         }
         return schemaCache.get(e.name);
     };
-    server.tool("list_tool_groups", "List every WebCake tool group, how many tools it has, and whether it is loaded natively or reached on-demand via search_tools + invoke_tool.", {}, () => handle(async () => GROUPS.map((g) => ({
+    server.tool("list_tool_groups", "List every WebCake tool group, how many tools it has, and whether it is loaded natively or reached on-demand via search_tools + invoke_tool.", {}, toolAnnotations("list_tool_groups"), () => handle(async () => GROUPS.map((g) => ({
         name: g.name,
         title: g.title,
         description: g.desc,
@@ -180,7 +196,7 @@ courses, sale channels, automation…). Returns name, group, description and JSO
         query: z.string().describe("Keywords, e.g. 'affiliate payout', 'translate product', 'add domain ssl', 'block phone'"),
         group: z.string().optional().describe("Restrict to a group name (see list_tool_groups)"),
         limit: z.number().optional().describe("Max results (default 8)"),
-    }, ({ query, group, limit }) => handle(async () => {
+    }, toolAnnotations("search_tools"), ({ query, group, limit }) => handle(async () => {
         const ql = query.toLowerCase();
         const terms = ql.split(/\s+/).filter(Boolean);
         const PREFIX_MIN = 4;
@@ -230,6 +246,7 @@ courses, sale channels, automation…). Returns name, group, description and JSO
             name: e.name,
             group: e.group,
             native: native.has(e.group),
+            annotations: toolAnnotations(e.name),
             description: e.description,
             input_schema: jsonSchema(e),
         }));
@@ -238,7 +255,8 @@ courses, sale channels, automation…). Returns name, group, description and JSO
 Arguments are validated before running. Use this for tools that are not loaded natively.`, {
         name: z.string().describe("Exact tool name (from search_tools)"),
         arguments: z.record(z.any()).optional().describe("Arguments object matching the tool's input schema"),
-    }, async ({ name, arguments: args }) => {
+    }, toolAnnotations("invoke_tool"), // runs any tool, so never read-only
+    async ({ name, arguments: args }) => {
         const e = registry.get(name);
         if (!e)
             return errorResult(`Error: unknown tool "${name}". Use search_tools to find available tools.`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "webcake-storefront-mcp",
-  "version": "1.32.0",
+  "version": "1.33.0",
   "description": "MCP server for the WebCake/StoreCake storefront builder — page CRUD, page authoring, products, orders, and more",
   "mcpName": "io.github.vuluu2k/webcake-storefront-mcp",
   "license": "MIT",