
Research
SANDWORM_MODE: Shai-Hulud-Style npm Worm Hijacks CI Workflows and Poisons AI Toolchains
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.
@salesforce/b2c-dx-mcp
Advanced tools
MCP (Model Context Protocol) server for Salesforce B2C Commerce Cloud developer experience tools.
⚠️ Active Development: This package is under active development. All tools are currently placeholder implementations that return mock responses. Tool implementations will be added incrementally.
This MCP server enables AI assistants to help with B2C Commerce development tasks. It provides toolsets for SCAPI, CARTRIDGES, MRT, PWAV3, and STOREFRONTNEXT development.
The server automatically detects your project type and enables relevant tools. See Available Toolsets and Tools for details.
The most important flag is --working-directory (or env var SFCC_WORKING_DIRECTORY). It tells the server where your project is located, enabling:
dw.json from your project for credentialsImportant: MCP clients like Cursor and Claude Desktop spawn servers from the home directory (
~), not your project. Always set--working-directory.
Cursor (supports ${workspaceFolder}):
{
"mcpServers": {
"b2c-dx": {
"command": "node",
"args": ["/path/to/packages/b2c-dx-mcp/bin/dev.js", "--working-directory", "${workspaceFolder}", "--allow-non-ga-tools"]
}
}
}
Claude Desktop (use explicit path):
{
"mcpServers": {
"b2c-dx": {
"command": "node",
"args": ["/path/to/packages/b2c-dx-mcp/bin/dev.js", "--working-directory", "/path/to/your/project", "--allow-non-ga-tools"]
}
}
}
The server analyzes your working directory and enables toolsets based on what it finds:
| Project Type | Detection | Toolsets Enabled |
|---|---|---|
| PWA Kit v3 | @salesforce/pwa-kit-*, @salesforce/retail-react-app, or ccExtensibility in package.json | PWAV3, MRT, SCAPI |
| Storefront Next | @salesforce/storefront-next-* in package.json | STOREFRONTNEXT, MRT, SCAPI |
| Cartridges | .project file in cartridge directory | CARTRIDGES, SCAPI |
| No project detected | No B2C markers found | SCAPI (base toolset only) |
The SCAPI toolset is always enabled. Hybrid projects (e.g., cartridges + PWA Kit) get combined toolsets.
Override auto-discovery by specifying toolsets explicitly:
"args": ["--working-directory", "${workspaceFolder}", "--toolsets", "CARTRIDGES,MRT", "--allow-non-ga-tools"]
AI assistants (like Cursor, Claude Desktop) automatically decide which MCP tools to use based on your prompts. To get the best results, use clear, specific prompts that describe what you want to accomplish.
⚠️ IMPORTANT: Explicitly mention "Use the MCP tool" in your prompts for reliable tool usage. While AI assistants (like Cursor's Composer) can automatically select MCP tools based on context, explicit instructions ensure the assistant prioritizes MCP tools over general knowledge, especially when multiple approaches are possible. This is particularly important for getting project-specific, up-to-date information rather than generic responses.
The storefront_next_development_guidelines tool provides critical architecture rules and best practices. Use this tool first when starting new Storefront Next development or when you need architecture guidance.
Good prompts:
Available sections:
quick-reference - Critical rules and architecture principles (default)data-fetching - Data loading patterns with loadersstate-management - Client-side state managementauth - Authentication and session managementcomponents - Component patterns and best practicesstyling - Tailwind CSS 4, Shadcn/ui, styling guidelinespage-designer - Page Designer integrationperformance - Performance optimizationtesting - Testing strategiesi18n - Internationalization patternsconfig - Configuration managementextensions - Extension developmentpitfalls - Common pitfallsGood prompts:
Good prompts:
Good prompts:
Good prompts:
Credentials can be provided via config files (recommended), environment variables, or flags. Priority: Flags > Env vars > Config files.
| Toolset | Required Credentials |
|---|---|
| SCAPI | hostname + client-id + client-secret |
| CARTRIDGES | hostname + username + password (or OAuth) |
| MRT | api-key + project (optionally environment) |
| PWAV3 | --working-directory only (+ MRT config for deployments) |
| STOREFRONTNEXT | --working-directory only (+ MRT/CARTRIDGES config for those tools) |
Option 1: Config files (recommended)
B2C credentials — dw.json in your project root:
{ "hostname": "xxx.demandware.net", "username": "...", "password": "...", "client-id": "...", "client-secret": "..." }
MRT credentials — ~/.mobify (create manually or via B2C CLI):
{ "api_key": "..." }
Option 2: Environment variables
"env": { "SFCC_SERVER": "xxx.demandware.net", "SFCC_USERNAME": "...", "SFCC_PASSWORD": "...", "SFCC_MRT_API_KEY": "..." }
Option 3: Flags
"args": ["--server", "xxx.demandware.net", "--username", "...", "--password", "...", "--api-key", "..."]
See Flag Reference for all available flags and env vars.
username/password = B2C username + WebDAV access keyclient-id/client-secret = API client credentials from Account Manager| Flag | Env Variable | Description |
|---|---|---|
--working-directory | SFCC_WORKING_DIRECTORY | Project directory (enables auto-discovery and config loading) |
--toolsets | — | Comma-separated toolsets to enable |
--tools | — | Comma-separated individual tools to enable |
--allow-non-ga-tools | — | Enable experimental (non-GA) tools |
--config | — | Explicit path to dw.json (advanced) |
--log-level | — | Logging verbosity (trace, debug, info, warn, error, silent) |
--debug | — | Enable debug logging |
| Flag | Env Variable | Description |
|---|---|---|
--server | SFCC_SERVER | B2C instance hostname |
--username | SFCC_USERNAME | Username for Basic auth (WebDAV) |
--password | SFCC_PASSWORD | Password/access key for Basic auth |
--client-id | SFCC_CLIENT_ID | OAuth client ID |
--client-secret | SFCC_CLIENT_SECRET | OAuth client secret |
--code-version | SFCC_CODE_VERSION | Code version for deployments |
| Flag | Env Variable | Description |
|---|---|---|
--api-key | SFCC_MRT_API_KEY | MRT API key |
--project | SFCC_MRT_PROJECT | MRT project slug |
--environment | SFCC_MRT_ENVIRONMENT | MRT environment (staging, production) |
--cloud-origin | SFCC_MRT_CLOUD_ORIGIN | MRT cloud origin URL |
Use --toolsets all to enable all toolsets, or select specific ones with --toolsets CARTRIDGES,MRT.
Note: All tools are currently placeholder implementations. Use
--allow-non-ga-toolsflag to enable them.
Cartridge development, deployment, and code version management.
| Tool | Description |
|---|---|
cartridge_deploy | Deploy cartridges to a B2C Commerce instance |
Managed Runtime operations for PWA Kit and Storefront Next deployments.
| Tool | Description |
|---|---|
mrt_bundle_push | Build, push bundle (optionally deploy) |
PWA Kit v3 development tools for building headless storefronts.
| Tool | Description |
|---|---|
pwakit_create_storefront | Create a new PWA Kit storefront project |
pwakit_create_page | Create a new page component in PWA Kit project |
pwakit_create_component | Create a new React component in PWA Kit project |
pwakit_get_dev_guidelines | Get PWA Kit development guidelines and best practices |
pwakit_recommend_hooks | Recommend appropriate React hooks for PWA Kit use cases |
pwakit_run_site_test | Run site tests for PWA Kit project |
pwakit_install_agent_rules | Install AI agent rules for PWA Kit development |
pwakit_explore_scapi_shop_api | Explore SCAPI Shop API endpoints and capabilities |
scapi_discovery | Discover available SCAPI endpoints and capabilities |
scapi_custom_api_discovery | Discover custom SCAPI API endpoints |
mrt_bundle_push | Build, push bundle (optionally deploy) |
Salesforce Commerce API discovery and exploration.
| Tool | Description |
|---|---|
scapi_discovery | Discover available SCAPI endpoints and capabilities |
scapi_customapi_scaffold | Scaffold a new custom SCAPI API |
scapi_custom_api_discovery | Discover custom SCAPI API endpoints |
Storefront Next development tools for building modern storefronts.
| Tool | Description |
|---|---|
storefront_next_development_guidelines | Get Storefront Next development guidelines and best practices |
storefront_next_site_theming | Configure and manage site theming for Storefront Next |
storefront_next_figma_to_component_workflow | Convert Figma designs to Storefront Next components |
storefront_next_generate_component | Generate a new Storefront Next component |
storefront_next_map_tokens_to_theme | Map design tokens to Storefront Next theme configuration |
storefront_next_design_decorator | Apply design decorators to Storefront Next components |
storefront_next_generate_page_designer_metadata | Generate Page Designer metadata for Storefront Next components |
scapi_discovery | Discover available SCAPI endpoints and capabilities |
scapi_custom_api_discovery | Discover custom SCAPI API endpoints |
mrt_bundle_push | Build, push bundle (optionally deploy) |
Note: Some tools appear in multiple toolsets (e.g.,
mrt_bundle_push,scapi_discovery). When using multiple toolsets, tools are automatically deduplicated.
The MCP server collects anonymous usage telemetry to help improve the developer experience. Telemetry is enabled by default.
Development mode: Telemetry is automatically disabled when using bin/dev.js, so local development and testing won't pollute production data.
Set options in the env object of your server entry in .cursor/mcp.json or ~/.cursor/mcp.json (the client injects these when it starts the server):
SF_DISABLE_TELEMETRY=true or SFCC_DISABLE_TELEMETRY=trueSFCC_APP_INSIGHTS_KEY=your-key# Install dependencies (from monorepo root)
pnpm install
# Navigate to the package directory
cd packages/b2c-dx-mcp
# Launch MCP Inspector for development (no build needed, uses TypeScript directly)
pnpm run inspect:dev
# Launch MCP Inspector with production build (runs build first)
pnpm run inspect
# Build the package
pnpm run build
# Run tests (includes linting)
pnpm run test
# Format code
pnpm run format
# Run linter only
pnpm run lint
# Clean build artifacts
pnpm run clean
Commands should be run from the packages/b2c-dx-mcp directory:
cd packages/b2c-dx-mcp
Or use pnpm's filter flag from the monorepo root:
pnpm --filter @salesforce/b2c-dx-mcp run <script>
Use MCP Inspector to browse tools and test them in a web UI:
pnpm run inspect:dev
This runs TypeScript directly (no build needed). Open the localhost URL shown in the terminal, click Connect, then List Tools to see available tools.
For CLI-based testing:
# List all tools
npx mcp-inspector --cli node bin/dev.js --toolsets all --allow-non-ga-tools --method tools/list
# Call a specific tool
npx mcp-inspector --cli node bin/dev.js --toolsets all --allow-non-ga-tools \
--method tools/call \
--tool-name storefront_next_design_decorator
Configure your IDE to use the local MCP server. Add this to your IDE's MCP configuration:
{
"mcpServers": {
"b2c-dx-local": {
"command": "node",
"args": [
"/full/path/to/packages/b2c-dx-mcp/bin/dev.js",
"--toolsets", "all",
"--allow-non-ga-tools"
]
}
}
}
Note: Make sure the script is executable:
chmod +x /full/path/to/packages/b2c-dx-mcp/bin/dev.jsThe script's shebang (
#!/usr/bin/env -S node --conditions development) handles Node.js setup automatically.
Note: Restart the MCP server in your IDE to pick up code changes.
Send raw MCP protocol messages:
# List all tools (--allow-non-ga-tools required for placeholder tools)
echo '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' | node bin/dev.js --toolsets all --allow-non-ga-tools
# Call a specific tool
echo '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"cartridge_deploy","arguments":{}}}' | node bin/dev.js --toolsets all --allow-non-ga-tools
Apache-2.0
FAQs
MCP server for B2C Commerce Cloud developer experience tools
We found that @salesforce/b2c-dx-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 28 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.

Company News
Socket is proud to join the OpenJS Foundation as a Silver Member, deepening our commitment to the long-term health and security of the JavaScript ecosystem.

Security News
npm now links to Socket's security analysis on every package page. Here's what you'll find when you click through.