You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/cli/index.md
+26Lines changed: 26 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -27,6 +27,32 @@ These flags are available on all commands that interact with B2C instances:
27
27
|`--username`, `-u`|`SFCC_USERNAME`| Username for Basic Auth |
28
28
|`--password`, `-p`|`SFCC_PASSWORD`| Password/access key for Basic Auth |
29
29
30
+
### Safety Mode
31
+
32
+
Safety Mode provides protection against accidental or unwanted destructive operations. This is particularly important when using the CLI in automated environments, CI/CD pipelines, or as a tool for AI agents.
33
+
34
+
| Environment Variable | Values | Description |
35
+
| ---------------------- | ------ | ----------- |
36
+
|`SFCC_SAFETY_LEVEL`|`NONE` (default) | No restrictions |
37
+
||`NO_DELETE`| Block DELETE operations |
38
+
||`NO_UPDATE`| Block DELETE and destructive operations (reset, stop, restart) |
39
+
||`READ_ONLY`| Block all write operations (GET only) |
40
+
41
+
**Example:**
42
+
```bash
43
+
# Prevent deletions in CI/CD
44
+
export SFCC_SAFETY_LEVEL=NO_DELETE
45
+
b2c sandbox create --realm test# ✅ Allowed
46
+
b2c sandbox delete test-id # ❌ Blocked
47
+
48
+
# Read-only mode for reporting
49
+
export SFCC_SAFETY_LEVEL=READ_ONLY
50
+
b2c sandbox list # ✅ Allowed
51
+
b2c sandbox create --realm test# ❌ Blocked
52
+
```
53
+
54
+
Safety Mode operates at the HTTP layer and cannot be bypassed by command-line flags. See the [Security Guide](/guide/security#operational-security-safety-mode) for detailed information.
Copy file name to clipboardExpand all lines: docs/guide/security.md
+39Lines changed: 39 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -64,6 +64,44 @@ When adding a new dependency that requires build scripts:
64
64
65
65
This project uses [NPM trusted publishers](https://docs.npmjs.com/trusted-publishers) for package publication. Instead of storing long-lived npm tokens, packages are published via GitHub Actions using short-lived OIDC tokens that cannot be extracted or reused.
66
66
67
+
## Operational Security: Safety Mode
68
+
69
+
The CLI includes a **Safety Mode** feature via CLI checks and HTTP middleware that prevents accidental or unwanted destructive operations. This is particularly important when:
70
+
71
+
- Providing the CLI as a tool to AI agents/LLMs
72
+
- Working in production environments
73
+
- Training new team members
74
+
- Running commands from untrusted scripts
75
+
76
+
### Safety Levels
77
+
78
+
Configure via the `SFCC_SAFETY_LEVEL` environment variable:
Copy file name to clipboardExpand all lines: docs/mcp/figma-tools-setup.md
+5-5Lines changed: 5 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,7 +4,7 @@ description: Prerequisites and setup for Figma-to-component tools (workflow orch
4
4
5
5
# Figma-to-Component Tools Setup
6
6
7
-
Prerequisites and setup for using the Figma workflow tools: `storefront_next_figma_to_component_workflow`, `storefront_next_generate_component`, and `storefront_next_map_tokens_to_theme`.
7
+
Prerequisites and setup for using the Figma workflow tools: `sfnext_start_figma_workflow`, `sfnext_analyze_component`, and `sfnext_match_tokens_to_theme`.
8
8
9
9
> **Note:** 🚧 This MCP tool is for Storefront Next. Storefront Next is part of a closed pilot and isn't available for general use.
10
10
@@ -15,7 +15,7 @@ The Figma-to-component workflow requires an **external Figma MCP server** to fet
15
15
**Prerequisites:**
16
16
- b2c-dx-mcp configured with `--allow-non-ga-tools` flag (Figma tools are preview)
17
17
- Storefront Next project
18
-
-`app.css` theme file (required for `storefront_next_map_tokens_to_theme` tool; optional path can be provided)
18
+
-`app.css` theme file (required for `sfnext_match_tokens_to_theme` tool; optional path can be provided)
19
19
- External Figma MCP server enabled in your MCP client
20
20
21
21
See [Installation](./installation) for b2c-dx-mcp setup.
@@ -49,8 +49,8 @@ If the Figma MCP server is not enabled, the workflow tool will still return inst
Copy file name to clipboardExpand all lines: docs/mcp/tools/pwakit-get-guidelines.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,13 +2,13 @@
2
2
description: Get PWA Kit v3 development guidelines and best practices for React, Chakra UI, and Commerce API.
3
3
---
4
4
5
-
# pwakit_development_guidelines
5
+
# pwakit_get_guidelines
6
6
7
7
Returns critical architecture rules, coding standards, and best practices for building PWA Kit v3 applications with React, Chakra UI, and Commerce API.
8
8
9
9
## Overview
10
10
11
-
The `pwakit_development_guidelines` tool provides essential development guidance for PWA Kit v3. It:
11
+
The `pwakit_get_guidelines` tool provides essential development guidance for PWA Kit v3. It:
12
12
13
13
1. Returns comprehensive guidelines by default (quick-reference plus key sections).
14
14
2. Supports retrieving specific topic sections on demand.
Copy file name to clipboardExpand all lines: docs/mcp/tools/scapi-custom-api-generate-scaffold.md
+5-5Lines changed: 5 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,19 +2,19 @@
2
2
description: Generate a new custom SCAPI endpoint (OAS 3.0 schema, api.json, script.js) in an existing cartridge.
3
3
---
4
4
5
-
# scapi_custom_api_scaffold
5
+
# scapi_custom_api_generate_scaffold
6
6
7
7
Generate a new custom SCAPI endpoint in an existing cartridge. Creates `schema.yaml` (OAS 3.0 contract), `api.json` (endpoint mapping), and `script.js` (implementation) under the cartridge's `rest-apis/<apiName>/` directory.
8
8
9
9
## Overview
10
10
11
-
The `scapi_custom_api_scaffold` tool scaffolds a new custom API using the B2C tooling SDK's `custom-api` scaffold. It:
11
+
The `scapi_custom_api_generate_scaffold` tool scaffolds a new custom API using the B2C tooling SDK's `custom-api` scaffold. It:
12
12
13
13
- Creates an OpenAPI 3.0 schema, API manifest, and script stub in your project.
14
14
- Uses the first cartridge found in the project if you don't specify one.
15
15
- Supports **shopper** (siteId, customer-facing) or **admin** (no siteId) API types.
16
16
17
-
**No instance or OAuth required** — this tool works locally and only writes files into your project. To check registration status after deployment, use [`scapi_custom_apis_status`](./scapi-custom-apis-status).
17
+
**No instance or OAuth required** — this tool works locally and only writes files into your project. To check registration status after deployment, use [`scapi_custom_apis_get_status`](./scapi-custom-apis-get-status).
18
18
19
19
## Parameters
20
20
@@ -78,15 +78,15 @@ Returns the scaffold ID, output directory, and list of created files:
78
78
1.**Edit**`schema.yaml` to define paths, request/response schemas, and operation IDs.
79
79
2.**Edit**`script.js` to implement the endpoint logic.
80
80
3.**Deploy** the cartridge to your instance and **activate** the code version to register the API.
81
-
4.**Verify** with [`scapi_custom_apis_status`](./scapi-custom-apis-status) that endpoints show as `active`.
81
+
4.**Verify** with [`scapi_custom_apis_get_status`](./scapi-custom-apis-get-status) that endpoints show as `active`.
82
82
83
83
Shopper APIs are available at:
84
84
`https://{shortCode}.api.commercecloud.salesforce.com/custom/{apiName}/v1/organizations/{organizationId}/...` and require the `siteId` query parameter and ShopperToken authentication.
85
85
86
86
## Related Tools
87
87
88
88
- Part of the [SCAPI](../toolsets#scapi), [PWAV3](../toolsets#pwav3), and [STOREFRONTNEXT](../toolsets#storefrontnext) toolsets
89
-
-[`scapi_custom_apis_status`](./scapi-custom-apis-status) — Check custom API endpoint registration status after deployment
89
+
-[`scapi_custom_apis_get_status`](./scapi-custom-apis-get-status) — Check custom API endpoint registration status after deployment
90
90
-[`scapi_schemas_list`](./scapi-schemas-list) — List or fetch custom API schemas (use `apiFamily: "custom"`)
Copy file name to clipboardExpand all lines: docs/mcp/tools/scapi-custom-apis-get-status.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,15 +2,15 @@
2
2
description: Check the registration status of custom SCAPI endpoints deployed on your B2C Commerce instance.
3
3
---
4
4
5
-
# scapi_custom_apis_status
5
+
# scapi_custom_apis_get_status
6
6
7
7
List custom SCAPI endpoint registration status (active/not_registered). Returns one row per endpoint per site with detailed status information.
8
8
9
9
## Overview
10
10
11
11
Checks the registration status of custom API endpoints deployed on your B2C Commerce instance. Returns endpoint status (`active` or `not_registered`) with per-site details.
12
12
13
-
**Note:** This tool queries your live instance. For schema definitions, use [`scapi_schemas_list`](./scapi-schemas-list) with `apiFamily: "custom"`. To create a new custom API, use [`scapi_custom_api_scaffold`](./scapi-custom-api-scaffold).
13
+
**Note:** This tool queries your live instance. For schema definitions, use [`scapi_schemas_list`](./scapi-schemas-list) with `apiFamily: "custom"`. To create a new custom API, use [`scapi_custom_api_generate_scaffold`](./scapi-custom-api-generate-scaffold).
0 commit comments