# create_product

Create a product so the storefront has real merchandise (grid-product / slider-product bindings need this). Simple use: pass name + price (+ images, category_ids). One default variation with the price/stock is created for you. Advanced use: pass attributes (e.g. Color/Size) + variations for a multi-SKU product. Images must be HOSTED URLs — get them from search_images or upload_images first. The backend generates id, slug and publishes the product.

Agent View of the PolicyLayer registry record for `create_product`. HTML page: https://policylayer.com/tools/webcake-storefront/create-product

## Facts

- Tool: `create_product`
- Server: Webcake Storefront (`webcake-storefront-mcp`) — https://policylayer.com/tools/webcake-storefront.md
- Install: `npx -y webcake-storefront-mcp`
- Homepage: git+https://github.com/vuluu2k/webcake-storefront-mcp.git
- Risk category: Write (Medium risk)
- Registry record: grade F, identity unverified
- Server rate-limited: no
- Parameters: 0
- Recommended policy verdict: Rate-limited

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "create_product",
    "arguments": {}
  }
}
```

## Why create_product is rated Medium

The tool creates and publishes new product records in the storefront database. While this modifies the storefront's product catalog, it is reversible (products can be edited or deleted), distinguishing it from Destructive actions. The tool does not execute arbitrary code, delete data, or move money.

From the tool's own definition: "Tool creates product merchandise in the storefront via name, price, images, category_ids, attributes, and variations."

## Use case

AI agents use create_product to create or update resources in Webcake Storefront, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Webcake Storefront environment.

## Recommended policy (PolicyLayer)

Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Webcake Storefront:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "create_product": {
      "limits": [
        {
          "counter": "create_product_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}
```

## Other tools on Webcake Storefront (286)

- `clear_page_draft` — Destructive — https://policylayer.com/tools/webcake-storefront/clear-page-draft.md
- `delete_affiliate_accounts` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-affiliate-accounts.md
- `delete_affiliate_products` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-affiliate-products.md
- `delete_appointment_addresses` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-appointment-addresses.md
- `delete_appointment_calendars` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-appointment-calendars.md
- `delete_appointment_classifies` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-appointment-classifies.md
- `delete_appointment_employees` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-appointment-employees.md
- `delete_article` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-article.md
- `delete_automation` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-automation.md
- `delete_collection` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-collection.md
- `delete_contacts` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-contacts.md
- `delete_course` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-course.md
- `delete_courses` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-courses.md
- `delete_domain` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-domain.md
- `delete_employees` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-employees.md
- `delete_global_section` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-global-section.md
- `delete_global_source` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-global-source.md
- `delete_page` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-page.md
- `delete_partner_feeds` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-partner-feeds.md
- `delete_product` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-product.md
- `delete_product_category` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-product-category.md
- `delete_redirect_urls` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-redirect-urls.md
- `delete_saved_filter` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-saved-filter.md
- `delete_site_utms` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-site-utms.md
- `delete_subscribers` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-subscribers.md
- `empty_media_trash` — Destructive — https://policylayer.com/tools/webcake-storefront/empty-media-trash.md
- `remove_font` — Destructive — https://policylayer.com/tools/webcake-storefront/remove-font.md
- `remove_font_group` — Destructive — https://policylayer.com/tools/webcake-storefront/remove-font-group.md
- `remove_reviews` — Destructive — https://policylayer.com/tools/webcake-storefront/remove-reviews.md
- `unblock_all_phone_customers` — Destructive — https://policylayer.com/tools/webcake-storefront/unblock-all-phone-customers.md
- …and 256 more: https://policylayer.com/tools/webcake-storefront.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=webcake-storefront · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/webcake-storefront