# scan_unique_images Scan all images used across page sources, global sources, and global sections. Returns a unique list of image URLs with which elements use each one. Useful for: image audit, finding broken/duplicated CDN URLs, bulk replace planning, theme migration. Scans every string field in the source tree (config.src, style.background-image, etc.) and CSS url(...) refs — wide net catches all variants. Agent View of the PolicyLayer registry record for `scan_unique_images`. HTML page: https://policylayer.com/tools/webcake-storefront/scan-unique-images ## Facts - Tool: `scan_unique_images` - Server: Webcake Storefront (`webcake-storefront-mcp`) — https://policylayer.com/tools/webcake-storefront.md - Install: `npx -y webcake-storefront-mcp` - Homepage: git+https://github.com/vuluu2k/webcake-storefront-mcp.git - Risk category: Read (Low risk) - Registry record: grade F, identity unverified - Server rate-limited: no - Parameters: 0 - Recommended policy verdict: Allowed ## Example call (MCP tools/call, JSON-RPC 2.0) ```json { "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "scan_unique_images", "arguments": {} } } ``` ## Why scan_unique_images is rated Low This tool only reads and aggregates data about existing images across the storefront without altering, creating, or deleting any content. The blast radius of misuse is minimal — an attacker gains visibility into image asset usage but cannot modify storefront configuration, execute commands, or cause data loss. This is a straightforward Read category tool. From the tool's own definition: "Tool scans and returns a unique list of image URLs and their usage locations. Action verbs are 'scan' and 'returns' — purely retrieval with no modification, creation, deletion, or execution of operations." Risk signals: Bulk/mass operation — affects multiple targets ## Use case AI agents call scan_unique_images to retrieve information from Webcake Storefront without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere. ## Recommended policy (PolicyLayer) Verdict: **Allowed**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Webcake Storefront: ```json { "version": "1", "default": "deny", "tools": { "scan_unique_images": {} } } ``` ## Other tools on Webcake Storefront (286) - `clear_page_draft` — Destructive — https://policylayer.com/tools/webcake-storefront/clear-page-draft.md - `delete_affiliate_accounts` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-affiliate-accounts.md - `delete_affiliate_products` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-affiliate-products.md - `delete_appointment_addresses` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-appointment-addresses.md - `delete_appointment_calendars` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-appointment-calendars.md - `delete_appointment_classifies` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-appointment-classifies.md - `delete_appointment_employees` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-appointment-employees.md - `delete_article` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-article.md - `delete_automation` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-automation.md - `delete_collection` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-collection.md - `delete_contacts` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-contacts.md - `delete_course` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-course.md - `delete_courses` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-courses.md - `delete_domain` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-domain.md - `delete_employees` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-employees.md - `delete_global_section` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-global-section.md - `delete_global_source` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-global-source.md - `delete_page` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-page.md - `delete_partner_feeds` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-partner-feeds.md - `delete_product` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-product.md - `delete_product_category` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-product-category.md - `delete_redirect_urls` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-redirect-urls.md - `delete_saved_filter` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-saved-filter.md - `delete_site_utms` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-site-utms.md - `delete_subscribers` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-subscribers.md - `empty_media_trash` — Destructive — https://policylayer.com/tools/webcake-storefront/empty-media-trash.md - `remove_font` — Destructive — https://policylayer.com/tools/webcake-storefront/remove-font.md - `remove_font_group` — Destructive — https://policylayer.com/tools/webcake-storefront/remove-font-group.md - `remove_reviews` — Destructive — https://policylayer.com/tools/webcake-storefront/remove-reviews.md - `unblock_all_phone_customers` — Destructive — https://policylayer.com/tools/webcake-storefront/unblock-all-phone-customers.md - …and 256 more: https://policylayer.com/tools/webcake-storefront.md ## For agents This record is a snapshot. Live verdicts and the full registry: - Check every server in your MCP config at once: `npx -y policylayer stack` - Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md) - Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events` --- Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=webcake-storefront · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/webcake-storefront