# upload_images Convert external image URLs, data: URIs, or LOCAL FILE PATHS into site-hosted CDN URLs by reading/downloading each image and re-uploading it to the WebCake backend. Use this whenever the user supplies their OWN images (their URLs or files from their machine), or a page is built from a reference HTML/URL. The returned CDN URLs go straight into an image element Agent View of the PolicyLayer registry record for `upload_images`. HTML page: https://policylayer.com/tools/webcake-storefront/upload-images ## Facts - Tool: `upload_images` - Server: Webcake Storefront (`webcake-storefront-mcp`) — https://policylayer.com/tools/webcake-storefront.md - Install: `npx -y webcake-storefront-mcp` - Homepage: git+https://github.com/vuluu2k/webcake-storefront-mcp.git - Risk category: Write (Medium risk) - Registry record: grade F, identity unverified - Server rate-limited: no - Parameters: 0 - Recommended policy verdict: Rate-limited ## Example call (MCP tools/call, JSON-RPC 2.0) ```json { "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "upload_images", "arguments": {} } } ``` ## Why upload_images is rated Medium This tool creates and modifies data by uploading images to a CDN and integrating them into site content. While it reads external URLs/files as input, its primary effect is writing/storing new image assets on the backend and modifying site state. This is reversible (images can be deleted or replaced later), so it maps to Write rather than Execute or Destructive. From the tool's own definition: "Tool description states it performs upload/re-upload operations: 'downloading each image and re-uploading it to the WebCake backend' and 'returned CDN URLs go straight into an image element', indicating persistent modification of site content." ## Use case AI agents use upload_images to create or update resources in Webcake Storefront, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Webcake Storefront environment. ## Recommended policy (PolicyLayer) Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Webcake Storefront: ```json { "version": "1", "default": "deny", "tools": { "upload_images": { "limits": [ { "counter": "upload_images_rate", "window": "minute", "max": 30, "scope": "grant" } ] } } } ``` ## Other tools on Webcake Storefront (286) - `clear_page_draft` — Destructive — https://policylayer.com/tools/webcake-storefront/clear-page-draft.md - `delete_affiliate_accounts` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-affiliate-accounts.md - `delete_affiliate_products` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-affiliate-products.md - `delete_appointment_addresses` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-appointment-addresses.md - `delete_appointment_calendars` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-appointment-calendars.md - `delete_appointment_classifies` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-appointment-classifies.md - `delete_appointment_employees` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-appointment-employees.md - `delete_article` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-article.md - `delete_automation` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-automation.md - `delete_collection` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-collection.md - `delete_contacts` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-contacts.md - `delete_course` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-course.md - `delete_courses` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-courses.md - `delete_domain` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-domain.md - `delete_employees` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-employees.md - `delete_global_section` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-global-section.md - `delete_global_source` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-global-source.md - `delete_page` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-page.md - `delete_partner_feeds` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-partner-feeds.md - `delete_product` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-product.md - `delete_product_category` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-product-category.md - `delete_redirect_urls` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-redirect-urls.md - `delete_saved_filter` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-saved-filter.md - `delete_site_utms` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-site-utms.md - `delete_subscribers` — Destructive — https://policylayer.com/tools/webcake-storefront/delete-subscribers.md - `empty_media_trash` — Destructive — https://policylayer.com/tools/webcake-storefront/empty-media-trash.md - `remove_font` — Destructive — https://policylayer.com/tools/webcake-storefront/remove-font.md - `remove_font_group` — Destructive — https://policylayer.com/tools/webcake-storefront/remove-font-group.md - `remove_reviews` — Destructive — https://policylayer.com/tools/webcake-storefront/remove-reviews.md - `unblock_all_phone_customers` — Destructive — https://policylayer.com/tools/webcake-storefront/unblock-all-phone-customers.md - …and 256 more: https://policylayer.com/tools/webcake-storefront.md ## For agents This record is a snapshot. Live verdicts and the full registry: - Check every server in your MCP config at once: `npx -y policylayer stack` - Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md) - Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events` --- Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=webcake-storefront · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/webcake-storefront