Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add SalesforceCommerceCloud/b2c-developer-tooling --skill b2c-mcp-configgit clone --depth 1 https://github.com/SalesforceCommerceCloud/b2c-developer-toolingWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/salesforcecommercecloud/b2c-developer-tooling/b2c-mcp-config)<a href="https://agentmods.dev/skills/salesforcecommercecloud/b2c-developer-tooling/b2c-mcp-config"><img src="https://agentmods.dev/badge/skills/salesforcecommercecloud/b2c-developer-tooling/b2c-mcp-config/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/salesforcecommercecloud/b2c-developer-tooling/b2c-mcp-config"><img src="https://agentmods.dev/badge/skills/salesforcecommercecloud/b2c-developer-tooling/b2c-mcp-config.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00044 | $0.01067 |
| Opus 5.5 | $0.00018 | $0.00427 |
| Sonnet 5.5 | $0.00009 | $0.00213 |
| Haiku 4.5 | $0.00004 | $0.00107 |
Grade A, and why
b2c-mcp-config scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 15d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 88 lines — stays where its author put it; the contents beside it link to each section on GitHub.
MCP Configuration
For MCP installation, tool selection, or other MCP workflows, see the server skill index.
Inspect resolved values
Call config_inspect directly with the task's absolute projectDirectory.
No prior skill read is required. Secrets are masked by default (unmask: false).
The result includes effective values, contributing sources, warnings, and
resolution identifying the selected project, configuration file, and instance.
Use the returned hostname, site, tenant, and other configured values. Report missing values rather than inventing them. Inspection does not verify remote credentials or connectivity.
Reading dw.json manually is usually unnecessary: it may not be the selected
file or contain the effective values. Avoid dumping configuration files or the
environment to discover credentials. Inspect source files only for a requested
edit or a specific issue the resolved output cannot explain. Set unmask: true
only when the user explicitly requests secret values.
Where configuration comes from
MCP tools use the same resolver as the CLI. Value precedence, highest first:
launch overrides/environment (including project .env), high-priority config
plugins, dw.json, ~/.mobify (MRT key), low-priority config plugins, then
package.json under b2c for non-sensitive defaults.
- Project: per-call
projectDirectory, then server--project-directory/SFCC_PROJECT_DIRECTORY, then server working directory. The agent's project may differ from the server's working directory; pass it explicitly. - Primary file: per-call
configPath, startup--config/SFCC_CONFIG, project.envSFCC_CONFIG, projectdw.json, then shared global default. RelativeconfigPathresolves fromprojectDirectory. - Instance:
instanceNameselects a named instance from the primary/shared catalog; otherwise configured active/default selection applies. Override only to select another target; useresolutionto confirm it. - Configuration files are reloaded for each configuration-dependent tool call. Restart MCP after changing launch flags or its process environment. Existing debugger sessions retain their selected target.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 15d ago First seen · 88 lines · 44 tokens per session scan A 637526b179ec
b2c-mcp-config is a skill published in the GitHub repository SalesforceCommerceCloud/b2c-developer-tooling (56 stars, last pushed yesterday), licensed Apache-2.0. It adds 44 tokens to every session and 1,067 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-03.
Other skills, from other repositories
shopping
Skill "shopping" from Hmbown/Codewhale, covering shopping, when to use, setup, workflow and non-goals.
daiso-cli
A command-line interface for searching Daiso and related Korean shopping, store, food, cinema, and convenience-store data through the Daiso project. It can return structured JSON for searches and comparisons.
goofish-publish-item
A workflow for publishing second-hand items on Xianyu, a Chinese marketplace for used goods. It turns an item description and images into a category, title, listing text, and a ready-to-submit listing.
goofish-reply-buyer
A Chinese-language workflow for handling buyer messages on Xianyu, a Chinese second-hand marketplace. It reviews conversations, classifies buyer intent, and drafts replies according to the seller’s rules, but waits for human approval before sending.
goofish-shop-diagnosis
A read-only diagnostic workflow for Xianyu shops and listings. It compares how a shop’s items appear in marketplace search with their stored details to investigate visibility and sales problems.
booking-cli
Searches Booking.com from the terminal via cli-web-booking — find hotels, apartments, and hostels by destination, dates, and guests; get property details by slug; resolve destination names to IDs. Use when the user asks about Booking.com, hotel search, accommodation prices, property ratings, or comparing places to…