Webflow MCP Server (official)
Capped at 70: no passing tool call yet; the tests add up to 75. Why scores are capped
Test points add up to 75; the score is capped at 70 until a tool call passes. Not a quality or security rating. Methodology
Test points before the cap (75/100)
- Install20/20
- Handshake5/30
- Maintenance25/25
- Docs15/15
- License10/10
Also offered: a hosted remote server at https://mcp.webflow.com/sse with OAuth sign-in, per the README (checked 2026-10-28). Needs credentials Not tested We tested the npm package above, not this remote server.
Transport (tested 2026-10-28): stdio
Score 70/100 · Tools — · Token cost — · Compare · Last tested 2026-10-28 · Version tested 1.0.0 · Package webflow-mcp-server · Repo webflow/mcp-server
Summary: Webflow MCP Server (official) requires credentials or a backing service before it will list tools.
Evidence summary
- Handshake
- auth-gated
- Tools listed
- —
- Context cost
- Not measured ranking
- API key
- Needs a key
- Tested
- 2026-10-28
Test results
| Test | Result | Points | Evidence |
|---|---|---|---|
| install | pass | 20 | npm install webflow-mcp-server (Node 20, Linux) succeeded in 6s. |
| handshake | auth-gated | 5 | Auth-gated: without credentials the server only printed a missing-credential message and did not list tools ("… exited code 1; first stderr line: 'Error: WEBFLOW_TOKEN is missing' (our test runner keeps only the last 400 chars of …"). Not tested with real credentials; not counted as working. |
| maintenance | pass | 25 | Repo pushed 1 days before test; 140 GitHub stars. |
| docs | pass | 15 | README over 3,000 chars; install instructions present; mcpServers config example present. Automated check of the package's own README (README shipped in npm package). |
| license | pass | 10 | MIT (OSI-approved). |
Local-model readiness
Not yet tested (no tools/list response without credentials).
What we tested and what we didn't
Tested on 2026-10-28
- Install from the registry
- We attempted an MCP initialize with no credentials; it stopped at a credential check, so we never reached the tool list (Method details:
initializedid not complete;tools/listnot sent) - Maintenance signals (last push, archived/deprecated status)
- Docs (README length, install and config example)
- License (OSI-approved or not)
Not tested
- Security: not audited (no code review, no permission or data-flow analysis)
- Real tasks (no functional task runs yet)
- Behaviour with real credentials or a real account
- Performance, rate limits or load
- Correctness of results beyond the listed tasks
Methodology: how we test. A high score means it installs and responds, not that it is safe to give it access to your data.
Known security issues
Not yet checked.
Monthly roundup: MCP security issues, October 2026.
Tool list changes
No tool list: this server did not list tools without credentials in our test, so tool changes are not tracked.
Raw test record (JSON)
{
"name": "webflow-mcp-server",
"version": "1.0.0",
"registry": "npm",
"status": "auth-gated",
"tested": "2026-10-28",
"tools_count": null,
"tools_schema_tokens_est": null,
"deprecated": false,
"archived": false,
"tests": {
"install": [
"pass",
20,
"`npm install webflow-mcp-server` (Node 20, Linux) succeeded in 6s."
],
"handshake": [
"auth-gated",
5,
"Auth-gated: without credentials the server only printed a missing-credential message and did not list tools (\"\u2026 exited code 1; first stderr line: 'Error: WEBFLOW_TOKEN is missing' (our test runner keeps only the last 400 chars of \u2026\"). Not tested with real credentials; not counted as working."
],
"maintenance": [
"pass",
25,
"Repo pushed 1 days before test; 140 GitHub stars."
],
"docs": [
"pass",
15,
"README over 3,000 chars; install instructions present; `mcpServers` config example present. Automated check of the package's own README (README shipped in npm package)."
],
"license": [
"pass",
10,
"MIT (OSI-approved)."
]
}
}Install
npx -y webflow-mcp-server
Tools listed
Not available (handshake did not complete without credentials).
Quick config
{
"mcpServers": {
"webflow-mcp-server-official": {
"command": "npx",
"args": [
"-y",
"webflow-mcp-server"
],
"env": {
"WEBFLOW_TOKEN": "<your key>"
}
}
}
}API key: set WEBFLOW_TOKEN in env (replace <your key>). Our handshake ran without it; real use needs it.
Add to config Opens the config generator with this server selected.
Setup
Without credentials it said (verbatim): … exited code 1; first stderr line: 'Error: WEBFLOW_TOKEN is missing' (our test runner keeps only the last 400 chars of …
Env var seen in our test: WEBFLOW_TOKEN
- Install. Run
npm install webflow-mcp-server(Node 20). This is the exact command we ran on 2026-10-28. - Configure. Add the mcpServers entry below to your MCP client config and set WEBFLOW_TOKEN.
- Verify. Restart the client and check that tools/list returns tools. In our test it did not list tools without credentials.
{
"mcpServers": {
"webflow-mcp-server-official": {
"command": "npx",
"args": [
"-y",
"webflow-mcp-server"
],
"env": {
"WEBFLOW_TOKEN": "<your key>"
}
}
}
}Not tested with credentials We have not tested this with real credentials.
Test history
No dated events yet.
Related: MCP servers that need an API key · How to secure AI API keys
FAQ
Is Webflow MCP Server (official) deprecated?
No. webflow-mcp-server was not deprecated or archived when we last tested it on 2026-10-28.
What replaces Webflow MCP Server (official)?
Nothing; Webflow MCP Server (official) is not deprecated as of 2026-10-28.
Does Webflow MCP Server (official) need an API key?
Yes. Without credentials it only printed a missing-credential message and did not list tools (auth-gated).
Embed the badge
Every tested server gets a free embeddable badge. It shows the current score and test date and expires after 90 days. Testing is free; payment never changes a score.