MCP Capabilities & Limitations

🧪 Audit method. Live capability test of the Webflow MCP server (both claude.ai Webflow and webflow_mcp_test installations -- schemas are identical) against the Collection Tests site (id 628848057f4f99d7ae0b8128). Each capability was either exercised (called with real arguments and the result observed) or spec-only (schema present but not exercised live). Reference docs used: Webflow Data API v2.0.0 + Webflow Designer Extension API documentation. Test date 2026-05-10.

Two transports, very different prerequisites

The Webflow MCP exposes two separate surfaces that behave nothing like each other operationally.

⚠️ Designer prerequisite. Every Designer-tool call returns a hard error containing the launch URL until the user clicks it (https://.design.webflow.com?app=) and brings the Designer tab to the foreground. The bridge then drops if the tab loses focus or if multiple Designer tools are called in parallel. This is the single biggest UX gotcha. There is no headless mode.

TL;DR -- The headlines

1. The MCP is a curated subset of the public APIs, not a 1:1 wrapper. It gives you the Webflow primitives most often needed for content automation and AI-assisted design -- but Forms, Ecommerce, Memberships, asset upload, interactions/animations, page deletion, and most workspace-level actions are simply absent.
2. Component definitions cannot be created from scratch by either API. The only way is transform_element_to_component -- convert an existing canvas element. Component properties (the named slots/variables that make a component reusable) cannot be defined or overridden via the MCP at all.
3. Interactions / Animations / Page Transitions are completely missing from both transports. The Webflow Designer's interactions panel is not addressable through the MCP at all.
4. Asset binary upload is missing. You can rename, retag, foldering, but no upload tool exists in either transport.
5. A real bug: every Data-API endpoint that returns 204 No Content (item delete, field delete, webhook delete) reports "undefined" is not valid JSON -- even though the call succeeded. Verify by re-listing.
6. Localization requires secondary locales to already exist. The Data API explicitly rejects calls with the primary locale ID: "The provided locale must be a secondary locale." Without a configured secondary locale you cannot exercise the localization endpoints.
7. CMS Collection element is a hollow shell on the Designer side. You can create the wrapper, but cannot bind it to a collection or add an Item template -- dynamic CMS templating cannot be built via the MCP.

Coverage map at a glance

CMS -- Data API surface

Collections

Field types -- confirmed creatable (16)

PlainText, RichText, Number, Color, DateTime, Email, Phone, Link, VideoLink, Switch, Image, MultiImage, File (via create_collection_static_field); Option (single-select via create_collection_option_field); Reference, MultiReference (via create_collection_reference_field).

Field types not supported via the MCP

• Set (multi-select / multi-option)
• Ecommerce-specific (SkuValues, SkuProperties, currency/price)
• Membership-specific (User)

Field-level operations

Items

Field-value gotchas observed

• VideoLink is asymmetric: write "https://youtu.be/...", server stores a structured object including metadata.html (embedly iframe), thumb, aspectRatio, videoId etc. Diff tools must normalise.
• Option requires the option ID (not the name) when writing items.
• update_collection_items requires name and slug in fieldData even on partial field updates.
• Every item carries a cmsLocaleId even on single-locale sites (the primary locale's id) -- but get_site does not return a locales array on single-locale workspaces, so the only way to discover the primary id is to read any item or to receive an error from a localized endpoint.

Pages & Components -- Data API

Pages

Pages -- confirmed gaps

Components (Data API)

Scripts, Webhooks, Comments, Enterprise -- Data API

Scripts (custom code)

Webhooks

list_webhooks, get_webhook, create_webhook (17 trigger types), delete_webhook -- all confirmed.

delete_webhook exhibits the 204 parse-error bug (succeeds + reports parse error). get_webhook does not include lastTriggered despite Webflow REST exposing it.

Trigger types accepted (verified enum):

form_submission, site_publish, page_created, page_metadata_updated, page_deleted, ecomm_new_order, ecomm_order_changed, ecomm_inventory_changed, user_account_added, user_account_updated, user_account_deleted, collection_item_created, collection_item_changed, collection_item_deleted, collection_item_published, collection_item_unpublished, comment_created.

Comments

Read-only by design -- list_comment_threads, get_comment_thread, list_comment_replies. No create/reply/resolve in REST or MCP.

Enterprise

Schemas exist for 301_redirects CRUD, robots.txt PUT/PATCH/DELETE/GET, well-known files, site activity logs. Every action returns "This site does not have an Enterprise hosting plan." on non-Enterprise sites -- plan-gated.

Designer surface -- live tests

⚙️ Operational notes for the Designer bridge. Foreground-tab requirement, parallel-call sensitivity, and partial-batch returns are reproducible. A write call that times out can still apply its change (create_page did so during testing). See the Quirks table at the bottom for the full list.

Pages (de_page_tool)

Elements (element_tool, element_builder, whtml_builder, element_snapshot_tool)

Section, Container, BlockContainer, Heading (h1-h6), TextBlock, Paragraph, Button, TextLink, LinkBlock, Blockquote, DivBlock, RichText, CodeBlock, HtmlEmbed, Video, YouTubeVideo, Lightbox, Tabs, Slider, Dropdown, DOM (any tag), BY_CUSTOM_TAG, Form (returns as FormWrapper), CMSCollection (returns as DynamoWrapper), ComponentSlot (returns as Slot -- only inside open_component_view).

FormBlockLabel, FormTextInput, FormTextarea, FormCheckboxInput, FormRadioInput, FormSelect, FormFileUploadWrapper, FormButton -- all reject placement outside a Form. Server enforces and fails the entire batch, not just the offending element.

You can create a CMSCollection element (it renders as the design-time placeholder "Double-click to connect to a collection"). You cannot:

• Bind it to a Webflow CMS collection (no set_collection_source action).
• Add an Item template inside it. Heading (and most non-Block children) rejected with "Heading can not be placed in a Collection List Wrapper." There is no CMSCollectionItem element type in the enum.

→ Dynamic CMS templating cannot be built via the MCP.

✅ Confirmed working. Single root element required. CSS may use Webflow breakpoint media queries (max-width: 991px, 767px, 479px). @keyframes and arbitrary @media ranges are documented as not allowed. Classes referenced in CSS are auto-created as Webflow style classes.

element_snapshot_tool ✅ returns inline PNG. Confirmed for both a single element and the entire page body.

Styles (style_tool)

Breakpoint enum:xxl, xl, large, main, medium, small, tiny. Pseudo enum:noPseudo, nth-child(odd), nth-child(even), first-child, last-child, hover, active, pressed, visited, focus, focus-visible, focus-within, placeholder, empty, before, after.

Variables (variable_tool)

Components (de_component_tool, component_builder)

Assets (asset_tool, get_image_preview)

Localization

Both the Data API and the underlying REST require a secondary locale id for content updates:

• get_page_metadata and get_page_content accept localeId, but if you supply the primary locale id you get "The provided locale must be a secondary locale."
• update_static_content and update_component_content and update_component_properties are all per-locale write operations, all secondary-locale-only.
• The site under test (Collection Tests) has no secondary locales -- so the write paths cannot be exercised end-to-end here.

Everything should work given a configured secondary locale; the surface itself is wired correctly.

Confirmed bugs and quirks

What is completely missing from the MCP

Surfaces documented in the Webflow Data API or Designer Extension API but not wrapped at all by the MCP:

Absent transports / surfaces

• Forms -- list forms, get form, list/get/update/delete submissions, list submissions by site.
• Ecommerce -- products, SKUs, orders (list/get/update/fulfill/unfulfill/refund), inventory, ecommerce settings.
• Users / Memberships -- list/get/update/delete user, invite user, list access groups.
• Asset upload -- REST POST /sites/:id/assets; Designer Extension create-an-asset. No MCP equivalent.
• Asset delete, asset folder delete/rename/move.
• Custom code: register hosted (URL) script.
• Custom code: site-level apply (only per-page apply is exposed).
• Granular delete of a single applied script (only delete-all per page or per site).
• Token introspection / authorized-by.
• Workspace audit logs get action.
• Workspace management -- create/update/delete workspace, get site plan.
• Site lifecycle -- cannot create, duplicate, transfer, or delete a site.

Absent capabilities within wrapped surfaces

• CMS -- collection delete / rename / duplicate; field type change; option-list edit; reference-target change; create-and-publish in one call; unpublish item; filter items by field value or lastPublished range; full-text search.
• Pages -- delete page; duplicate page; set is-homepage; set password; per-page publish; branching lifecycle; site-level SEO defaults; sitemap config; favicon / webclip; 404 page.
• Components -- define a component definition from scratch; define component properties; override properties on a specific instance; detach a component instance; rename a slot.
• Variables -- rename (BETA tool exists but no-ops); delete (same); delete a mode; delete a collection; reorder; move variables between collections.
• Styles -- rename a class; reorder classes; duplicate a class; detach a class from a single element override.
• Elements -- move an element; reorder children; duplicate an element. (Workaround: read schema + recreate in target.)
• Interactions / Animations / Page Transitions -- completely absent. The Webflow Designer's Interactions 2.0 and Webflow Animations are not addressable.
• Backups, branches, versioning -- UI only.

Recommended workflows & gotchas

✅ For content automation (the strongest use case): CMS via Data API is reliable. Build collections + fields + items + publish. Just remember to (a) publish the site once via UI before publish-items will succeed, (b) ignore the empty-body parse error on deletes, and (c) treat the staged endpoint as the only writer.

🛠️ For AI-assisted design via Designer: keep the Designer tab in the foreground at all times. Issue Designer calls serially -- parallelism is the most common cause of timeouts. Treat write timeouts as "may have succeeded" -- re-query before retrying. Build component definitions by first creating an element on the canvas, then calling transform_element_to_component.

🚫 Don't try to: build dynamic CMS templates (CMS Collection element is a hollow shell), wire up interactions/animations, upload images, define component props, or operate on Forms/Ecommerce/Memberships through the MCP. None of those paths exist.

Test artifacts left on the site

These artifacts were created during the audit and remain on the site (the MCP does not expose delete tools for them):

• PageMCP Test Page (id 6a00417e68bd8a66e81e7413) -- no delete-page action in either MCP transport.
• ComponentsMCP Card (id 8ba3db6a-ea58-13b5-6d20-13698393f937) and MCP Chip (id 53b3c687-2718-269a-d2b8-74d902b865a2) -- unregister_component not exercised.
• Asset folderMCP Test Folder -- no delete-folder action.
• Variable collectionMCP Test Tokens and MCP variables (Brand Color, Spacing Lg, Z Index Modal, Hero Width, Body Font, Hero Height, Brand Alias) -- delete_variable BETA action returned empty.
• CMS collectionMCP Capability Test (id 6a0022ef57fc602a9927b09d) and one item Test Item One -- no delete_collection action.
• Inline scriptMCPTest (id mcptest, hosted CDN URL) -- no per-id delete; the delete_all_site_scripts action would be needed.
• Webhook for collection_item_created was created and successfully deleted (verified).
• Style classmcp-test-class was successfully deleted; combo is-large reported "not found" (likely cascaded).

These can be cleaned up manually in the Webflow UI when convenient.

Reported (unverified) -- pending verification

📣 Provenance. The items below were relayed by a third party (a CMS-to-Webflow migration team) and have not yet been reproduced against a live test. They are logged here for tracking and should be promoted into the verified audit above once confirmed -- or removed if they fail to reproduce. Reported: 2026-07-17.

1. JSON-LD structured data -- not writable via REST (Reported -- 2026-07-17)

Reported that the Webflow REST API cannot add structured data (JSON-LD) in the dedicated page section. This is not currently covered by the live audit above (the closest existing row is the missing site-level SEO defaults, which is a different capability). To verify: attempt a JSON-LD write via the page SEO / update_page_settings path on the Collection Tests site.

2. Rich Text component-property values -- not writable (Reported -- 2026-07-17)

Reported that Rich Text-type component property values cannot be written:

• Via the MCP -- cannot write to a component property of type Rich Text.
• Via the Designer Extension API (underlying) -- component properties can be updated except Rich Text, where an HTML structure cannot be inserted.

This refines rather than contradicts the verified findings above. The audit records that update_component_properties (Data API) works for per-locale value overrides, and that component props cannot be defined/overridden on the Designer side at all. The reported nuance adds a property-type exception (Rich Text) that the audit did not test. To verify: attempt a Rich Text prop value write in a secondary locale via update_component_properties.

🔀 Layer note (reconciliation). The reporter distinguishes three layers -- the underlying REST API, the MCP wrapper, and the underlying Designer Extension API -- whereas the audit above models two transports inside the MCP (Data tools / Designer tools). The reporter's "Designer API can update props except Rich Text" describes the raw Designer Extension API, not the MCP; the audit's "props can't be touched" describes the MCP wrapper, which does not expose that capability. The two are consistent: the MCP simply does not wrap the Designer Extension API's component-property support.