SFCC Field Notes - Oleksandr Katerynchuk Notes on Salesforce Commerce Cloud (SFCC) architecture, development, and platform internals. 2025-12-11T00:00:00Z https://www.okater.com/ Oleksandr Katerynchuk SFCC Vibe Coding with an MCP Server 2025-12-11T00:00:00Z https://www.okater.com/posts/sfcc-vibe-coding-mcp-server/ <p>At this point, it is hard to imagine SFCC development without using AI. It speeds things up significantly. Of course, you need to be careful with it, which is a separate &quot;Vibe Coding&quot; topic.</p> <p>The specific challenge with SFCC Vibe Coding is that standard LLMs usually aren't very good with SFCC context.</p> <p>To cover that gap, we can use an MCP Server. This allows the AI to actually understand our environment. 📖 <a href="https://www.linkedin.com/pulse/taming-ai-beast-custom-toolkit-supercharge-copilot-commerce-theunen-0i7se/">Thomas Theunen describes this concept perfectly here</a>.</p> <p>I created a video guide on how to configure this and a demo showing Copilot automatically fetching error logs to resolve issues.</p> <div class="video-embed"><iframe src="https://www.youtube.com/embed/cSs0u9b_vhk" title="SFCC Vibe Coding with an MCP Server" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen="" loading="lazy"></iframe></div> <p>MCP Server: <a href="https://sfcc-mcp-dev.rhino-inquisitor.com/">https://sfcc-mcp-dev.rhino-inquisitor.com</a> (Creator: Thomas Theunen)</p> <p>There are some security concerns:</p> <ol> <li><strong>dw.json</strong> — I'd suggest creating a dedicated SFCC account/credentials with a limited access to sandboxes only, maybe DEV, but definitely not STG/PRD. It might be one shared account per project/team.</li> <li><strong>OCAPI Client</strong> — Same here, a dedicated API Client per project with a limited access to sandboxes (and maybe DEV) only.</li> <li><strong>3rd-party MCP Server</strong> — While MCP Server from Thomas sounds reliable, it is still 3rd-party with unexpected updates. And enterprise security models can be against it. In this case we can clone it (since it's under MIT).</li> </ol> Using an MCP Server to give AI coding assistants real SFCC context — a video walkthrough, and the security tradeoffs worth knowing before you wire one up.