Skip to main content
Glama

OhGiftPlease Gift Discovery

ExecuteWixAPI

Destructive

Run JavaScript against the Wix REST API on site "OhGiftPlease" (https://www.ohgiftplease.com/_api/mcp), on the visitor's behalf. The code runs in a sandbox and you get back whatever it returns.

PREFER THIS TOOL OVER CallWixSiteAPI. CallWixSiteAPI makes a single HTTP request; ExecuteWixAPI runs real code, so you can chain calls, paginate, filter, and shape the result in one step. Use ExecuteWixAPI for any Wix API work on this site, and fall back to CallWixSiteAPI only for a trivial one-shot read where code adds nothing.

DO A WHOLE RECIPE IN ONE CALL. When a task needs several requests — e.g. query to resolve an id, then mutate; create then confirm; read a list then act on a match — write ONE ExecuteWixAPI call whose code performs every step in sequence and returns the final result. Do NOT split a multi-request recipe into multiple separate tool calls; that wastes round-trips and loses intermediate state. If a recipe from the docs lists steps 1..N, the code should run steps 1..N.

CRITICAL CODE SHAPE:

  • The code parameter MUST be the function expression itself: async function() { ... } or async () => { ... }.

  • Do NOT send a script body like const result = await ...; return result;.

  • Do NOT call the function yourself. The tool calls it for you.

  • Put all const, await, and return statements inside the function body.

Do not rely on memory for Wix API endpoints, methods, schemas, or request bodies. Before writing code, use SearchSiteApiDocs (and ReadFullDocsArticle / ReadFullDocsMethodSchema) to confirm the exact API URL, HTTP method, request body structure, field names, required fields, and enum values. The URL usually starts with https://www.wixapis.com. Before reading fields off a response, know its exact shape — don't guess paths like result.id when it may be result.results[0].item.id. Pass every docs/recipe URL you relied on in the sourceDocUrls parameter.

Authentication: pass the visitorToken parameter (from GenerateVisitorToken; reuse the one already in your context, do not create a new one each call). Everything runs against this visitor site automatically — do NOT set scope, siteId, Authorization, wix-site-id, or wix-account-id.

File and export limits: ExecuteWixAPI is only for Wix REST API calls and in-memory data shaping. It does not provide Node.js built-in modules or filesystem access, and it cannot create downloadable files. Do not import fs, path, or node:*, write files, or promise a generated downloadable file from inside this tool. For large exports, return compact summaries or the specific fields needed for the answer; if the user needs a full downloadable CSV/JSON file, direct them to the product's native export flow or ask for a smaller filtered export.

Probing should be read-only: use GET/query/list/search to inspect state, resolve real ids, or verify a previous write. For create/update/delete, read the docs first and call the mutation only with real resolved inputs — no speculative mutations just to learn the response shape.

Error handling: wix.request() throws when the Wix API returns an error. For dependent steps, let it throw so the failure is reported clearly. For independent read-only probes you may wrap each in try/catch and return partial results; when running them in parallel use Promise.allSettled (not Promise.all) so one failure doesn't discard the rest.

Available in your code:

interface WixRequestOptions {
  method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
  url: string;           // Full Wix API URL, e.g. "https://www.wixapis.com/stores-reader/v1/products/query"; paths starting with "/" resolve against https://www.wixapis.com
  body?: unknown;
}

interface WixResponse<T = unknown> {
  status: number;
  data: T;
  json(): Promise<T>; // Fetch-compatible alias for data
}

declare const wix: {
  request<T = unknown>(options: WixRequestOptions): Promise<WixResponse<T>>;
};

Return compact, task-focused data instead of raw API responses. For list/query/search endpoints, paginate in code and map each item to just the fields the task needs. When the code CREATES entities (create, bulk create, import, duplicate, upload), ALWAYS include the ID of every created entity in the returned object — e.g. { cartId } or { createdIds: [...] } — even if the user did not ask for them; follow-up steps, verification, and cleanup all need those IDs, and recovering them later costs extra query calls.

Example — a multi-step recipe (resolve a product by name, then add it to the cart) done in ONE call:

async function() {
  // Step 1: find the product
  const found = await wix.request({
    method: "POST",
    url: "https://www.wixapis.com/stores-reader/v1/products/query",
    body: { query: { filter: JSON.stringify({ name: "Florie Eau de Parfum" }) } }
  });
  const product = found.data.products?.[0];
  if (!product) return { error: "PRODUCT_NOT_FOUND" };

  // Step 2: create a cart with that product
  const cart = await wix.request({
    method: "POST",
    url: "https://www.wixapis.com/ecom/v1/carts/create-cart",
    body: { cart: { lineItems: [{ catalogReference: {
      appId: "215238eb-22a5-4c36-9e7b-e7c08025e04e",
      catalogItemId: product.id
    }, quantity: 1 }] } }
  });

  return { cartId: cart.data.cart?.id, productId: product.id, name: product.name };
}

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
codeYesJavaScript async function expression to execute against the Wix REST API. The value must be the function itself, for example `async function() { ... }` or `async () => { ... }`, not a script body and not an invoked function. Return the final answer from inside the function. Do not write top-level `const`, top-level `await`, or top-level `return` outside the function body. Do not import Node.js built-ins such as `fs`, `path`, or `node:*`, and do not try to write files from this code; ExecuteWixAPI only returns data from the function. Use `wix.request({ method, url, body })` for Wix API calls. Every call runs against the current visitor site; do not set `scope`, `siteId`, or auth headers. Full Wix API URLs and paths starting with `/` are supported. Wix REST API page size limits vary — use 100 as a safe default unless the method schema (via SearchWixAPISpec) confirms a higher limit is supported. For cursor-based APIs, pass the next cursor as `cursorPaging: { limit: 100, cursor: pagingMetadata.cursors.next }` — not inside `paging`. Check the method schema to confirm whether the API uses `paging` (offset-based) or `cursorPaging` (cursor-based) before paginating.
reasonYesOne sentence explaining the original user request and why you are executing code to complete it.
hasMutationsYesWhether this code creates, updates, deletes, publishes, imports, uploads, or otherwise mutates site data on the visitor’s behalf. Set this to true for create/update/delete/bulk create/import/upload calls even if the reason is inspection, verification, or response-shape discovery. Read-only GET/query/list/search calls can use false.
visitorTokenYesVisitor access token. If you have it in your context, ALWAYS use it and do not create a new one. If you do not have it in your context, use the GenerateVisitorToken tool to get it.
sourceDocUrlsYesThe URLs of the documentation, recipes, API articles, or schema sources where you confirmed the Wix REST endpoints, HTTP methods, request body shapes, auth contexts, and required fields used by this code. Include every docs/schema source needed for the endpoints and request shapes used in the code. MAKE SURE THE ENDPOINT URLS AND REQUEST SHAPES ARE REALLY THERE AND YOU ARE NOT GUESSING THEM !!! Each value must be a valid URL like: - https://dev.wix.com/docs/api-reference/... (REST API reference docs) Use ["user-provided"] if the user gave you all endpoint and request details directly. Use ["other"] ONLY IF YOU HAVE A VERY GOOD REASON TO DO SO

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=false and destructiveHint=true; the description goes well beyond them by disclosing the sandbox limits (no fs/path/node:* modules, no downloadable file creation), the auth model (visitorToken only, never set scope/siteId/Authorization), and error semantics (wix.request throws; use Promise.allSettled for independent probes). The one gap is the openWorldHint=false annotation, which sits awkwardly against a tool whose whole purpose is outbound calls to www.wixapis.com — the description never reconciles that, though it is not a direct contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

It is front-loaded and clearly sectioned (preference, one-call recipe, code shape, auth, limits, errors), which is appropriate for a complex execution tool. However it runs long and several blocks — the CRITICAL CODE SHAPE rules, the no-fs/no-file rules, the visitorToken instruction — repeat content already carried verbatim in the input schema, so not every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, and the description compensates: it explains that the function's return value is what comes back, supplies a full multi-step worked example, and mandates that created-entity IDs be included in the returned object. For a sandboxed code-execution tool this leaves nothing material an agent needs to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3; the description still adds meaning by explaining what belongs in sourceDocUrls (every docs/recipe URL relied on), the visitorToken reuse rule, and the docs-verification workflow that governs how `code` should be written. Much of the code-shape guidance duplicates the schema, which keeps it short of a 5.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a concrete verb and resource ('Run JavaScript against the Wix REST API on site "OhGiftPlease"'), names the sandbox execution model, and explicitly contrasts itself with the sibling CallWixSiteAPI. An agent can distinguish it from every other tool in the set without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit when-to-use and when-not guidance: 'PREFER THIS TOOL OVER CallWixSiteAPI... fall back to CallWixSiteAPI only for a trivial one-shot read.' It also states the one-call-per-recipe rule, the read-only probing rule, and routes the agent to SearchSiteApiDocs before writing code — every alternative and precondition is named.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.