Data API Tools

Scripts

The Scripts tool (formerly Custom Code) allows you to register, apply, and manage custom scripts for your Webflow sites. Add inline JavaScript, tracking codes, analytics, or other custom scripts to site headers or footers.

When to use

Use the Scripts tool to:

  • Add tracking codes: Implement Google Analytics, Facebook Pixel, or other tracking
  • Custom functionality: Add JavaScript for custom behaviors or integrations
  • Third-party integrations: Include scripts from external services

Currently, only site-level, inline custom code is supported, and only JavaScript scripts can be applied. To apply page-level scripts, use the Custom DOM element and update the tag to script.

Tool details

Tool name: data_scripts_tool

Available actions

List registered scripts

View all scripts registered for a site that are available to be applied.

Action: list_registered_scripts

Parameters:

ParameterTypeRequiredDescription
site_idstringYesUnique identifier for the site

Returns: Array of registered scripts with IDs, names, and metadata

Example usage:

Show me all registered scripts for site [site_id]

List applied scripts

Retrieve scripts currently applied to a site.

Action: list_applied_scripts

Parameters:

ParameterTypeRequiredDescription
site_idstringYesUnique identifier for the site

Returns: Array of applied scripts with their configuration

Example usage:

What scripts are currently active on site [site_id]?

Use this to audit which scripts are running on your site before adding new ones.

Add inline site script

Register and apply a new inline script to a site.

Action: add_inline_site_script

Parameters:

ParameterTypeRequiredDescription
site_idstringYesUnique identifier for the site
sourceCodestringYesJavaScript code (max 2000 characters)
versionstringYesVersion identifier for the script
displayNamestringYesHuman-readable name for the script
locationstringNoWhere to place the script: header or footer (default)
canCopybooleanNoWhether the script can be copied
attributesobjectNoCustom attributes for the script tag

Example usage:

Add Google Analytics tracking to site [site_id] in the header

Scripts are limited to 2000 characters. For longer scripts, host them externally and use a script tag to include them.

Delete all site scripts

Remove all custom scripts applied to a site by the MCP server.

Action: delete_all_site_scripts

Parameters:

ParameterTypeRequiredDescription
site_idstringYesUnique identifier for the site

Returns: Confirmation of deletion

Example usage:

Remove all custom scripts from site [site_id]

This action removes ALL scripts applied through the MCP server. This operation cannot be undone.

Best practices

Header scripts (location: "header"):

  • Critical JavaScript that must load before page content
  • Fonts or CSS dependencies
  • Scripts that modify the DOM before rendering

Footer scripts (location: "footer", default):

  • Analytics and tracking codes
  • Non-critical JavaScript
  • Third-party widgets
  • Social media scripts

Footer placement is generally preferred for better page load performance.

Minify your JavaScript to reduce character count and fit within the 2000 character limit. For larger scripts:

  • Host externally and include via script tag
  • Split into multiple smaller scripts
  • Load from a CDN

Use meaningful version identifiers to track script changes:

  • v1.0.0 - Initial version
  • v1.1.0 - Added features
  • v2.0.0 - Major changes

This helps with troubleshooting and rollbacks.

After adding scripts, test your site thoroughly before publishing:

  • Check browser console for errors
  • Verify tracking codes are firing
  • Test on multiple browsers and devices
  • Ensure scripts don’t interfere with site functionality

Use descriptive displayName values that clearly indicate what each script does:

  • “Google Analytics 4 Tracking”
  • “Facebook Pixel - Purchase Events”
  • “Custom Form Validation”
  • “Hotjar Heatmap Tracking”

Limitations

  • Character limit: Scripts are limited to 2000 characters
  • Inline only: Can only add inline scripts, not external file references. To add external scripts, use script tags in the Designer.
  • MCP-managed only: delete_all_site_scripts only removes scripts added through the MCP server
  • Publishing required: Scripts must be published to appear on the live site
  • No execution in MCP: Scripts are registered but not executed by the MCP server itself

Security considerations

Important security notes:

  • Only add scripts from trusted sources
  • Never include sensitive data (API keys, passwords) in scripts
  • Validate and sanitize any user input used in scripts
  • Be cautious with third-party scripts that can access site data
  • Regularly audit and update scripts to patch security vulnerabilities
Sites

Publish sites to make script changes live

Pages

Manage page-specific content

Elements

Add HTML embed elements for more complex code