WebMCP for ecommerce: what it is, who supports it and what retailers should do now

Direct answer: WebMCP is a proposed web standard that lets your store's pages tell an AI agent running in the shopper's browser exactly what it can do there (search the catalogue, read a product, update the cart, go to checkout) as callable tools, instead of the agent guessing its way around buttons and drop-downs. In October 2026 it is still experimental, but it is already live at scale: Shopify registers WebMCP tools on its Liquid storefronts, BigCommerce switched it on by default for eligible storefronts on 21 October 2026, and the ChatGPT desktop app's built-in browser uses it. Most retailers on those platforms should check what their store now exposes; retailers on other platforms should get the foundations right first and add a small, read-only tool set when they have the engineering time.

Last verified: 23 October 2026. WebMCP is changing quickly, so every platform and browser fact below links to its source.

What WebMCP is

Today, an agent that shops in a browser works from the page as a person would see it: it reads the layout, guesses which element is the size selector, clicks, and tries again when it gets it wrong. Chrome's documentation calls this "actuation". WebMCP gives the page a way to declare its capabilities instead.

According to Chrome's WebMCP documentation (last updated 7 October 2026), a page can register tools such as checkout or filter_results, each with a name, a plain-language description and a JSON Schema for its inputs. A browser agent discovers those tools and calls them, and the tools run on your page in the shopper's tab, so the shopper can see what happens.

There are two ways to register a tool:

On status: the WebMCP specification is a Draft Community Group Report of the W3C Web Machine Learning Community Group (the version we checked is dated 20 October 2026), edited by people from Microsoft and Google. A technical note from a separate W3C community group states plainly that it is "not a W3C Standard nor is it on the W3C Standards Track". The API has already changed during the preview: the February 2026 early preview described navigator.modelContext, current documentation uses document.modelContext, and a tool is now unregistered with an AbortSignal rather than an unregisterTool() call (Chrome imperative API docs, updated 16 October 2026). Anything you build by hand should expect further changes.

WebMCP vs MCP, UCP and ACP

The names overlap, so it helps to place WebMCP against the other agent protocols a retailer hears about.

Three practical consequences follow.

1. WebMCP does not get you discovered. Chrome's documentation lists "tool discoverability" as a limitation: "Clients and browsers must visit a site directly to know if it has callable tools." Whether an agent comes to your store at all still depends on search, your product feed and your structured data.
2. It works with the shopper's own session. Shopify's documentation is explicit that cart changes made through its WebMCP tools "change the cart the shopper sees". BigCommerce's adds that tool calls go from the shopper's browser to your storefront's own domain, so no credentials go to a third party.
3. It reuses your MCP work. BigCommerce syncs the tools from its server-side Storefront MCP into WebMCP, and Shopify's checkout WebMCP tools implement the same UCP checkout capability as its server-side Checkout MCP. One set of shopping tools, two delivery routes.

Who supports it (October 2026)

Browsers and agents

From the WebMCP implementation status page and the vendors' own pages, checked 23 October 2026:

The ChatGPT entry matters most for retailers, because it puts WebMCP in front of ordinary shoppers rather than developers. OpenAI's help page lists "Update a shopping cart" among the things site tools can do, and says ChatGPT asks for confirmation before sensitive actions, including making purchases.

Ecommerce platforms

What the Shopify and BigCommerce tools do

Shopify's storefront tools, as documented:

On checkout, Shopify swaps in get_checkout, update_checkout, complete_checkout and navigate_to_storefront. Its documentation tells agent builders to show the buyer the current order and total and get their permission before calling complete_checkout, and states that Checkout WebMCP doesn't accept new card details: a Shop Pay buyer can pick a saved card, and other payment methods are chosen by the buyer on the page.

BigCommerce's B2C tools are synced from Storefront MCP: search_products, get_product_details, related_products, add_item_to_cart, update_cart_item, remove_item_from_cart and create_checkout_url. The agent builds the cart and hands back a checkout link; the shopper completes the purchase on the storefront. With Storefront MCP off, WebMCP exposes only two default image tools that read content credentials (C2PA).

Why it matters to retailers

WebMCP serves agents that work in a browser alongside the shopper, and that is the kind of agent most stores already let in. In our Agent Commerce Index (Q4 2026), of the 116 stores where the basket test could run, 8 (7%) let a page-fetching agent reach checkout, while 96 (83%) let in an agent that browses like a person. (The Index explainer covers how that was measured.) A browsing agent that gets in still has to read your page correctly; WebMCP replaces that guesswork with your own answers.

The upside is accuracy. When a tool returns the price, stock and variant from your store, the agent no longer has to infer them from the layout, which is where size, colour and price mix-ups come from. The risk is the reverse: a tool that returns stale or wrong data is now an authoritative-looking source of wrong data, so your tool output, your page and your structured data have to agree.

It does not fix what happens before or around the visit. Which stores an agent visits still depends on feeds, search results and structured data; a captcha on checkout still stops the flow (Shopify's checkout docs ask agents to sign requests with Web Bot Auth and warn that "without it, bot detection might deprioritize or block your requests"); and a forced account login still ends the journey.

The free Agent Conversion Score does not test WebMCP tools themselves: they only exist inside a browser that supports them. It checks the things those tools depend on, using the published specification: whether agent identities are refused, whether guest checkout exists (TRX-01), whether there is a captcha on cart or checkout (TRX-03) and whether discovery documents for UCP (TRX-04), ACP (TRX-05) and MCP (TRX-06) are published.

What to do, by platform

If you are on Shopify

1. Confirm the tools are there. Open a product page in Chrome with WebMCP enabled, then open DevTools → Application → WebMCP to see the registered tools (Chrome DevTools guide).
2. Check that your cart behaves. Shopify's cart tools call the standard storefront actions, so if your theme or an app overrides cart behaviour, try update_cart from DevTools and confirm the cart drawer and totals update correctly.
3. Fill in your policies and FAQs. search_shop_policies_and_faqs answers from your store's own content. Vague or missing returns and delivery terms become vague answers to the agent.
4. Headless on Hydrogen? The tools load by default on Hydrogen 2026-10 when the browser supports WebMCP; set webMcp to false only if you have a reason to opt out.

If you are on BigCommerce

1. Check the script. Run curl -s https://your-store.example | grep webmcp. A /.webmcp/bridge.js tag means WebMCP is active.
2. Decide on Storefront MCP. Without it, only the image tools are exposed. Turning it on is what gives browser agents search, cart and checkout-link tools.
3. Know the opt-out. Settings → API and MCP → MCP. BigCommerce warns that disabling can take a couple of days to take full effect, and re-enabling needs Support.

If you run a custom, headless or other-platform store

Start small and read-only. A sensible first set is product search, product detail (with variants, price and stock) and a returns-and-delivery policy lookup. Add cart tools once those are reliable, and leave payment to the page.

A minimal imperative tool, with feature detection so nothing changes for browsers without WebMCP:

if ("modelContext" in document) {
  document.modelContext.registerTool({
    name: "search_products",
    description: "Search this store's products. Returns name, URL, price, currency and stock for up to 10 matches.",
    inputSchema: {
      type: "object",
      properties: {
        query: { type: "string", description: "What the shopper is looking for" },
        max_price: { type: "number", description: "Optional maximum price in the store currency" }
      },
      required: ["query"]
    },
    annotations: { readOnlyHint: true },
    async execute({ query, max_price }, { signal }) {
      const res = await fetch(`/api/search?q=${encodeURIComponent(query)}&max=${max_price ?? ""}`, { signal });
      return JSON.stringify(await res.json());
    }
  });
}

Or turn an existing search form into a tool with the declarative API:

<form action="/search" toolname="search_products"
      tooldescription="Search this store's products by keyword." toolautosubmit>
  <label for="q">Search</label>
  <input id="q" name="q" type="search">
</form>

Keep the same validation, pricing and stock logic on your server that the page uses. A tool is a new way in to your existing functions, not a second copy of them.

Security and design rules

Chrome's WebMCP tool security guidance (updated 1 September 2026) and the imperative API docs give the main rules:

Two more points for retailers. Chrome's own documentation notes that extensions can query and run WebMCP tools, so never put anything in a tool, or its output, that you would not show the signed-in shopper on the page. And keep the shopper in the loop for payment: every platform implementation we reviewed leaves the final purchase to the shopper's confirmation or to the checkout page.

How to test it

1. In Chrome, enable chrome://flags/#enable-webmcp-testing and relaunch.
2. Open your product, search and cart pages and check DevTools → Application → WebMCP. Run each tool by hand with realistic inputs, including a sold-out item and a misspelt query.
3. Compare each tool's price, currency, stock and variant with the page and with your JSON-LD for the same product. They should match exactly.
4. Try a natural-language task with the Model Context Tool Inspector or the example agent extension linked from Chrome's documentation, for example "find a medium black jacket under 150 and add it to my basket", and watch which tools it calls.
5. Re-test after theme, app and checkout releases. A release that breaks a cart action breaks it for agents too.

The Simulated Agent Buyer runs browser agents through your purchase flow with every step recorded, which shows where an agent stalls whether or not it is using WebMCP.

Sources

All checked on 23 October 2026.

• Chrome for Developers: WebMCP, Imperative API, Declarative API, tool security, origin trial, DevTools
• W3C Web Machine Learning Community Group: WebMCP specification and implementation status
• Microsoft Edge: WebMCP origin trial
• OpenAI: Using site tools in the ChatGPT desktop app
• Shopify: WebMCP tools, Checkout WebMCP, changelog
• BigCommerce: WebMCP developer docs, announcement
• Cloudflare: Give any website a WebMCP interface, Commerce.com and Cloudflare