Cloudflare, Commerce.com Enable WebMCP Stores

Cloudflare and Commerce.com are enabling WebMCP across nearly 100,000 storefront domains so browser-based AI agents can use defined shopping tools instead of guessing at page buttons. Cloudflare injects a small script at the network edge, and individual merchants can opt out through a setting in their Commerce.com dashboard. WebMCP is an experimental proposed browser standard from Google, available in early preview through experimental Chrome flags, Chrome Origin Trials, some agentic browsers and developer environments such as Cloudflare Kitesurf. Cloudflare launched its edge implementation in beta in August.

Commerce.com Product Management Director Kristina Pototska says merchants want stores to appear in agent shopping results, retain customers and control checkout without rebuilding their sites. WebMCP gives agents tools to search products, check details, build a cart and provide a checkout link, while shoppers remain on the merchant’s site. It works alongside server-side MCP: that approach supports agents connecting directly to stores, while WebMCP serves agents operating in a shopper’s browser. Both use the same shopping tools. The integration runs WebMCP tools in the shopper’s active browser session on the store’s domain, so the agent sees the same prices and cart; credentials are not sent to a third party. Cloudflare proxies the backend MCP server’s tool definitions and actions unchanged, leaving merchants in control of their tool logic.

For a request to find a waterproof trail-running shoe under $140 in size 10 and add it to a cart, an agent without WebMCP may struggle with cookie banners, variant menus or bot checks while simulating clicks. With WebMCP, it can discover tools through document.modelContext, call search_products and add_to_cart, and update the cart in the active session. The shopper still clicks checkout to complete the purchase, keeping payment details secure and control of the final transaction.

Commerce.com asked to enable WebMCP across almost 100,000 storefronts hosted on shared Cloudflare zones. Since the standard was designed as a domain-wide switch, Cloudflare connected it to Configuration Rules and custom hostname metadata: the platform enables WebMCP for its main zone, while an edge rule checks each merchant’s opt-out setting. Opted-out stores receive no injected script, remote lookup or added latency. Cloudflare also added a zone-level MCP URL setting after finding Commerce.com’s server at /api/mcp rather than the bridge’s expected /mcp path. If a store’s MCP server is offline or a browser lacks WebMCP support, the script exits and the storefront loads normally. Cloudflare says it will continue developing WebMCP as the standard evolves, including ways to help agents find site tools.

Cloudflare and Commerce.com are enabling WebMCP across nearly 100,000 storefront domains so browser-based AI agents can use defined shopping tools instead of guessing at page buttons. Cloudflare injects a small script at the network edge, and individual merchants can opt out through a setting in their Commerce.com dashboard. WebMCP is an experimental proposed browser standard from Google, available in early preview through experimental Chrome flags, Chrome Origin Trials, some agentic browsers and developer environments such as Cloudflare Kitesurf. Cloudflare launched its edge implementation in beta in August.

Commerce.com Product Management Director Kristina Pototska says merchants want stores to appear in agent shopping results, retain customers and control checkout without rebuilding their sites. WebMCP gives agents tools to search products, check details, build a cart and provide a checkout link, while shoppers remain on the merchant’s site. It works alongside server-side MCP: that approach supports agents connecting directly to stores, while WebMCP serves agents operating in a shopper’s browser. Both use the same shopping tools. The integration runs WebMCP tools in the shopper’s active browser session on the store’s domain, so the agent sees the same prices and cart; credentials are not sent to a third party. Cloudflare proxies the backend MCP server’s tool definitions and actions unchanged, leaving merchants in control of their tool logic.

For a request to find a waterproof trail-running shoe under $140 in size 10 and add it to a cart, an agent without WebMCP may struggle with cookie banners, variant menus or bot checks while simulating clicks. With WebMCP, it can discover tools through document.modelContext, call search_products and add_to_cart, and update the cart in the active session. The shopper still clicks checkout to complete the purchase, keeping payment details secure and control of the final transaction.

Commerce.com asked to enable WebMCP across almost 100,000 storefronts hosted on shared Cloudflare zones. Since the standard was designed as a domain-wide switch, Cloudflare connected it to Configuration Rules and custom hostname metadata: the platform enables WebMCP for its main zone, while an edge rule checks each merchant’s opt-out setting. Opted-out stores receive no injected script, remote lookup or added latency. Cloudflare also added a zone-level MCP URL setting after finding Commerce.com’s server at /api/mcp rather than the bridge’s expected /mcp path. If a store’s MCP server is offline or a browser lacks WebMCP support, the script exits and the storefront loads normally. Cloudflare says it will continue developing WebMCP as the standard evolves, including ways to help agents find site tools.