How Commerce.com and Cloudflare are getting storefronts ready for AI agents

An AI assistant can now instantly discover the necessary functions on a Commerce.com storefront, eliminating the need for guesswork when an agent is tasked with finding a specific item. This capability is enabled across nearly 100,000 Commerce.com domains utilizing WebMCP within Cloudflare.

The challenge for automated shoppers is that current websites were designed with human users in mind, not robotic agents. Most agents today operate by examining a site's HTML structure, guessing which element performs a certain action, clicking it, and then trying again if the attempt fails. This method is inherently slow, consumes substantial processing tokens, and even minor visual adjustments, such as a theme change, can cause the entire process to break down. WebMCP, which stems from a browser standard proposed by Google, solves this by furnishing AI agents with structured utilities directly on the page, such as a `search_products` function. Rather than sifting through visual elements, the agent invokes the precise tool it requires, leading to shopping experiences that are quicker, less costly, and significantly more dependable.

Since WebMCP remains an experimental, proposed browser standard in its early preview phase, access to it is currently restricted to specific avenues: experimental Chrome flags (accessible via `chrome://flags/#enable-webmcp-testing`), Chrome Origin Trials, certain agent-focused browsers, and development environments like Cloudflare Kitesurf. In August, the beta deployment of WebMCP reached the edge infrastructure. Enabling this feature causes Cloudflare to insert a minimal script at the edge, thereby making those specialized tools available automatically, without requiring store proprietors to write any code.

Commerce.com, a flexible e-commerce platform engineered for the AI era, already leverages Cloudflare to operate its nearly 100,000 domains. Consequently, when the preview became available, their question was: "Can we activate this for every one of our stores simultaneously?" This piece explores the reasons behind Commerce.com's desire for WebMCP, the method devised to implement edge-level opt-outs ensuring every merchant retains command, and the lessons learned throughout this process.

Kristina Pototska, Product Management Director at Commerce.com, elaborates on the significance of WebMCP for online shops: “Merchants keep asking us how they can keep up with agentic shopping. When a shopper asks an agent to find something, merchants want their store to be in the answer. They want to keep the customer, keep control of the checkout, and do it without rebuilding their site. WebMCP helps with all three. The agent gets real tools to search products, check details, build a cart, and get a checkout link, so it doesn’t have to guess its way around the page. The human shopper stays on the merchant’s site, and the merchant keeps the relationship.”

The objective was to implement this in a secure manner, avoiding the need for merchants to manually alter their themes or perform any manual adjustments. This is where the collaboration with Cloudflare proved exceptionally effective. Furthermore, WebMCP operates concurrently with their server-side MCP, providing comprehensive coverage for the various ways agents interact with commerce. Server-side MCP accommodates agents that link directly to a store, such as an assistant assisting someone across multiple websites. Conversely, WebMCP supports agents operating within the shopper’s web browser. Since the collection of shopping functions is identical in both scenarios, merchants face no requirement to choose between them or manage them separately.

The technical foundation of this integration rests upon two core concepts. First, the WebMCP utilities execute directly within the shopper's active browsing session on the storefront's domain, guaranteeing the agent views the identical pricing and cart status. No sensitive login data is shared with an external party, and the entire visit remains hosted on the merchant's platform. Second, Cloudflare functions as the edge delivery layer for Commerce.com’s backend MCP server, proxying tool definitions and actions without modification, thus preserving complete oversight of the tool logic for the merchants.

When a user visits an enabled Commerce.com shop, the AI assistant no longer needs to guess how to navigate the site; instead, it can immediately detect the available tools via WebMCP. Imagine instructing your agent: "Locate a trail running shoe that is waterproof, costs less than $140, is size 10, and place it in my cart." Without WebMCP, the agent would attempt to mimic human clicks, only to encounter obstacles like cookie notifications, misinterpretations of variant selection menus, or bot challenges designed to differentiate automated traffic from genuine customers. With WebMCP, the agent recognizes the store's functions on `document.modelContext` and executes two precise commands: `- search_products({ query: "trail running shoe", max_price: 140, size: 10 })` and `- add_to_cart({ product_id: "shoe_123" })`. Because the agent functions within your live browser session on the store's domain, your shopping cart updates in real time. Commerce.com’s backend MCP server manages the purchasing progression; when you are prepared to finalize the transaction, you click checkout yourself, thereby safeguarding your payment information and maintaining your full control over the concluding purchase.

When Commerce.com requested the activation of WebMCP across nearly 100,000 storefronts, a practical hurdle arose: WebMCP was initially conceived as a simple on/off switch for an entire domain zone. Commerce desired to deploy their `mcp-server-client` toolpack, which acts as an edge intermediary—forwarding tool definitions and requests directly from Commerce.com’s backend MCP server to the visitor's browser. Since Commerce.com utilizes Cloudflare for SaaS hosting thousands of merchant vanity domains within shared zones, a mechanism was necessary to deploy this platform-wide while simultaneously providing individual store owners with an effortless method to opt out.

1. Enabling for all Commerce.com stores, with individual opt-outs available. Instead of constructing an elaborate custom whitelist, the team integrated WebMCP with Cloudflare's established mechanisms of Configuration Rules and custom hostname metadata. Commerce.com activates WebMCP for its primary zone, subsequently adding an edge rule that inspects the merchant's metadata. Should a merchant toggle the "opt-out" switch within their Commerce.com control panel, Cloudflare automatically bypasses WebMCP for that specific storefront: `{ "action": "set_config", "expression": "cf.hostname.metadata.webmcp_opt_out eq \"true\"", "action_parameters": { "webmcp_enabled": false } }`. Because Cloudflare processes these rules at the edge before delivering the page, a store that has chosen to opt out experiences no added delay, no external queries, and no injected code.

2. Customizable endpoints and safe fallback options. As is common with any release in preview, real-world collaboration revealed several practical nuances that were not initially foreseen: Custom MCP paths: When the `mcp-server-client` toolpack was activated, the bridge initially anticipated locating every site's MCP server at `/mcp`. Since Commerce.com's server resides at `/api/mcp`, a configurable MCP URL setting was introduced at the zone level to manage this. When this setting is applied, the custom pathway is passed into the inserted script tag. Seamless fallbacks: If a store's MCP server is unavailable or the customer's browser lacks support for WebMCP, the script terminates. The storefront loads as expected, and human shoppers are unaffected.

Looking ahead, investment in WebMCP will continue as the standard matures, beginning with improving how agents locate a site's available tools. Cloudflare and Commerce.com plan to collaborate further to ensure that shopping facilitated by agents remains fast, dependable, and secure for both vendors and consumers. If you are attending Cloudflare Connect in San Francisco on October 21, 2026, you can meet the team at the session titled "Getting your storefront agent ready for peak season," which will feature Kristina Pototska (Product Management Director, Commerce), Justis Blasco (CTO and Co-Founder, Popmenu), Ross Harvey (Head of Infrastructure, Fruugo), and Josh Mills (VP of Engineering, Gopuff).