Commerce.com Enables AI Shopping Tools for 100,000 Stores via Cloudflare WebMCP
Cloudflare and Commerce.com deployed WebMCP tools across nearly 100,000 storefronts, allowing AI agents to interact directly with e-commerce sites without human-like navigation.
Key points
- Cloudflare and Commerce.com enabled WebMCP tools for almost 100,000 domains to support AI agent shopping.
- The integration uses an edge-level script that requires no code changes from merchants.
- WebMCP allows agents to call structured tools like search_products instead of guessing HTML elements.
Cloudflare and Commerce.com have enabled WebMCP tools across nearly 100,000 storefronts, allowing AI agents to interact directly with e-commerce sites. This deployment, announced in a joint research publication, turns on structured shopping tools for every store simultaneously while keeping individual merchants in control. The move addresses the difficulty AI agents face when navigating websites designed for human users rather than automated systems.
According to the Cloudflare blog post, traditional AI shopping agents struggle because they rely on interpreting HTML, guessing button functions, and clicking through pages. This process is slow, consumes significant computational tokens, and breaks easily when site themes change. WebMCP, a proposed browser standard from Google, solves this by providing agents with structured tools on a page, such as search_products, enabling direct and reliable interactions without visual interpretation.
Implementation and Technical Details
The integration relies on an edge implementation of WebMCP that Cloudflare launched in beta in August. By turning on this feature, Cloudflare injects a tiny script at the edge, making the necessary tools available automatically. Site owners do not need to write a single line of code or edit their themes to benefit from the update. This approach allows Commerce.com to enable the feature across its entire network of domains instantly, ensuring consistency and ease of adoption for all merchants.
Currently, WebMCP is available behind experimental Chrome flags, in Chrome Origin Trials, in some agentic browsers, and across developer environments like Cloudflare Kitesurf. Because it remains an experimental proposed browser standard in early preview, widespread public browser support is not yet universal. However, the infrastructure is now in place for agents operating within these supported environments to access Commerce.com storefronts using standardized tool calls rather than simulated human interactions.
Merchant Control and Security
Kristina Pototska, Product Management Director at Commerce.com, stated that merchants want to keep customers on their sites and maintain control of the checkout process without rebuilding their infrastructure. WebMCP supports this by allowing agents to search products, check details, build carts, and generate checkout links directly. The human shopper remains on the merchant’s site, preserving the customer relationship and data privacy.
The system ensures that WebMCP tools execute directly inside the shopper's active browser session on the storefront's domain. This means the agent sees the same prices and cart contents as the user, and no credentials are sent to third parties. Cloudflare acts as the edge delivery layer for Commerce.com’s backend MCP server, proxying tool definitions and actions unchanged. This setup allows merchants to maintain full control over their tool logic while supporting both server-side MCP for direct connections and WebMCP for browser-based agents.
What should you do?
Security and technology professionals should monitor the status of WebMCP as it moves from experimental preview to broader adoption. Merchants using Commerce.com should verify that their storefronts are correctly configured to handle structured agent interactions. Developers building AI shopping agents should test compatibility with WebMCP tools in supported environments like Cloudflare Kitesurf or via Chrome Origin Trials to ensure reliable performance.
What to do and how to stay safe: Cloudflare
- Review current AI agent implementations to see if they rely on fragile HTML parsing that could be replaced by structured tool calls.
- Monitor browser vendor updates for general availability of WebMCP support, as it is currently behind experimental flags.
- Ensure that e-commerce platforms maintain clear boundaries between agent interactions and human user sessions to preserve data integrity.
- Test agent behavior in environments supporting WebMCP to identify potential improvements in speed and reliability compared to traditional methods.
Step-by-step guide: Prompt Injection Warning Signs: How to Spot AI Manipulation
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many Commerce.com domains have WebMCP enabled?
Almost 100,000 Commerce.com domains now have WebMCP tools enabled through the Cloudflare integration.
Do merchants need to update their code to use WebMCP?
No, Cloudflare injects the necessary script at the edge, so site owners do not need to write code or edit themes.
Is WebMCP available in all web browsers?
No, it is currently available behind experimental Chrome flags, in Origin Trials, in some agentic browsers, and in developer environments.
