Artificial intelligence has made staggering leaps in recent years, mastering complex coding tasks and passing rigorous professional examinations like the bar exam. Yet, despite these advanced capabilities, an AI assistant still stumbles over a surprisingly mundane task: buying a pair of shoes online.
The underlying problem is not a lack of computational intelligence, but a fundamental mismatch in architecture. Modern websites were meticulously built for human eyes and hands, not automated digital agents. Today, most AI agents attempting to shop for users must scrape and interpret raw HTML code from a webpage, guessing which interactive element corresponds to a checkout button or a product filter. They click blindly, evaluate the visual or structural response, and try again when things inevitably break.
This trial-and-error process is slow, computationally expensive, and notoriously fragile. Something as seemingly innocuous as a routine visual theme change or a minor CSS update can completely derail an agentic browsing session.
To bridge this gap, Google introduced an experimental browser standard known as WebMCP, which equips AI agents with structured, direct tools on a webpage, such as search_products. Instead of visually hunting for buttons and parsing messy DOM trees, an agent can call the exact tool it requires directly. This makes the e-commerce experience significantly faster, cheaper, and far more reliable. Because WebMCP remains an experimental proposed browser standard in early preview, it is presently accessible behind experimental Chrome flags, through Chrome Origin Trials, in select agentic browsers, and across developer environments like Cloudflare Kitesurf.
Capitalizing on this emerging standard, Cloudflare launched an edge implementation of WebMCP in beta. When enabled, Cloudflare injects a lightweight script at the edge of its network, automatically making these structured tools available to visiting agents without requiring site owners to author a single line of custom code.
Commerce.com, a flexible commerce platform explicitly engineered for the age of artificial intelligence, already relies on Cloudflare to manage its network of nearly 100,000 domains. When the WebMCP preview emerged, leadership at Commerce.com immediately evaluated the potential and asked a pivotal question: Could they activate this capability across all of their hosted stores simultaneously?
Why Commerce.com Wanted WebMCP
Kristina Pototska, Product Management Director at Commerce.com, explained the critical importance of this integration for modern storefront operators navigating the shift toward automated purchasing. Merchants are continuously inquiring about how they can stay competitive as agentic shopping gains traction among consumers. When a shopper asks an automated assistant to locate a specific item, merchants naturally want their online store to feature prominently in the results. Furthermore, they want to retain the customer relationship, maintain complete control over the secure checkout process, and achieve this without undertaking costly or time-consuming website redesigns.
WebMCP directly addresses all three objectives. The AI agent receives standardized, functional tools to search for products, verify detailed specifications, build a shopping cart, and generate a verified checkout link without having to guess its way around a dynamic visual interface. Meanwhile, the human shopper remains directly on the merchant’s proprietary website, ensuring the business preserves the vital customer relationship.
According to Pototska, the primary goal was to deploy this powerful capability securely and seamlessly, avoiding any requirement for merchants to manually edit their site themes or configure settings by hand. That specific operational challenge is where the strategic partnership with Cloudflare proved indispensable.
Furthermore, WebMCP operates in tandem with Commerce.com’s server-side Model Context Protocol implementation, creating a comprehensive framework that covers the diverse ways consumers utilize AI assistants for shopping. Server-side MCP is designed to support agents that connect to an online store directly from external environments, such as a general-purpose virtual assistant helping a user shop across multiple disparate websites simultaneously. WebMCP, conversely, supports agents that operate directly within the shopper’s active browser session. Because both methods utilize the identical set of underlying shopping tools, merchants are spared the burden of choosing between competing architectures or managing them as separate, disconnected systems.
Under the hood, this collaborative integration rests upon two fundamental operational principles. First, the WebMCP tools execute directly inside the shopper’s active browser session on the storefront’s native domain, guaranteeing that the AI agent perceives identical pricing, inventory levels, and cart contents as a human user. Crucially, no sensitive user credentials are transmitted to a third party, and the browsing session remains anchored entirely on the merchant’s domain. Second, Cloudflare functions as the edge delivery layer for Commerce.com’s backend MCP server, proxying tool definitions and actions transparently so that individual merchants retain absolute authority over their underlying business and tool logic.
What a Shopper’s Agent Sees
When an AI assistant navigates to an enabled Commerce.com storefront, it is spared the traditional friction of interpreting visual layouts and battling anti-bot defenses. Instead, it discovers available tools instantly via WebMCP.
Consider a common consumer scenario: a user instructs their personal AI agent to find a waterproof trail running shoe priced under $140 in a specific size 10 and add it directly to their shopping cart.
Without WebMCP, the agent attempts to simulate human interaction by clicking through a maze of interface elements, frequently getting blocked by cookie consent banners, misinterpreting product variant drop-down menus, or triggering automated bot challenges designed to differentiate scripts from human shoppers.
With WebMCP enabled, the agent seamlessly detects the store’s native tools via document.modelContext and executes clean, programmatic calls to accomplish the task instantly. Because the agent operates inside the active browser session on the store’s domain, the shopping cart updates in real time. Commerce.com’s backend MCP server orchestrates the commerce workflow, ensuring that when the user is ready to finalize the transaction, they complete the purchase themselves by clicking the checkout button. This architecture maintains payment security and leaves the human consumer in absolute control of the final financial transaction.
What We Built Together
When Commerce.com approached Cloudflare about deploying WebMCP across nearly 100,000 storefronts, the engineering teams encountered a practical structural challenge: the WebMCP standard was originally conceptualized as a binary, all-or-nothing switch applied to an entire domain zone.
Commerce.com wanted to activate its mcp-server-client toolpack, which acts as an edge bridge proxying tool definitions and incoming requests directly from Commerce.com’s backend MCP server to the visitor’s browser. Because Commerce.com utilizes Cloudflare for SaaS to host thousands of individual merchant vanity domains on shared infrastructure zones, the teams required a sophisticated mechanism to deliver this capability platform-wide while offering individual store owners a frictionless way to opt out if desired.
To solve this without constructing a burdensome custom allowlist system, the engineers integrated WebMCP with existing Cloudflare capabilities, specifically Configuration Rules and custom hostname metadata.
Under this architecture, Commerce.com enables WebMCP globally for its main zone, while establishing a rule at the edge that evaluates individual merchant metadata. If a specific merchant toggles an opt-out preference within their Commerce.com administrative dashboard, Cloudflare’s edge network automatically bypasses WebMCP for that particular storefront. Because Cloudflare evaluates these configuration rules at the edge before serving the webpage, opted-out stores experience zero additional latency, no remote lookups, and no injected scripts.
As is common during early technical previews, real-world deployment with a major enterprise partner surfaced additional practical edge cases. For instance, when the mcp-server-client toolpack was activated, the edge bridge initially anticipated finding every site’s MCP server located at a standardized /mcp endpoint. However, Commerce.com’s server architecture hosted the MCP endpoint at /api/mcp.
To accommodate this variation, the engineering teams introduced a configurable MCP URL setting at the zone level, allowing the custom path to be dynamically injected into the script tag. Furthermore, the system was designed with seamless fallback logic; if a store’s backend MCP server experiences downtime or if a customer’s browser lacks native WebMCP support, the script gracefully exits, allowing the storefront to load normally without disrupting human shoppers.
As the browser standard continues to evolve, Cloudflare and Commerce.com plan to invest further in refining agentic discovery tools, ensuring that automated shopping remains fast, reliable, and secure for merchants and consumers alike. Industry professionals gathering in San Francisco for Cloudflare Connect can explore these developments further during dedicated panel discussions focused on preparing retail storefronts for peak seasonal demand with key industry leaders.
