Artificial intelligence has made staggering leaps forward in recent years, mastering complex coding tasks and even passing professional bar exams with flying colors. Yet, despite these advanced capabilities, generative AI still routinely stumbles over a surprisingly mundane task: buying a pair of shoes online.
This friction exists because the modern web was architected exclusively for human users, not automated software agents. Today, most shopping agents attempting to purchase items on behalf of users must interpret raw HTML. They scan a webpage, attempt to guess which button performs a specific action, click it, and cross their fingers. If the action fails, they try again. This trial-and-error process is exceptionally slow, consumes a high volume of tokens, and can be completely derailed by something as minor as a visual theme update or a shifted element on a page.
To bridge this fundamental gap, engineers and web standards developers have introduced WebMCP, an experimental browser standard proposed by Google that equips AI agents with structured, direct tools on a webpage, such as a dedicated search_products function. Instead of blindly hunting for buttons and navigating cluttered interfaces, an agent can call the exact tool it requires instantly. This makes the digital shopping experience dramatically faster, significantly cheaper, and vastly more reliable.
Because WebMCP is currently an experimental proposed browser standard in early preview, it is typically accessed behind experimental Chrome flags, in Chrome Origin Trials, through select agentic browsers, and across specialized developer environments like Cloudflare Kitesurf. Recognizing the potential of this technology to transform online retail, Cloudflare launched an edge implementation of WebMCP in beta. When enabled, Cloudflare automatically injects a lightweight script at the network edge to make these tools immediately available, eliminating the need for site owners to write a single line of custom code.
Commerce.com, a flexible commerce platform specifically engineered for the age of artificial intelligence, already leverages Cloudflare to manage its network of nearly 100,000 individual domains. When the WebMCP preview was first released, the team at Commerce.com immediately recognized its potential and posed a critical question to their infrastructure partners: could this capability be enabled simultaneously across all of their hosted stores?
Why Commerce.com Wanted WebMCP
Kristina Pototska, Product Management Director at Commerce.com, explained the profound importance of this integration for digital storefronts navigating the shift toward automated, agent-driven commerce.
"Merchants keep asking us how they can keep up with agentic shopping," Pototska noted. "When a shopper asks an agent to find something, merchants want their store to be in the answer. They want to keep the customer, keep control of the checkout, and do it without rebuilding their site. WebMCP helps with all three. The agent gets real tools to search products, check details, build a cart, and get a checkout link, so it doesn’t have to guess its way around the page. The human shopper stays on the merchant’s site, and the merchant keeps the relationship."
Pototska emphasized that the implementation needed to be secure and seamless, avoiding any requirement for merchants to manually edit their site themes or tinker with code by hand. This exact requirement made the existing partnership with Cloudflare an ideal fit for the rollout. Furthermore, WebMCP functions in tandem with Commerce.com’s server-side Model Context Protocol implementation. Together, these two layers cover the diverse ways consumers shop using digital assistants. Server-side MCP supports agents that connect directly to a store, such as an assistant helping someone compare and shop across multiple disparate websites, while WebMCP supports agents operating locally within the shopper’s browser. Because both methods utilize the same underlying set of shopping tools, merchants are spared the burden of choosing between the two systems or managing them separately.
Under the hood, this architecture rests upon two foundational principles. First, the WebMCP tools execute directly inside the shopper’s active browser session on the exact domain of the storefront, guaranteeing that the agent sees identical pricing and real-time cart contents. No sensitive user credentials are transmitted to any third-party entity, and the traffic visit remains entirely on the merchant’s property. Second, Cloudflare functions as the edge delivery layer for Commerce.com’s backend MCP server, proxying tool definitions and actions cleanly so that merchants maintain absolute control over their underlying business logic.
What a Shopper’s Agent Sees
When an AI assistant visits an enabled Commerce.com storefront, it no longer has to rely on visual guesswork to traverse the layout. Instead, it discovers available tools dynamically via WebMCP.
Consider a common consumer scenario: a user instructs their personal AI assistant to find a waterproof trail running shoe under $140 in a size 10 and add it directly to their shopping cart. Without WebMCP, the automated agent typically attempts to simulate human clicks, only to become blocked by cookie banners, misinterpret complex product variant drop-downs, or get tripped up by automated bot-detection challenges designed to distinguish between scripts and human buyers.
With WebMCP enabled, the agent seamlessly detects the store’s native tools exposed on document.modelContext and initiates direct, clean calls to accomplish the task without friction. Because the entire process executes within the user’s active browser session on the store’s domain, the shopping cart updates in real time. The backend MCP server dictates the overarching commerce flow, ensuring that when the user is finally ready to complete the transaction, they click the checkout button themselves. This design preserves payment security and leaves the human consumer in total control of the final purchase.
What We Built Together
When Commerce.com requested the mass deployment of WebMCP across nearly 100,000 storefronts, the engineering teams encountered a practical technical hurdle. WebMCP was originally architected as a binary, site-wide on-or-off switch intended for an entire domain zone.
Commerce.com wanted to deploy their mcp-server-client toolpack, which serves as an edge bridge designed to proxy tool definitions and incoming requests directly from the backend MCP server to the visitor’s browser. Because Commerce.com utilizes Cloudflare for SaaS to host tens of thousands of merchant vanity domains on shared infrastructure zones, the companies needed a sophisticated mechanism to deliver this capability globally while simultaneously granting individual store owners a frictionless way to opt out if they chose not to participate.
To achieve this without constructing a complicated and brittle custom allowlist, engineers integrated WebMCP directly into existing Cloudflare primitives, namely Configuration Rules and custom hostname metadata. Commerce.com enables WebMCP globally for their primary zone and introduces a rule evaluated at the edge that inspects individual merchant metadata. If a merchant toggles an opt-out preference within their Commerce.com dashboard, Cloudflare’s infrastructure automatically bypasses WebMCP for that specific storefront. Because Cloudflare evaluates these configuration rules at the edge before serving the page, opted-out stores experience zero additional latency, no unnecessary remote lookups, and no injected scripts.
Working closely with real-world partners during the preview phase also uncovered minor practical details that required refinement, such as handling custom MCP paths. When the toolpack was initially enabled, the edge bridge expected every participating site’s MCP server to reside at a standard /mcp endpoint. However, Commerce.com’s server is hosted at /api/mcp. To accommodate this structural reality, developers added a configurable MCP URL setting at the zone level, allowing the custom path to be injected cleanly into the script tag. Furthermore, robust fallback mechanisms were implemented to ensure that if a store’s MCP server happens to go offline or a customer’s browser lacks WebMCP support, the script gracefully exits so the storefront loads normally without impacting human shoppers.
As the underlying browser standard continues to evolve, Cloudflare and Commerce.com plan to make further investments, focusing initially on helping AI agents discover site tools with even greater efficiency. The companies will continue collaborating to ensure that agent-driven shopping remains fast, reliable, and secure for merchants and consumers alike. Industry participants attending Cloudflare Connect in San Francisco can hear more about these developments during a dedicated panel discussion titled getting your storefront agent ready for peak season, featuring retail technology leaders from Commerce.com, Popmenu, Fruugo, and Gopuff.
