6 min read
Ask an AI assistant to find shoes in your size and add them to a basket, and it needs a way to use the shop. WebMCP gives compatible assistants a menu of website actions, with instructions for each one.
The assistant can pass your size and budget to a product search tool rather than navigate dropdowns and forms.
On 21 October 2026, Cloudflare described bringing WebMCP to Commerce.com’s storefront network, which runs almost 100,000 domains on Cloudflare. Commerce.com, the company behind BigCommerce, says the feature is enabled by default for eligible merchants. The announcements give no figures for completed purchases or additional sales.
Kristina Pototska, product management director at Commerce.com, described the aim in Cloudflare’s announcement. Merchants want to “keep the customer, keep control of the checkout, and do it without rebuilding their site.”
WebMCP explained: a menu for AI agents
WebMCP is a proposed web standard for describing website actions and their required inputs. Developers can define tools in JavaScript or label existing forms.
A booking tool might request a date, time and contact details. The agent, an AI assistant acting on a user’s behalf, supplies them.
The website lists its tools, each with a name, description and rules for the information it accepts. The browser presents them to a compatible agent, which chooses a tool and supplies the details. The website runs the action and returns a result.
The agent can then use a separate tool to add the selected shoes to the basket.
The result still depends on accurate stock data and the agent choosing the right shoes.
Commerce.com supplies shopping tools through its backend MCP server. Cloudflare exposes them in the shopper’s browser session.
In the published example, the agent adds an item to the basket and the shopper completes checkout. Merchants can opt out. Cloudflare says the storefront still loads if browser support or the MCP server is unavailable.
BigCommerce says eligible merchants can use the integration without editing their storefront code. Other websites can implement WebMCP tools directly.
Chrome offers an origin trial, a programme for testing experimental browser features on live websites, alongside a setting for local development. Businesses need to check support in their customers’ intended browser and agent.
MCP stands for Model Context Protocol and connects AI applications to external data, tools and workflows. WebMCP makes website functions available during a browser visit. The two can work together.
| Question | MCP | WebMCP |
|---|---|---|
| Where does it connect? | Between an AI application and an MCP server. | Between a website and a compatible agent through the browser. |
| Must the website be open? | It can work independently of a website visit. | Its tools are tied to the active page. |
| What work does it support? | External systems, data and workflows. | Actions within the website’s current session. |
| How can they work together? | The server supplies underlying capabilities. | The page makes those capabilities available during a visit. |
Our Cloudflare Code Mode story explains tool discovery across large catalogues. WebMCP applies a related approach during a website visit.
Our shopping agent analysis explores customer context across stores.
The menu does not run the kitchen
Choosing which tools to expose is a product decision. Product search, an order change and cancellation need different permissions and different evidence of completion.
Product search is a straightforward starting point. Changing an order requires the system to identify it, check the customer’s authority and apply the change correctly. Retrieving a support case needs different permissions from cancelling a service.
Developers must connect tools, validate inputs and handle errors as the service changes. Chrome notes that complex interfaces may need restructuring.
A tool is another way into the product. It deserves the same care as the button a customer would press.
Chrome’s security guidance recommends flagging consequential actions so the browser or agent can request confirmation. It also advises restricting which websites can access tools and labelling untrusted material returned by them. The business still has to enforce access controls.
The guidance warns about indirect prompt injection, where malicious instructions reach an agent through content it encounters. Read-only tools also need scrutiny. Looking up an order can expose personal details.
Our AI mistake test explains how the consequences of errors should limit an agent’s authority.
Did the agent select the intended product and quantity? Did it request confirmation at the right point? How often did a person intervene? Costs should include implementation, maintenance and support work caused by mistakes.
Industry Contents has not independently tested the deployment.
Giving agents clear access to website functions has practical value. Commerce.com lets eligible merchants test it on existing storefronts. The commercial case rests on accurate orders, completed tasks and operating costs.
A readable menu is a useful start. The order still has to arrive as requested.
WebMCP FAQ
What is WebMCP?
WebMCP is a proposed web standard that lets websites describe actions, such as product search or adding an item to a basket, so compatible browser-based AI agents can use them.
How does WebMCP work?
A website exposes named tools with defined inputs. A compatible browser makes them available to an AI agent, which supplies parameters and receives the website’s result.
What is the difference between WebMCP and MCP?
MCP connects AI applications to external tools and systems. WebMCP exposes website actions to compatible agents during an active browser visit. They can work together.
Does a business need Cloudflare to use WebMCP?
No, developers can add WebMCP tools directly. Cloudflare provides the delivery approach used in the Commerce.com integration.
Does WebMCP improve SEO or AI search rankings?
The cited documentation establishes no direct search-ranking benefit. WebMCP is intended to help agents interact with websites and complete tasks.
Can WebMCP complete purchases without confirmation?
Confirmation depends on the implementation and its controls. In the Commerce.com example, the agent prepares the basket and the shopper completes checkout.
Which browsers support WebMCP?
Chrome has offered an experimental origin trial and local development support. Businesses should verify browser and agent compatibility before relying on it.
Is WebMCP safe for ecommerce websites?
Safety depends on permissions, input validation, confirmation for consequential actions and protection against malicious content. WebMCP does not remove the need for those controls.
Related reading from IC Lab
For tool discovery at scale, read our Cloudflare Code Mode analysis. Teams choosing platforms can also compare agent builder pricing.
Shopping agents also need customer context. Our shopper memory story examines that gap, while our n8n vs Make comparison covers workflow automation.
Sources and reporting note
Sources include Chrome’s WebMCP documentation, its MCP comparison and security guidance, Cloudflare’s announcement and BigCommerce’s implementation overview.
Reported capabilities come from these sources. Industry Contents has not independently verified sales outcomes.