Cloudflare turns on WebMCP for nearly 100,000 Commerce.com stores

What happened

Cloudflare says almost 100,000 Commerce.com domains now give AI agents shopping tools through WebMCP, running on Cloudflare's network ^[1]. The announcement, in a Cloudflare blog post of 21 October, describes how the two companies enabled it across every store at once while keeping each merchant in control ^[1].

The problem with agents and websites

Cloudflare says websites were built for humans, so most shopping agents work from a page's HTML: they guess which button does what, click, and retry when wrong. That process is slow, uses many tokens, and can break after something as small as a theme change ^[1].

WebMCP is a browser standard from Google that gives agents structured tools on a page, such as search_products, so agents call the tool they need instead of hunting for buttons ^[1]. Cloudflare stresses it is still an experimental proposed standard in early preview, currently behind experimental Chrome flags, in Chrome Origin Trials, in some agentic browsers and in developer environments such as Cloudflare Kitesurf ^[1]. In August, Cloudflare launched an edge implementation in beta that injects a small script so tools appear without site owners writing code ^[1].

How it works for shoppers

In Cloudflare's example, a shopper asks an agent for a waterproof trail running shoe under $140 in size 10. With WebMCP the agent makes two clean calls, search_products and add_to_cart, rather than simulating clicks ^[1]. The tools run in the shopper's own browser session on the store's domain, so prices and cart match what the shopper sees, and no credentials go to a third party ^[1]. The shopper still clicks checkout personally ^[1].

Kristina Pototska, product management director at Commerce.com, said merchants want their store to be in the answer when a shopper asks an agent to find something, while keeping the customer and control of checkout ^[1].

Merchant control

WebMCP was designed as a single on-off switch for a whole domain zone, which did not suit a platform hosting many vanity domains ^[1]. Cloudflare and Commerce.com used Configuration Rules and custom hostname metadata so Commerce.com can switch WebMCP on for its main zone, while a merchant who flips an opt-out switch in their dashboard is bypassed at the edge with no extra latency or injected script ^[1]. They also added a configurable MCP URL because Commerce.com's server lives at /api/mcp, and the script exits quietly if a store's server is offline or the browser lacks WebMCP support, so human shoppers are unaffected ^[1].

What it means for businesses

For online retailers, the story shows one route to being usable by shopping agents without rebuilding a site. It is a vendor-written account, and Cloudflare gives no figures on how often agents use the tools or on sales results ^[1]. Because WebMCP is experimental and limited to certain browsers, most shoppers will not see a difference yet ^[1]. Merchants on Commerce.com should check their dashboard for the opt-out setting if they want to decide for themselves.

Source: Cloudflare — How Commerce.com and Cloudflare are getting storefronts ready for AI agents