CLOUDFLARE and Commerce.com are extending WebMCP, an experimental proposed browser standard, across Commerce.com’s almost 100,000 storefront domains. WebMCP lets AI agents use structured tools exposed by a website, such as product search and adding an item to a basket, rather than trying to operate its pages by interpreting HTML and simulating clicks.
Cloudflare says its edge implementation, launched in beta in August, injects a small script to make these tools available without merchants changing their site themes.
The tools run in the shopper’s active browser session on the shop’s domain, so the agent sees the same prices and basket; Cloudflare says credentials are not sent to a third party. Commerce.com’s backend MCP server supplies the tool definitions and actions through Cloudflare’s edge. The shopper still completes the purchase themselves at checkout. WebMCP is available in early preview, including through experimental Chrome flags and Chrome Origin Trials, so support is not universal.
To enable the feature across stores while preserving merchant choice, Commerce.com can switch it on for its main zone and use Cloudflare Configuration Rules and custom hostname metadata to honour each shop’s opt-out. Cloudflare says opted-out stores receive no injected script, remote lookup or added latency. The integration also supports Commerce.com’s custom MCP path, `/api/mcp`, rather than assuming the standard `/mcp` route.
If a store’s MCP server is offline or a browser does not support WebMCP, the script exits and the shop continues to load normally. The article describes an integration and its design, not a reported security incident or confirmed exploitation.