Commerce.com and Cloudflare Turn On WebMCP by Default for BigCommerce Merchants: How It Reaches Almost 100,000 Domains and What It Means for Merchants
WebMCP is now on by default for eligible BigCommerce stores. We explain how Cloudflare delivers AI agent tools at the edge, how it differs from Shopify and Cafe24, and what merchants should check, including what remains undisclosed.
Key Takeaways
- On October 21, 2026, Commerce.com, the parent company of BigCommerce, and Cloudflare announced that WebMCP is now on by default for eligible BigCommerce merchants. Across almost 100,000 domains, AI agents in the shopper's browser can search products, build a cart and get a checkout link
- Cloudflare injects a script at the edge and relays the tools from Commerce.com's MCP server to the browser unchanged. Platforms handing out agent tools on behalf of their stores is a pattern BigCommerce now shares with Shopify and Cafe24
- Shoppers still pay themselves, and merchants can turn the feature off in a settings menu. But few agents can call WebMCP yet, and measurement and eligibility criteria are undisclosed. Merchants should decide how to handle a feature that is already switched on
BigCommerce Stores Start Offering Tools to Browser Agents
Almost 100,000 Commerce.com domains now give AI agents real shopping tools through WebMCP on Cloudflare. Here's how we turned it on across every store at once, while keeping each merchant in control.
blog.cloudflare.com"Find a lightweight jacket in my size under $150." When a shopper gives that request to a browser agent, the agent searches the store's actual products and prices, adds the best match to a cart, and hands back a link to pay on the merchant's own site. That is the example Commerce.com gave in its press release.
On October 21, 2026, Commerce.com (Nasdaq: CMRC), the parent company of BigCommerce, and Cloudflare announced that this capability is turned on by default for eligible BigCommerce merchants. According to Cloudflare's blog published the same day, almost 100,000 Commerce.com domains running on Cloudflare now carry WebMCP tools. Merchants do not need to write code or edit their themes.
WebMCP lets a web page register its functions as "tools" with the browser, so an agent can call them by name with a defined input format. We covered the basics in our article on Shopify's checkout support, so this piece focuses on two new points: how a platform delivered tools to roughly 100,000 stores at once, and the role Cloudflare played.
Cloudflare Positioned Itself to Deliver the Tools, Not Build Them
The most important point about this setup is that Cloudflare does not build what the tools do.
In August 2026, Cloudflare released a preview of its edge implementation of WebMCP. Once switched on in the dashboard, Cloudflare uses HTMLRewriter, which rewrites HTML as it is served, to add one line of script to each page. The script itself is also served from the edge on the same domain, so nothing changes on the merchant's servers. This is the line injected into Commerce.com stores:
<script type="module"
src="/.webmcp/bridge.js"
data-packs="c2pa,mcp-server-client"
data-mcp-url="/api/mcp"></script>
At the center is a tool pack Cloudflare calls "mcp-server-client." At startup, the bridge asks Commerce.com's MCP server for its list of tools and registers each name, description and input format, unchanged, on the browser's document.modelContext. When an agent calls a tool, the bridge sends the request to /api/mcp on the same domain, within the shopper's own session.
This design matters in two ways. First, because tool definitions and actions are relayed without modification, Commerce.com keeps control of what the tools actually do. Second, the work happens inside the shopper's browser on the store's domain. Cloudflare says the agent sees the same prices and cart as the human shopper, and no credentials go to a third party.
Letting Each Store Opt Out Across 100,000 Domains
The rollout hit a wall. Cloudflare's WebMCP was originally designed as a single on-or-off switch per zone, a group of domains. Commerce.com, however, uses Cloudflare for SaaS to host thousands of merchant vanity domains on shared zones. A zone-level switch could turn every store on, but could not leave out a specific store.
Rather than build a new allowlist, Cloudflare combined its existing Configuration Rules with per-hostname metadata. When a merchant flips the opt-out switch in their dashboard, the domain is tagged with webmcp_opt_out, and an edge rule removes WebMCP for that store alone. Because the check runs before the page is served, an opted-out store sees zero extra latency, no remote lookups and no injected scripts, according to Cloudflare.
If the MCP server is down or the browser does not support WebMCP, the script simply exits and human shoppers are not affected.
Agents Get Tools Up to the Cart and a Checkout Link
Kristina Pototska, Product Management Director at Commerce.com, describes the tools agents receive as ways to search products, check details, build a cart and get a checkout link. She says server-side MCP and WebMCP share the same set of shopping tools, so merchants do not have to manage them separately.
According to BigCommerce's MCP server documentation, the B2C tools cover product search, product details, related products, adding, updating and removing cart items, and generating a checkout URL. On B2B stores, tools for shopping lists and quotes are added, gated by each buyer's permissions.
The line is drawn just before payment. Cloudflare's blog states that the shopper clicks checkout themselves to complete the purchase, and payment details never pass through the agent.
The human shopper stays on the merchant's site, and the merchant keeps the relationship.Source: Kristina Pototska (Commerce.com)
The contrast with Shopify makes this choice clear. In September, Shopify extended WebMCP to checkout so an agent can place the order once the buyer approves. Adding South Korea's Cafe24, which announced adoption across all its stores the same week, the three platforms draw their lines as follows.
| Item | BigCommerce (Commerce.com x Cloudflare) | Shopify | Cafe24 |
|---|---|---|---|
| Announced | October 21, 2026 | Extended to checkout on September 28, 2026 (storefront came first) | October 2026 (same week) |
| Coverage | On by default for eligible merchants (almost 100,000 domains) | No setup for Liquid stores; checkout for eligible merchants | Every store built on Cafe24 |
| What agents can do | Product search, product details, cart actions, checkout URL | Product search, cart actions, checkout updates, order placement after buyer approval | 11 functions, from product search to moving to the order form for an instant purchase and viewing order history |
| Final payment | The shopper clicks checkout themselves | The agent places the order with the buyer's approval; the buyer handles authentication | The user handles login and final payment |
| Delivery mechanism | Cloudflare injects a script at the edge and relays to Commerce.com's MCP server | Built by Shopify | Built by Cafe24 |
| Merchant opt-out | Can be turned off in a new settings menu | Not stated in official docs (as of September) | Not mentioned in coverage |
| Agent identity verification | Not mentioned in the announcement | Signatures via Web Bot Auth | Not mentioned in coverage |
According to Digital Today, Cafe24 offers 11 functions, from product search to moving to the order form for an instant purchase and viewing order history. They work in the built-in browser of the ChatGPT desktop app, while Chrome requires an extension and developer settings.
What the three share is that platforms hand out the tools in bulk instead of asking each store to implement them. They differ in how far they let agents go, and in whether they build the delivery mechanism themselves or rely on a partner.
On by Default Versus On by Request
One detail is easy to miss: within BigCommerce itself, there are two different ways a feature gets turned on.
According to the documentation, server-side Storefront MCP only works after the store owner switches it on in the control panel and accepts the terms of service. The page also records who accepted and when. WebMCP, by contrast, is on from the start for eligible merchants, and stores that want out must turn it off. The press release says this is done in a new settings menu that also manages all of Commerce.com's AI connections.
Yet WebMCP tools are relayed from the server-side MCP. The announcement does not say how WebMCP behaves at stores that have not enabled server-side MCP, or what makes a merchant "eligible."
Caveats: The Tools Are There, but Few Agents Call Them
There are reasons not to take the promoters' account at face value.
First, WebMCP itself is not settled. The draft specification from the W3C Web Machine Learning Community Group, in its October 20, 2026 version, still states that it is not a W3C Standard nor on the W3C Standards Track. Chrome's developer documentation points to an origin trial (a way to test features on production sites for a limited time) starting in Chrome 149, plus a flag for local development. Cloudflare itself describes WebMCP as an experimental proposed standard in early preview.
So even with tools on 100,000 domains, only a small share of shoppers use agents that can call them. Chrome's documentation also lists as a limitation that agents cannot know whether a site has tools until they visit it. Cloudflare naming "helping agents find a site's tools more easily" as its next step is a response to that weakness.
Second, there is the security question. The draft specification assumes agents inherit the user's logged-in session, and acknowledges that a malicious site can omit or misrepresent hints such as "read-only." Merchants face the reverse problem too. Shopify requires agents using its checkout tools to sign requests with Web Bot Auth, but this announcement says nothing about how agent identity is verified. How the setup handles automated, high-volume cart creation is unclear.
Finally, there are no results yet. Neither company has disclosed how many visits, carts or purchases have come through agents.
What Merchants Should Check
BigCommerce merchants should start by checking the new settings menu. If they do nothing, they should assume their store is already usable by agents. Whether to turn it off can be decided after checking that search results and cart contents come out correctly for their own products. With Chrome's development flag enabled, DevTools shows which tools are registered.
Measurement deserves early attention too. If agent-built carts cannot be distinguished as their numbers grow, cart abandonment and conversion rates will read differently.
The case is useful beyond BigCommerce. Cloudflare's edge implementation is a preview any site on Cloudflare can enable from "Agent Readiness" in the dashboard. A business with its own MCP server gets a nearly code-free path to expose it as browser-side tools. Put the other way, without an MCP server behind it, there are no tools to deliver. Deciding which functions to open to agents comes first.
What Has Not Been Disclosed
Comparing the announcement, Cloudflare's blog and BigCommerce's developer documentation, the following points remain unaddressed.
- Criteria for "eligible" merchants (plan, country or region, store type): undisclosed
- How stores that have not enabled server-side Storefront MCP are treated: undisclosed
- Relationship to agent identity verification and bot protection: undisclosed
- Whether carts and orders from agents can be measured separately: undisclosed
- Whether there are additional fees: undisclosed
- Actual usage through agents: undisclosed (only the scale of almost 100,000 domains has been published)
Conclusion
With this announcement, Cloudflare did not build tools itself. It became the delivery network that carries a platform's MCP server out to roughly 100,000 stores. Together with Shopify and Cafe24, the shift toward commerce platforms handing out agent tools on behalf of their merchants became clear in the fall of 2026.
The open question is on the calling side. Will major agents start using WebMCP every day? And how will platforms show agent-driven shopping to merchants, and let them stop it? With the tools now in place first, what matters next is how well stores put them to use.
