Cloudflare and e-commerce platform Commerce.com have enabled WebMCP — Google's experimental browser standard that allows a page to declare structured tools for AI agents — on nearly 100,000 Commerce.com domains. The enablement was performed at the edge infrastructure level, so agent actions became available to stores without changing their code, while the final decision on purchase remains with the human. Essentially, this is the first platform-level template for preparing storefronts for agentic commerce, although the standard currently only works in browsers with experimental support.
What happened
At the edge level, Cloudflare inserts a tiny script /.webmcp/bridge.js into Commerce.com pages, which automatically declares tools for agents to search for products, view product cards, add items to the cart, and obtain a payment link; it was not necessary to rewrite the code of the stores themselves. The tools are executed in the buyer's active browser session on the store's domain, so the agent operates with current prices and the current cart contents, rather than an outdated copy of the page. Automation deliberately stops before payment: the final checkout remains manual so that payment data is not transmitted to third parties. The distribution of tools across tens of thousands of stores in shared zones was organized through Configuration Rules and custom hostname metadata, and the zone-level opt-out option works without additional delay.
Context
WebMCP itself is an experimental standard from Google: a website publicly describes the actions available to an agent, and interaction occurs through structured calls rather than guessing the interface. Until now, enabling such support remained a task for individual stores, and agent access to storefronts was usually built on scraping and simulating DOM clicks. The Commerce.com case became the first scale-tested instance where the hosting platform itself distributes agent tools, setting the framework for future e-commerce integrations with agentic purchases. The experimental stage is also indicated by the launch method: the standard is enabled via Chrome flags, through Origin Trials, and in special agent browsers, rather than being present in the default behavior of a regular browser.
Why this matters for the industry
For the industry, this is one of the first real cases of mass WebMCP enablement at the hosting platform level, rather than site by site. The combination of edge script injection, Configuration Rules, and custom hostname metadata is a reproducible recipe: an e-commerce platform or CDN opens agent tools to all stores at once, while preserving each merchant's right to opt out without losing performance. The point of control over whether a store is visible to agents shifts from store code owners to platform owners and distribution channels, and storefront compatibility with agents becomes an infrastructure setting like CDN or HTTPS. For models and benchmarks, this changes nothing for now, because the shift is infrastructural rather than a growth in capabilities; however, engineers receive an open example of WebMCP enablement at the edge with merchant-level management.
Why this matters for users
If you are buying through an AI agent or developing such an agent, instead of unreliable click simulation, the agent receives clean calls like search_products, viewing a product card, or add_to_cart: this is faster, cheaper, and more stable because the agent does not need to manually parse the page layout. The tools are executed in your active session, so the agent sees the real price and cart contents at the current moment, not cached data. The choice of whether to trust an agent with purchases in a specific store remains with the merchant and the buyer: any domain can be excluded via opt-out. The limitation today is coverage: support exists only in browsers with experimental integration of the standard, so the audience for agent sessions is currently narrow, and the most realistic scenario for engineers and stores is prototyping their storefront's tool catalog: search_products, product details, add_to_cart, and a payment link.
What is still unknown / limitations
Figures and effects should be verified carefully: all facts come from the Cloudflare vendor blog, there is no independent data in the case, and the figure of nearly 100,000 domains is not independently confirmed. There are no quantitative assessments at all: metrics for the success rate of agent sessions, latency measurements, and the share of tool call failures are not disclosed. The WebMCP specification has not yet stabilized — the case notes a non-standard MCP server path /api/mcp instead of the expected /mcp, which had to be compensated for with zone-level configuration — and the path of the standard to full browser status remains uncertain. It is also unknown how quickly support will appear in regular browsers and how actively buyers will use the tools in real sessions.
Sources
Author
Look at AI, editorial team