What Shopify storefronts tell AI agents

Shopify ships a set of WebMCP tools to its storefronts. An AI agent running in the shopper’s browser can then search a store, read a cart and move to checkout through structured calls, instead of operating a page built for human eyes and hands. This page lists what those tools declare, how the set has changed, and where our data stops. If WebMCP itself is new to you, start with What is WebMCP?.

The short version

Shopify’s documentation says it provides these tools “on every Liquid storefront”. The individual merchants did not opt in one by one.
In our sealed file for 2026-10-17, 104,005 crawled sites carry one of three tool sets that Shopify distributes: 69,381 carry the twelve-tool set, 30,576 the eleven-tool set and 4,048 the original ten-tool set.
Four of the twelve current tools declare themselves read-only. The other eight declare readOnlyHint: false: they change the cart or move the browser to another page.
This is a documented platform feature, not a vulnerability. We read what each storefront declares; we do not call the tools.

The twelve tools in the current version

The table is taken from the declarations in Shopify’s public script webmcp-f427de6a.js, read the way a page would register them. Each tool name links to its own page with the full description, the input it asks for and the hints it declares.

Group	Tool	readOnlyHint	What the declaration says
Catalog	`search_catalog`	true	Searches products, collections, articles and pages. Says it does not change the cart.
Catalog	`browse_store`	false	Lists a store’s collections, or navigates the browser to one.
Catalog	`get_product`	false	Returns product details, or navigates the browser to the product page.
Catalog	`show_variant`	false	Opens a product page with a variant selected.
Cart	`get_cart`	true	Returns line items, prices, quantities and totals.
Cart	`add_to_cart`	false	Adds products to the cart.
Cart	`update_cart_lines`	false	Changes quantities or removes lines. Each line is addressed by its id, so it asks for `get_cart` first.
Cart	`cancel_cart`	false	Removes every item from the cart.
Checkout and orders	`proceed_to_checkout`	false	Checks that the cart is not empty, then moves the browser to checkout.
Checkout and orders	`manage_orders`	false	Navigates to the order history page. The description says the shopper is asked to log in if not already signed in.
Store information	`search_shop_policies_and_faqs`	true	Returns facts about policies, FAQs and contact details.
Store information	`get_ucp_profile`	true	Returns the store’s Universal Commerce Protocol profile, served at `/.well-known/ucp`.

This is what our crawler records for one of them. The implementation is not shown, because we do not read what runs behind the declaration here; that limit is explained in What a WebMCP tool declares.

await document.modelContext.registerTool({
  name: "get_ucp_profile",
  description: "Get this store's Universal Commerce Protocol (UCP) profile, as served at /.well-known/ucp: the UCP version, the services the store offers with their endpoints (e.g. the store's UCP MCP server), its capabilities, and its payment handlers. Use it to discover how to continue a purchase with this store over UCP, or to check which platform operates the store. Read-only; works from any page.",
  inputSchema: {"type": "object", "properties": {}},
  annotations: {"readOnlyHint": true, "untrustedContentHint": true},
  async execute() { /* implementation not shown */ }
});

Nine of the twelve tools declare untrustedContentHint: true; the three that do not are cancel_cart, proceed_to_checkout and manage_orders. See the tool reference for every tool and the hints it declares.

Three versions of the set

The tool set is not fixed. Storefronts have moved from ten tools to eleven and then to twelve:

Ten tools (webmcp-0.1.0.js, webmcp-0.1.1.js): the original set, including update_cart.
Eleven tools (webmcp-1cd8a9f0.js): add_to_cart and update_cart_lines take the place of update_cart.
Twelve tools (webmcp-f427de6a.js): adds get_ucp_profile.

Sealed file	Twelve-tool sites	Eleven-tool sites	Ten-tool sites
2026-10-09	6,503	87,231	4,110
2026-10-11	31,153	64,429	4,082
2026-10-14	58,645	39,181	4,056
2026-10-17	69,381	30,576	4,048

The counts follow our re-crawl schedule. A site moves from one column to the next when we next read it, so the table shows how much of what we crawl has been re-read, not the day each store switched. Each row comes from its own sealed file.

Documentation and the live script differ

The Shopify documentation page we read on 2026-10-19 lists ten tools, including update_cart. The script that storefronts load now declares twelve. We do not know which of the two Shopify intends as current; the storefronts we crawl are shipping the twelve-tool script. Read the documentation for what Shopify intends, and read our tool pages for what a storefront declares.

The same page says the cart tools call the standard storefront actions, so an agent’s cart change behaves like the shopper’s own, and that the shopper is asked to log in before order history. It does not describe a way to turn the tools off on a Liquid storefront, and it does not say whether an agent must ask the shopper before moving to checkout. We did not test either point.

Check your own storefront

View the page source and search for webmcp. In the storefronts we examined, the page loads a script whose file name starts with webmcp-, for example webmcp-f427de6a.js.
The part after the dash tells you which of the scripts above the store loads. In our data, each store falls into one of the three sets, by the tool names it declares.
For settings, ask Shopify. We can tell you what a storefront declares; we cannot change or see how it is configured.

How common this is

We crawl a large sample of the web and record which sites register tools. In our sealed file for 2026-10-17, we crawled 6,771,594 domains and found 110,803 sites that declare WebMCP tools. They fall into two very different groups:

Kind	Sites	Share
Vendor-distributed (a platform ships the tool set to its sites)	104,343	94.2%
Independent (the site wrote its own implementation)	6,460	5.8%

Of the vendor-distributed group, 104,005 sites carry one of the tool sets that Shopify distributes (see the Shopify page). Quoting a single total without this split misstates what the data shows.

What this does and does not tell you

We read the tool names and descriptions a page declares. We never invoke a tool.
What a tool does is inferred from its name and description. We have not yet published an accuracy measurement for that inference.
A declared tool is not a vulnerability, and a finding in our data is not evidence that a site has a security problem. These are measured indicators, not audits.
The crawl is a sample, not a census. Sites that disallow our crawler in robots.txt are excluded and counted separately.

Every number above comes from a sealed, dated file with a published sha256 in the index, so it can be checked and does not change. The full method and its limits are on the main page.