cancel_cart
A WebMCP tool distributed by Shopify. 99,664 of the sites we crawled carry a tool set that includes it (99.7% of vendor-distributed detections). This is a documented platform feature, not a vulnerability. Individual sites did not each choose it one by one.
What the tool declares
The description below is quoted as Shopify publishes it, in the distributed bundle:
Remove all items from the cart in one step. Use when the user wants to empty their cart or start over.
| Vendor | Shopify |
|---|---|
| Sites | 99,664 in 3 tool sets (64,429 + 31,153 + 4,082) |
| Declared by bundle versions | 0.1.0, 0.1.1, 1cd8a9f0, f427de6a |
| Read-only hint | readOnlyHint: false |
The input it asks for
The tool takes no input.
The full input schema, as declared:
{
"type": "object",
"properties": {}
}What we checked
We read the tool set the page declares and we never invoke a tool. We fetched and analysed the distributed bundle that declares this tool, so these copies carry no unverified-implementation signal. What a tool does is inferred from its name and description, and we have not yet published an accuracy measurement for that inference. These are measured indicators, not audits. The crawl is a sample, not a census.
Vendor documentation: https://shopify.dev/docs/api/web-mcp
Other tools in the same sets
add_to_cartbrowse_storeget_cartget_productget_ucp_profilemanage_ordersproceed_to_checkoutsearch_catalogsearch_shop_policies_and_faqsshow_variantupdate_cartupdate_cart_lines
Source
25d8fb700a3a3e973ea18e6ac678d15762cce58a46690334defa5b05b9142e13.
Declarations: captured from the vendor's distributed bundles, each checked against a recorded sha256.
See the Shopify tool sets
and what a tool declares and what a crawler cannot see.