Shopify WebMCP tools

4,110 of the sites we crawled carry the WebMCP tool set that Shopify distributes (4.2% of vendor-distributed detections). This is a documented platform feature, not a vulnerability. Individual sites did not each choose it one by one.

Source: sealed file 2026-10-09, sha256 320138c50a8aae22548e7284841d9ecfcf413b5b3772375d2a07c2f280d1aa48. Numbers on this page are from that file and do not change. For the current state, see the main page.

What the tool set declares

We read the tool names; we have not run them.

These 10 tool names are declared by every copy of this set.

browse_store
cancel_cart
get_cart
get_product
manage_orders
proceed_to_checkout
search_catalog
search_shop_policies_and_faqs
show_variant
update_cart

We fetched and analysed the distributed bundle for this set, so its copies carry no unverified-implementation signal. 20 of these sites still show a scoring signal.

What a tool does is inferred from its name and description, and we have not yet published an accuracy measurement for that inference. These are measured indicators, not audits.

What we checked

We never invoke a tool. Whether we analysed the distributed bundle is stated for each set above.

Vendor documentation: https://shopify.dev/docs/api/web-mcp

How to cite

Cite the sealed file above, not the live endpoints. Corrections, if any, are appended to errata in the index; the dated file is never rewritten. Licence: CC BY 4.0, attribute to WebMCP Shield with a link to the dated file.