Commerce.com’s WebMCP rollout puts merchant opt-outs in the agent interface

Commerce.com and Cloudflare are putting a browser-facing agent interface into storefront delivery, with a merchant opt-out. Their October 21 announcement describes a WebMCP bridge that connects browser agents to commerce tools while keeping actions in the shopper’s active website session.

For a merchant, the first decision is whether to make that interface available on the store. The second is whether the exposed actions preserve the expected session, cart, and authorization boundaries. A tool appearing in a browser does not settle either question.

A browser bridge to commerce tools

Cloudflare’s announcement describes proxying backend MCP tool definitions and actions through a WebMCP bridge. Its roughly 100,000-domain figure describes the Commerce.com footprint. It is not a count of active agent shoppers, completed orders, or independently measured adoption.

WebMCP remains an experimental proposed browser standard with early-preview support. Browser flags, trials, and supported agentic browsers matter. The rollout does not establish that every browser can discover and execute the same storefront tools.

The BigCommerce MCP overview describes server tools and connection requirements. Keep that server connection distinct from a browser-side bridge: the bridge operates in the shopper’s current domain and session, while a direct MCP client has its own connection and authentication path.

Opt-out belongs in the store’s release record

Cloudflare says Commerce storefronts receive the feature with an individual merchant opt-out. Its example matches hostname metadata with cf.hostname.metadata.webmcp_opt_out eq "true" and sets webmcp_enabled to false. This is a documented deployment example, not a universal switch available in every unrelated hosting setup.

Record the hostname, the merchant’s intended state, the supported browser, and the tool list observed after a change. Keep a conventional shopping path available and inspect it separately. A disabled agent interface should not silently become a broken product page or checkout.

Follow one cart through the boundary

In a fictional store, an agent adds a product while a shopper already has a cart open. A useful acceptance test follows that same session through the action, then checks product identity, quantity, price, and the resulting cart. Repeat with the agent interface disabled and with an expired session.

• Confirm which tool calls are available to an unauthenticated visitor and to a signed-in shopper.
• Check that switching accounts cannot reuse another shopper’s cart or permissions.
• Require the store’s intended confirmation before an irreversible order action.
• Verify the opt-out in a supported browser and confirm that ordinary navigation still works.

Those are proposed checks; SearchEngineAnswer did not connect a live store or place an order. The announcement supplies no evidence that enabling WebMCP improves search rankings, citations, or sales. Use the WebMCP discovery guide for tool exposure and the commerce standards guide to separate protocols, product data, and trust decisions.