On 28 September Shopify added WebMCP support for checkout. In plain terms: an AI agent running in a shopper's browser can now look at your checkout, fill in the address and delivery option, and place the order once the shopper has said yes. It no longer has to guess at buttons and form fields by reading the page like a screen scraper.
You didn't have to do anything for this to happen. Shopify says the tools need no merchant configuration and expose no new API. This post explains what changed, what an agent can and cannot do in your checkout, and the few things worth checking so that an order placed by an agent is the order the customer meant.
First, what is WebMCP?
WebMCP is a way for a web page to tell an AI agent in the browser: here are the actions you can take on this page, with names and inputs. Instead of the agent clicking around, it calls a named tool such as "update the cart".
Shopify switched it on for storefronts in August. Its changelog of 5 August (effective 21 August) says WebMCP was live on every Liquid storefront and on the Hydrogen developer preview, with tools for the catalogue (search_catalog, browse_store, get_product, show_variant), the cart (get_cart, update_cart, cancel_cart), the hand-off to checkout and orders (proceed_to_checkout, manage_orders), and your policies and FAQs (search_shop_policies_and_faqs). For now it only works in Chromium-based browsers, through an origin trial.
What was missing was the checkout itself. That's what the September change adds.
The four checkout tools
Shopify's changelog lists four tools:
get_checkoutreads the checkout: what's in it, the state, any messages, and the order details once it's completed.update_checkoutchanges the fields an agent is allowed to change, such as the shipping address or delivery option.complete_checkoutsubmits the order after the buyer has confirmed.navigate_to_storefronttakes the tab back to your shop.
The tools work inside Shopify's checkout using the same checkout page the customer would see. Shop Pay is included.
What an agent can't do
This is the part a shop owner should know, because it limits what can go wrong. As reported by Search Engine Journal from Shopify's documentation:
- Agents can't change the items in the order at checkout. What's in the cart is what gets bought.
- The tools don't accept new card details. Payment goes through a saved Shop Pay card or a Shop Pay approval already in place.
- The buyer must confirm. Before calling
complete_checkout, the agent has to show the buyer the current order and total and get their permission to place it. A signature proving which agent it is, or an earlier Shop Pay approval, doesn't count as that permission. - Control goes back to the shopper when the checkout needs a person: Shop Pay login, payment challenges such as 3D Secure, or a checkout extension that blocks progress.
So the realistic risks aren't an agent buying random things on a stolen card. They're quieter: the wrong delivery option, an address with a missing flat number, or a customer who didn't read the summary the agent showed them.
How this differs from Shopify's MCP server
Shopify now has two routes for agents, and they're easy to confuse:
- WebMCP runs in the shopper's own browser tab. The agent works on your live storefront and checkout, on the shopper's session, and hands over to the shopper whenever a person is needed.
- Checkout MCP is server-to-server. An agent platform creates and completes checkouts through Shopify's API, without a browser. Its documentation describes checkout states such as
incomplete,requires_escalationandready_for_complete; when a checkout needs something the API can't provide, the agent sends the buyer to acontinue_urlto finish on your normal checkout.
Both are built on the Universal Commerce Protocol (UCP), Shopify's common format for product discovery, carts and checkout. For a merchant, the practical point is the same either way: the clearer your checkout and store data are, the fewer orders an agent gets wrong or abandons.
A checklist for agent-placed orders
None of this requires a developer. Most of it is housekeeping you'd want for human shoppers too.
- Name your shipping options plainly. "Standard (3 to 5 working days)" and "Express (next working day, order by 2 pm)" are easy for an agent to pick from and to show the buyer. "Option A" and "Eco Plus" aren't.
- Make required fields really required. If you need a phone number for the courier or a flat number for delivery, make the field required in checkout settings. An agent fills what it's asked for.
- Put conditions where the checkout shows them. Final-sale items, made-to-order lead times and delivery restrictions should appear in the product title or checkout, not only in a policy page. The agent reports what the checkout tells it.
- Keep policies and FAQs current. Agents can search them with
search_shop_policies_and_faqs. An out-of-date returns window becomes the answer an agent gives. - Test your checkout extensions. If an app adds a step that blocks checkout (an age gate or a mandatory upsell), the agent hands control back to the shopper. That's safe, but check the step is clear when a person lands on it mid-flow.
- Watch the first orders. For the next month, look for orders with odd delivery choices or address problems. If you see a pattern, fix the label or field that caused it.
Should a small shop care yet?
Honestly, most of your customers aren't shopping through a browser agent today, and it only works in Chromium-based browsers for now. But you don't have to opt in, it is already live on eligible stores, and every item on the checklist above also helps human shoppers. Do the housekeeping now; it costs an afternoon.
