/
← Voltar ao feed
low retail e-commerce

Cloudflare and Commerce.com enable WebMCP at the edge for nearly 100,000 storefronts with per-merchant opt-out

1 fonte(s) · 1 atualização(ões) · publicado 21/10/2026 10:00 · coletado há 4 horas

Cloudflare and Commerce.com describe enabling WebMCP, an experimental Google browser standard that exposes structured tools (e.g. search_products, add_to_cart) to AI shopping agents, across almost 100,000 Commerce.com storefronts. Cloudflare injects a script at the edge, so merchants do not have to edit their themes. This is product and partnership news, not a security incident, and the article reports no vulnerability, exploitation or threat actor activity. It is relevant to defenders mainly as context on how agentic commerce and bot-mitigation interactions are evolving.

Detalhes técnicos

  • WebMCP tools run inside the shopper's active browser session on the storefront's domain, so no credentials go to a third party. Checkout is completed by the human shopper.
  • Cloudflare acts as the edge delivery layer for Commerce.com's backend MCP server and proxies tool definitions and actions unchanged through the mcp-server-client toolpack.
  • Merchant opt-out uses Cloudflare Configuration Rules keyed on custom hostname metadata (cf.hostname.metadata.webmcp_opt_out), evaluated at the edge, with no injected script for opted-out stores.
  • A zone-level configurable MCP URL was added because Commerce.com's server lives at /api/mcp rather than the default /mcp.
  • If the MCP server is offline or the browser does not support WebMCP, the script exits and the storefront loads normally.
  • WebMCP is still in early preview, available behind Chrome flags, in Chrome Origin Trials, in some agentic browsers and in Cloudflare Kitesurf.

Remediação

No remediation is required. Merchants who do not want agent-facing tools can set the opt-out switch in the Commerce.com dashboard.

Linha do tempo

  1. blog.cloudflare.com ↗ · pub. 21/10/2026 10:00 · coletado 21/10 12:00 primeiro registro

    Cloudflare and Commerce.com enable WebMCP at the edge for nearly 100,000 storefronts with per-merchant opt-out

    ler a análise desta fonte

    Cloudflare and Commerce.com describe enabling WebMCP, an experimental Google browser standard that exposes structured tools (e.g. search_products, add_to_cart) to AI shopping agents, across almost 100,000 Commerce.com storefronts. Cloudflare injects a script at the edge, so merchants do not have to edit their themes. This is product and partnership news, not a security incident, and the article reports no vulnerability, exploitation or threat actor activity. It is relevant to defenders mainly as context on how agentic commerce and bot-mitigation interactions are evolving.

    Technical Details

    • WebMCP tools run inside the shopper's active browser session on the storefront's domain, so no credentials go to a third party. Checkout is completed by the human shopper.
    • Cloudflare acts as the edge delivery layer for Commerce.com's backend MCP server and proxies tool definitions and actions unchanged through the mcp-server-client toolpack.
    • Merchant opt-out uses Cloudflare Configuration Rules keyed on custom hostname metadata (cf.hostname.metadata.webmcp_opt_out), evaluated at the edge, with no injected script for opted-out stores.
    • A zone-level configurable MCP URL was added because Commerce.com's server lives at /api/mcp rather than the default /mcp.
    • If the MCP server is offline or the browser does not support WebMCP, the script exits and the storefront loads normally.
    • WebMCP is still in early preview, available behind Chrome flags, in Chrome Origin Trials, in some agentic browsers and in Cloudflare Kitesurf.

    Remediation

    No remediation is required. Merchants who do not want agent-facing tools can set the opt-out switch in the Commerce.com dashboard.