Cloudflare Injects WebMCP at the Edge Across ~100,000 Commerce.com Storefronts for AI Shopping Agents
Cloudflare Blog · rss · 2026-10-21
AI can write code and pass the bar exam, yet still struggles to buy shoes online—because sites are built for humans, not agents. Most shopping agents parse HTML, guess which button does what, and retry, which is slow, token-heavy, and breaks on a theme change.
Cloudflare and commerce platform Commerce.com have rolled out Google's proposed WebMCP browser standard at the edge:
- How it works: WebMCP exposes structured tools on the page (e.g. searchproducts, addtocart) so agents call the exact tool instead of hunting for buttons. It is still an experimental standard, available behind Chrome flags, Origin Trials, and some agentic browsers.
- Edge injection: Cloudflare injects a small script at the edge to expose the tools automatically, with no code or theme changes for merchants.
- Scale: Commerce.com runs nearly 100,000 domains on Cloudflare and enabled it for all stores at once.
- Merchant control: Using Configuration Rules and custom hostname metadata, a merchant flipping an opt-out switch in the dashboard bypasses WebMCP with zero added latency and no injected script.
- Security model: Tools execute inside the shopper's active browser session on the store's domain, so prices and cart match, no credentials go to third parties, and the user still clicks checkout.
- Coexistence with server-side MCP: WebMCP serves in-browser agents while server-side MCP serves assistants connecting directly to a store; both share the same tool set.
- Lessons learned: Commerce.com's MCP server lives at /api/mcp rather than the default /mcp, so a zone-level configurable MCP URL was added; if the MCP server is offline or the browser lacks support, the script exits and human shoppers are unaffected.
More from coding & agent
- Voice agent developers wrestle with the hardest edge case: knowing when to hang up — Kindly-Duty272 · 2026-10-21
- OpenCode hacked, eMudra used private key of 4, PHP hit by supply-chain chaos — burny_tech · 2026-10-21
- Falconer launches to unify internal knowledge bases and docs for agents, raises from GC and BoxGroup — heyshrutimishra · 2026-10-21
- PHP ships emergency fixes for two 9.2/10 RCE vulnerabilities — MickeySteamboat · 2026-10-21
- Anthropic releases Claude Sonnet 5.5: Terminal-Bench jumps from 10.3% to 70.6%, tasks up to 30% cheaper — Aiden_Tech_Ai · 2026-10-21
- Indie hacker ships 8 email product features in one drop with Opus, shares inbox open-rate data — marclou · 2026-10-21