Your Shopify store started handing AI agents ten callable tools on August 5. You did not install anything, and there is no switch to turn it off.

Most platform changes arrive as an email you skim and a settings page you never open. This one arrived as a script tag.

On August 5, 2026, Shopify’s developer changelog published four sentences that deserved more attention than they got: “Online stores now expose WebMCP tools that AI agents can call. Agents can search your catalog, manage the shopper’s cart, and go to checkout on the shopper’s behalf.” Then the part that makes it unusual: the tools are “live today on every Liquid storefront and on the Hydrogen developer preview,” and “there’s nothing to install or configure.”

Read that as a merchant and it says: your store grew a programmable interface, five weeks ago, and you were not asked.

We did not want to take the changelog’s word for it, so we went and read the HTML that real storefronts are serving today. Everything in the next two sections we checked ourselves on September 13, 2026.

What is actually in the page

Load the homepage of a Shopify store on a Liquid theme and view source. On Allbirds, Brooklinen, Partake Foods, Death Wish Coffee, Knix, Frank And Oak, Tentree, Bush Balm and Olipop, you will find three things sitting next to each other.

A global that says it is on. window.Shopify.MCP.enabled = true.

A store-specific endpoint. window.Shopify.MCP.mcpEndpoint, pointing at /api/mcp on the store’s own domain. On Allbirds that reads https://www.allbirds.com/api/mcp. This is Shopify’s Storefront MCP server, which Shopify’s own documentation describes plainly: the Storefront MCP endpoint is https://{shop}.myshopify.com/api/mcp, and “Storefront MCP servers don’t require authentication.” That endpoint is a separate thing from the in-page tools, and it has existed for a while. It is worth knowing it is there.

A loader for the agent adapter. A small inline script that fetches https://cdn.shopify.com/storefront/webmcp/webmcp-0.1.1.js as a module.

That loader is better engineered than the coverage suggests, and the detail matters if you care about page weight. It checks for the browser’s agent API first, in this form: typeof (document.modelContext || navigator.modelContext)?.registerTool == "function". If neither exists, it returns immediately and the 64 KB adapter is never requested. It also caches a shopify:webmcp_adapter_loaded flag in localStorage so that a returning visitor who does have an agent gets the adapter earlier in the page lifecycle instead of waiting for DOMContentLoaded.

So for the overwhelming majority of your shoppers, the ones on a normal browser with no agent attached, the cost of this feature today is a few hundred bytes of inline JavaScript. That is a reasonable default and Shopify deserves credit for it.

The interesting part is inside the adapter.

The ten tools, and what each one can actually do

We pulled webmcp-0.1.1.js and read the tool definitions out of it. There are ten, and they match Shopify’s published documentation exactly. The annotations column is the part nobody is quoting, and it is the part that tells you what the tool is allowed to do to the page.

Tool	What it does	Annotations in the shipped adapter
search_catalog	Searches products, collections, articles and pages	readOnlyHint: true, untrustedContentHint: true
browse_store	Lists collections, or navigates the browser to a collection page	readOnlyHint: false, untrustedContentHint: true
get_product	Full product details including variants, prices and stock, or navigates to the product page	readOnlyHint: false, untrustedContentHint: true
show_variant	Takes the shopper to a product page with a specific variant selected	readOnlyHint: false
get_cart	Cart contents, line items, quantities, totals	readOnlyHint: true, untrustedContentHint: true
update_cart	Adds items, changes quantities, removes items	readOnlyHint: false
cancel_cart	Empties the cart	readOnlyHint: false
proceed_to_checkout	Takes the shopper to checkout with the current cart	readOnlyHint: false
manage_orders	Takes the shopper to their order history page	readOnlyHint: false
search_shop_policies_and_faqs	Answers questions about policies and services	readOnlyHint: true, untrustedContentHint: true

Three observations from reading the real definitions rather than the summary.

get_product is marked not read-only, and that is correct. It looks like a lookup, but the shipped description says it will “navigate the browser to the product page” when asked to. A tool that can move the shopper’s browser is not read-only, and Shopify flagged it honestly. Several write-ups list it as a read tool. It is not.

Every read tool is marked untrustedContentHint. This is the annotation that tells the agent “what comes back from me is data, not instructions.” Product titles, collection copy and policy pages are all things a third party can sometimes influence, and marking them is exactly the right call. Chrome’s own security guidance for WebMCP tool authors says to use it when a tool returns user-generated or external data.

No tool sets consequentialHint. Chrome’s guidance reserves that flag for high-impact operations, and gives “booking travel or transferring money” as its examples. Emptying a cart and going to checkout arguably sit near that line. In Shopify’s defence, proceed_to_checkout only navigates, it does not buy, and the agent side applies its own confirmations. But if you build your own tools later, this is the flag most people will forget, and it is the one that decides whether the agent asks the human first.

One more thing we noticed. On the Allbirds homepage, only a single tool is inlined directly in the HTML, search_shop_policies_and_faqs. The other nine are registered by the adapter once it loads. So grepping a page for tool names undercounts what the store exposes. You need to read the adapter.

Who has it, and who does not

“Every Liquid storefront” is accurate, and the word doing the work in that sentence is Liquid.

We checked sixteen storefronts on September 13. Nine carried the loader. Five did not. Two returned a 403 to our request and are inconclusive. The five that did not carry it are the interesting group, because they all had Shopify CDN assets in the page, so they are all Shopify stores.

Storefront	WebMCP loader	What the page looks like
Allbirds, Tentree	Present	Shopify.theme global, Liquid theme
Brooklinen, Partake Foods, Death Wish Coffee, Knix, Frank And Oak, Bush Balm, Olipop	Present	Liquid
Kotn, Endy, Gymshark	Absent	__NEXT_DATA__ and _next/static, Next.js front end
Mejuri, Silk & Snow	Absent	Shopify CDN assets, no Liquid theme global
Pela, Peace Collective	Inconclusive	HTTP 403 to our request

The rule, as far as we can tell from the sample: if your store renders through a Liquid theme, you have this. If someone built you a headless front end, you do not. Shopify’s changelog covers Liquid and the Hydrogen developer preview, which is not the same as a production headless build on Next.js or anything else.

That is a genuinely odd place for the industry to land, and it is worth saying out loud to anyone weighing a replatform. A merchant who paid for a custom headless front end, usually for performance and control, is the merchant who now does not have an agent interface, while the merchant on a stock theme got one for free. We wrote about that trade-off in general terms in the post on Shopify versus a custom build. This is a new line in that table, and it points the opposite way from most of the others.

If you want to check your own store in thirty seconds, open the homepage, view source, and search for Shopify.MCP.enabled. Present means on. Absent means either headless, or a theme that somehow is not getting the injection, and it is worth asking your developer which.

The switch you are thinking of is a different switch

If you know your way around the Shopify admin you may be about to go looking under Sales channels, then Agentic. That page is real, it is on by default for eligible stores, and its purpose is different.

Agentic Storefronts controls which AI sales channels get access to your catalog, and Shopify’s help documentation lists them: ChatGPT, Google AI Mode, Gemini, Microsoft Copilot and Meta. Turning off the “Allow Shopify to manage for me” behaviour lets you manage those channels individually. That is about your products appearing inside somebody else’s assistant.

The WebMCP tools in this post are a separate thing: they are registered by your own page, in the shopper’s own browser, on your own domain. Shopify’s documentation for them says there is nothing to install or configure, and we could find no admin setting, no theme flag and no app that governs them. So if you go to the Agentic page expecting to find this and turn it off, you will change something else instead. Worth knowing before you touch it.

Who can actually call these tools today

This is where the excitement gets ahead of the reality. A tool nobody can call is a tool nobody calls.

ChatGPT’s desktop browser can, since August 25, 2026. OpenAI added “site tools” to the browser built into the ChatGPT desktop app. Per Search Engine Journal’s reading of OpenAI’s help documentation, it requires GPT-5.6 Sol or Terra, is disabled on GPT-5.6 Luna, and is not available in Enterprise or Edu workspaces. An arrow appears in the address bar when a page offers tools, showing whether a tool can read data or make changes, and OpenAI confirms actions like purchases, deleting data, changing account settings, sending messages or sharing personal information. It works in the built-in browser, not the Chrome extension.

Chrome can, in an origin trial. WebMCP has been in origin trial since Chrome 149, which reached stable on June 2, 2026. Edge has its own trial from Edge 150. Local testing is behind chrome://flags/#enable-webmcp-testing. Brave has experimental support in Leo.

Most browsers cannot, and two vendors have said so. On the proposal’s public standards-position issues, WebKit’s position is labelled oppose, with concern labels covering API design, duplication, internationalization, portability, privacy, security, use cases and venue. That is eight of them, which is a lot. Mozilla’s position is neutral. So Safari is not shipping this, and Firefox has not committed either way.

Add that up and the population of shoppers who can use these tools today is: people running the ChatGPT desktop app’s browser, plus developers with a Chrome flag on, plus whatever traffic the origin trial reaches. It is not zero, and it is not a channel yet.

The date to circle is November 3, and almost nobody has

Here is the part that took the most digging, and it is the reason we think this is worth reading now rather than in November.

WebMCP’s Chrome origin trial is registered for milestones 149 through 156. We pulled this from Chrome Platform Status directly rather than from coverage: the feature’s experiment stage records desktop_first: 149 and desktop_last: 156. Chrome 156 reaches stable on October 20, 2026, and Chrome 157 on November 3, 2026, both confirmed against Chromium Dash’s milestone schedule this morning.

So the trial runs out in seven weeks, and the next milestone is where a decision has to show up.

Two things about that decision. First, third-party coverage says shipping is targeted at Chrome 157. Second, Chrome Platform Status does not say that. The feature’s status still reads “Proposed,” its ship stage carries no milestone, and there is no committed desktop version. Those two facts can both be true, a team can intend to ship and not have filed the intent yet, but if you have read anywhere that WebMCP becomes ubiquitous in Q4 because Chrome and Edge are 85 percent of the market, that claim currently rests on nothing you can look up.

And here is the bit that will catch people. That milestone range was announced in May 2026, when a Chrome milestone was four weeks. At that cadence, 149 through 156 ran to roughly December 15, with 157 in mid-January 2027. Chrome then went to two-week releases starting at Chrome 153 on September 8. Same eight milestone numbers, and the end of the window moved from January 12, 2027 to November 3, 2026. That is ten weeks earlier, and the announcement never changed.

We have now watched this exact mechanism move three separate dates, which is why we wrote the post about every browser going biweekly in the first place. Milestone numbers stopped being a proxy for months in September. If a vendor gives you a deadline in Chrome versions, convert it against the schedule yourself.

For a Shopify merchant, the practical read is simple. If Chrome ships it, the tools you already have quietly become a permanent part of your storefront. If Chrome does not, they quietly stop working in Chrome and keep working in ChatGPT’s browser. Either way you are not the one who decides, and either way nothing appears in your admin.

What this does not do

It does not help you get found. This is the most common misreading and it is worth being blunt about.

WebMCP is relevant only after an agent is already on your page. It has no bearing on whether an assistant recommends you, cites you, or knows you exist. Search Engine Journal put it well in its coverage: WebMCP “is mainly relevant once a user or agent has reached the site. It focuses on what can be done afterward, rather than on the page’s ranking or citations.”

Getting recommended in the first place is a different job, and it runs on the same fundamentals it always has, which we went through in the post on making your website AI-readable and in more checklist form in the answer engine optimization checklist. Nothing about WebMCP replaces any of it.

It also does not mean agents are buying things. We argued in August that AI shopping is a discovery channel and not a checkout channel, and this changes that less than it looks. proceed_to_checkout navigates the shopper to checkout. A human still completes it. The genuinely agentic checkout work is happening elsewhere, in Google’s Universal Commerce Protocol, which we covered in the post on the Content API for Shopping sunset, and which still has no published Canadian launch date.

The security question, answered honestly

Two things are true at once and both matter.

Shopify’s implementation is conservative. No credentials are exposed. Everything happens in the shopper’s own session, in their own browser, with their own cart. The read tools carry untrustedContentHint. There is no new server-side attack surface here that the public /api/mcp endpoint and your public product pages did not already represent.

Your policy pages are now an API response. search_shop_policies_and_faqs reads your store’s policies and FAQs and hands them to an agent that will paraphrase them to a customer in a tone of authority. If your returns policy still says 14 days because nobody updated it when you moved to 30, that stale paragraph is now being read aloud as your position by software your customer trusts. Same for shipping cutoffs, phone numbers, and anything seasonal.

That is the same failure mode we flagged in the post on making your website AI-readable, where a business agent learns your hours and policies straight off your pages and then repeats them in your name, and it is the one concrete, non-theoretical action item in this entire post for a Shopify merchant: go and read your own policy pages as though a machine were about to quote them. Most stores have at least one wrong sentence in there.

The broader prompt injection problem is real and it is not yours to solve, though it is worth understanding if you are being sold an agent of your own, which is a separate and more dangerous decision. Chrome’s own guidance for tool authors is unusually candid about it: it says plainly that “it’s impossible to guarantee safety inside of a large language model,” and it caps tool descriptions at 500 characters, parameter descriptions at 150, and individual tool output at 1.5K, precisely to limit how much text a tool can push into an agent’s context. Those limits exist because the attack works.

If you are not on Shopify, should you add tools?

For most small businesses, today: no, not yet, and especially not by installing a plugin for it.

The honest case against moving now is the API itself. On July 21, 2026, the W3C community group moved the entry point from navigator.modelContext to document.modelContext, on the reasoning that tools belong to a document rather than to the browser session. navigator.modelContext was then deprecated in Chrome 150. Shopify’s shipped adapter reads document.modelContext first and falls back to navigator.modelContext, which is exactly right, and is also a tidy illustration of the problem: anything written before late July is pointed at the deprecated name. OpenAI’s own challenge announcement and a good deal of the tutorial content still show navigator.

Which brings us to the plugins. There are WordPress plugins offering to expose your site and your WooCommerce catalog as agent tools. The most visible one reports roughly 600 active installations, is tested up to WordPress 6.9.7, and was last updated about five months ago. WordPress is currently at 7.1. A plugin last touched in April cannot have been written against a namespace that changed in July, and a plugin that registers your catalog and cart as callable tools is not a place to accept stale code. We have written enough about what happens when small businesses install unmaintained extensions to not need to labour the point.

The case for doing something small, if you have a real reason: pick the two or three actions where an agent doing it correctly genuinely beats a human clicking, wire those up by hand, mark them honestly with readOnlyHint, untrustedContentHint and consequentialHint, treat every argument that arrives as hostile input, and read Chrome’s tool security page before you write the first line. A booking lookup, an availability check, an order status query. Not “expose the admin.”

For everyone else, the cost of waiting until Chrome makes its decision on November 3 is approximately zero, and the cost of building against an API that moved once already this summer is not.

The twenty minute check

1. Find out if you have it. Homepage, view source, search for Shopify.MCP.enabled. Thirty seconds. If you are headless, you do not have it and should know that.

2. Read your policy pages as a machine would. Returns window, shipping cutoffs, exchange rules, phone number, hours, anything with a date in it. This is the step that has actual customer consequences this month, and it is the one most likely to be wrong.

3. Check the same for your product data. get_product hands over variants, prices and stock status. If your stock levels are decorative, an agent will now state them as fact.

4. If you are on a headless build, decide whether you care. You are not exposed, and you are also not present. That is a conversation with whoever built it, not an emergency.

5. Do not install a WebMCP plugin this quarter. See above.

6. Put November 3 in the calendar with one line: does Chrome ship WebMCP. If it does, the thing your store has been doing since August becomes permanent and worth designing for. If it does not, this was a five-week curiosity. Nothing you do between now and then changes the answer.

7. Do not confuse this with getting found. If your actual problem is that assistants do not mention your business, the work is elsewhere entirely.

The part that generalises

The specific news here has a shelf life of about seven weeks. The pattern does not.

Your business is now assembled out of platforms that ship capabilities into it without asking, because asking does not scale to millions of merchants. Shopify turned on an agent interface. Google migrated your product feed for you and silently orphaned your feed rules in the process. Chrome changed how often it ships and moved three deprecation deadlines that were written as version numbers. Meta changed how business messaging gets billed. None of those arrived as a decision you made.

The defence is not vigilance, because nobody can read every changelog for every platform they depend on. It is a short list. Write down every platform that can change your storefront, your feed, your payments or your messaging without your involvement, and once a quarter spend twenty minutes reading what each of them shipped. Ten items, two hours a year. That is the entire practice, and it is the only reason we found this one in the first place.

If you want us to run that check on your store, including whether you have these tools, what they currently expose, and whether your policy pages say what you think they say, send us your storefront URL. It takes about half an hour and we will tell you if the answer is “nothing to do here,” because for plenty of stores it is.

Sources

• WebMCP support for Liquid and Hydrogen storefronts, Shopify developer changelog, August 5, 2026, retrieved September 13, 2026, for the quoted announcement, the scope of every Liquid storefront and the Hydrogen developer preview, “there’s nothing to install or configure,” and the note that agent support is limited to Chromium-based browsers through an origin trial
• WebMCP tools, Shopify, retrieved September 13, 2026, for the published list of ten tools and their descriptions
• Storefront MCP server, Shopify, retrieved September 13, 2026, for the https://{shop}.myshopify.com/api/mcp endpoint pattern and the statement that “Storefront MCP servers don’t require authentication”
• Live storefront HTML and the webmcp-0.1.1.js adapter served from cdn.shopify.com, retrieved and read September 13, 2026, for window.Shopify.MCP.enabled, the mcpEndpoint value, the loader’s document.modelContext || navigator.modelContext feature check and lazy-load behaviour, the shopify:webmcp_adapter_loaded localStorage flag, and the ten tool definitions with their annotations
• WebMCP explainer, W3C Web Machine Learning Community Group, retrieved September 13, 2026, for the document.modelContext.registerTool API shape, the exposedTo option, the goals and non-goals, and the August 13, 2025 first publication date
• WebMCP implementation status, retrieved September 13, 2026, for the Chrome 149 origin trial, the Edge 150 origin trial, Brave’s experimental Leo support, and Firefox and Safari being under consideration
• WebMCP, Chrome for Developers, published May 18, 2026 and last updated August 7, 2026, retrieved September 13, 2026, for availability from Chrome 149, the chrome://flags/#enable-webmcp-testing flag, and the caveat that WebMCP “is under active discussion and subject to change in the future”
• WebMCP tool security, Chrome for Developers, retrieved September 13, 2026, for indirect prompt injection as the named threat, the untrustedContentHint, consequentialHint and readOnlyHint annotations, the “booking travel or transferring money” example, the statement that “it’s impossible to guarantee safety inside of a large language model,” and the 500 character, 150 character and 1.5K character limits
• Join the WebMCP origin trial, Chrome for Developers, June 9, 2026, retrieved September 13, 2026, for the Chrome 149 origin trial announcement
• WebMCP feature entry, Chrome Platform Status, retrieved September 13, 2026, for the origin trial range of desktop milestones 149 to 156, the document-modelcontext web feature name, the “Proposed” status, and the absence of any committed shipping milestone
• Chrome release schedule, Chromium Dash, retrieved September 13, 2026, for stable dates of June 2 (149), June 30 (150), July 28 (151), August 25 (152), September 8 (153), September 22 (154), October 6 (155), October 20 (156) and November 3 (157), which is also the evidence for the four-week to two-week cadence change at 153
• WebMCP, issue 670, WebKit standards-positions, retrieved September 13, 2026, for the oppose position and the eight concern labels
• WebMCP, issue 1412, Mozilla standards-positions, retrieved September 13, 2026, for the neutral position
• OpenAI Adds WebMCP Site Tools To ChatGPT’s Browser, Search Engine Journal, August 27, 2026, retrieved September 13, 2026, for the model and workspace requirements reported from OpenAI’s help documentation, the address bar arrow behaviour, the confirmation behaviour, and the built-in browser versus Chrome extension distinction
• WebMCP Connects AI Agents To Actions Inside Websites, Search Engine Journal, August 28, 2026, retrieved September 13, 2026, for the quoted point that WebMCP is relevant after an agent reaches the site rather than to ranking or citations, and for the roster of implementers
• Compete in the OpenAI WebMCP Challenge, Netlify, retrieved September 13, 2026, for the challenge window of August 25 to September 3, 2026 with winners on September 23, and as an example of current documentation still showing navigator.modelContext
• WordPress Playground and WebMCP, WordPress Playground, September 5, 2026, retrieved September 13, 2026, for the statement that WebMCP “is currently a W3C Community Group draft, not an official W3C standard”
• WebMCP Bridge, WordPress.org plugin directory, retrieved September 13, 2026, for the install count, the tested-up-to version of 6.9.7 and the last-updated date
• Managing your agentic storefronts, Shopify Help Center, retrieved September 13, 2026, for the Sales channels then Agentic location, agentic storefronts being active by default for eligible stores, and the channel list of ChatGPT, Google AI Mode, Gemini, Microsoft Copilot and Meta
• WordPress core version check API, retrieved September 13, 2026, for WordPress 7.1 being current

A note on what we could not verify, and what we corrected. OpenAI’s help centre article on site tools returned a 403 to us, so the model and workspace requirements above are reported from Search Engine Journal’s reading of it rather than from the source. Widely repeated claims we could not stand behind: that WebMCP delivers an “89 percent token efficiency improvement” over screenshot-based agents, which we found no measurement for; that stable browser support arrives in Q4 2026 and the standard therefore becomes ubiquitous, which Chrome Platform Status contradicts by still listing the feature as Proposed with no ship milestone; and that Shopify enabled this in March 2026, which appears to conflate a different Shopify feature with the August 5 changelog entry. The exact date each browser vendor’s standards position was recorded is also unclear from the issues themselves, so we have described the positions and not dated them. Two of the sixteen storefronts we checked returned HTTP 403 to our request, so they are counted as inconclusive rather than negative. Finally, Shopify publishes no merchant setting for disabling these tools and we could not find one; that is an absence of documentation, not proof that no mechanism exists, and if you need the tools off, ask Shopify support rather than editing your theme.