Shopify expanded its WebMCP tools into checkout on Sept. 28. Now, browser agents can read and update the checkout open in a shopper’s tab and submit the order once the buyer confirms it. When I discussed Shopify’s WebMCP rollout in August, its storefront tools allowed agents to search for products and manage the cart, then guide shoppers to checkout without placing the order.
The new tools use the same state as the checkout page the shopper sees. Shopify’s developer changelog says they “don’t expose a new API or require merchant configuration.”
What Agents Can Do At Checkout
Eligible Shopify checkouts now register four WebMCP tools, according to the company’s Checkout WebMCP docs.
get_checkoutreads the checkout and, after purchase, the order details.update_checkoutchanges contact details, shipping or pickup, discount codes, payment, and extra fields such as a tax number.complete_checkoutplaces the order.navigate_to_storefrontreturns the tab to the store.
Checkout runs its own validation on each update, and agents can’t change the items in the order.
The tools don’t accept new card details. An agent can assist by selecting a saved card from Shop Pay or, if the guest checkout allows, using a Shop Pay approval that the agent has on file. Any other payment options will be up to the buyer to choose on the checkout page.
Agents should sign their browser requests using Web Bot Auth, which Shopify relies on to recognize agents. Without it, their requests might be deprioritized or blocked by bot detection systems.
Where The Buyer Takes Over
Shopify’s documentation tells agents to display the current order and total to the buyer before calling complete_checkout, and to “get their permission to place it.” A Web Bot Auth signature, a Shop Pay approval, or a ready-to-complete status does not qualify as that consent.
Shop Pay login and payment challenges, like 3D Secure, return control to the buyer on the page, along with blocking UI extensions and review steps. The buyer also manages interactions with app-defined checkout extensions.
Which Checkouts Get The Tools
Shopify’s standard three-page checkout gets no WebMCP tools unless the buyer checks out with Shop Pay. B2B checkout, embedded checkout, and checkouts inside mobile checkout SDKs are excluded too. Checkouts with merchandise from another shop, draft orders, order edits, and payment collection are also excluded.
For now, Shopify’s storefront docs say agents can use WebMCP only in Chromium-based browsers.
Checkout WebMCP Versus Checkout MCP
Shopify documents two routes for agents at checkout and recommends the server-based one, Checkout MCP, where an agent manages a checkout session from its own server. Shopify says to use Checkout WebMCP “only when your agent is already operating in the buyer’s browser.”
Both options rely on the checkout capability of the Universal Commerce Protocol and use the same checkout object. Checkout WebMCP operates through tools that the checkout page registers in the buyer’s browser, while Checkout MCP handles requests on the server side. No matter the method, Shopify says the merchant stays the merchant of record in both cases.
Shopify’s Test Against Browser Automation
Gil Greenberg, who is part of the team at Shopify working on agentic commerce, recently shared the results of a company test. In this test, they compared WebMCP with browser automation, where an agent reads the page and clicks through it. Both methods were tested using GPT-6 Sol “with the same prompts and starting conditions.”
Across ten checkout tasks in two test shops, WebMCP was successful in all 60 attempts, while browser automation succeeded in 56 out of 60. Excluding page setup time, the time per attempt was 10.3 seconds with WebMCP versus 27.4 seconds with browser automation. Additionally, WebMCP’s cost per attempt was 58% lower at OpenAI’s list prices. However, one line in Greenberg’s post states a total for the test that doesn’t align with the 60 attempts listed per method.
The results come from Shopify’s test shops and a single model. The changelog and checkout documentation don’t include real-world data, such as orders made by agents or conversion rates.
Why This Matters
In August, Shopify limited its browser tools to getting shoppers to the checkout page. Now, an agent can complete the order on eligible checkouts once the buyer confirms, with no need for the merchant to enable anything.
Your checkout setup controls when a browser agent returns the order to the shopper. With a three-page checkout, tools are available only when the buyer uses Shop Pay to check out. Blocking UI extensions enable the buyer to regain control, and any payments outside a saved Shop Pay card or approval are processed directly on the page.
Looking Ahead
As of publication, Shopify’s storefront and checkout WebMCP docs don’t say whether merchants can switch off individual tools or separate agent-placed orders in their reports. Watch Shopify’s developer changelog for either.
Shopify’s WebMCP docs also don’t name which agents call the checkout tools. ChatGPT’s desktop browser added WebMCP site tools in August, but OpenAI’s help page for those tools doesn’t mention Shopify’s checkout tools.
Featured Image: Samuel Boivin/Shutterstock
