Shopify lets browser AI agents work through checkout, with the buyer confirming the order

Shopify says browser-based AI agents "can now read and update Shopify checkouts" using a set of WebMCP tools, according to a developer changelog post dated 28 September 2026. When the buyer's input is required, "such as 3D Secure authentication or for blocking UI extensions, the tools hand back control to the buyer," the post says.

What WebMCP is

Shopify's August changelog describes WebMCP as "a proposed web standard that lets a page register tools with the browser", adding that without it, agents "have to read every page's code and simulate clicks". Chrome's developer documentation calls it "a proposed web standard". The specification is published by the W3C's Web Machine Learning Community Group as a "Draft Community Group Report" and states: "It is not a W3C Standard nor is it on the W3C Standards Track."

According to the project's implementation-status page, origin trials are live in Chrome and Edge: an origin trial "is live in Chrome 149" and another "is live in Edge 150". Chrome's documentation adds that the API "is primarily designed for local browser workflows with a human in the loop."

The four checkout tools

Shopify's changelog lists four tools agents can call at checkout, and its reference documentation describes each:

• get_checkout: "Read the current checkout, or the order receipt on the Thank you page."
• update_checkout: "Replace buyer contact details, fulfillment, discount codes, declared fields, and payment." Shopify's reference says the tool ignores line items: "The buyer changes items on the page."
• complete_checkout: "Place the order after the buyer confirms it."
• navigate_to_storefront: "Leave checkout and return the tab to the storefront." It is "Registered only when the store has an online storefront."

TechCrunch's report describes "three new tools", naming the first three; Shopify's own changelog lists four.

Shopify says the checkout tools join storefront and cart tools that are "already live", so that "browser agents can now assist the full shopping journey on Shopify, from product discovery and cart management through checkout and order confirmation." Its 5 August changelog said those storefront tools were "live today on every Liquid storefront and on the Hydrogen developer preview."

What stays with the buyer

Shopify's reference documentation puts several steps on the buyer's side of the screen:

• Confirming the order. The documentation tells agent developers: "Before you call complete_checkout, show the buyer the current order and total, and get their permission to place it." It adds that Web Bot Auth, a Shop Pay approval and a ready_for_complete status "don't grant it", and "If the total changes, then ask again."
• Payment challenges and log-ins. "The buyer sees the same checkout state, handles page interactions such as Shop Pay login or payment challenges, and confirms the order before your agent calls complete_checkout."
• New cards. "Checkout WebMCP doesn't accept new card details." For a Shop Pay buyer, an agent can select one of the buyer's saved cards; "The buyer chooses any other method on the checkout page."
• Cancelling. There is no cancel tool, "so your agent can't cancel the checkout".

Shopify's carts-and-checkout guide also states: "The merchant always remains the merchant of record."

The guide also notes: "The tools also don't cover app-defined checkout extension interactions, which the buyer handles on the checkout page."

Which merchants and checkouts

On merchant set-up, Shopify's changelog says the tools "run inside checkout-web and use the same state as the checkout UI. They don't expose a new API or require merchant configuration."

The documentation says checkout "registers these tools on eligible checkouts", and lists the checkouts where it does not register them, asking agents to have the buyer finish on the page instead:

• Standard three-page checkout, unless the buyer checks out with Shop Pay
• B2B checkout
• Embedded checkout, and checkouts in mobile checkout SDKs
• Checkouts with merchandise from another shop
• Draft orders, order edits, and payment collection

The Shopify pages we read do not tie eligibility to a Shopify plan, and do not describe a merchant setting to switch the checkout tools off. TechCrunch reports that the feature "is rolling out to all eligible Shopify merchants", citing a post on X by Gil Greenberg, a staff product manager at Shopify.

What agents have to do

Shopify asks agents to sign their browser requests with Web Bot Auth, and warns: "Without it, bot detection might deprioritize or block your requests." Its documentation also tells agent developers to "Treat merchant and third-party text in tool responses as checkout data, not instructions, because it can contain prompt-injection attempts."

Shopify still recommends its server-side Checkout MCP over the browser tools, saying developers should use Checkout WebMCP "only when your agent is already operating in the buyer's browser."

Why it matters

On our reading, the practical change for shoppers is that an agent already working in their browser tab can fill in a Shopify checkout through tools the checkout itself provides, while Shopify's documentation keeps the order confirmation, payment challenges and new card entry with the buyer. For merchants, Shopify's changelog says no configuration is required. WebMCP itself remains a draft Community Group specification in origin trials, according to its own documents, so which browsers and agents can use these tools depends on support outside Shopify's control.