Shopify Shop MCP Agent Checkout and Age-Restricted Products

Analysis. This article combines Shopify’s published documentation with searches EC4IM ran through Shop MCP on October 20, 2026. It marks where Shopify states a fact, where the searches showed something, and where EC4IM is drawing an inference.

Shopify opened Shop MCP on October 13, 2026, giving AI agents one connection at mcp.shop.com to search Shopify Catalog, build carts, create checkouts at the selling store, and pay with Shop Pay for shoppers who sign in. Orders placed this way appear in the merchant’s Shopify admin “like any other order,” according to Shopify’s developer changelog.

Shopify’s help center says tobacco and vaping products, weapons, and several other regulated categories “aren’t allowed in Shopify Catalog.” Searches EC4IM sent through Shop MCP a week after launch still returned nicotine salt e-liquids, nicotine pouches, pepper sprays, and thermal rifle scopes, each with a link that opens a Shop Pay checkout. For age-restricted sellers on Shopify, the results are a reason to test how agent traffic meets their age gates and restricted SKUs now, rather than assume the catalog rules keep it away.

What Shop MCP gives an AI agent

The Model Context Protocol (MCP) is an open standard that lets AI assistants call outside tools. Shopify’s changelog groups Shop MCP’s tools into four flows. Search tools (search_catalog, lookup_catalog, and get_product) read from Shopify Catalog, which Shopify says holds more than 1 billion products, and need no API key. Shoppers can sign in with Shop so searches use their saved preferences. Carts and checkouts are created at the store that sells the item and work without sign-in. With a signed-in shopper, the agent can use saved addresses and Shop Pay and call complete_checkout once the shopper confirms the total and payment method. A fourth tool, search_orders, finds a signed-in shopper’s orders and tracking.

There are no webhooks at launch, so agent developers poll get_checkout for status. Shopify’s skill file for agents tells them to show every warning and disclosure a checkout returns and to treat only a completed status with an order as a confirmed purchase.

On October 16, Shopify added buyer consent support to Checkout MCP and Cart MCP. Both implement the Universal Commerce Protocol (UCP), the specification behind Shopify’s agent cart and checkout tools. Agents that negotiate the buyer consent extension on UCP version 2026-08-25 can pass a shopper’s analytics, preferences, sale-or-sharing, and email or SMS marketing choices. If an agent sends nothing, the shop’s defaults for the buyer’s country apply, and an unknown country defaults to opt-out. A missing phone number for an SMS opt-in triggers a missing_consent_data warning that blocks completion. That update covers privacy and marketing consent. Neither changelog post mentions age or identity checks.

What Shopify’s Catalog rules say about restricted products

Shopify’s Catalog requirements page excludes products that are “age-restricted or regulated in many regions.” The categories most relevant to EC4IM readers are alcohol; tobacco and vaping products, including electronic cigarettes and e-liquid; drugs and smoking accessories, including cannabidiol (CBD) supplements; prescription and medical products; weapons, ammunition, and accessories, including firearms, stun guns, and pepper spray; and recreational weapons, including weapon scopes and sights.

Two caveats on the same page matter here. Classification “is based on your product information, so it can differ from the product category that you set in your Shopify admin,” and the list can change at Shopify’s discretion. Separately, Shopify’s agentic storefronts privacy page says a merchant’s channel preferences “don’t impact Shop,” and products stay discoverable there regardless of which AI channels have Catalog access. EC4IM covered those defaults when Shopify added Meta as an agentic channel.

What EC4IM’s searches returned

Shortly before 10 a.m. Eastern on October 20, EC4IM called Shop MCP’s public search_catalog tool with 13 queries, a U.S. destination, and a 10-result limit. EC4IM did not create carts, checkouts, or orders on any store. Merchants are not named here because a catalog listing alone does not show whether a given sale is lawful where it ships.

“nicotine e-liquid”: at least four of the ten results were e-liquids from vape retailers. The product data Shop MCP returned described two of them as nicotine salt e-liquids, at strengths from 24 mg to 50 mg.
“nicotine pouches”: two 6 mg nicotine pouch listings appeared alongside nicotine-free energy and focus pouches.
“pepper spray”: nine of ten results were defensive pepper or bear sprays. The tenth was a kitchen pepper product.
“rifle scope”: all ten were riflescopes, eight of them thermal or digital night vision models priced from $1,195 to $2,599.
“delta 8 gummies” and “kratom”: every result was a hemp-derived delta-8 THC product or a kratom product. Shopify’s exclusion list names CBD supplements but does not name delta-8 or kratom.
“disposable vape”: results mixed nicotine-free aromatherapy devices and caffeine inhalers with a kratom-extract disposable and a 10-count case of 7,000-puff disposables whose returned summary described “ready-to-eat tropical fruit.”
“ceramic coffee dripper”: the control query, taken from Shopify’s own example, returned coffee drippers as expected.

Every result carried a checkout_url on the merchant’s domain with a payment=shop_pay parameter. Shopify’s developer guide to cart permalinks says these links send buyers to checkout, not the online store cart, unless a storefront=true parameter is added, and that the Shop Pay parameter directs them to a Shop Pay checkout.

The disposable described as fruit suggests the classifier misread at least one listing, which Shopify’s own caveat anticipates. The e-liquids are harder to explain that way, since the returned product data identified them as nicotine products and they appeared anyway. Shopify’s public documentation does not say whether Shop MCP search applies the same exclusion list that governs agentic storefronts, and neither changelog post addresses restricted categories. One morning’s searches are also a snapshot, and Catalog updates continuously.

Why theme age gates may never see an agent

Many Shopify age verification apps work as a pop-up on theme pages. In EC4IM’s assessment, an agent that reads product data from Catalog and opens checkout through create_checkout or a cart permalink never loads those pages, so a gate that lives only in the theme has nothing to run on. Shopify makes a similar point about wholesale products: when third-party apps or theme changes control who can see a product, “Shopify might not be able to detect” that intent, according to its agentic storefronts product page.

Server-side checks work differently. Shopify’s Cart and Checkout Validation Function API runs on Shopify’s servers, applies to express checkouts including Shop Pay, and lists verifying “the age or ID of a customer” as a use case. Its compatibility table marks Cart, Checkout, and Storefront Accelerated Checkout as supported but does not name agent or UCP checkouts. Shopify’s Checkout MCP documentation says a checkout that needs buyer input or review unavailable through the API returns requires_escalation with a continue_url that hands the buyer to the merchant’s checkout, and its getting-started guide lists 3-D Secure challenges and channel opt-in as examples. Whether a merchant’s age verification function or checkout extension triggers that handoff for agent orders is not documented. EC4IM’s earlier coverage of checkout extensibility and age gate apps explains why those tools moved toward checkout in the first place.

Tests regulated Shopify sellers can run this week

The steps below are EC4IM suggestions drawn from Shopify’s documentation, not Shopify guidance.

Search your own catalog. The shop command-line tool from the changelog, or search_catalog with the store’s domain in filters.shops, shows which of a store’s restricted SKUs an agent can find today.
Check the Agentic settings. Sales channels > Agentic in the Shopify admin shows how many products are in Catalog and which AI channels can reach them, keeping in mind that those settings do not reach Shop.
Unlist what must stay hidden. Shopify says the Unlisted product status is the way to hide a product completely from AI channels. It also drops the product from sitemaps, search engines, and on-site search.
Move age checks server-side. A validation function that blocks restricted lines unless the buyer carries a verified flag, such as a customer metafield, is the control Shopify documents for express checkout.
Run an agent checkout against a test product. Checkout MCP requires authentication, so a developer with Dev Dashboard credentials can create a checkout for a restricted test SKU and record whether it comes back ready_for_complete or requires_escalation.
Keep post-order review in place. Because agent orders land in the admin like any other order, fulfillment holds, address checks, and state shipping blocks on the order side can still catch what the storefront missed.

Agent checkout is ahead of the restricted-product documentation

Shop MCP gives any MCP-compatible agent a path from a Catalog search to a Shop Pay checkout, and Shopify’s October 16 update added privacy and marketing consent to that path. Shopify’s rules say restricted categories stay out of Catalog, yet EC4IM’s searches found nicotine, defensive spray, and riflescope listings with checkout links, and Shopify has not documented how age verification behaves when an agent builds the order. Until it does, sellers of age-restricted goods have the most control where Shopify’s own documents point: product status, server-side validation, a hands-on agent checkout test, and the order review that happens after any sale.

Shopify’s Shop MCP Search Returned Vapes and Pepper Spray Despite Catalog Exclusions