BigCommerce WebMCP On by Default With a Storefront Opt-Out

Shopping agents that run inside a customer’s web browser can now search products and fill carts on BigCommerce stores without the merchant doing anything. Commerce.com, the Nasdaq-listed parent of BigCommerce, said on October 21 that it had partnered with Cloudflare to switch on a browser standard called WebMCP by default for eligible BigCommerce merchants. Stores that do not want it have to turn it off, and the only switch BigCommerce describes covers the entire storefront, not individual products or categories.

That matters most for sellers of age-restricted or state-restricted goods, who often keep tight control over which items appear where and to whom.

What Commerce.com and Cloudflare switched on

WebMCP lets a website hand a browser agent a list of structured tools, such as a product search, instead of leaving the agent to guess which buttons to press. Cloudflare’s blog describes it as an experimental proposed standard from Google that is still in early preview. Today it runs behind an experimental Chrome flag, in Chrome origin trials and in some agentic browsers, and BigCommerce’s control panel lists it as available in Chrome and Edge (preview).

In its press release, Commerce.com gave the example of a shopper asking an agent to find a lightweight jacket under $150. The agent searches the store’s real products and prices, adds a match to a cart and returns a link so the shopper can finish checkout on the merchant’s site. “WebMCP replaces guessing with a handshake,” said Sharon Gee, Commerce’s senior vice president of product for AI. “Commerce is ensuring our customer sites are agent-ready by default.”

Matthew Conroy, a senior director at Cloudflare, said in the release that the work was “built on open standards with the site owner in control.” Cloudflare’s engineering post puts the reach at almost 100,000 Commerce.com domains.

Which stores are eligible

The press release says only “eligible BigCommerce merchants” without listing them. BigCommerce’s WebMCP developer documentation is more specific. It says WebMCP is enabled by default on all Stencil storefronts and on Catalyst storefronts hosted on Cloudflare. A merchant running a custom headless storefront on Cloudflare can have it turned on by contacting BigCommerce Support. BigCommerce’s own launch blog post, written by Tony Capetola, says that “to start” the feature covers eligible storefronts built on Stencil, so a Catalyst store owner should check the setting rather than assume either way.

The mechanics sit at Cloudflare’s edge. Cloudflare inserts a script tag that loads /.webmcp/bridge.js from the store’s own domain and points it at the store’s MCP server at /api/mcp. MCP stands for Model Context Protocol, the format agents use to call tools. The calls run in the shopper’s browser session, so the agent sees the same prices and cart the shopper sees, according to Cloudflare.

What an agent can do on a default store

The exposure depends on a second setting. Out of the box, BigCommerce’s documentation lists only two tools on a WebMCP storefront, both for checking image provenance under the C2PA content credentials standard. The shopping tools arrive when the merchant has also turned on BigCommerce’s server-side Storefront MCP, whose tools sync to WebMCP automatically. They include search_products, get_product_details, related_products, tools to add, update and remove cart items, and create_checkout_url.

So a store that never enabled Storefront MCP has the bridge script on its pages, but agents get no catalog tools through it. A store that did enable it now hands those tools to any compatible browser agent that visits.

How the opt-out works

BigCommerce’s documentation places the control at Settings > API and MCP > MCP, where a WebMCP toggle opens a “Disable WebMCP” confirmation. It warns that disabling can take a couple of days to take full effect, and that turning WebMCP back on afterward requires a call to Support. Commerce.com’s release adds that the same settings menu manages all of the company’s AI connections.

Cloudflare’s post shows how the switch reaches the edge. Each merchant’s opt-out is stored as metadata on its custom hostname, and a rule checks for webmcp_opt_out before serving the page. An opted-out store gets no injected script.

That design answers the open question about scope. The opt-out works per storefront. Neither the documentation, the press release nor either blog post describes a way to keep particular products, categories or catalogs out of WebMCP while leaving it on for the rest of the store.

Opting out also does not keep agents away. BigCommerce’s documentation says that without WebMCP, browser agents fall back to reading and parsing the page the way they did before.

Points for restricted sellers to check

None of the launch material addresses age verification or state shipping limits. Because the agent’s tools work through the MCP server rather than by clicking through pages, a merchant with an age gate or a state block would want to know where that control fires before deciding whether to leave WebMCP on. EC4IM’s earlier look at agent checkout for age-restricted Shopify products covered the same question on a rival platform.

Questions a BigCommerce store owner can work through, based on what the documentation describes:

Is server-side Storefront MCP turned on, and if so, which products does search_products return?
Does the age check or shipping restriction run at checkout on the storefront, where the shopper still ends up, or only as a page overlay an agent never sees?
Does the store’s content security policy allow /.webmcp/bridge.js? The documentation says a policy that omits it blocks the script, and no tools register.
Is the bridge actually present? The documentation suggests fetching the storefront with curl and searching the result for “webmcp.”

Merchants who run several storefronts, a setup EC4IM compared in BigCommerce vs Shopify for high-risk catalog control, may want to confirm with Support whether each storefront carries its own WebMCP setting. Cloudflare’s post describes the opt-out at the storefront hostname level, but BigCommerce’s documentation does not spell out how the toggle behaves across multiple storefronts on one account.

A default that merchants now own

Commerce.com and Cloudflare turned WebMCP on for eligible BigCommerce stores on October 21, starting with Stencil and including Catalyst storefronts on Cloudflare according to the developer docs. Shopping tools only flow to agents when Storefront MCP is also on, and checkout still finishes on the merchant’s site. The off switch covers a whole storefront, can take days to settle and needs Support to undo, and nothing in the sources offers product-level exclusions. For a seller of restricted goods, the practical decision is whether each storefront’s catalog and checkout controls can handle an agent before the default stays in place.

BigCommerce Turns On WebMCP Shopping Tools by Default, and the Opt-Out Covers the Whole Storefront