Regulatory & Compliance

What Age-Restricted Shopify Sellers Should Check as Shop MCP Opens Agent Checkout

Shopify opened Shop MCP on October 13 so AI agents can search Shopify Catalog and check out with Shop Pay. Sellers of age-restricted and regulated products have reason to review how their listings, age checks, and order controls work when an agent does the buying.

E-commerce 4 Internet Marketers Editorial

Older woman holds up a photo card as a toy robot carrying a basket stands between her and a young man at a laptop
A woman holds up a photo card as a toy robot with a shopping basket crosses the desk, as Shopify opens checkout to shopping agents.

Analysis. This article is based on Shopify’s published documentation and changelog. The checks listed near the end are EC4IM suggestions drawn from those documents, not Shopify guidance.

Shopify opened Shop MCP on October 13, 2026, giving AI agents one connection at mcp.shop.com to search Shopify Catalog, build carts, create checkouts at the selling store, and pay with Shop Pay for shoppers who sign in. For merchants who sell vapes, CBD, defensive sprays, hunting optics, or other restricted goods, the launch adds a buying path that starts in a chat window instead of on the storefront, and it is a good moment to confirm how those products appear to agents and what happens when an agent tries to buy one.

Orders placed this way land in the merchant’s Shopify admin “like any other order,” according to Shopify’s developer changelog. That makes agent sales easy to fulfill, but it also means a store’s age and eligibility controls need to work for a buyer who may never see the theme.

What Shop MCP gives an AI agent

The Model Context Protocol (MCP) is an open standard that lets AI assistants call outside tools. Shopify’s changelog groups Shop MCP’s tools into four main flows. Search tools (search_catalog, lookup_catalog, and get_product) read from Shopify Catalog, which Shopify says holds more than 1 billion products, and need no API key. Shoppers can sign in with Shop so the search tools use their saved preferences. Carts and checkouts are created at the store that sells the item and work without sign-in. With a signed-in shopper, the agent can use saved addresses and Shop Pay and call complete_checkout once the shopper confirms the total and payment method. A fourth tool, search_orders, finds a signed-in shopper’s orders and tracking.

There are no webhooks at launch, so agent developers poll get_checkout for status. Shopify’s skill file for agents tells them to display every warning a checkout returns, to send the shopper to the checkout link when a step needs the buyer, and to treat only a completed status with an order as a confirmed purchase.

On October 16, Shopify added buyer consent support to Checkout MCP and Cart MCP. Both implement the Universal Commerce Protocol (UCP), the specification behind Shopify’s agent cart and checkout tools. Agents that negotiate the buyer consent extension on UCP version 2026-08-25 can pass a shopper’s analytics, preferences, sale-or-sharing, and email or SMS marketing choices. If an agent sends nothing, the shop’s defaults for the buyer’s country apply, and an unknown country defaults to opt-out. That update covers privacy and marketing consent, not age or identity checks.

What Shopify’s Catalog rules say about restricted products

Shopify’s Catalog requirements page keeps out products that are “age-restricted or regulated in many regions.” The categories closest to EC4IM readers are alcohol; tobacco and vaping products, including electronic cigarettes and e-liquid; drugs and smoking accessories, including cannabidiol (CBD) supplements; prescription and medical products; weapons, ammunition, and accessories, including firearms, stun guns, and pepper spray; and recreational weapons, including weapon scopes and sights.

The same page explains that Shopify classifies products “based on your product information, so it can differ from the product category that you set in your Shopify admin,” and that complete, accurate product data helps it classify correctly. The list can also change at Shopify’s discretion. Some regulated lines, such as hemp-derived THC products or kratom, are not named on the list at all, so sellers of those goods cannot assume the exclusions cover them.

Channel settings are a separate question. Shopify’s agentic storefronts privacy page says a merchant’s agentic storefronts preferences “don’t impact Shop,” and products stay discoverable there regardless of which AI channels have Catalog access. EC4IM covered those defaults when Shopify added Meta as an agentic channel.

Why a theme age gate may not reach an agent buyer

Age verification that runs only as a pop-up on theme pages depends on the shopper loading those pages. In EC4IM’s assessment, an agent that reads product data from Catalog and opens a checkout through create_checkout skips the storefront browsing where such a pop-up would appear. Shopify makes a similar point about wholesale products: when third-party apps or theme changes control who can see a product, “Shopify might not be able to detect” that intent, according to its agentic storefronts product page.

Server-side checks work differently. Shopify’s Cart and Checkout Validation Function API runs on Shopify’s servers, applies to express checkouts including Shop Pay, and lists verifying “the age or ID of a customer” as a use case. Its compatibility table marks Cart, Checkout, and Storefront Accelerated Checkout as supported but does not name agent or UCP checkouts specifically.

Shopify’s Checkout MCP documentation describes a handoff for cases an agent cannot finish. A checkout that needs buyer input or review not available through the API returns requires_escalation with a continue_url that sends the buyer to the merchant’s own checkout, and for most partners referring checkouts from Catalog, that handoff is how the purchase completes. Shopify’s getting-started guide names 3-D Secure challenges and channel opt-in as examples. Shopify has not published specific guidance on whether an age verification function or checkout extension triggers that handoff. EC4IM’s earlier coverage of checkout extensibility and age gate apps explains why those tools moved toward checkout in the first place.

What restricted Shopify sellers can check

The steps below are EC4IM suggestions based on Shopify’s documentation.

  • Look up the store’s own listings. The shop command-line tool from the changelog, or search_catalog with the store’s domain in filters.shops, shows which of a store’s products an agent can find and how their data reads.
  • Review product data. Because Catalog classification follows titles, descriptions, and other product information, vague or incomplete listings for restricted items are worth tightening.
  • Check the Agentic settings. Sales channels > Agentic in the Shopify admin shows how many products are in Catalog and which AI channels can reach them, keeping in mind that those settings do not reach Shop.
  • Unlist what must stay hidden. Shopify says the Unlisted product status is the way to hide a product completely from AI channels. It also drops the product from sitemaps, search engines, and on-site search.
  • Move age checks server-side. A validation function that blocks restricted lines unless the buyer carries a verified flag, such as a customer metafield, is the control Shopify documents for express checkout.
  • Walk through an agent checkout on a test product. Checkout MCP requires authentication, so a developer with Dev Dashboard credentials can create a checkout for a restricted test SKU and note whether it comes back ready_for_complete or requires_escalation.
  • Keep post-order review in place. Because agent orders land in the admin like any other order, fulfillment holds, address checks, and state shipping blocks can still stop a sale that should not ship.

Agent checkout puts age controls back on the merchant’s list

Shop MCP gives any MCP-compatible agent a route from a Catalog search to a Shop Pay checkout, and Shopify’s October 16 update added privacy and marketing consent to that route. Shopify’s Catalog rules exclude many age-restricted categories, but classification depends on product data, some regulated goods fall outside the list, and Shopify has not spelled out how age verification behaves when an agent builds the order. Sellers of restricted products have the most control in the places Shopify’s own documents point to: accurate product data, product status, server-side validation, a hands-on agent checkout test, and the order review that follows any sale.

Sources