MCP vs. WebMCP: where agentic commerce actually stands in mid-2026

This is part 1 of a 3-part series on agentic commerce standards. Part 2 fact-checks the most-repeated claims circulating in blogs and on LinkedIn. Part 3 covers what brands should actually do before Shopify’s August 31 deprecation deadline. Links at the end of this post.

Two different technologies are circulating under the name “MCP” in ecommerce marketing right now, and most of the content written about them treats them as one thing. They are not. One is shipped, documented, and answering requests on millions of storefronts today. The other is a browser experiment that exists in exactly one browser, has no shipping commitment, and is formally opposed by Apple.

A marketer who conflates them will spend budget preparing for the wrong one. This post separates them, using primary sources throughout — vendor documentation, browser-vendor standards positions, and Chrome’s own process records. Not summaries of summaries.

The layer that shipped: storefront MCP and UCP

MCP — the Model Context Protocol — is a server-side protocol that lets an AI agent call tools over HTTP: search a catalog, read a product, build a cart. It was created by Anthropic and adopted broadly across the AI industry in 2025. In commerce, the platforms have built on it.

Shopify announced Storefront MCP in its Summer ‘25 Edition (May 2025). Per Shopify’s developer documentation:

“Each Shopify store has its own MCP server endpoint that exposes storefront features.”

That endpoint lives at https://{shop}.myshopify.com/api/mcp, requires no authentication, and exists for every store. An AI agent that knows a shop’s domain can search its catalog, ask about its policies, and build a cart — right now, today, with no work from the merchant.

Since then, Shopify has been consolidating this stack onto UCP — the Universal Commerce Protocol — which Shopify describes as “an open standard for AI agents to connect and transact with any merchant”, co-developed with Google and endorsed by 20+ retailers. The migration is visible in Shopify’s own changelog:

• April 22, 2026 — catalog tools re-based onto UCP: search_catalog, lookup_catalog, and get_product now live at /api/ucp/mcp. The old versions were maintained until June 15, 2026.
• June 24, 2026 — the original cart tools were deprecated in favor of UCP-conforming Cart MCP tools. The deprecated versions are maintained until August 31, 2026.

Two deprecation cycles in three months is what active platform investment looks like. The broader stack at shopify.dev/docs/agents now spans a Global Catalog MCP (search across every Shopify merchant from one endpoint), per-shop Storefront Catalog MCP, Cart MCP, Checkout MCP, Order MCP, and a Universal Cart API in early access. UCP treats MCP as one supported transport alongside REST, the Agent Payments Protocol (AP2), and Agent2Agent (A2A).

BigCommerce followed in May 2026 with its own Storefront MCP — a first-party, server-side MCP server any live store can opt into via an Early Access toggle. One accuracy note, because it gets repeated wrong: BigCommerce’s own developer documentation labels it beta (“The BigCommerce MCP server is currently in beta”), and the company’s own announcement called it open beta. It is real and first-party; it is not generally available.

One more name to keep straight: OpenAI and Stripe’s Agentic Commerce Protocol (ACP) is a separate, competing protocol — not part of UCP, despite how often the two get blended in coverage.

The layer that didn’t: WebMCP, the browser experiment

WebMCP is a proposed browser API that would let a web page expose JavaScript functions as schema-described “tools” for an agent running inside the browser — think of a page telling Gemini in Chrome “here are the three actions you can take on this page.” It is being incubated in the W3C Web Machine Learning Community Group with editors from Microsoft and Google.

Here is its actual status, from Chrome’s own process records:

• It is in a Chrome origin trial spanning Chrome 149 through 156, per Chrome’s documentation and the Intent to Experiment on blink-dev (approved May 18, 2026: “LGTM to experiment from M149 to M156 inclusive”). An origin trial is a test, run on sites that opt in, behind a registration wall. It is not a launch.
• The Intent to Experiment lists shipping at Chrome 157 — desktop, Android, and WebView — as an estimated milestone. There is no Intent to Ship. Chrome stable is at 150 as of this writing, which puts milestone 157 in roughly the first quarter of 2027 — if the estimate holds, and estimates in an Intent to Experiment often don’t.
• The only agent-side consumers named in Chrome’s documentation are Gemini in Chrome and a developer-facing inspector extension. No third-party assistants. No ecommerce platforms.

And then there is the part almost nobody writing about WebMCP mentions.

Apple formally opposes it

On June 11, 2026, Apple’s WebKit team closed its review of WebMCP with the label position: oppose — the full record is public, with concern labels spanning API design, duplication, privacy, security, portability, use cases, and venue. The objection is architectural, in WebKit’s own words:

“An agent acting on a user’s behalf is, in effect, assistive technology: it should operate a site as the user would, and the site should not single it out for different treatment. WebMCP does the opposite, making ‘an agent is driving’ an observable fact.”

WebKit’s concern is that once a site can detect an agent, it can treat agents differently than humans — grant them more capability, or block them the way some sites break screen readers. On June 17, Apple’s representative went further, calling these invariants “not negotiable” and proposing that the group:

“Set WebMCP aside as a proposal for now… Stand up a new community group for agent-assisted user agents… Define the problem and scope first, with no solutions and no engineering… Hold a W3C Workshop that brings in far more voices than a couple of engine developers. Around the TPAC 2026 time frame maybe (26–30 October, Dublin)?”

Mozilla, the other engine vendor, has an open review with no position. The one substantive Mozilla comment proposes marking it neutral — and makes an observation that should reframe every piece of content conflating the two layers:

“There is no MCP here.”

The WebMCP browser API does not use the Model Context Protocol. The name is borrowed. A Mozilla engineer reviewing the spec said so directly.

What about Shopify and WebMCP?

A claim circulates that Google announced Shopify (along with Expedia, Target, Etsy, and others) is “experimenting with WebMCP.” Lumio traced that claim across the posts repeating it and could not find it in any primary source — not Chrome’s origin-trial announcement, not the WebMCP documentation, not the blink-dev thread. None of them names any company. What is verifiable: two Shopify engineers participate in the W3C community group where WebMCP is discussed and have filed issues on the spec. That is standards-body participation — the thing large platform companies do for dozens of proposals — not adoption, not implementation, not a commitment. Shopify has published nothing that implements the WebMCP browser API. Part 2 of this series traces how that claim mutated from nothing into “early adopters” into “publicly committed.”

Side by side

	Storefront MCP / UCP	WebMCP
What it is	Server-side agent endpoints, minted per shop by the platform	Proposed Chrome browser API for in-page agent tools
Shipped?	Yes — every Shopify store; BigCommerce in open beta	No — origin trial in one browser, opt-in sites only
Standards status	Open protocol (UCP), Shopify + Google, 20+ retailers	Community-group draft; WebKit opposes; Mozilla undecided
Who consumes it	AI shopping agents and channels (ChatGPT, Microsoft Copilot, Google AI Mode via Agentic Storefronts)	Gemini in Chrome, in a trial
Uses the MCP protocol	Yes	No — the name is borrowed
A deadline you can miss	Yes — old cart tools sunset August 31, 2026	No deadline exists

What this means for a brand

The agent traffic that matters to commerce runs through the server-side layer — the endpoints, catalogs, and feeds the platforms have shipped — not through a browser API in a trial. What an AI agent finds when it calls a store’s MCP endpoint is a direct function of the store’s product data: the catalog completeness, the structured data, the policies. That part is measurable and fixable now, and it is where preparation pays off regardless of how the browser fight resolves.

Whether WebMCP survives Apple’s opposition, gets reshaped at the proposed W3C workshop, or ships as a Chrome-only feature — nothing a brand does this quarter should depend on the answer.

Next in this series: Part 2 fact-checks the WebMCP claims making the rounds in blogs and on LinkedIn — including the fabricated Google announcement. Part 3 is the readiness checklist for the deadline that actually exists.

Want to know what AI agents see when they call your store today? Talk to Lumio.