On this page
- What it is
- Architecture
- Creation and governance
- Adoption timeline (ecommerce focus)
- Platform implementations in ecommerce
- Shopify
- Dynamics 365 Commerce (Microsoft)
- Stripe and PayPal
- WooCommerce
- The protocol stack: MCP's place among commerce AI protocols
- Adoption state: infrastructure vs transactions
- Retail implications
- Security concerns
- Key terms
Model Context Protocol (MCP)
Model Context Protocol (MCP)
An open standard for connecting AI models to external tools and data sources, introduced by Anthropic in November 2024. In ecommerce, MCP is the connectivity layer that allows AI shopping agents to query live product catalogs, check inventory, build carts, and initiate checkout — without the agent having to scrape web pages or use brittle custom integrations. By 2026, every major AI lab, commerce platform, and payments processor has adopted or announced support, making it the de facto infrastructure of Agentic Commerce.
What it is
The Model Context Protocol is a JSON-RPC 2.0–based open standard and open-source framework that standardizes how AI systems like large language models integrate with external tools, systems, and data sources. (Wikipedia — Model Context Protocol, fetched 2026-09-07)
The analogy that stuck since Anthropic's launch is USB-C: instead of building a custom cable for every device pairing, you get one universal connector. Before MCP, developers had to build custom connectors for each data source — what Anthropic described as an "N×M data integration problem." (Anthropic launch announcement, November 25, 2024; Ars Technica, April 1 2025)
Architecture
Three roles in every MCP interaction: (Wikipedia — Model Context Protocol, citing modelcontextprotocol.io/docs/learn/architecture, fetched 2026-09-07)
- Host — the AI application the user talks to (Claude, ChatGPT, Gemini, Copilot, an IDE). Contains one or more clients.
- Client — lives inside the host; manages the connection to one MCP server.
- Server — the program run by the external service (a retailer, a payment processor) that exposes capabilities in three flavours:
- Tools — actions the agent can take (search a catalog, add to cart, trigger checkout)
- Resources — read-only context (product data, order history, returns policy)
- Prompts — reusable templates for recurring tasks
Client and host typically run on the same machine; servers may be local or remote. Communication uses JSON-RPC 2.0. (Wikipedia — Model Context Protocol)
MCP re-uses message-flow ideas from the Language Server Protocol (LSP). (Engineering.com, May 2025)
Creation and governance
Developed at Anthropic by engineers David Soria Parra and Justin Spahr-Summers; announced November 25, 2024. (Anthropic launch announcement, November 25 2024, cited in Wikipedia)
On December 9, 2025, Anthropic donated MCP to the Agentic AI Foundation (AAIF), a directed fund under the Linux Foundation, co-founded by Anthropic, Block, and OpenAI. At the time of donation: 10,000+ active public servers; approximately 97 million monthly SDK downloads across Python and TypeScript. (TechCrunch, December 9 2025; Lengow Blog — MCP: the protocol every AI shopping agent (now) depends on, published 2026-07-31)
In April 2026, AAIF held the MCP Dev Summit North America in New York City, drawing approximately 1,200 attendees. (InfoQ, April 14 2026, cited in Wikipedia)
Adoption timeline (ecommerce focus)
Compiled from Lengow Blog, 2026-07-31 and Wikipedia:
| Date | Milestone |
|---|---|
| Nov 25, 2024 | Anthropic open-sources MCP |
| Mar 2025 | OpenAI officially adopts MCP across its products including ChatGPT desktop app (TechCrunch) |
| Apr 2025 | Google DeepMind adopts MCP (TechCrunch) |
| May 2025 | PayPal ships industry's first remote commerce MCP server; Stripe publishes at mcp.stripe.com; Visa partners with Anthropic/OpenAI/Microsoft/Perplexity for in-chat payments; Mastercard launches "Agent Pay" (Fortune, May 15 2025) |
| Sep 2025 | OpenAI adds MCP support to ChatGPT apps for third-party access (VentureBeat, Sep 11 2025) |
| Oct 2025 | WooCommerce v10.3 ships native MCP support (as-of 2026-09-07 web search) |
| Nov 2025 | Spec update: server identity, scoped access control, async operations (Lengow Blog, 2026-07-31) |
| Dec 2025 | AAIF governance; Shopify ships Dev MCP server (Winter '26 Edition) (Lengow Blog, 2026-07-31) |
| Jan 11, 2026 | Google unveils Universal Commerce Protocol (UCP) at NRF 2026; MCP is one of its three underlying protocols (Lengow Blog, 2026-07-31) |
| Mar 24, 2026 | Shopify activates Agentic Storefronts by default; 5.6 million stores become discoverable inside ChatGPT, Copilot, Google AI Mode, Gemini (Lengow Blog, 2026-07-31) |
| Jun 2026 | Dynamics 365 Commerce MCP server enters Public Preview (introduced at NRF 2026) (Microsoft D365 Blog, June 29 2026 — PRIMARY) |
| Jun 2026 | Shopify Spring '26 Edition opens agentic commerce to all developers (Lengow Blog, 2026-07-31) |
| Jul 28, 2026 | MCP release candidate final spec ships; removes session handshakes, enabling stateless servers behind standard load balancers (as-of 2026-09-07 web search, [agenticstorefront.com](https://agenticstorefront.com/blog/mcp-2026-release-candidate-explained/)) |
Platform implementations in ecommerce
Shopify
Shopify activated an MCP endpoint at /api/mcp on every store as part of the Summer 2025 Edition — no setup or developer required. (as-of 2026-09-07 web search) By March 2026, Shopify's Agentic Storefronts launch brought four official MCP servers to all eligible stores: (Lengow Blog, 2026-07-31)
- Storefront server — answers agent questions about products, availability, policies in real time
- Customer Accounts server — order tracking and returns for logged-in shoppers
- Checkout server (preview) — cart creation through trusted payment handoff
- Dev server — building and running stores through AI agents
Dynamics 365 Commerce (Microsoft)
Introduced at NRF 2026; entered Public Preview in June 2026. Runs as a Microsoft-managed endpoint on the Commerce Scale Unit (CSU) 10.0.48+. Uses Microsoft Entra ID for authentication. Compatible agent hosts: Microsoft Copilot Studio, ChatGPT, or custom orchestrators. (Microsoft D365 Blog, June 29 2026 — PRIMARY)
Available tools (as-of June 2026):
| Category | Key tools |
|---|---|
| Product Discovery & Inventory | search_products, get_product_by_id, search_store_inventory |
| Cart & Checkout | create_cart, add_product_to_cart, update_cart_line, get_cart, update_cart_address, get_cart_delivery_options, create_payment_link (Adyen Pay-by-Link) |
| Promotions | apply_coupon_code, remove_coupon_code |
| Order Lookup | get_order_details (anonymous + authenticated), get_order_history |
Partner agents built on D365 Commerce MCP as of June 2026: Amicis Store Commerce Agent (voice-first in-store), Argano Retail Clienteling Agent, Visionet FashionGPT Agent, Evenica B2B Licensee Product Request Agent. (Microsoft D365 Blog, June 29 2026 — PRIMARY)
Early adopter quote:
"Our early experience with testing Dynamics 365 Commerce MCP server has been promising. Having access to this type of tooling creates a practical way to introduce AI-driven innovation at the pace retail demands, simply by layering intelligence over existing commerce platforms."
— Shaun Morley, Group Retail and Omnichannel Systems Manager, Michael Hill (Microsoft D365 Blog, June 29 2026 — PRIMARY)
Stripe and PayPal
Stripe's MCP server exposes ~25 tools spanning payments, invoices, disputes, and subscriptions. (Lengow Blog, 2026-07-31, citing Stripe MCP docs)
PayPal shipped the industry's first remote commerce MCP server in 2025. (Lengow Blog, 2026-07-31)
WooCommerce
Native MCP support shipped in WooCommerce version 10.3 (October 2025). (as-of 2026-09-07 web search)
The protocol stack: MCP's place among commerce AI protocols
MCP is not a commerce protocol — it says nothing about how a purchase should be negotiated, payment authorized, or liability assigned. It is the universal plumbing layer that higher-level commerce protocols sit on top of. (Lengow Blog, 2026-07-31)
| Protocol | Who's behind it | The question it answers | Layer |
|---|---|---|---|
| MCP (Model Context Protocol) | Anthropic → Linux Foundation | How does an AI agent access a system's data and tools at all? | Connection & discovery |
| A2A (Agent2Agent) | Google → Linux Foundation | How do autonomous agents talk to each other? | Agent coordination |
| AP2 (Google Agent Payments Protocol (AP2)) | Google, PayPal, payment partners | How is a payment proven to be agent-authorized? (cryptographic mandates) | Payment trust |
| ACP (Agent Commerce Protocol (ACP)) | OpenAI and Stripe | How does a purchase complete inside a conversation? | Checkout rail |
| UCP (Universal Commerce Protocol (UCP)) | Google + Shopify, Walmart, Target, 20+ others | How do all of the above combine into one interoperable purchase journey? | Orchestration |
Shorthand: "MCP is the language, UCP is the contract, ACP and AP2 are the payment rails." (Lengow Blog, 2026-07-31)
UCP explicitly orchestrates MCP, A2A, and AP2. A real transaction in 2026 might use MCP to read live inventory, UCP to negotiate merchant capabilities, and ACP or AP2 to complete payment. (Lengow Blog, 2026-07-31)
Adoption state: infrastructure vs transactions
Two distinct adoption curves (Lengow Blog, 2026-07-31):
Infrastructure curve (steep, real): Three frontier AI labs, major commerce platforms (Shopify, D365, WooCommerce), both payment giants (Stripe, PayPal), vendor-neutral AAIF governance, millions of storefronts exposed by default. MCP is at infrastructure scale in 2026.
Transaction curve (lagging): OpenAI pulled back native checkout in ChatGPT in March 2026 when users browsed but didn't convert. Autonomous end-to-end agent transactions remain a 2027–2028 story. (Lengow Blog, 2026-07-31)
Estimates:
- BCG estimates 15–20% of ecommerce transactions will be AI-mediated by 2028. (as-of BCG 2025)
- eMarketer estimates AI platforms will account for $20.9 billion in retail spending in 2026, nearly quadrupling 2025 figures. (as-of eMarketer December 2025)
Infrastructure readiness vs consumer adoption gap: Shopify's March 2026 announcement characterises 5.6M stores as "agent-ready by default" (Lengow Blog, 2026-07-31). Forrester's "State of Agentic Commerce in Mid-2026" suggests agentic commerce is not yet mainstream from a consumer transaction standpoint (Forrester, mid-2026). The contradiction reflects a real gap between supply-side infrastructure and demand-side consumer behaviour — both claims can be simultaneously true.
Retail implications
Product data quality becomes the entry ticket. When an agent queries a Storefront MCP server, the answer is only as good as the catalog behind it. Missing attributes, stale stock, vague titles, inconsistent identifiers — these were conversion problems before; now they determine whether an agent can answer a shopper's question about you at all. Product Feed Quality has become the entry ticket to agentic commerce.
Check what your platform already exposes. Shopify merchants' storefronts are already agent-readable. Merchants on other platforms should ask: "What is your MCP roadmap and what will agents see when they knock?"
Treat agent access as a security surface. See Security section below.
Don't confuse the layers. Betting on a specific checkout experience (ChatGPT's, Google's) is betting on the volatile layer. Investing in clean, structured, real-time product data is betting on the layer every scenario shares.
Security concerns
In April 2025, security researchers published an analysis identifying prompt injection and "tool poisoning" as key vulnerabilities: attackers hide instructions in content agents read, or tamper with tool descriptions agents consume (which humans never see). (The Hacker News, April 30 2025; The New Stack, April 24 2025, cited in Wikipedia)
In April 2026, production coding agents were hijacked via malicious instructions injected into GitHub pull-request titles. (Lengow Blog, 2026-07-31)
In May 2026, OX Security disclosed a supply-chain flaw estimated to affect ~200,000 MCP instances. (Lengow Blog, 2026-07-31)
Responses: November 2025 spec added server identity and scoped access control; 2026 spec introduced incremental scope consent; NIST's AI Agent Standards Initiative (launched February 2026) expects an interoperability profile by Q4 2026. (Lengow Blog, 2026-07-31)
Payment-adjacent MCP capabilities are expected to stay behind human-in-the-loop checkpoints longer than non-payment tooling. (Lengow Blog, 2026-07-31)
Key terms
| Term | Meaning |
|---|---|
| Host | The AI application (Claude, ChatGPT, Copilot) that contains clients and talks to the user |
| Client | Component inside the host managing a connection to one MCP server |
| Server | The external service's program exposing tools, resources, and prompts |
| Tools | Actions an agent can take via an MCP server (search, add to cart, checkout) |
| Resources | Read-only data exposed by an MCP server (product catalog, order history) |
| Prompts | Reusable task templates exposed by an MCP server |
| Tool poisoning | Attack where malicious actors tamper with tool descriptions that agents read but humans don't see |
| Prompt injection | Attack where malicious instructions are hidden in content that agents process |
| AAIF | Agentic AI Foundation — Linux Foundation directed fund governing MCP from December 2025 |