Agentic commerce
What tools does a store’s UCP MCP endpoint expose?
Updated
Thirteen, on every store we measured: three for catalog (search, lookup, get product), four for carts (create, get, update, cancel), five for checkout (create, get, update, complete, cancel) and one for orders (get order). It is a complete commerce API rather than a checkout bolt-on. Listing the tools requires nothing; calling them requires the agent to present its own resolvable identity, so an anonymous request is refused.
The thirteen
Observed by posting a tool-listing request to the MCP endpoint named in each store’s discovery document. Sixty-nine of the 70 stores serving such a document returned exactly this set; one returned nothing at all.
| Group | Tools | What it lets an agent do |
|---|---|---|
| Catalog | search_catalog, lookup_catalog, get_product | Query the catalog directly instead of crawling and parsing product pages. |
| Cart | create_cart, get_cart, update_cart, cancel_cart | Assemble and revise a basket across several turns of a conversation. |
| Checkout | create_checkout, get_checkout, update_checkout, complete_checkout, cancel_checkout | Take a cart through address and shipping selection to a completed purchase. |
| Orders | get_order | Retrieve an order after the fact, for tracking or support. |
The two that change how you think about it
Catalog search is the one with strategic weight. An agent that can query your catalog directly has no reason to render your product page, which means merchandising, layout and on-page persuasion do not reach it. What reaches it is the data.
Order retrieval is the other. It extends the surface past the purchase into support, which is where a large share of agent value actually sits — and where a merchant’s existing processes assume a human is asking.
Listing is open; calling is not
A tool-listing request needs no credentials, which is why the inventory above is verifiable by anyone. Calling a tool is different: the servers we tested refused an anonymous request, requiring the calling agent to present its own resolvable profile first.
That is an identity handshake in both directions rather than merchant discovery alone, and it is a more considered design than the breathless version of this story suggests. A checkout API reachable by any unidentified caller would be an abuse surface; this is not one.
Schema details worth knowing before you integrate
Every tool carries a full JSON schema and takes a metadata argument. Prices come back as integer minor units with a currency code, and the schema notes warn explicitly that an agent must convert before quoting a figure to a buyer — the kind of detail that distinguishes a shipped API from a specification stub.
Frequently asked questions
- Is this list the same on every store?
- It was on 69 of the 70 we tested, all reporting the same protocol version. One store served a valid discovery document and then advertised no tools at all, which looks like a half-configured deployment rather than a different implementation.
- Can I call these tools to test my own store?
- You can list them freely. Calling them requires your agent to present a resolvable identity, so a bare script will be refused. Listing is enough to confirm the surface exists and what it covers.
- Does exposing these tools mean agents bypass my storefront?
- For discovery and purchase, largely yes — an agent using catalog search never renders your pages. That makes the accuracy of your product data, rather than your page design, the thing that determines what an agent tells a buyer about you.
Sources
- DTC AI crawler index — 147 brands, collected 14 August 2026 — PlatformDTC (primary data)
- Agentic checkout is already live on half of DTC — PlatformDTC (primary data)