Field study · 31 August 2026 · live registry evidence

Ten agent tools hiding in a storefront

Away Travel looks like a familiar ecommerce site. To a WebMCP-aware browser it also exposes a structured route from product discovery to checkout. We scanned that live tool surface — then checked five more Shopify storefronts to see whether the pattern held.

Away Travel: one surface, three page contexts

The production scan observed the same ten tools on the homepage, a collection page and a product page. That consistency matters: an agent can plan a shopping journey without losing capabilities as the visible page changes. See the public Away Travel report and the independent directory entry.

A journey an agent can understand

1. 01
   search_catalog

   Find products from a natural-language request.

2. 02
   get_product

   Read structured product and variant details.

3. 03
   show_variant

   Bring the matching option into the human's view.

4. 04
   update_cart

   Change cart state with an explicit action.

5. 05
   proceed_to_checkout

   Hand off at the sensitive boundary.

We discovered and classified these contracts; we did not invoke them or place an order. Transactional completion requires a separate, consented test.

The six-store validation cohort

Five storefronts produced live registry evidence in the production scanner. The sixth, Simple Affiliate, was unmeasured in that production run; a local Chrome run independently observed 14 tools. We show the distinction instead of converting an unavailable witness into a false negative.

The interesting exception: tools unique to the business

Simple Affiliate exposed Shopify's ten standard commerce tools plus four capabilities specific to its product. That is the deeper opportunity: a platform can supply the common surface while each business adds the actions that make it distinct.

What the scanner learned

Detecting that WebMCP exists is only the first layer. The scanner now preserves tool names, input schemas, WebMCP annotations, classifications and the page context that exposed each tool. It also normalises the object and serialized schema shapes found across Chrome transports, and keeps an unavailable browser witness separate from a verified zero.

That turns a browser feature into an auditable question for a business: what can an agent actually do here, on which page, with what contract, and where should a human remain in control?