The report
Commerce.com worked with Cloudflare on WebMCP interfaces for nearly 100,000 storefronts. Cloudflare's developer example lets a browser agent discover typed shopping tools, search the catalog and add an item to the customer's live cart. The described checkout boundary is deliberate: the merchant retains the checkout backend and the person confirms the final purchase.
The intended store count is not evidence that every storefront had activated the feature when the post appeared, nor a verified incident count. The arrangement deserves coverage because a browser-session agent gains a structured ability to modify a user's commerce state while ordinary page content remains less trusted than the tools it invokes. Keeping the final purchase separate may narrow financial authority, but it does not by itself validate every product, price or malicious prompt injected into search results. Cloudflare technical announcement.
The merchant retains the purchase boundary
In the published example, WebMCP exposes search_products and add_to_cart through the customer's active browser session, while the customer proceeds to checkout on the storefront. Commerce.com also describes an opt-out per merchant, implemented at Cloudflare's edge. The nearly 100,000-store footprint describes availability of the integration, not 100,000 stores completing authorized autonomous payments. This matters because discovery of typed tools makes a shopping workflow more deterministic without transferring the authority to settle a purchase. A separate agent payment signer would still require its own purpose, recipient and budget controls. Cloudflare/Commerce.com implementation; payment boundary analysis.