MCP: the protocol every AI shopping agent (now) depends on

The Model Context Protocol is an open standard for connecting AI models to external tools and data sources. The analogy that stuck since Anthropic’s launch announcement is USB-C: instead of building a custom cable for every device pairing, you get one universal connector. Before MCP, every AI assistant needed a bespoke integration with every system it wanted to use, the same N×N problem that plagues commerce integrations. After MCP, a system exposes its capabilities once, and any compatible AI client can use them.

The architecture has three parts. A host is the application the user talks to: Claude, ChatGPT, Gemini, Copilot, or an IDE like Cursor. Inside it, a client manages the connection. On the other side, a server is the program that exposes what the AI can actually access, in three flavors: tools (actions the agent can take, like searching a catalog or creating a cart), resources (read-only context, like product data or an order history), and prompts (reusable templates for recurring tasks). Stripe’s MCP server, to take a concrete commerce example, exposes around 25 tools spanning payments, invoices, disputes and subscriptions through exactly this structure.

What MCP deliberately is not: a commerce protocol. It says nothing about how a purchase should be negotiated, how a payment should be authorized, or who is liable when an agent buys the wrong thing. It is plumbing, and that modesty turned out to be its superpower. Because it solved only the universal problem (how does an AI talk to an external system at all?), everyone could adopt it without picking a side in the commerce wars.

The adoption curve is worth laying out, because its speed is unprecedented for infrastructure of this kind.

Two things stand out. First, the speed: SDK downloads reached roughly 97 million per month within sixteen months, with more than 10,000 public servers indexed. Second, the governance move: by handing the protocol to a neutral foundation co-founded with OpenAI and Block, Anthropic removed the last reason for competitors to hold back. It is hard to overstate how unusual that is. The last time the industry converged this fast on shared infrastructure, it was HTTP.

The clearest commerce deployment is Shopify’s. Every store on the platform now ships official MCP servers: a Storefront server that answers agent questions about products, availability, and policies in real time; a Customer Accounts server for order tracking and returns on behalf of logged-in shoppers; a Checkout server (still in preview) managing cart creation through to a trusted payment handoff; and the Dev server for building and running stores through AI agents. When a shopper asks Claude or ChatGPT “does this store have it in a size 12, and what’s the returns window?”, the store itself answers, structured, live, and machine-readable, instead of the agent guessing from a cached webpage.

That compression is the commercial point. A journey that took a human five to eight page visits collapses into one conversation. And it reframes a question every retailer thought was settled: who, or what, is your storefront actually for? As of March 2026, for millions of stores, the answer includes AI agents by default.

The confusion between these protocols is understandable, because they emerged within months of each other and all carry the word “commerce” or get discussed in commerce contexts. The cleanest way to sort them is by the question each one answers.

A useful shorthand: MCP is the language, UCP is the contract, ACP and AP2 are the payment rails. They are not competitors so much as layers, and the dependency runs in one direction. UCP explicitly orchestrates MCP, A2A and AP2; ACP-style checkout assumes the agent already discovered the product and the merchant’s capabilities, which in practice happens over MCP. A real transaction in 2026 might use MCP to read live inventory, UCP to negotiate merchant capabilities, and ACP or AP2 to complete payment. Remove MCP from that stack and the agent is blind before the first euro moves.

That dependency also explains a strategic irony. OpenAI walked back native checkout in ChatGPT in March 2026 when users browsed but didn’t buy; the transaction layer wobbled. The discovery layer underneath it never did. Whichever checkout standard eventually wins, it will be reading product data through MCP.

Honesty requires separating two adoption curves. The infrastructure curve is steep and real: three frontier labs, the major commerce platforms, both payment giants, neutral governance, and millions of storefronts exposed by default. By any measure of plumbing, MCP is at scale today.

The transaction curve lags far behind, for two reasons. The first is behavioral, and it is the lesson of OpenAI’s checkout retreat: shoppers ask AI plenty of product questions but still finish purchases where their habits, saved cards and trust live. BCG still estimates 15 to 20 percent of e-commerce transactions will be AI-mediated by 2028, which simultaneously means most transactions will not be.

The second reason is security, and it deserves more attention than it gets in commerce circles. MCP’s openness cuts both ways: agents act on text they read, and attackers have learned to hide instructions in that text. In April 2026, researchers hijacked production coding agents by injecting malicious instructions into GitHub pull-request titles; in May, OX Security disclosed a supply-chain flaw touching an estimated 200,000 MCP instances. “Tool poisoning”, tampering with the tool descriptions agents read but humans never see, has become the signature attack of the agentic era. The response is under way: the November 2025 spec added server identity and scoped access, the 2026 update introduced incremental scope consent, and NIST’s AI Agent Standards Initiative, launched in February 2026, expects its interoperability profile by Q4 2026. But nobody serious claims the problem is solved, and an agent that can spend money is a more attractive target than one that can only read a calendar. Expect payment-adjacent MCP capabilities to stay behind human-in-the-loop checkpoints longer than the demos suggest.

So, when at scale? The defensible answer: discovery via MCP is scaling now, through 2026; autonomous transactions over the full protocol stack are a 2027-2028 story, gated less by technology than by fraud tooling, standards maturity, and the stubborn pace of consumer habit change. Mobile commerce needed eight years, not two. The pattern is repeating, with better infrastructure this time.

Four practical consequences, in order of urgency.

Your product data is becoming an API, whether you planned it or not. When an agent queries a Storefront MCP server, the answer it gets is only as good as the catalog behind it. Missing attributes, stale stock, vague titles and inconsistent identifiers were conversion problems before; now they determine whether an agent can answer a shopper’s question about you at all. Product feed quality has quietly become the entry ticket to agentic commerce, because the feed is what the MCP layer serves.

Check what your platform already exposes. If you sell on Shopify, agents can already read your storefront; the question is whether what they read is accurate, complete and in your interest. Merchants on other platforms should ask their vendor a simple question: what is your MCP roadmap, and what will agents see when they knock?

Treat agent access as a security surface. The same openness that makes your store discoverable makes it addressable. Scoped permissions, monitoring of agent traffic, and human checkpoints on anything that moves money or data are not paranoia; they are the current best practice of every serious deployment.

Don’t confuse the layers when you plan. Betting on a specific checkout experience (ChatGPT’s, Google’s, anyone’s) is betting on the volatile layer, as OpenAI’s pivot showed. Investing in the data layer, clean, structured, real-time product information served consistently everywhere, is betting on the layer every scenario shares.

There is a pattern in infrastructure history: the standards that endure are rarely the ones that tried to own the outcome. TCP/IP didn’t decide what the internet would be for; it just moved the packets. MCP made the same wager for AI, and in twenty months it went from an unassuming spec to the wiring behind every serious attempt at agentic commerce, including the ones from its creator’s fiercest competitors.

The checkout wars will grind on: UCP against ACP, orchestration against walled gardens, and retailers will rightly watch them closely. But whichever storefront the agents end up buying from, they will have found the product, checked the price, and read the returns policy the same way. Quietly. Over MCP.