Provides BigCommerce merchants with tools for AI agents to search products, check variant stock, apply promotions, manage cart sessions with 15-minute inventory reservations, create signed checkout sessions, and access store policies, along with agent intent analytics.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Merchant Web MCP search for waterproof jackets under $150 and add one to my cart"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Turn any e-commerce storefront into an observable, measurable, and transactable platform for AI shopping agents.
Prototype & Simulation Notice: This repository contains an interactive simulation cockpit and prototype of the proposed BigCommerce / Merchant Web MCP plugin architecture. The simulation engine runs client-side with simulated latency, genuine Web Crypto HMAC-SHA256 signing, real 15-minute TTL inventory reservation timers, and an executive Agent Intent Analytics dashboard.
Today, merchants are blind to AI shopping agents (ChatGPT Agent, Claude, Perplexity, Apple Intelligence). When bots scrape product pages:
Traffic is indistinguishable from dumb web scrapers.
Visual scraping consumes 6,000–10,000 tokens per page and frequently breaks on React hydration or DOM redesigns.
Merchants have zero visibility into what products agents are searching for, what queries fail, and what commercial demand passes through uncaptured.
Agent Intent Analytics (Immediate SaaS Value): Captures incoming agent sessions, tool executions, discovered intent value (£124k+ pipeline), provider breakdown, and catalog demand gaps.
Deterministic MCP Interface: Exposes structured JSON-RPC tools (search_products, get_product_details, check_variant_stock, apply_promotions, add_to_cart_session, create_checkout_session).
Verified Cryptographic Handoff: Generates signed checkout URLs using genuine Web Crypto HMAC-SHA256 tokens with 15-minute ephemeral inventory soft-locks.
Related MCP server: Shopify Agentic MCP Gateway
┌────────────────────────────────────────────────────────┐
│ AI Shopping Agent │
│ (Claude / ChatGPT / Perplexity) │
└───────────────────────────┬────────────────────────────┘
│ (1) Discover: /.well-known/mcp.json
│ (2) Transport: HTTP / SSE Stream
▼
┌────────────────────────────────────────────────────────┐
│ Merchant Web MCP Plugin Engine │
│ ┌──────────────────────────────────────────────────┐ │
│ │ Layered Security Guard (Unicode Filter & Regex) │ │
│ └────────────────────────┬─────────────────────────┘ │
│ │ │
│ ┌────────────────────────▼─────────────────────────┐ │
│ │ Standardized MCP Tools: │ │
│ │ • search_products(query, max_price, waterproof) │ │
│ │ • check_variant_stock(variant_id, postal_code) │ │
│ │ • apply_promotions(promo_code, subtotal) │ │
│ │ • add_to_cart_session(variant_id, qty) [15m TTL]│ │
│ │ • create_checkout_session (WebCrypto HMAC SHA256│ │
│ │ • get_store_policies() │ │
│ └────────────────────────┬─────────────────────────┘ │
└───────────────────────────┼────────────────────────────┘
│
┌───────────────┴───────────────┐
▼ ▼
┌───────────────────────┐ ┌───────────────────────┐
│ Merchant Catalog / DB │ │ Storefront Cart & DOM │
│ (BigCommerce / D1) │ │ (Live State Sync) │
└───────────────────────┘ └───────────────────────┘# 1. Install dependencies
bun install
# 2. Run test suite (7 tests, 27 assertions)
bun test
# 3. Start development server
bun run devInteractive Simulation Cockpit: https://merchant-web-mcp.web.app
Standalone Projector Demo (Single File HTML): https://merchant-web-mcp.web.app/demos/merchant-web-mcp-demo-v2.html
Genuine Web Crypto HMAC-SHA256: Implemented in src/mcp/cryptoAuth.ts using standard crypto.subtle. Signatures are cryptographically verified upon checkout session generation.
Active TTL Inventory Expiration: Implemented in src/mcp/merchantMcpEngine.ts. Ephemeral reservations expire after 900 seconds (15 mins), automatically returning stock to available inventory and notifying the client wire HUD.
Layered Defense-in-Depth: Implemented in src/mcp/securityGuard.ts. Normalizes Unicode/zero-width obfuscation and scans across customer reviews, search queries, and promo arguments.
Multi-Cart Isolation: Engine maps carts explicitly by cart_id, rejecting checkout attempts on invalid or foreign cart sessions.
For the target Cloudflare Worker + BigCommerce edge server specification, see ROADMAP.md.
This server cannot be deployed
AI shopping gateway for product search, inventory, carts, and merchant-hosted checkout.
AI-agent product catalog: search, lookup & purchase routing over verified merchant data.
The independent agent-commerce protocol for AI-agent checkout on any online store.
Agentic commerce gateway: discovery, search, checkout across Shopify/Woo/Odoo/PrestaShop.
