Agentic Checkout — Definition and Current State
Agentic checkout is a purchase completed by an AI agent acting for a shopper, where the store — not the agent — remains the merchant of record. The agent selects the item, builds the cart, supplies shipping details and submits the order through an interface the store exposes on purpose. It is not browser automation, and it is not a chatbot that hands the shopper a link. The order arrives through an API the merchant controls, with the merchant’s own payment provider taking the money.
The shopper says what they want, software does the clicking, and the store keeps the customer, the payment and the liability.
Three routes, and where each one actually stands
| Route | How the agent reaches the store | State in September 2026 |
|---|---|---|
| MCP tools | The store runs an MCP server exposing cart and order tools | Works today with MCP-capable assistants. Discovery is manual — the client must be given the endpoint |
| UCP checkout | Capabilities advertised in /.well-known/ucp, called over REST or MCP | Specified and implementable. Reaching Google surfaces additionally requires acceptance into their programme |
| ACP checkout | Checkout session created by the agent against the merchant’s endpoints | Specified, but ChatGPT’s in-chat Instant Checkout was retired in March 2026; ACP’s role there is now discovery |
The short version: the plumbing is real and the demand side is unsettled. A store can build a working agentic checkout today and still have very few agents that will call it unprompted.
What the agent never holds
Every serious design keeps the buyer’s card number away from the agent. ACP passes a narrowly scoped payment token to the merchant, who charges it through their existing provider. AP2 carries signed mandates proving what the shopper authorized. A pay-by-link flow hands payment back to the provider entirely.
This is also the honest answer to “is it safe to let AI buy things”: the risk is not the agent stealing card data, because it never has it. The risk is the agent buying the wrong thing with real authority.
What a store must get right first
- Availability that is true right now. An agent cannot judge a “usually in stock” page. If
offers.availabilityis missing or stale, the safe move for the agent is to skip you. - Deterministic totals. Tax and shipping must be final before the order is submitted. A total that changes after the agent has read it breaks any signed cart bound to it.
- Guest checkout that works. Most agent orders have no account behind them.
- Idempotency. An agent that retries a timed-out call must not create a second order.
- Server-side guardrails. Quantity and value ceilings, rate limits, and read-only by default. Guardrails written into a tool description are not guardrails.
Treat it like one. The interesting failure is not fraud but volume: a loop, a retry storm or a misread instruction producing orders you have to cancel by hand. Ceilings and idempotency keys are what make the difference between a demo and something you can leave running.
Does it work? Yes — with limits worth naming
We have published a recorded demo of Claude completing a real order on a live Magento 2 store over MCP: product search, cart, shipping method, order number, payment link. No browser automation involved.
What that demo also showed is the current ceiling. Being callable is not the same as being called. In our own testing, a direct question about the store reaches the connector, while a cold product query in a fresh conversation often goes to the assistant’s built-in search instead — even after tuning tool descriptions, titles and server instructions. Discovery, not checkout, is the unsolved part.
On Magento 2
- angeo/module-mcp-server — read-only, rate-limited catalogue access
- angeo/module-mcp-checkout — six tools from guest cart to placed order, guardrails enforced server-side, pay-by-link support
- angeo/module-ucp and angeo/module-ucp-catalog — the UCP profile and the catalog endpoints it advertises
All MIT-licensed. Walkthrough: MCP checkout for Magento 2.
Questions
- What is agentic checkout?
- A purchase completed by an AI agent on a shopper’s behalf through an interface the store exposes deliberately, with the store remaining merchant of record for catalogue, payment, fulfilment and disputes.
- Is agentic checkout the same as an AI chatbot on my store?
- No. A chatbot answers questions inside your site. Agentic checkout means an external assistant calls your store’s API and places the order itself, without a browser session.
- Does the AI agent get my customer’s card details?
- No. The designs in use pass a scoped payment token to the merchant, carry signed authorization mandates, or hand payment back to the payment provider through a link. The agent does not hold the primary account number.
- Which protocol should a Magento store implement first?
- For most merchants the product feed is the cheapest first step, because discovery is the binding constraint. MCP is the fastest way to have a working agent checkout; UCP is the route to Google’s surfaces. The prerequisites — accurate data, real availability, deterministic totals — are shared.
- Is agentic checkout worth building in 2026?
- It is worth being ready for. The checkout mechanics work and are demonstrable. What is not yet reliable is agents finding a store on their own, so the return today comes mainly from the shared groundwork rather than from order volume.