Increasingly, there is no human between your shop and the buying decision, but an AI agent. For ChatGPT, Claude, Gemini or an autonomous shopping assistant to process your assortment reliably, it needs clean, machine-readable access. So far, many AI systems resort to storefront scraping: they read your HTML pages the way a human would see them, guess at prices and availability and cannot really trigger anything. The Model Context Protocol (MCP) is the counter-model, an open standard that Anthropic introduced in late 2024 (Anthropic). An MCP server makes catalog, stock, prices and shop functions usable for agents in a structured, controlled way. Gartner expects that by 2028 around 90% (Gartner) of B2B buying will be intermediated by AI agents. This article shows what MCP is, what an MCP server does for your shop and how to connect it securely.
Why AI agents should not scrape your storefront
If an AI agent is to shop in your store today, it usually has to fight through the same interface as a human: it loads HTML, interprets layout, hunts for prices in body text and tries to derive actions from buttons and forms. This storefront scraping is fragile. Change a template and extraction breaks. If the price only lives in rendered JavaScript, the agent may not see it at all. And even when it reads everything correctly, it cannot reliably trigger an action through the web page alone, such as checking availability in real time or creating a cart server-side.
For revenue this is risky. An agent that cannot read your data cleanly recommends the competitor whose offer is easier to capture by machine. And the scale grows fast: Gartner expects AI agents to intermediate more than 15 trillion US dollars (Gartner) in B2B spending by 2028. Anyone who provides only a human-readable storefront leaves the interpretation of their prices, stock and terms to the chance of scraping.
How to prepare product data substantively for AI is covered in our guide to product data optimization with structured data. What an agent-ready checkout looks like is shown in our article on the agentic checkout. This article is about the interface itself: how an MCP server provides catalog, stock and functions in a structured way instead of letting agents read your page.
Model Context Protocol: the open standard for AI access
The Model Context Protocol is an open standard that describes how an AI application communicates with external data sources and tools. Technically, MCP uses the proven JSON-RPC 2.0 (Model Context Protocol) message format and distinguishes three roles: the host (the AI application, such as a chat or agent system), the client (the connector inside the host) and the server (the service that provides context and capabilities). The model is the Language Server Protocol from software development: instead of building a separate integration for every AI, you implement an MCP server once and every MCP-capable client can use it.
Adoption has been remarkably fast. In late 2025 Anthropic reported over 97 million (Anthropic) monthly SDK downloads and more than 10,000 (Anthropic) active public MCP servers; the Anthropic assistant alone offers over 75 connectors (Anthropic) built on MCP. The protocol is now supported by major platforms and was handed to the Agentic AI Foundation under the Linux Foundation, co-founded among others by Anthropic, Block and OpenAI with support from Google, Microsoft, AWS, Cloudflare and Bloomberg (Anthropic). For merchants this means MCP is not a niche experiment but an interface that many AI clients are converging on.
Tools
Functions the AI model can execute, such as check_availability, create_cart or get_order_status. This turns reading into real action (Model Context Protocol).
Resources
Context and data the agent may read, for example catalog, price lists or category tree, cleanly structured instead of guessed from HTML (Model Context Protocol).
Prompts
Templates for recurring workflows that make typical tasks in your shop easier for the agent, such as a guided product consultation (Model Context Protocol).
Beyond these three server building blocks, the protocol also describes client-side capabilities such as sampling, roots and elicitation (Model Context Protocol). For retail, elicitation is particularly interesting: the server can trigger a targeted question to the user before an action is executed, such as confirming the delivery address or the quantity. This keeps the human involved at the decisive points, without the entire workflow becoming manual again. It is exactly this balance of automation and control that makes the protocol attractive for selling systems.
The big lever of MCP is standardization: instead of separate integrations for each AI, you maintain one server that different assistants and agents address. This reduces effort and keeps your prices and stock consistent across channels, in the spirit of clean AI automation in e-commerce.
What an MCP server makes usable for your shop
An MCP server is the bridge between your shop backend and the AI. It provides exactly the information and functions an agent needs for a buying decision, in a form that is unambiguous to machines. Instead of interpreting a product page, the agent calls a clearly defined function and receives a structured answer. For retail, such a server typically covers:
- Catalog as a resource: products, variants, categories and attributes readable in structure, including GTIN and brand
- Stock and prices in real time: availability, delivery time and gross prices straight from the leading system, not from an overnight export
- Tools for actions: check availability, create cart, determine shipping options, query order status, initiate a return
- B2B terms: customer-specific prices, tiers and payment terms, provided the agent is authorized
- Prompts for workflows: predefined templates for recurring tasks such as reordering or guided selection
An MCP server is not all-or-nothing. You decide which resources are readable and which tools are executable. Starting with read-only access to catalog and availability is possible; writing actions such as an order are enabled deliberately and securely. Integration with stock and orders happens via your existing inventory system, for example through a JTL-Wawi connection.
An example from B2B illustrates the benefit. A purchasing assistant is meant to reorder recurring office supplies. Instead of clicking through the storefront, it reads the last order via a resource, checks availability and tier price for the desired quantity via a tool and assembles the cart. Only the final order is, if desired, tied to a human approval. The agent works precisely with real data from your system, and you keep control over prices and terms instead of leaving them to a guessing scraper. This reliability is a tangible advantage in recurring business.
Scraping vs. MCP server: the difference in detail
The core of the difference is between guessing and knowing. A scraping agent derives facts from an interface built for humans and is often wrong. An MCP client queries structured values and gets unambiguous answers, including the ability to trigger actions through defined tools.
| Aspect | Storefront scraping | MCP server |
|---|---|---|
| Data access | read HTML for humans | query structured resources |
| Availability | guessed from text, often stale | real time via defined tool |
| Actions | hardly triggerable reliably | cart, order, status as tools |
| Stability | breaks on layout change | contract-stable interface |
| Control | uncontrolled reading | granular access rights |
| Maintenance | one custom fix per AI | one standard for many clients |
We work with open standards and the freely available Shopware base and connect the MCP server individually to your system, through our interface and integration expertise. This is not a finished product package but a solution that fits your catalog, your inventory system and your processes.
The business opportunity: why the connection pays off
The shift to agentic buying is not a distant forecast. Gartner expects that by 2028 around 90% (Gartner) of B2B buying will be intermediated by AI agents, and that these agents will move more than 15 trillion US dollars (Gartner) in spending. By 2030, 20% (Gartner) of monetary transactions are expected to become programmable so that agents can act with contractual terms. In parallel, the user interface itself is shifting: Gartner sees around one third (Gartner) of user experiences moving from native apps to agentic front ends by 2028.
Enterprise software is following suit. The share of enterprise applications with task-specific AI agents is expected to rise to 40% (Gartner) by 2026, up from less than 5% (Gartner) in 2025. And in sales, Gartner expects AI agents to outnumber human sellers tenfold (Gartner) by 2028. Those who connect their shop cleanly early position themselves ahead of hesitant competitors and make their catalog discoverable where buying decisions will increasingly be made. How autonomous processes are changing retail is explored in our article on agentic AI and autonomous processes in e-commerce.
In B2B the lever is especially large. Recurring procurement, clear item numbers and defined framework contracts are ideal for agents, because decisions can be anchored in hard data. Anyone who makes their catalog machine-readable and actionable here becomes the preferred supplier of the systems that will steer a growing share of procurement. The investment in clean access is therefore less a technology project than a sales decision: it secures visibility and orderability in a channel that, according to the forecasts, is growing considerably and that few providers serve systematically today.
If an AI cannot address your shop in a structured way, it will recommend it less often and order from it even less.
XICTRON development team
Security and control: MCP is not an open barn door
Access that lets AI agents take actions in your shop must be secured. The protocol specification puts this front and center: tools mean code execution and must be treated with appropriate caution, users must consent to every action, and hosts may only pass on data with explicit consent (Model Context Protocol). We implement these principles technically during the integration rather than leaving them to chance.
The big danger of a naively built server is over-exposure: overly broad tools, missing authentication, no rate limit, unprotected customer-specific prices. A properly secured MCP server separates read from write rights, authenticates every client, limits the call rate and logs access in a traceable way. Writing actions such as an order are encapsulated and, where necessary, tied to explicit confirmation.
- Authentication and token-based authorization for every client
- Separate rights for reading (catalog, stock) and writing (cart, order)
- Rate limits and abuse detection against automated overload
- No unwanted disclosure of personal or customer-specific data
- Traceable logging of all tool calls for audit and troubleshooting
- Writing actions encapsulated, with a confirmation step where required
An AI access point without protection is an entry point for attackers. We treat the MCP server as part of your overall attack surface and set it up to the same standards as the rest of your infrastructure, see our article on IT security in e-commerce. We handle operation and protection on request as part of hosting and maintenance.
How we connect your shop: the path to an MCP server
In practice, a connection rarely fails because of the protocol, but because of distributed data. Prices live in the shop, stock in the inventory system, delivery times with the service provider. An MCP server needs this information bundled and consistent. The first task is therefore to define a leading data source that consolidates all relevant fields and serves them through the server. This work pays off twice, because clean data also strengthens your classic e-commerce foundation.
- Assessment: clarify data sources, systems and desired capabilities
- Bundle the data source: consolidate catalog, prices, stock and terms into one leading source
- Define resources: decide which data the agent may read and in what structure
- Define tools: provide actions such as availability check, cart and order status as clearly scoped functions
- Secure: set up authentication, rights, rate limits and logging
- Connect and test: link the server to the inventory system and test against real agent requests
- Operate and refine: monitor usage and continuously improve latency and data gaps
What a single capability looks like is shown by a tool definition. From this description an agent learns what it can call, which parameters are required and what answer to expect, all without interpreting your HTML page:
{
"name": "check_product_availability",
"description": "Checks availability, gross price and delivery time for a SKU in real time.",
"inputSchema": {
"type": "object",
"properties": {
"sku": { "type": "string", "description": "Item number" },
"quantity": { "type": "integer", "minimum": 1 },
"country": { "type": "string", "description": "Delivery country, ISO code" }
},
"required": ["sku"]
}
}Technically it is worth looking at the performance of the data path. When agents and upstream AI services fetch your data, fast, cacheable delivery matters, an aspect we explore in our article on Store API caching for headless Shopware. The individual development of the server and its tools is handled by our team in programming and development.
A sensible entry point is an MCP server with read access to catalog and availability. This way you gain experience with real agent traffic before enabling writing actions. For recurring workflows it is worth looking at AI automation in processes.
Create access for AI agents now
The Model Context Protocol is becoming the language in which AI agents talk to software. Connecting your shop through an MCP server makes catalog, stock and functions available where buying decisions are increasingly made, while keeping control over what agents may see and do. It is a foundation that grows with the maturity of the platforms instead of breaking with every layout change.
Those who open the shop technically for agents should keep an eye on the regulatory side in parallel. The year 2026 brings new duties, from the GPSR product safety regulation for online shops to the BFSG exemptions for micro-enterprises and B2B. Technical openness and legal diligence go hand in hand. We support both sides, from AI integration to individual shop development with Shopware.
This article is based on data and forecasts from: Anthropic (introduction of the Model Context Protocol in late 2024, over 97 million monthly SDK downloads, more than 10,000 active MCP servers, over 75 connectors, transfer to the Agentic AI Foundation under the Linux Foundation), Model Context Protocol (official specification: JSON-RPC 2.0, host-client-server architecture, the primitives tools, resources and prompts as well as the security principles on consent and tool execution) and Gartner (90% of B2B buying AI-agent-intermediated and more than 15 trillion US dollars in B2B spending by 2028, 20% programmable monetary transactions by 2030, one third of user experiences via agentic front ends by 2028, 40% of enterprise applications with AI agents by 2026 up from under 5% in 2025, AI agents outnumbering sellers tenfold by 2028). The figures cited are snapshots and can vary depending on time and methodology.
MCP is an open standard that Anthropic introduced in late 2024 and that describes how AI applications communicate with external data and tools. It uses JSON-RPC 2.0 and defines three roles (host, client, server) and three server primitives: tools, resources and prompts. An MCP server thereby gives your shop a standardized interface for AI agents.
Storefront scraping is fragile and inaccurate: prices, stock and terms are guessed from an interface built for humans, and real actions can hardly be triggered reliably. An MCP server instead delivers structured data in real time and defined functions such as availability checks or ordering. This typically increases the chance that an agent captures and recommends your offer correctly.
Only if it is built carelessly. The specification explicitly puts consent and careful handling of tools front and center. In implementation we separate read from write rights, authenticate every client, set rate limits and log access. Writing actions are encapsulated and, where needed, tied to a confirmation, so access stays controlled.
No. The principle applies to any modern shop system, because MCP is platform-independent. We work with the freely available Shopware base but also connect the server to other systems and your inventory system. What matters is a leading, consistent data source from which the server draws.
That depends on the state of your data and the desired scope of functions. A sensible entry point is a server with read access to catalog and availability; writing actions are added step by step. In our experience, bundling distributed data into one leading source is the largest part of the work and at the same time strengthens your classic data quality.
A blanket promise would not be serious, as it depends on assortment, audience and platform behavior. The market forecasts, however, point to a rapid shift, for example around 90% AI-agent-intermediated B2B buying by 2028 (Gartner). Those who build a clean, secured foundation early typically position themselves ahead of hesitant competitors, without having to rebuild later.