Shopping agents and agent checkout

Let AI shopping agents search your catalog, build a cart and hand the buyer to checkout.

Every ShopFast store has a public MCP server for AI shopping agents. An agent can search your catalog, check prices and live stock, build a cart with a discount code, and give the buyer a link to your own checkout. The buyer pays there, in their own browser: the agent never sees card details or the buyer’s account.


Server URL	`https://<your-store>/api/mcp` (your custom domain works too)
Also at	`https://api.shopfa.st/mcp/shops/<handle>`
Sign-in	None: it only shows what your store already shows
Limit	60 calls a minute per address

Tools

Tool	What it does
`search_catalog`	Search by words, category, collection, price and sort, with a cursor for more
`get_product_details`	Options and prices, live stock and sales status, what the buyer gets, rating and reviews
`list_collections`, `list_categories`	Browse the store
`get_store_policies`	Your refund policy, terms and privacy policy, and your support email
`create_cart`, `get_cart`, `update_cart`	Products and quantities, discount codes and gift cards, the country for tax
`get_checkout_link`	A link to your checkout with that cart, valid for two hours
`get_order_status`	An order’s status, with the access token from the buyer’s receipt link

Every product also carries its price written out ("price": "$49.00"), so an agent quotes it right.

How agent checkout works

The agent builds a cart with create_cart and update_cart.
get_checkout_link returns https://<your-store>/checkout/handoff?cart=…&exp=…&sig=….
The buyer opens it. Your store checks the signature, opens your checkout with that cart, and the buyer pays as usual: email verification, fraud checks, taxes and your payment methods all apply.
The buyer gets the receipt and their delivery like any other order.

Links expire after two hours and work only for your store and that cart.

How agents find your store

https://<your-store>/llms.txt: what you sell, prices, collections, categories, your policies, and where agents shop.
https://<your-store>/.well-known/mcp/server-card.json: how to connect and the tools.
robots.txt names both.

Turning off search indexing in Domain & SEO also hides llms.txt. A closed store, a store in maintenance or a password-protected store answers agents that it is not open.

What you see

Agent calls appear in Settings → Headless & MCP → Activity under Shopping agents, with the agent’s name when it gives one. ShopFast keeps a one-way hash of the address, never the address itself. Orders placed through a checkout link are ordinary orders.