The previous four articles in this cluster were about reading. This one is about doing — an agent that books, buys, submits a form or pulls a value. I checked where the standards actually stand, and the picture is sharp: WebMCP is a W3C Community Group draft, it is in origin trial in Chrome and Edge, and Apple has filed a formal objection. The commerce protocol from OpenAI and Stripe requires a merchant to implement five endpoints and is in beta — and its own official site says discovery mechanisms are still being built. The IETF working group for agent identity has been chartered, but it has not yet adopted a single document. And on the leading independent benchmark for office task execution, the best verified result completed 42.9% of tasks.
The three layers that all have to exist
For an agent to complete a task on your site, three things have to be true at once: it has to know what it is allowed to do, it has to have an interface to do it through, and you have to know it is really that agent and not someone impersonating it. The table sums up where each layer stands today.
| Layer | Leading mechanism | Actual status |
|---|---|---|
| Capability declaration | WebMCP | Community Group draft; origin trial in Chrome and Edge; WebKit opposed |
| Completing a purchase | ACP by OpenAI and Stripe | Beta; five merchant endpoints; no discovery mechanism |
| Payment authorization | AP2 by Google | Version 0.2; contributed to the FIDO Alliance; requires no site change |
| Agent to agent | A2A | Version 1.0.1; stable, but solves a different problem |
| Agent identity | Web Bot Auth | WG chartered at the IETF; no adopted document yet; Cloudflare has implemented |
| Agentic browser identification | — | No documented user-agent for any agentic browser |
WebMCP: where it really stands
WebMCP is the idea that a site can declare, inside the page itself, which actions it offers an agent — instead of the agent guessing where to click. That is the right approach, which is why it gets a lot of headlines. But it matters to know its formal standing.
The document is published by the W3C Web Machine Learning Community Group, and its header states explicitly that it is not a W3C standard and is not on the standards track. The editors come from Microsoft and Google. The draft version I read is dated 26 August 2026.
The implementations: Chrome opened an origin trial in version 149, per a developer blog post published on 9 June 2026. Edge opened an origin trial in version 150, Brave runs it experimentally in Leo, and the ChatGPT desktop app supports it. On the other side, WebKit filed a position of opposition with a list of concerns that includes the choice of venue itself, and Mozilla filed a neutral position.
Two mistakes that recur in every guide: the API is not navigator.modelContext — the word Navigator does not appear in the spec text even once. And Chrome did not ship this in version 146 in February 2026; the official blog talks about an origin trial in version 149. If a guide tells you otherwise, it did not read the source.
What it looks like in code
The real API is document.modelContext.registerTool. The idea is simple: the page registers a tool with a name, a description, an input schema and a function that executes it. The agent running the page sees the tool without having to guess what each button does.
document.modelContext.registerTool({
name: “book_appointment”,
description: “Book an appointment on a given date”,
inputSchema: {
type: “object”,
properties: { date: { type: “string” } },
required: [“date”]
},
async execute({ date }) {
const result = await bookOnServer(date);
return { content: [{ type: “text”, text: result.confirmation }] };
}
});
What matters here is not the syntax but the implication: the action goes through your code. You decide what is exposed, you validate the input, and you control the side effects. That is fundamentally different from an agent trying to click the visual interface and hoping. At this stage, any such implementation is an experiment — not production infrastructure.
Agentic commerce: three protocols, three different problems
It is easy to get confused because all three names show up in the same articles, but they solve completely different things.
ACP — the Agentic Commerce Protocol, maintained by OpenAI and Stripe, defines itself as being in beta, under an Apache-2.0 license. The most recent spec version I saw is dated 17 April 2026. From a merchant’s point of view the requirement is concrete: implement five REST endpoints for managing a checkout session — create, update, complete, cancel and retrieve — plus webhooks for order events. The official site says they are still working on creating discovery mechanisms that will let AI platforms identify businesses. Which means that even if you implement everything, there is no standard way today to declare that you did — exactly the gap I described in the discovery layer article.
AP2 — Google’s Agent Payments Protocol, at version 0.2, announced in September 2025 and since contributed to the FIDO Alliance for further standardization. It is built as an extension to A2A, and it deals with payment authorization: verifiable mandates proving the user really permitted the agent to pay. It requires no change to your site’s HTML, so it is not a replacement for ACP but a layer beneath it.
UCP — the Universal Commerce Protocol, which according to a Shopify announcement dated 24 March 2026 is being developed together with Google and has backing from Walmart, Target, Etsy, American Express, Mastercard, Stripe and Visa. I did not open the spec itself, so I will not cite a version.
A note that prevents disappointment: that same Shopify announcement describes its ChatGPT integration as working through an internal browser, and on desktop redirecting straight to the merchant’s store. In other words, “buying inside ChatGPT” is not necessarily a native ACP checkout. And OpenAI’s documentation says Instant Checkout is available to approved partners — not to every merchant.
A2A solves a different problem
A2A reached version 1.0.0 in March 2026 and version 1.0.1 in May 2026, and it is the most mature protocol in the group. It defines an agent card — a JSON document describing the identity, capabilities, skills, service endpoint and authentication requirements of an agent server — and publishes it at /.well-known/agent-card.json. It is also the only entry in the agent world registered in the IANA registry.
And precisely because of that it is worth being exact: its domain is communication between independent agent systems, not between a site and an agent. Publishing this file on a brochure site does nothing, unless you really are running an A2A server behind it. I have already seen quite a few recommendations that miss this distinction.
How do you even identify an agent
This is the layer that is most missing, and the sharpest finding in this research is a negative one: there is no documented user-agent for any agentic browser. OpenAI’s bots page lists OAI-SearchBot, OAI-AdsBot, GPTBot and ChatGPT-User — and has no entry for ChatGPT Atlas. Anthropic’s bots page lists ClaudeBot, Claude-User and Claude-SearchBot — and has no entry for Claude in Chrome. If you see a string in your logs that looks like an agentic browser, it is undocumented and may change without notice.
The answer taking shape is Web Bot Auth: a cryptographic signature on the request itself. A working group by that name has been chartered at the IETF, but as of today it has not adopted a single document — all the relevant drafts are still individual submissions. The core protocol draft was updated on 19 August 2026.
Cloudflare has already implemented the mechanism: a key directory at /.well-known/http-message-signatures-directory and the Signature-Agent, Signature-Input and Signature headers on the request. Its documentation also notes that since 1 July 2026 there is a new metadata field distinguishing a direct agent from an intermediary, and that the behavior categories explicitly include transacting on a user’s behalf. One caveat worth knowing: Cloudflare implements earlier draft versions than the latest, so mismatches between implementations are to be expected at this stage.
How well do agents actually complete tasks
Here I want to give a real number instead of a feeling. The most serious independent benchmark I found is TheAgentCompany, developed at Carnegie Mellon University among others, comprising 175 tasks that simulate work at a software company. The leaderboard results are marked as independently verified.
- The best result on the board: 42.9% of tasks completed, an entry recorded on 10 November 2025.
- OpenHands-Versa with Claude Sonnet 4 completed 33.1%, in June 2025.
- OpenHands with GPT-4o completed 8.6%, in December 2024.
A caveat I have to state: the most recent entry on the board is from November 2025, and it contains no 2026 frontier models. So do not present 42.9% as “the state of the art in 2026” but as the best independently verified result on this benchmark. What the number does say, even assuming meaningful improvement, is that there is not yet a reality in which you hand an agent a complex task and expect it to finish.
What to actually do today
The honest recommendation is not to rush to implement drafts. My order of operations, based on what is documented and stable: first make sure the site is readable at all — correct permissions, content in the initial HTML, and pages that can be cited. Then check that your blocking is not dropping legitimate agents acting on a user’s behalf: this is a common mistake, and the only explicit approval mechanism I found documented is Cloudflare’s, which lets bot providers apply and lets site owners enable category-based settings.
And only then, if your business model genuinely benefits from it, consider a pilot: a WebMCP origin trial for one well-defined action, or an ACP implementation if you sell products and have development resources. In both cases treat it as an experiment, because that is what it is.
The gap that remains open is exactly the one I have described throughout this cluster: there is no standard way for a site to declare what it offers an agent. ACP admits this itself, MCP does not cover it, and A2A solves a different problem. That is why I am working on the AX spec. But until there is an agreed standard, my recommendation is not to invent a private path and hope — but to build what already works.
Frequently asked questions
Should I implement WebMCP on my site today?
Only as an experiment. The document is a W3C Community Group draft, and it states explicitly that it is not a standard and not on the standards track. Chrome and Edge opened origin trials, WebKit filed opposition and Mozilla a neutral position. This is not something you build production infrastructure on.
What is the WebMCP API actually called?
document.modelContext.registerTool. The name navigator.modelContext, which appears in many guides, is wrong — the word Navigator does not appear in the spec text at all.
What exactly do I need to implement to support OpenAI’s agentic commerce?
Per the ACP spec, a merchant needs to implement five REST endpoints for managing a checkout session — create, update, complete, cancel and retrieve — plus webhooks for order events. The protocol defines itself as being in beta, and Instant Checkout is documented as available to approved partners.
Should I publish agent-card.json on my site?
Only if you really are running an A2A server. The card describes the identity, capabilities, service endpoint and authentication requirements of an agent server, and A2A deals with communication between agent systems — not between a site and an agent. On a brochure site the file does nothing.
How do I identify agentic browser traffic in my logs?
As of today, there is no documented way. The bots pages of OpenAI and Anthropic contain no entry for their agentic browsers. The mechanism taking shape is Web Bot Auth, based on signing the request; a working group on it has been chartered at the IETF but has not yet adopted a document, and Cloudflare has already implemented draft versions of it.
Continue reading
Agentic Commerce in 2026: Which Protocol Should You Actually Implement? – The next step after an agent can act on your site is letting it complete a purchase. ACP, AP2 and x402 solve different halves of that problem.