Magento and Adobe Commerce AI agent readiness

The checkout side is in good shape before you touch anything.

Guest checkout is on. Adobe's page says "The default setting allows guests to make purchases", and the core config sets guest_checkout to 1. The setting is Stores > Configuration > Sales > Checkout > Checkout Options > Allow Guest Checkout, and it is set per store view. An agent buying for a shopper has no account, so this is what our guest checkout check wants to see.

Checkout has no CAPTCHA unless you add one. Google reCAPTCHA for the storefront lives under Stores > Settings > Configuration > Security > Google reCAPTCHA Storefront, with a separate field per form, including "Enable for Checkout/Placing Order". Adobe's page states no default, but in the security package's source the place-order setting is empty, which means no reCAPTCHA type is chosen. Our CAPTCHA check passes that.

robots.txt names no AI agent. The instructions core restores when you click Reset to Default are one group for every crawler with 14 Disallow lines, covering checkout, customer, catalog, review and system paths, and one query-string rule we come back to below. Nothing in it singles out GPTBot, ClaudeBot or any other agent.

Six places decide most of what an agent meets, and one of them exists only on Adobe Commerce Cloud.

robots.txt is edited at Content > Design > Configuration: open the Global row, or a website's, click Edit, and expand Search Engine Robots. Adobe's page says "If needed, enter custom instructions into the Edit Custom instruction of robots.txt file box," and "To restore the default instructions, click Reset to Default." We have not confirmed that a fresh install serves those defaults before anyone clicks the button, so read your live /robots.txt rather than trusting the box.

Two things in the defaults, and two that Adobe has announced but not shipped.

The default robots.txt closes search results. Among its lines is Disallow: /*?, which matches every URL with a query string. That includes the search results page, /catalogsearch/result/?q=, and every filtered category page. A polite agent will not run your search through its URL, which is what our search check tests. The /catalog/ line also blocks product URLs that were never rewritten, such as /catalog/product/view/id/42; your rewritten .html URLs are fine.

Stock Luma prints no JSON-LD. Its product page uses schema.org microdata instead: a Product item with name, SKU and description, and an Offer with price and currency, written as attributes in the HTML. The stock template has no availability property at all. Our product structured data check reads JSON-LD, so a stock Luma store fails it, and our availability check has nothing structured to read. Microdata is valid schema.org, but it is not what our check, or any tool that reads only JSON-LD, looks for.

Shipping and returns terms do not reach agents. Magento's shipping policy is set at Stores > Configuration > Sales > Shipping Settings > Shipping Policy Parameters, and Adobe says "The text appears when customers click See our shipping policy during checkout." That is after an agent has decided. Returns (RMA) are, in Adobe's words, "an exclusive feature that is available only in Adobe Commerce and is not available in Magento Open Source." Neither prints structured data.

There is no llms.txt in core. We found no core setting for one; several Marketplace extensions generate it.

Two need a developer or an extension, the rest are settings.

If our robots.txt check fails, look first for a block someone added in the custom instructions box, and remove it or narrow it to the bot you mean. On the default instructions our check reports WARN, not PASS, because every agent inherits the checkout and customer lines. It reads the ? in /*? as a plain question mark, as the standard says, so that line closes URLs with a query string and nothing else. An earlier version of our parser took the ? for a pattern symbol and read the line as closing every page, which made the check fail and our crawler give up after the home page. We fixed it, and the figure below gives the same answers as the scan.

If you want agents to use your search, you can add Allow: /catalogsearch/result/ under the * group. The longer Allow wins over /*? for search results only, so filtered category pages stay closed. That is our example, not Adobe's advice: search and filter URLs can trap crawlers in endless combinations, so weigh it. Try it below.

User-agent: *
Disallow: /index.php/
Disallow: /*?
Disallow: /checkout/
Disallow: /app/
Disallow: /lib/
Disallow: /*.php$
Disallow: /pkginfo/
Disallow: /report/
Disallow: /var/
Disallow: /catalog/
Disallow: /customer/
Disallow: /sendfriend/
Disallow: /review/
Disallow: /*SID=

User-agent: *
Disallow: /index.php/
Disallow: /*?
Allow: /catalogsearch/result/
Disallow: /checkout/
Disallow: /app/
Disallow: /lib/
Disallow: /*.php$
Disallow: /pkginfo/
Disallow: /report/
Disallow: /var/
Disallow: /catalog/
Disallow: /customer/
Disallow: /sendfriend/
Disallow: /review/
Disallow: /*SID=

If DISC-004 fails on Luma, add JSON-LD. On Luma or Hyvä that means an extension or your own module; we found no first-party statement on structured data from Hyvä, so check what your theme prints. On Adobe Commerce Storefront, the Edge Delivery front end, Adobe documents the types to add ("WebSite, Product, AggregateRating, Rating, BreadcrumbList") and offers a PDP Metadata Generator to "automate the process of generating all recommended metadata". Adobe also "recommends uploading product metadata into Edge Delivery Services so that it can be rendered server-side", which helps our no-JavaScript check too. Whatever writes it, include price, currency and availability on each offer.

If our shipping and returns checks fail, publish a CMS page with your shipping costs, with their currency, and your return window in days, and link it from the footer. "Free delivery over €50" and "returns within 30 days" are the kind of sentence an agent can use; "see our shipping policy during checkout" is not. How agents read a page has more on this.

If you are on Adobe Commerce Cloud and want to tell agents from scrapers, look at the Fastly WAF first. Its standard service lists "Protection against malware or bot mitigation" among the things it does not cover. The paid Advanced Security add-on ("Advanced Security is available at an additional cost") adds Bot Management that "Identifies and manages AI crawlers that scrape content to train large language models" and "Controls AI fetchers used in real-time AI search results". Adobe says its configurations "currently require submitting a support ticket". Our bot management check looks for something like that in front of your store. Bots, crawlers and agents explains the difference between the two kinds of AI bot.

If our llms.txt check fails, pick an extension that writes a title, at least 20 lines and working links, which is what our check asks for.

Not through an Adobe feature yet, in Adobe's own labels.

Adobe's Commerce MCP is marked "Coming Soon" on Experience League, with the note "This feature is coming soon and is subject to change." Adobe describes it as helping "developers build custom agentic experiences from discovery to checkout". Adobe's developer tooling for coding agents, such as the MCP server for its storefront drop-ins, is for developers building a storefront, and a shopper's agent has no use for it.

On the commerce protocols, Adobe's February 2026 post says "Adobe Commerce is committed to supporting agentic commerce standards, including Universal Commerce Protocol (UCP)" and "Adobe Commerce is moving towards supporting UCP and ACP", making catalogs, pricing and inventory "machine-readable by AI agents and available to the latest LLM surfaces like Gemini and ChatGPT." We read that as a commitment, not a setting you can switch on, so our agent checkout check will not find a UCP profile on a stock store. UCP vs ACP vs MCP vs AP2 explains what each would add.

Until then, the agent's last step is your own checkout page, which is one more reason to keep guest checkout on and the place-order reCAPTCHA off.

Tick as you go. The ticks are kept in this browser, which is less configuration than Stores > Configuration usually asks of you.

Does Magento block AI agents in robots.txt?

Not by name. The default instructions are one group for every crawler. But Disallow: /*? blocks every URL with a query string, including search results and filtered categories, and /catalog/ blocks product URLs that were never rewritten.

Does Magento's Luma theme output JSON-LD?

No. Stock Luma prints schema.org microdata on product pages, with no availability property. Tools that read JSON-LD, ours included, report product structured data missing. An extension, a custom module or Adobe Commerce Storefront's metadata can add JSON-LD.

Is guest checkout on by default in Magento?

Yes. Adobe says "The default setting allows guests to make purchases." The setting is Allow Guest Checkout under Stores > Configuration > Sales > Checkout > Checkout Options, per store view.

Does Adobe Commerce support UCP or MCP?

Not as a shipped feature. Adobe labels its Commerce MCP "Coming Soon", and says Adobe Commerce is "committed to supporting" UCP and "moving towards supporting UCP and ACP".

Does Adobe Commerce Cloud's WAF manage AI bots?

Not the standard Fastly WAF, which does not cover bot mitigation. The paid Advanced Security add-on includes Bot Management with AI crawler detection and AI fetcher control.

The sources below were last checked on the date shown.