# Magento and Adobe Commerce AI agent readiness

What Magento Open Source and Adobe Commerce do for AI agents by default, where Luma’s microdata and the /*? robots rule get in the way, and where MCP, UCP and ACP stand in Adobe’s own labels.

By Valerii Checha, 3 Nov 2026

Is a Magento store ready for AI agents? It depends on your theme and your hosting. Magento Open Source and Adobe Commerce allow guest checkout and keep reCAPTCHA off at checkout by default, and the default robots.txt names no AI agent. But stock Luma prints no JSON-LD, the default `/*?` rule closes search results to crawlers, and Adobe's own MCP server and its UCP and ACP support are announced, not shipped.

This guide covers what the platform already does for agents, what is off or missing by default, and how to fix each common gap, with the admin path for each setting and the [check](https://storewalk.ai/checks) in our scan that reads it. Magento's behaviour comes from Adobe's Experience League docs and the Magento source code, read on 3 November 2026. "Magento" here means both Magento Open Source and Adobe Commerce; where they differ, we say so. Storewalk is ours: we build it, and this blog is part of its site. Where we explain something in plain words, the explanation is ours.

[The hub article](https://storewalk.ai/blog/why-agents-cant-buy) sets out the five walls between an agent and a finished purchase. Here is where a Magento store meets them.

## What does Magento already do for AI agents?

The checkout side is in good shape before you touch anything.

Guest checkout is on. Adobe's page says "The default setting allows guests to make purchases", and the core config sets `guest_checkout` to 1. The setting is Stores > Configuration > Sales > Checkout > Checkout Options > Allow Guest Checkout, and it is set per store view. An agent buying for a shopper has no account, so this is what our [guest checkout check](https://storewalk.ai/checks/TRX-001) wants to see.

Checkout has no CAPTCHA unless you add one. Google reCAPTCHA for the storefront lives under Stores > Settings > Configuration > Security > Google reCAPTCHA Storefront, with a separate field per form, including "Enable for Checkout/Placing Order". Adobe's page states no default, but in the security package's source the place-order setting is empty, which means no reCAPTCHA type is chosen. Our [CAPTCHA check](https://storewalk.ai/checks/TRX-002) passes that.

robots.txt names no AI agent. The instructions core restores when you click Reset to Default are one group for every crawler with 14 Disallow lines, covering checkout, customer, catalog, review and system paths, and one query-string rule we come back to below. Nothing in it singles out GPTBot, ClaudeBot or any other agent.

What Magento ships, against what an agent needs.

- robots.txt lets AI agents in: Fine by default. Core names no AI agent. Its Disallow lines apply to everyone, so our DISC-001 reports WARN, which is expected. The /\*? line closes only URLs with a query string. Checks: [DISC-001 robots.txt allows AI agents](https://storewalk.ai/checks/DISC-001). Source: [Magento source: Theme/etc/config.xml](https://raw.githubusercontent.com/magento/magento2/2.4-develop/app/code/Magento/Theme/etc/config.xml).
- Site search open to crawlers: Gap by default. The /\*? line covers catalogsearch/result/?q=, so a polite agent will not run your search. Checks: [DISC-008 Search endpoint usable by GET](https://storewalk.ai/checks/DISC-008). Source: [Magento source: Theme/etc/config.xml](https://raw.githubusercontent.com/magento/magento2/2.4-develop/app/code/Magento/Theme/etc/config.xml).
- Product JSON-LD (Luma): Gap by default. Stock Luma prints schema.org microdata, not JSON-LD, and no availability property. Our DISC-004 reads JSON-LD, so it fails. Checks: [DISC-004 Product structured data](https://storewalk.ai/checks/DISC-004) and [EVAL-004 Availability explicit](https://storewalk.ai/checks/EVAL-004). Source: [Magento source: catalog_product_view.xml](https://raw.githubusercontent.com/magento/magento2/2.4-develop/app/code/Magento/Catalog/view/frontend/layout/catalog_product_view.xml).
- Product JSON-LD (Adobe Commerce Storefront): Yours to set. Adobe documents the types to add and offers a PDP Metadata Generator, and recommends rendering it on the server. Checks: [DISC-004 Product structured data](https://storewalk.ai/checks/DISC-004) and [DISC-006 Content available without JavaScript](https://storewalk.ai/checks/DISC-006). Source: [Adobe Commerce Storefront: metadata](https://experienceleague.adobe.com/developer/commerce/storefront/setup/seo/metadata/).
- Guest checkout: Fine by default. On by default. Checks: [TRX-001 Guest checkout available](https://storewalk.ai/checks/TRX-001). Source: [Adobe Experience League: Guest checkout](https://experienceleague.adobe.com/en/docs/commerce-admin/stores-sales/point-of-purchase/checkout/checkout-guest).
- No CAPTCHA before payment: Fine by default. Checkout reCAPTCHA is not set in the source config. Checks: [TRX-002 No CAPTCHA before the payment step](https://storewalk.ai/checks/TRX-002). Source: [Magento security-package source: ReCaptchaCheckout config.xml](https://raw.githubusercontent.com/magento/security-package/develop/ReCaptchaCheckout/etc/config.xml).
- Shipping and returns in JSON-LD: Gap by default. The shipping policy shows at checkout only; RMA is Adobe Commerce only. Neither prints structured data. Checks: [EVAL-001 Shipping cost and terms machine-readable](https://storewalk.ai/checks/EVAL-001) and [EVAL-002 Return policy machine-readable](https://storewalk.ai/checks/EVAL-002). Sources: [Adobe Experience League: Shipping settings](https://experienceleague.adobe.com/en/docs/commerce-admin/stores-sales/delivery/shipping-settings) and [Adobe Experience League: Configure returns (RMA)](https://experienceleague.adobe.com/en/docs/commerce-admin/stores-sales/order-management/returns/rma-configure).
- Bot management (Commerce Cloud): Yours to set. The standard Fastly WAF has no bot mitigation; the paid Advanced Security add-on does. Checks: [VER-001 Bot management present](https://storewalk.ai/checks/VER-001). Sources: [Adobe Experience League: Fastly WAF service](https://experienceleague.adobe.com/en/docs/commerce-on-cloud/user-guide/cdn/fastly-waf-service) and [Adobe Experience League: Advanced Security](https://experienceleague.adobe.com/en/docs/commerce-on-cloud/user-guide/cdn/advanced-security).
- llms.txt: Yours to set. Through Marketplace extensions; we found no core setting. Checks: [DISC-002 llms.txt present and non-trivial](https://storewalk.ai/checks/DISC-002). Source: [Adobe Commerce Marketplace: an llms.txt extension](https://commercemarketplace.adobe.com/mb-module-llms.html).
- Commerce MCP: Not stated or not shipped. Adobe labels it “Coming Soon” and “subject to change”. Checks: [DISC-012 MCP server card published](https://storewalk.ai/checks/DISC-012). Source: [Adobe Experience League: Commerce MCP overview](https://experienceleague.adobe.com/en/docs/commerce-learn/ai-and-agentic-commerce/commerce-mcp/commerce-mcp-overview).
- UCP and ACP: Not stated or not shipped. Adobe says Adobe Commerce is “committed to supporting” UCP and “moving towards supporting UCP and ACP”. Checks: [TRX-004 Agent checkout endpoint present](https://storewalk.ai/checks/TRX-004). Source: [Adobe Commerce commits to agentic commerce standards (18 February 2026, mirror)](https://glenbrook.com/payments_news/adobe-commerce-commits-to-agentic-commerce-standards/).

Statuses are ours, read from each source’s own words. “Not stated or not shipped” means the platform’s pages do not say, or the feature is announced but not something you can switch on.

## Where do the Magento settings live?

Six places decide most of what an agent meets, and one of them exists only on Adobe Commerce Cloud.

Where each Magento setting lives, and what it defaults to.

1. robots.txt. Where: Content > Design > Configuration > (Global or a website) Edit > Search Engine Robots. Default: Core’s default instructions, which Reset to Default restores. No AI agent named. What to do (our advice): Read the “Edit Custom instruction of robots.txt file” box. The default /\*? line blocks every URL with a query string, search results included. Checks: [DISC-001 robots.txt allows AI agents](https://storewalk.ai/checks/DISC-001), [DISC-008 Search endpoint usable by GET](https://storewalk.ai/checks/DISC-008) and [DISC-023 robots.txt lets agents read the UCP profile](https://storewalk.ai/checks/DISC-023). Sources: [Adobe Experience League: SEO overview](https://experienceleague.adobe.com/en/docs/commerce-admin/marketing/seo/seo-overview) and [Magento source: Theme/etc/config.xml](https://raw.githubusercontent.com/magento/magento2/2.4-develop/app/code/Magento/Theme/etc/config.xml).
2. Guest checkout. Where: Stores > Configuration > Sales > Checkout > Checkout Options > Allow Guest Checkout. Default: Yes. In its words: “The default setting allows guests to make purchases” What to do (our advice): Leave it on. It is set per store view, so check each one. Checks: [TRX-001 Guest checkout available](https://storewalk.ai/checks/TRX-001). Source: [Adobe Experience League: Guest checkout](https://experienceleague.adobe.com/en/docs/commerce-admin/stores-sales/point-of-purchase/checkout/checkout-guest).
3. reCAPTCHA at checkout. Where: Stores > Settings > Configuration > Security > Google reCAPTCHA Storefront: Enable for Checkout/Placing Order. Default: The docs state none; in the source code no reCAPTCHA type is set for placing an order, so it is off. What to do (our advice): Keep the checkout field empty unless you are under attack. The login and contact forms can keep theirs. Checks: [TRX-002 No CAPTCHA before the payment step](https://storewalk.ai/checks/TRX-002) and [VER-003 Checkout has stricter controls than the product page](https://storewalk.ai/checks/VER-003). Sources: [Adobe Experience League: Google reCAPTCHA](https://experienceleague.adobe.com/en/docs/commerce-admin/systems/security/captcha/security-google-recaptcha) and [Magento security-package source: ReCaptchaCheckout config.xml](https://raw.githubusercontent.com/magento/security-package/develop/ReCaptchaCheckout/etc/config.xml).
4. Shipping policy and returns. Where: Stores > Configuration > Sales > Shipping Settings > Shipping Policy Parameters. Default: Off until you set Apply Custom Shipping Policy to Yes. In its words: “The text appears when customers click See our shipping policy during checkout.” What to do (our advice): It shows during checkout, not on product pages, so also publish a CMS page with your shipping and returns terms. RMA returns are an Adobe Commerce feature, not in Open Source. Checks: [EVAL-001 Shipping cost and terms machine-readable](https://storewalk.ai/checks/EVAL-001) and [EVAL-002 Return policy machine-readable](https://storewalk.ai/checks/EVAL-002). Sources: [Adobe Experience League: Shipping settings](https://experienceleague.adobe.com/en/docs/commerce-admin/stores-sales/delivery/shipping-settings) and [Adobe Experience League: Configure returns (RMA)](https://experienceleague.adobe.com/en/docs/commerce-admin/stores-sales/order-management/returns/rma-configure).
5. Bot protection on Adobe Commerce Cloud. Where: Fastly WAF, and the paid Advanced Security add-on. Default: The standard WAF does no bot mitigation. In its words: “Advanced Security is available at an additional cost” What to do (our advice): With the add-on, Bot Management can tell AI crawlers from AI fetchers. Adobe says its configurations “currently require submitting a support ticket”. Checks: [VER-001 Bot management present](https://storewalk.ai/checks/VER-001) and [SAFE-101 Spoofed agent UA accepted](https://storewalk.ai/checks/SAFE-101). Sources: [Adobe Experience League: Fastly WAF service](https://experienceleague.adobe.com/en/docs/commerce-on-cloud/user-guide/cdn/fastly-waf-service) and [Adobe Experience League: Advanced Security](https://experienceleague.adobe.com/en/docs/commerce-on-cloud/user-guide/cdn/advanced-security).
6. llms.txt. Where: A Marketplace extension. Default: We found no core setting. What to do (our advice): Several Marketplace extensions generate one. Pick one that writes links to your categories and policy pages. Checks: [DISC-002 llms.txt present and non-trivial](https://storewalk.ai/checks/DISC-002). Source: [Adobe Commerce Marketplace: an llms.txt extension](https://commercemarketplace.adobe.com/mb-module-llms.html).

robots.txt is edited at Content > Design > Configuration: open the Global row, or a website's, click Edit, and expand Search Engine Robots. Adobe's page says "If needed, enter custom instructions into the Edit Custom instruction of robots.txt file box," and "To restore the default instructions, click Reset to Default." We have not confirmed that a fresh install serves those defaults before anyone clicks the button, so read your live `/robots.txt` rather than trusting the box.

## What is off or missing by default?

Two things in the defaults, and two that Adobe has announced but not shipped.

The default robots.txt closes search results. Among its lines is `Disallow: /*?`, which matches every URL with a query string. That includes the search results page, `/catalogsearch/result/?q=`, and every filtered category page. A polite agent will not run your search through its URL, which is what our [search check](https://storewalk.ai/checks/DISC-008) tests. The `/catalog/` line also blocks product URLs that were never rewritten, such as `/catalog/product/view/id/42`; your rewritten `.html` URLs are fine.

Stock Luma prints no JSON-LD. Its product page uses schema.org microdata instead: a Product item with name, SKU and description, and an Offer with price and currency, written as attributes in the HTML. The stock template has no availability property at all. Our [product structured data check](https://storewalk.ai/checks/DISC-004) reads JSON-LD, so a stock Luma store fails it, and our [availability check](https://storewalk.ai/checks/EVAL-004) has nothing structured to read. Microdata is valid schema.org, but it is not what our check, or any tool that reads only JSON-LD, looks for.

Shipping and returns terms do not reach agents. Magento's shipping policy is set at Stores > Configuration > Sales > Shipping Settings > Shipping Policy Parameters, and Adobe says "The text appears when customers click See our shipping policy during checkout." That is after an agent has decided. Returns (RMA) are, in Adobe's words, "an exclusive feature that is available only in Adobe Commerce and is not available in Magento Open Source." Neither prints structured data.

There is no llms.txt in core. We found no core setting for one; several Marketplace extensions generate it.

## How do you fix the common failures?

Two need a developer or an extension, the rest are settings.

If our [robots.txt check](https://storewalk.ai/checks/DISC-001) fails, look first for a block someone added in the custom instructions box, and remove it or narrow it to the bot you mean. On the default instructions our check reports WARN, not PASS, because every agent inherits the checkout and customer lines. It reads the `?` in `/*?` as a plain question mark, as the standard says, so that line closes URLs with a query string and nothing else. An earlier version of our parser took the `?` for a pattern symbol and read the line as closing every page, which made the check fail and our crawler give up after the home page. We fixed it, and the figure below gives the same answers as the scan.

If you want agents to use your search, you can add `Allow: /catalogsearch/result/` under the `*` group. The longer Allow wins over `/*?` for search results only, so filtered category pages stay closed. That is our example, not Adobe's advice: search and filter URLs can trap crawlers in endless combinations, so weigh it. Try it below.

Magento’s default robots.txt, and what /\*? catches.

These are the instructions core restores when you click Reset to Default. We have not confirmed that a fresh install serves them before anyone clicks it.

Core default. No AI agent is named. /\*? blocks every URL with a query string, and /catalog/ blocks product URLs that were never rewritten. By the rule of our DISC-001, this file is WARN: no agent is fully blocked, but each inherits some Disallow lines, such as cart or checkout. That is normal for a store and costs little.

```text
User-agent: *
Disallow: /index.php/
Disallow: /*?
Disallow: /checkout/
Disallow: /app/
Disallow: /lib/
Disallow: /*.php$
Disallow: /pkginfo/
Disallow: /report/
Disallow: /var/
Disallow: /catalog/
Disallow: /customer/
Disallow: /sendfriend/
Disallow: /review/
Disallow: /*SID=
```

| Path                                                  | GPTBot under “Core default”      |
| ----------------------------------------------------- | -------------------------------- |
| A product page (rewritten URL): /linen-shirt.html     | Allowed                          |
| A product page (raw URL): /catalog/product/view/id/42 | Blocked, by Disallow: /catalog/  |
| Site search: /catalogsearch/result/?q=linen           | Blocked, by Disallow: /\*?       |
| A filtered category: /men/shirts.html?color=blue      | Blocked, by Disallow: /\*?       |
| Checkout: /checkout/                                  | Blocked, by Disallow: /checkout/ |
| Sign-in: /customer/account/login/                     | Blocked, by Disallow: /customer/ |

With search allowed (our example). Our example, not Adobe’s advice. The longer Allow beats /\*? for search result URLs only; filtered category pages stay blocked. By the rule of our DISC-001, this file is WARN: no agent is fully blocked, but each inherits some Disallow lines, such as cart or checkout. That is normal for a store and costs little.

```text
User-agent: *
Disallow: /index.php/
Disallow: /*?
Allow: /catalogsearch/result/
Disallow: /checkout/
Disallow: /app/
Disallow: /lib/
Disallow: /*.php$
Disallow: /pkginfo/
Disallow: /report/
Disallow: /var/
Disallow: /catalog/
Disallow: /customer/
Disallow: /sendfriend/
Disallow: /review/
Disallow: /*SID=
```

| Path                                                  | GPTBot under “With search allowed (our example)” |
| ----------------------------------------------------- | ------------------------------------------------ |
| A product page (rewritten URL): /linen-shirt.html     | Allowed                                          |
| A product page (raw URL): /catalog/product/view/id/42 | Blocked, by Disallow: /catalog/                  |
| Site search: /catalogsearch/result/?q=linen           | Allowed, by Allow: /catalogsearch/result/        |
| A filtered category: /men/shirts.html?color=blue      | Blocked, by Disallow: /\*?                       |
| Checkout: /checkout/                                  | Blocked, by Disallow: /checkout/                 |
| Sign-in: /customer/account/login/                     | Blocked, by Disallow: /customer/                 |

Sources: [Magento source: Theme/etc/config.xml](https://raw.githubusercontent.com/magento/magento2/2.4-develop/app/code/Magento/Theme/etc/config.xml) and [Adobe Experience League: SEO overview](https://experienceleague.adobe.com/en/docs/commerce-admin/marketing/seo/seo-overview).

If DISC-004 fails on Luma, add JSON-LD. On Luma or Hyvä that means an extension or your own module; we found no first-party statement on structured data from Hyvä, so check what your theme prints. On Adobe Commerce Storefront, the Edge Delivery front end, Adobe documents the types to add ("WebSite, Product, AggregateRating, Rating, BreadcrumbList") and offers a PDP Metadata Generator to "automate the process of generating all recommended metadata". Adobe also "recommends uploading product metadata into Edge Delivery Services so that it can be rendered server-side", which helps our [no-JavaScript check](https://storewalk.ai/checks/DISC-006) too. Whatever writes it, include price, currency and availability on each offer.

If our [shipping](https://storewalk.ai/checks/EVAL-001) and [returns](https://storewalk.ai/checks/EVAL-002) checks fail, publish a CMS page with your shipping costs, with their currency, and your return window in days, and link it from the footer. "Free delivery over €50" and "returns within 30 days" are the kind of sentence an agent can use; "see our shipping policy during checkout" is not. [How agents read a page](https://storewalk.ai/blog/how-agents-read-a-page) has more on this.

If you are on Adobe Commerce Cloud and want to tell agents from scrapers, look at the Fastly WAF first. Its standard service lists "Protection against malware or bot mitigation" among the things it does not cover. The paid Advanced Security add-on ("Advanced Security is available at an additional cost") adds Bot Management that "Identifies and manages AI crawlers that scrape content to train large language models" and "Controls AI fetchers used in real-time AI search results". Adobe says its configurations "currently require submitting a support ticket". Our [bot management check](https://storewalk.ai/checks/VER-001) looks for something like that in front of your store. [Bots, crawlers and agents](https://storewalk.ai/blog/bots-crawlers-agents) explains the difference between the two kinds of AI bot.

If our [llms.txt check](https://storewalk.ai/checks/DISC-002) fails, pick an extension that writes a title, at least 20 lines and working links, which is what our check asks for.

## Can a Magento store take agent checkout?

Not through an Adobe feature yet, in Adobe's own labels.

Adobe's Commerce MCP is marked "Coming Soon" on Experience League, with the note "This feature is coming soon and is subject to change." Adobe describes it as helping "developers build custom agentic experiences from discovery to checkout". Adobe's developer tooling for coding agents, such as the MCP server for its storefront drop-ins, is for developers building a storefront, and a shopper's agent has no use for it.

On the commerce protocols, Adobe's February 2026 post says "Adobe Commerce is committed to supporting agentic commerce standards, including Universal Commerce Protocol (UCP)" and "Adobe Commerce is moving towards supporting UCP and ACP", making catalogs, pricing and inventory "machine-readable by AI agents and available to the latest LLM surfaces like Gemini and ChatGPT." We read that as a commitment, not a setting you can switch on, so our [agent checkout check](https://storewalk.ai/checks/TRX-004) will not find a UCP profile on a stock store. [UCP vs ACP vs MCP vs AP2](https://storewalk.ai/blog/ucp-vs-acp-vs-mcp-vs-ap2) explains what each would add.

Until then, the agent's last step is your own checkout page, which is one more reason to keep guest checkout on and the place-order reCAPTCHA off.

## Magento agent readiness checklist

Tick as you go. The ticks are kept in this browser, which is less configuration than Stores > Configuration usually asks of you.

Your Magento checklist, saved in this browser.

- \[ ] robots.txt reviewed; decided about /\*? and search (Content > Design > Configuration > Search Engine Robots). Checks: [DISC-001 robots.txt allows AI agents](https://storewalk.ai/checks/DISC-001) and [DISC-008 Search endpoint usable by GET](https://storewalk.ai/checks/DISC-008).
- \[ ] Allow Guest Checkout is Yes in every store view (Stores > Configuration > Sales > Checkout). Checks: [TRX-001 Guest checkout available](https://storewalk.ai/checks/TRX-001).
- \[ ] No reCAPTCHA on checkout or placing an order (Security > Google reCAPTCHA Storefront). Checks: [TRX-002 No CAPTCHA before the payment step](https://storewalk.ai/checks/TRX-002).
- \[ ] Product pages print JSON-LD with price, currency and availability. Checks: [DISC-004 Product structured data](https://storewalk.ai/checks/DISC-004) and [EVAL-004 Availability explicit](https://storewalk.ai/checks/EVAL-004).
- \[ ] A shipping and returns page agents can open, with the window in days. Checks: [EVAL-001 Shipping cost and terms machine-readable](https://storewalk.ai/checks/EVAL-001) and [EVAL-002 Return policy machine-readable](https://storewalk.ai/checks/EVAL-002).
- \[ ] Commerce Cloud: decided whether you need Advanced Security. Checks: [VER-001 Bot management present](https://storewalk.ai/checks/VER-001).
- \[ ] An llms.txt from an extension, if you want one. Checks: [DISC-002 llms.txt present and non-trivial](https://storewalk.ai/checks/DISC-002).

## Frequently asked questions

### Does Magento block AI agents in robots.txt?

Not by name. The default instructions are one group for every crawler. But `Disallow: /*?` blocks every URL with a query string, including search results and filtered categories, and `/catalog/` blocks product URLs that were never rewritten.

### Does Magento's Luma theme output JSON-LD?

No. Stock Luma prints schema.org microdata on product pages, with no availability property. Tools that read JSON-LD, ours included, report product structured data missing. An extension, a custom module or Adobe Commerce Storefront's metadata can add JSON-LD.

### Is guest checkout on by default in Magento?

Yes. Adobe says "The default setting allows guests to make purchases." The setting is Allow Guest Checkout under Stores > Configuration > Sales > Checkout > Checkout Options, per store view.

### Does Adobe Commerce support UCP or MCP?

Not as a shipped feature. Adobe labels its Commerce MCP "Coming Soon", and says Adobe Commerce is "committed to supporting" UCP and "moving towards supporting UCP and ACP".

### Does Adobe Commerce Cloud's WAF manage AI bots?

Not the standard Fastly WAF, which does not cover bot mitigation. The paid Advanced Security add-on includes Bot Management with AI crawler detection and AI fetcher control.

The sources below were last checked on the date shown.

## Sources

- [Adobe Experience League: SEO overview](https://experienceleague.adobe.com/en/docs/commerce-admin/marketing/seo/seo-overview)
- [Magento source: Theme/etc/config.xml](https://raw.githubusercontent.com/magento/magento2/2.4-develop/app/code/Magento/Theme/etc/config.xml)
- [Magento source: catalog_product_view.xml](https://raw.githubusercontent.com/magento/magento2/2.4-develop/app/code/Magento/Catalog/view/frontend/layout/catalog_product_view.xml)
- [Adobe Commerce Storefront: metadata](https://experienceleague.adobe.com/developer/commerce/storefront/setup/seo/metadata/)
- [Adobe Experience League: Guest checkout](https://experienceleague.adobe.com/en/docs/commerce-admin/stores-sales/point-of-purchase/checkout/checkout-guest)
- [Adobe Experience League: Google reCAPTCHA](https://experienceleague.adobe.com/en/docs/commerce-admin/systems/security/captcha/security-google-recaptcha)
- [Magento security-package source: ReCaptchaCheckout config.xml](https://raw.githubusercontent.com/magento/security-package/develop/ReCaptchaCheckout/etc/config.xml)
- [Adobe Experience League: Shipping settings](https://experienceleague.adobe.com/en/docs/commerce-admin/stores-sales/delivery/shipping-settings)
- [Adobe Experience League: Configure returns (RMA)](https://experienceleague.adobe.com/en/docs/commerce-admin/stores-sales/order-management/returns/rma-configure)
- [Adobe Experience League: Fastly WAF service](https://experienceleague.adobe.com/en/docs/commerce-on-cloud/user-guide/cdn/fastly-waf-service)
- [Adobe Experience League: Advanced Security](https://experienceleague.adobe.com/en/docs/commerce-on-cloud/user-guide/cdn/advanced-security)
- [Adobe Experience League: Commerce MCP overview](https://experienceleague.adobe.com/en/docs/commerce-learn/ai-and-agentic-commerce/commerce-mcp/commerce-mcp-overview)
- [Adobe Commerce commits to agentic commerce standards (February 2026, mirror)](https://glenbrook.com/payments_news/adobe-commerce-commits-to-agentic-commerce-standards/)
- [Adobe Developer: Drop-ins MCP server](https://developer.adobe.com/commerce/extensibility/developer-agent/dropins-mcp-server)
- [Adobe Commerce Marketplace: an llms.txt extension](https://commercemarketplace.adobe.com/mb-module-llms.html)

Last checked 4 Nov 2026