Shopify AI agent readiness: get your store ready for agentic commerce

Quite a lot, and most of it without asking you.

Shopify writes robots.txt for every store. In its words: "All Shopify stores have a default robots.txt file that's optimal for Search Engine Optimization (SEO)." The default on the Dawn demo store names no AI agent at all. It has one group for every crawler and one for Google's ad bot, and it asks crawlers to stay out of the cart, checkout, account and order pages, plus sorted and filtered collection URLs that would otherwise multiply forever. Above the rules it now carries comments addressed to agents, pointing them to agents.md, the UCP profile and the UCP MCP endpoint, and asking them to use those "instead" of the cart's AJAX URLs.

For agent instructions, Shopify's developer docs say "Shopify manages an agents.md file by default for every store", and that /llms.txt and /llms-full.txt mirror its content. So a store has an llms.txt it never wrote. Whether it passes our llms.txt check depends on its length and links, which we did not measure for every store.

On the Dawn demo store, /.well-known/ucp returns a UCP profile, version 2026-08-25, with checkout, cart, catalog search, order and identity linking among its thirteen capabilities, and an MCP endpoint at /api/ucp/mcp. That is one store, so read it as what the platform serves, not a promise about yours. If you have read older guides, note the move: Shopify says "The catalog and cart tools on https://{shop}/api/mcp were removed" and tells developers to "Use the Universal Commerce Protocol (UCP) instead." UCP explained covers what the profile holds.

Agentic Storefronts list your products in AI channels that Shopify names as "ChatGPT, Google AI Mode and Gemini, Microsoft Copilot, and Meta". The help page says "Agentic storefronts is active by default for eligible stores." When we read a Shopify store in September, a Shopify platform script had added eleven WebMCP tools for browser agents, from catalogue search to checkout. That is our observation of one store, not a Shopify statement.

Dawn prints its product JSON-LD with Shopify's structured_data filter. Shopify's docs say it outputs a schema.org Product when there are no variants and "a ProductGroup if they have one or more variants", which is what our variant check likes to see. Our product data check and the price and stock checks read that ProductGroup as one product, with an offer for each variant. Other themes write their own, so check yours.

On bots, Shopify says "Bot management is handled directly for stores on Shopify, and you don't need to take any action." Since May 2026 it has also given unsigned bots the tightest rate limits: "Bots and agents that don't sign their requests are subject to the strictest limits." Agents that sign with Web Bot Auth can get higher ones.

Seven settings decide most of what an agent meets. Pick one to see its path, its default as Shopify states it, and the checks it moves.

Two of them deserve a closer look, because Shopify's help pages leave the default open.

The first is sign-in at checkout. Under Settings > Checkout, Shopify asks you to "Select whether to require customers to sign in to their customer account before checking out." The page states no default for this choice. An agent buying for someone has no customer account of its own, so a required sign-in stops it at the door. Our guest checkout check reads your checkout entry and reports it. Why agents stall at checkout has the longer version.

The second is the return window. Under Settings > Policies you write your refund and shipping policies, which Shopify publishes at fixed addresses such as /policies/refund-policy and /policies/shipping-policy. The return window comes from your return rules, with 14, 30 or 90 days, unlimited or a custom number. Shopify states no default window and says nothing about whether those rules reach structured data.

Four things. The first is Shopify's to fix; you can work on the other three.

When we sent Accept: text/markdown to Shopify home pages in September, the answer was labelled text/markdown and the body was the full HTML page. A merchant reported the same in Shopify's developer forum on 29 September, adding that product and collection pages returned 404 for Markdown requests. We found no Shopify doc on the subject. Our Markdown check reads the body, not the label, so it fails such a reply. There is nothing in the admin to switch; this one is Shopify's to fix.

For structured data, the structured_data filter's page does not mention gtin, shippingDetails or hasMerchantReturnPolicy, and we have not confirmed what live product pages print. Shopify's own advice for AI platforms still asks for a "Barcode (ISBN, UPC, GTIN, etc.)", "Variants, including Option name" and policies kept "complete and up-to-date". Fill those in whatever the markup turns out to say, since the same facts feed your policy pages and Shopify Catalog.

Setup differs on Shopify's Agentic plan, and Shopify notes that there "direct checkout is deactivated by default."

Agentic Storefronts are on only for eligible stores. Shopify Catalog wants a store on the Starter plan or higher and not in private mode, and products with "a title and at least 1 product image" and "a price greater than 0". A product set to Unlisted is hidden from AI channels too, and from sitemaps and online store search. If the admin shows an ineligibility warning on the Agentic page, start there.

Most of these take a minute in the admin. The robots.txt one mostly takes restraint.

If our robots.txt check fails, someone edited the file. Shopify allows it through a robots.txt.liquid template in your theme, and is blunt about the risk: "This is an unsupported customization." and "Incorrect use of the feature can result in loss of all traffic." The template replaces the generated file, so keep Shopify's loop over robots.default_groups and add your lines after it. With the default file our check reports WARN rather than PASS, because every agent inherits the cart and checkout lines. That is expected and fine.

Blocking does less than you might think. Shopify says "Blocking AI crawlers at the /robots.txt or network layer affects only open-web discoverability," and that a block "doesn't stop your product data from being sent by Shopify Catalog to the agentic storefronts that you've activated." Try it on the default file below.

# Agent instructions: https://example.myshopify.com/agents.md
# UCP discovery: https://example.myshopify.com/.well-known/ucp
# UCP/MCP endpoint: https://example.myshopify.com/api/ucp/mcp

User-agent: *
Allow: /
Disallow: /admin
Disallow: /cart/
Disallow: /checkout
Disallow: /checkouts/
Disallow: /orders
Allow: /account/login
Disallow: /account
Disallow: /services
Disallow: /sf_*

# AJAX surfaces: agents should use UCP/MCP instead
Disallow: /cart.js
Disallow: /recommendations/products

# Filters, sort, previews, language-picker crawl traps
Disallow: /collections/*sort_by*
Disallow: /collections/*+*
Disallow: /*?*preview_theme_id=*

Sitemap: https://example.myshopify.com/sitemap.xml

# Agent instructions: https://example.myshopify.com/agents.md
# UCP discovery: https://example.myshopify.com/.well-known/ucp
# UCP/MCP endpoint: https://example.myshopify.com/api/ucp/mcp

User-agent: *
Allow: /
Disallow: /admin
Disallow: /cart/
Disallow: /checkout
Disallow: /checkouts/
Disallow: /orders
Allow: /account/login
Disallow: /account
Disallow: /services
Disallow: /sf_*

# AJAX surfaces: agents should use UCP/MCP instead
Disallow: /cart.js
Disallow: /recommendations/products

# Filters, sort, previews, language-picker crawl traps
Disallow: /collections/*sort_by*
Disallow: /collections/*+*
Disallow: /*?*preview_theme_id=*

Sitemap: https://example.myshopify.com/sitemap.xml

User-agent: GPTBot
Disallow: /

# Agent instructions: https://example.myshopify.com/agents.md
# UCP discovery: https://example.myshopify.com/.well-known/ucp
# UCP/MCP endpoint: https://example.myshopify.com/api/ucp/mcp

User-agent: *
Content-Signal: search=yes, ai-train=no
Allow: /
Disallow: /admin
Disallow: /cart/
Disallow: /checkout
Disallow: /checkouts/
Disallow: /orders
Allow: /account/login
Disallow: /account
Disallow: /services
Disallow: /sf_*

# AJAX surfaces: agents should use UCP/MCP instead
Disallow: /cart.js
Disallow: /recommendations/products

# Filters, sort, previews, language-picker crawl traps
Disallow: /collections/*sort_by*
Disallow: /collections/*+*
Disallow: /*?*preview_theme_id=*

Sitemap: https://example.myshopify.com/sitemap.xml

If checkout asks for a sign-in, go to Settings > Checkout and choose not to require it. While you are there, look at Online Store > Preferences > Spam protection. Shopify says "hCaptcha is activated by default on all Shopify stores", on contact, newsletter and comment forms and on the login, create account and password recovery pages. Checkout is not on that list, but the login page is, so a required sign-in also puts a CAPTCHA in an agent's way. Our CAPTCHA check looks for that.

If a CAPTCHA appears at checkout, it is probably Plus bot protection. On Shopify Plus, checkout bot protection is a scheduled event: "The bot protection feature is available only for merchants on a Shopify Plus plan," and "The maximum duration for a bot protection event is 60 minutes." It switches itself off when the time ends. Use it for a product drop, when you actually want to slow every buyer down, and let it lapse.

If an agent cannot read your terms, fill in Settings > Policies and set a return window. Our shipping and returns checks pass on a policy page that states its terms in plain words: a cost with its currency, or free delivery, and a return window. "30 days from delivery" beats "contact us to arrange a return", and "calculated at checkout" tells an agent nothing it can compare. How agents read a page explains why the wording matters.

If products are missing from AI channels, clear the ineligibility warning under Sales channels > Agentic, give every product a title, an image and a price, and check none is Unlisted by mistake. Shopify's help also describes opting out of ChatGPT or Copilot if you would rather not sell there.

If your agents.md says too little, add templates/agents.md.liquid to your theme to replace the managed file. Shopify's changelog from 28 May 2026 says that if no template is present for a path, "it falls back to your agents.md template, then to the Shopify-generated default", so one template can feed all three files.

Shopify runs a free Product Page Audit at shopify.com/agentic-readiness. It reads one product page's structured data and checks robots.txt against 10 search and AI user agents, then reports each factor with equal weight. It is a good first look at a single page. Our scan reads the whole path an agent takes, from robots.txt to checkout. Alternatives to isitagentready compares Shopify's audit with ten other tools, ours among them, each from its own pages.

Tick as you go. The ticks stay in this browser and nowhere else, which is more than can be said for most carts.

Does Shopify block AI agents by default?

No. The default robots.txt on Shopify's Dawn demo store names no AI agent and lets every crawler read products, collections and pages. It asks all crawlers to stay out of cart, checkout and account pages, which is normal. Shopify adds that robots.txt blocks affect "only open-web discoverability", not Shopify Catalog.

Does every Shopify store have an llms.txt?

Shopify's docs say it manages an agents.md for every store and that /llms.txt and /llms-full.txt mirror it by default. You can replace any of the three with a theme template.

Is guest checkout on by default on Shopify?

Shopify's help page does not say. The setting is under Settings > Checkout, where you choose whether customers must sign in before checking out. Check it, because an agent has no account to sign in with.

Where is Shopify's MCP endpoint?

On the store we read, at /api/ucp/mcp, as declared in its UCP profile at /.well-known/ucp. Shopify removed the catalog and cart tools from the older /api/mcp address and points developers to UCP instead.

Do I need to turn on Agentic Storefronts?

Shopify says they are "active by default for eligible stores". Check Sales channels > Agentic for an ineligibility warning, and review which channels your products appear in.

The sources below were last checked on the date shown.