Spree Commerce: open-source B2B and marketplace ecommerce
Open-source B2B and marketplace ecommerce; new stores include an MCP server for AI agents.
Runs in the cloud
Agentic Commerce Readiness
Overview
Description from the maker (original English)
Score a Magento or Adobe Commerce store on eight AI agent-readiness checks.
PopNx MCP’s three pillars
These three are never merged into one score: opinions, measurements and popularity are different things.
- User voiceiNo reviews yetReviews open together with accounts in a later step
- Our basic checksi3 of 3 passedChecked from public information; code not scanned yet
- UsageiVery new★ –
What you can do with it
We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.
- Connection: Runs in the cloud
- Transport: Streamable HTTP
- Category: Online shops & payments
Install
Pick the AI app you use, then copy the settings.
Before you install
- Basic checks: 3 of 3 passed
- Runs on the maker’s server: what you ask it goes through their server.
- Can do 7 things (tools) search_catalog, lookup_catalog, list_offers, get_offer …
- The registry lists no key to fill in.
You need
- Runs in the cloudNothing to install; it connects over the internet
Which app do you use?
Pick your app above. We remember it, so next time the button says “Install in …”.
Works in Claude on the web, desktop and mobile:
- Open Settings → Connectors
- Press Add custom connector
- Paste the address below and press Add
- If it asks you to sign in, sign in with the maker
https://expandingweb.com/mcpRun this in your terminal
claude mcp add --transport http agentic-commerce-readiness https://expandingweb.com/mcpOr copy the settings yourself
Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json
{
"mcpServers": {
"agentic-commerce-readiness": {
"url": "https://expandingweb.com/mcp"
}
}
}Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.
Or copy the settings yourself
Paste into .vscode/mcp.json in your project
{
"servers": {
"agentic-commerce-readiness": {
"type": "http",
"url": "https://expandingweb.com/mcp"
}
}
}Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.
ChatGPT connects only to servers on the internet:
- Open ChatGPT on the web → Settings → Connectors (Apps)
- Press Create or Add (some plans need Developer mode under Advanced first)
- Paste the address below, give it a name and save
- If it asks you to sign in, sign in with the maker
https://expandingweb.com/mcpMenu names can differ slightly by plan and over time.
Your choice stays on this device in a cookie; no account needed.
These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.
What it can do
Tool names and descriptions exactly as the server reported them on Nov 9, 2026. The maker wrote them, not us; we show them as plain text.
search_catalogUCP 2026-04-08 catalog search over the engagement tiers. Returns UCP product objects in structuredContent. Call with no query for the whole catalog.
lookup_catalogUCP 2026-04-08 catalog lookup: resolve engagement ids (e.g. readiness-sprint) to UCP product objects.
list_offersList every Expanding Web engagement tier with id, price, currency and what it includes.
get_offerFull record for one engagement tier: price, turnaround, deliverables, pricing policy and limits.
scan_storeRun the free eight-check agent-readiness scan against a live storefront and return the verdicts. Read-only, at most three pages, 15-second budget, robots.txt honoured. Limited to 5 scans per hour.
create_checkout_sessionCreate a Stripe Checkout Session and return its URL — for the Agentic Commerce Readiness Sprint (readiness-sprint) or for Pro licences of the Agentic Commerce Suite Magento module (module-pro, one licence per Magento installation, volume discount from 3). Payment is completed by
report_problemReport something on this site or endpoint that stopped you from completing a task: a page you could not read, data you could not find, a request that was refused. Read by a human. Use this instead of giving up silently — it is the only way we learn that an agent failed here.
Basic checksi
We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 10, 2026
- ✓ Pass
Maker matches the repo
The registry name was verified against the domain expandingweb.com (the registry checks domain ownership)
- … Not checked yet
Still maintained
We have not read this repo from GitHub yet
- … Not checked yet
Has a licence
We have not read this repo from GitHub yet
- ✓ Pass
Endpoint responds
Responded in 136 ms (HTTP 200)
- – Not applicable
Sign-in with OAuth
No sign-in needed
- ✓ Pass
No hidden instructions in tool descriptions
Read 7 tool descriptions and found no hidden instructions to the AI
Compared with others in Online shops & paymentsi
- More stars than 0% of the other 2644 servers in this category
- Published to the registry more recently than 30% of the other 2644 servers in this category
- Basic checks equal to or better than 100% of the other 2644 servers in this category
Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.
Common questions
Is Agentic Commerce Readiness safe?
It passed 3 of 3 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.
What keys or codes does it need?
The registry does not list a required key, though some servers ask you to sign in on first use.
Does it run on my computer or in the cloud?
It runs in the maker’s cloud. Connect over the internet with nothing to install, but what you send passes through the maker’s servers.
Is it still maintained?
The GitHub repo last changed –, and the latest version (1.0.0) reached the registry 2 months ago.
Which apps can use it?
Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. It connects by URL, so apps that accept remote MCP servers work too, such as ChatGPT in developer mode.
What can I use instead?
In the same category: Spree Commerce: open-source B2B and marketplace ecommerce, Stripe MCP, MCP Cn Commerce
Alternatives
Servers in the same category from other makers, sorted by stars.
Reading a card:↓ Downloads per weeki★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi
Stripe MCP
Stripe’s official server lets AI view and manage customers, products, payments and invoices. Connect to Stripe’s cloud and sign in with OAuth.
Runs in the cloud✓ stripe.com
MCP Cn Commerce
8 read-only MCP platform entries; support is operation-specific; merchant live acceptance pending
Runs on your computer
README from the maker
Open the README
Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.
AI Agent Readiness for Magento 2
ExpandingWeb_AgentReadiness runs the eight public agent-readiness checks against your own Magento 2 / Adobe Commerce store from inside the admin, and counts the AI agent traffic (GPTBot, ClaudeBot, PerplexityBot, …) your storefront already gets.
It is the free, open-source tier of the Agentic Commerce Suite by Expanding Web. MIT licence. Nothing leaves your store by default (see Privacy).
The eight checks
Same check ids, semantics and verdict language as the public scanner at https://expandingweb.com/#scan — a score means the same thing in your admin, on the public scan and in the quarterly benchmark.
| ID | Check | What passes |
|---|---|---|
| UCP-01 | /.well-known/ucp profile | A profile at that path that validates against the Universal Commerce Protocol spec, version 2026-04-08. |
| MCP-01 | Advertised MCP endpoint reachable | The MCP endpoint the UCP profile names (or a ) answers an initialize handshake and lists at least one tool. A profile that advertises a dead endpoint fails. |
| BOT-01 | robots.txt policy for AI shopping crawlers | The policy for the crawlers agents use (GPTBot, ClaudeBot, PerplexityBot, OAI-SearchBot, ChatGPT-User, Claude-User, Applebot-Extended, Amazonbot, Bingbot, meta-externalagent, CCBot) lets them read product URLs, not only the homepage, and the homepage carries no noindex/noai directive. |
| AGENT-01 | AI agent user-agents served at the edge | robots.txt states a policy; the edge states the truth. The scanner fetches the homepage *as* GPTBot and ClaudeBot and checks the CDN or firewall does not answer 401/403/429/503 or a bot challenge to that user agent. |
| CRAWL-01 | Crawl limits on search and faceted URLs | Catalog search and layered navigation generate unlimited distinct URLs, each a cache miss; the check asks whether robots.txt bounds them (/catalogsearch/result/, /search, query-string URLs) for every AI crawler, not only *. |
| LLMS-01 | /llms.txt present | A plain-text index of the site written for language models exists at the root. |
| FEED-01 | Product structured data completeness | Sampled product pages (up to three) score at least 16 of 35 weighted points across 27 attributes. The eight an agent cannot transact without — name, image, GTIN, price, currency, availability, shipping details, return policy — count double; a value that would mislead (bad GS1 check digit, non-numeric price, expired priceValidUntil) earns nothing. |
| SCHEMA-01 | Product, Offer, AggregateRating JSON-LD | A product page carries valid JSON-LD for the product with an offer and, where reviews exist, an aggregate rating. |
Reading the result:
- Score is checks passed out of applicable checks. It is a readiness measure, not a ranking prediction — nobody can promise placement in an AI answer, and this module does not.
- N/A appears when a check cannot run (no product catalog to sample, the edge refused that one path, the 60-second budget ran out). It does not count against the score.
- Blocked (the scan stops before the checks) means the store refused the scanner's own user agent at the edge; unreachable means nothing answered. Neither is reported as eight failed checks, but every real agent meets the same wall, so an edge rule is usually the first thing to fix.
Where the numbers come from: in the Q3 2026 benchmark of 1,867 Magento stores, 33.9% passed none of the eight checks; on SCHEMA-01 alone, 54% of reachable product pages carried no Product+Offer JSON-LD.
Installation
composer require expandingwebcom/module-agent-readinessbin/magento module:enable ExpandingWeb_AgentReadiness bin/magento setup:upgrade bin/magento cache:flush
Requirements: Magento Open Source / Adobe Commerce 2.4.6 or newer, PHP 8.2 or newer, guzzlehttp/guzzle 7 (already part of Magento). Two tables are created: expw_readiness_scan and expw_readiness_daily. bin/magento module:uninstall ExpandingWeb_AgentReadiness drops both and every expw_readiness/* config value.
The module can be installed alongside the Agentic Commerce Suite — tables, config paths, routes, ACL ids and cron jobs do not collide.
In the admin
- Marketing → AI Agent Readiness → Readiness Dashboard: the latest scan as a score gauge and one row per check (short verdict, severity, and the scanner's full technical verdict folded under *Technical details*), a *Run scan now* button, and the agent-traffic cards.
- Stores → Configuration → ExpandingWeb → AI Agent Readiness: counting on/off, retention, daily cron scan on/off, TLS verification.
The scan runs on your own server against the default store view's base URL, from the outside in — the same fetches an agent would make: /, /robots.txt, /.well-known/ucp, /llms.txt, /sitemap.xml, up to three product pages, the homepage again as GPTBot and as ClaudeBot, and an MCP handshake if a profile advertises an endpoint. Budget: 60 seconds wall clock, 5 seconds per request, 2 MB per response. Cron expw_readiness_scan runs it daily at 03:15 server time; the last 400 scans are kept.
*Run scan now* is synchronous: the admin POST waits for the scan, so PHP-FPM's request timeout needs to clear 60 seconds.
How the agent-traffic counter works — and what it cannot see
An observer on controller_action_predispatch matches the request's User-Agent against a list of known AI agent tokens (Model/Tracking/AgentDetector: OAI-SearchBot, ChatGPT-User, GPTBot, Claude-User, Claude-SearchBot, ClaudeBot, Perplexity-User, PerplexityBot, Google-Extended, Applebot-Extended, Amazonbot, Meta-ExternalAgent, Bytespider, CCBot, Bingbot) and, on a match, upserts one row per (day, agent, store view) in expw_readiness_daily. Nothing happens for the other 99.x% of requests beyond one substring scan. "Day" is the store's configured timezone. Rows older than the retention setting (default 400 days) are pruned nightly. The token list is compiled into the module and updated with a module release — a new agent means a new version, never a runtime download.
The dashboard shows 7/30/90-day totals per agent, the change against the previous 30 days, and a 14-day sparkline.
The count is a floor, not a total, for two reasons the dashboard states next to the number:
- Attribution is by declared user-agent. An agent that presents a browser user-agent is invisible to it.
- The observer runs in PHP. A page served entirely from Varnish or the built-in full-page cache never reaches PHP, so cache hits by agents are not counted. On a store with a high hit rate the counter sees mostly cache misses — first visits, uncached URLs, and everything that bypasses the cache.
For a complete picture, count at the edge (CDN or web-server logs). This module deliberately does not ship an edge-log parser.
Privacy
The module makes no request to anything but your own store:
- The self-scan fetches your own storefront URLs (listed above), with the User-Agent
ExpandingWebAgentReadiness/1.0.0 (+https://expandingweb.com/; readiness self-scan). The one exception is MCP-01: if your UCP profile advertises an MCP endpoint on another host, the handshake goes there — because that is what the profile tells agents to do. - The agent-traffic counter reads the request's
User-Agentheader and writes an integer to your own database. No IP addresses, no URLs, no headers are stored. - Scan results and counters live in your database and are shown only in your admin. The dashboard's link to the Agentic Commerce Suite is a static URL with no parameters — it carries nothing about your store.
No telemetry, no licence check, no agent-list download, no phone-home.
Keeping the checks in lock-step with the public scanner
Model/Scanner/Scanner.php and Model/Scanner/UcpProfile.php are generated, not hand-maintained: bin/port-scanner.php re-ports the public scanner's source (app/Agentic/Scanner.php in the expandingweb.com repo, which is not public) into this module's namespace and records the upstream revision in Model/Scanner/.upstream-hash. The script applies exactly five deliberate differences — namespace and strict types, ScanHttp in place of the public scanner's SSRF-hardened client (the only target here is your own base URL, which may legitimately be a private address), sequential instead of concurrent phase-1 fetches, a 60-second instead of 15-second budget (nobody waits on a cron), and the scanner's own identity in the MCP clientInfo and robots.txt matching — and refuses to run if upstream changed shape.
The reason is the promise on the tin: the public scan, the benchmark and the in-store scan have to give the same verdict for the same store. Hand-merging 1,800 lines twice a quarter is how that promise would quietly die, so the file carries a DO NOT EDIT BY HAND marker that CI enforces. Found a check misbehaving? Open an issue with the store shape that trips it; the fix lands upstream and the port is re-run. See CONTRIBUTING.md.
What is not in this module
Merchant-feed syndication (OpenAI, Perplexity, Google Merchant Center), Product/Offer/ProductGroup JSON-LD repair, the agent endpoints (/llms.txt, /.well-known/ucp, MCP server, agent product feed, checkout sessions), agent funnel and revenue-exposure analytics, AI visibility and share-of-voice probes and competitor analysis are the paid tier: the Agentic Commerce Suite. This module diagnoses; the Suite repairs.
For agents and MCP clients
Expanding Web's own MCP servers are listed in the official MCP registry: com.expandingweb/agentic-commerce-readiness (scan a store, read the offer, open a checkout session) and com.expandingweb/nord-trail-store (a reference agent-ready storefront to look at). Both speak JSON-RPC 2.0 over POST — the same shape this module's checks expect to find on a merchant's store.
Development
ln -s /path/to/agent-readiness app/code/ExpandingWeb/AgentReadinessbin/magento module:enable ExpandingWeb_AgentReadiness && bin/magento setup:upgrade
Tests, static analysis and coding standard: see CONTRIBUTING.md. Version history: CHANGELOG.md.