The Ten-Minute Agentic Readiness Audit for Any Shopify Store

Before any conversation about AI visibility strategy, there is a prior question with a yes-or-no answer: can an agent reach your store at all?

Six public endpoints answer it. No API key, no account, no tooling. Swap in your own domain and run them — the whole thing takes about ten minutes, and the result is binary in a way almost nothing else in marketing is.

Key takeaways

• Six commands, all public endpoints, no credentials required.
• Healthy looks like: both agent files return 200, eight or more UCP capabilities, payment_handlers not empty, permalink on your own domain, roughly 15 tools, WebMCP markers above zero.
• These are switches, not curves. There is no partial credit and no gradual decay.
• The most common failure in headless builds is a 404 on /agents.md and /llms.txt.
• The second most common, and the quietest, is payment_handlers: {}.

The six probes

1 — Do the agent instruction files exist?

curl -sI https://yourstore.com/agents.md curl -sI https://yourstore.com/llms.txt

Both should return 200. On Shopify these are the same document served twice — we diffed them and found one differing line out of 76. A 404 on either is a build or hosting issue, and it is the single most common finding on headless stores.

2 — Is the protocol discovery document healthy?

curl -s https://yourstore.com/.well-known/ucp

Pipe it through a JSON formatter and read three things: how many entries are under capabilities (eight or more is normal), whether payment_handlers is populated or an empty object, and where dev.ucp.shopping.permalink points.

3 — Is payment_handlers empty?

This is the quiet one. An empty object means there is no declared payment rail for Google's agent checkout path. Everything else can look fine while this single field removes your ability to close a sale in-conversation.

4 — Does the permalink point at your own domain?

If dev.ucp.shopping.permalink resolves to yourstore.myshopify.com/buy rather than yourstore.com/buy, every agent deep link leaves your brand domain at the point of purchase. Configuration, not code.

5 — What tools do you expose?

curl -s -X POST https://yourstore.com/api/ucp/mcp -H 'Content-Type: application/json' -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}'

This is anonymous and public. A healthy store returns roughly 15 tools across catalog, locations, cart, checkout and order. Note what is not there: ask_business is absent on stores negotiating a dated protocol version, because the Ask capability is still a UCP draft.

6 — Are WebMCP tools registered on the page?

curl -s --compressed https://yourstore.com/ | grep -ci 'modelContext\|webmcp'

Greater than zero. A Liquid store typically shows several matches. Zero means in-browser agents have no structured tools and must fall back to reading the page — which the official instructions tell them not to do.

The health baseline

Before the probes: eligibility

If your store is not eligible for Shopify Catalog, none of the above will help, because you will not be in the result set in the first place. The gate is low but strict:

• Compliant with Shopify's terms and acceptable use policy; a paid plan; the store not password-protected.
• Every product has a title, at least one image, and a price above zero. Free products are excluded.
• Products published to Online Store, Hydrogen or a headless channel.
• Terms of service, privacy policy and refund policy all completed under Settings → Policies, with the agentic storefronts supplementary terms accepted.
• Channel-level gates on top: ChatGPT and Microsoft Copilot are open to merchants selling to US buyers regardless of where the business is based; AI Mode and Gemini are currently limited to a subset of US-based merchants.

Fall '26 added a store eligibility check in the admin, which tells you what is missing rather than making you guess.

Reading the result

If all six are green, your work moves up a layer: catalog fields, ratings on the hero variant, extractable copy, fulfilment promises. Two catalogs, two ranking logics is the next thing to read.

If any one is red, stop. Content work behind a broken protocol or settlement layer improves an interface nobody can call. The priority is bottom-up: the six-layer stack explains why.

These checks are cheap, which is precisely the argument for doing them now. Agent-sourced volume is still small for most brands. The asymmetry is that fixing this costs an afternoon, while discovering it in six months means you were absent while the channel's norms were being set.

FAQ

Do I need permission to probe my own store? No. All six endpoints are public and unauthenticated by design. tools/list is deliberately anonymous — the tool list is public, while the right to call those tools is gated. See trust tiers and Web Bot Auth.

Can I run this against a competitor? Technically yes, since the endpoints are public, and it is a legitimate way to benchmark. Be aware that unsigned requests face the strictest rate limits, so do not automate it aggressively.

How often should I re-run it? After every theme release, every migration, every payment or market configuration change, and once a quarter regardless. Protocol versions move; a result dated today is a result dated today.