Shopify and personal agents: what a Shopify store can and cannot do today Free & Pro

Shopify was named as a launch partner when the Personal Agent Protocol was announced on 6 October 2026, and Shopify is also a co-developer of a different agent standard, UCP, which already runs on every Shopify store. So a Shopify merchant asking "is my store agent-ready?" gets two different answers depending on which kind of agent is asking. This page gives both, as checked against live Shopify stores and shopify.dev on 12 October 2026, and against the protocol’s draft as changed on 16 October 2026. Agent Adapt is a WooCommerce plugin and is not affiliated with or endorsed by Shopify, Sierra, Meta or the authors of UCP.

The short answer

• For an assistant using the Personal Agent Protocol, a Shopify-hosted storefront cannot publish /.well-known/poppy.json by itself. Shopify answers every /.well-known/ path at the platform level, and themes, URL redirects and apps cannot serve or proxy a file there. A store with Cloudflare in front can have a Cloudflare Worker serve a hosted provider’s document on the store’s own domain.
• For an assistant using UCP, every Shopify store already publishes /.well-known/ucp and the endpoints it names. Nothing to install.
• If Shopify adopts the Personal Agent Protocol, which its partner status makes plausible but which has not happened, every store would get the first answer for free.

Why Shopify blocks the path

On a Shopify-hosted storefront, the /.well-known/ folder is reserved by the platform for its own documents: Apple Pay verification, UCP, and others. Requests for anything else there get a platform 404 before your theme or any app sees them. Shopify’s URL redirects, which work for ordinary paths, do not apply to it. We checked this on live stores (the response is Shopify’s own, not a theme’s) and found no documented way for a merchant or an app to serve a file at that address.

That is not a judgement on Shopify. The path is new; the protocol is days old. It does mean the only lever a merchant has is to answer the request before it reaches Shopify.

The route that works: Cloudflare in front

Shopify supports a store’s domain being proxied by Cloudflare (both sides use Cloudflare, so it is sometimes called an orange-to-orange setup). With the proxy on, a Cloudflare Worker on the one exact path /.well-known/poppy.json runs before Shopify does, fetches the document of a hosted Company that speaks for your domain, and serves it on your domain. It has to be a proxy, not a redirect: since 16 October 2026 the protocol says the document speaks for the host that serves it after any redirects, so a Redirect Rule, which was the earlier route, no longer counts. The procedure is in Serving poppy.json with a Cloudflare Worker.

What the hosted Company can then do depends on what it is given:

• Catalogue, prices, stock, policies. Readable through Shopify’s own APIs with a permission you grant, or from the storefront. Searching, product details and your policy pages are straightforward.
• The cart and checkout. The agent builds a cart with the provider, and the customer is handed to your Shopify checkout to pay. The customer pays; the agent does not, because the protocol gives it no way to.
• Customer accounts. The hard part. The protocol wants the customer to sign in on your site and approve the agent, and then wants the agent to read that customer’s orders. Shopify’s own customer sign-in cannot act as the protocol’s issuer, so the provider runs the issuer itself and uses Shopify’s customer account sign-in to prove who the customer is.

Agent Adapt for Shopify

Agent Adapt is a Shopify app that does the above for your store. It is built and on its way to the Shopify App Store; it is not listed yet, and this page will link to it the day it is. Write to [email protected] to be told when it is.

What it does without any change to your domain:

• See what agents see. Run a real AI shopping agent against your store from the app, through Shopify’s own UCP, and watch every step: what it finds, where it gets stuck, and the handoff to your checkout.
• A readiness report for your store, and a policy page where you choose which actions agents may take.

What it does once your domain is on Cloudflare with the one-path Worker:

• Discovery, sign-in and the agent API for your domain. The app publishes the poppy.json the Worker serves on your domain, runs the issuer with the protocol’s key-bound sessions, and lets a customer sign in with their Shopify account and approve what their agent may do.
• Shopping. Catalogue search, a cart, and a handoff to your own Shopify checkout, where the customer pays.
• After the sale. Order status for the signed-in customer; cancelling an unpaid order and requesting a return are proposed by the agent and happen only after the customer approves the exact terms, and only if your policy page allows them.
• Insights per agent: sessions, sign-ins, refusals and handoffs.

The app never stores a customer’s name, email address, phone number or address; it asks Shopify for the least customer data Shopify offers an app. Every plan carries a usage charge of 1% of the value of orders placed through the app, billed through Shopify 14 days after payment, net of refunds; no other order is ever billed. Agent Adapt is not affiliated with or endorsed by Shopify.

What UCP already gives you

UCP (Universal Commerce Protocol) is co-developed by Google, Shopify, Stripe and others, and Shopify runs it on every store: /.well-known/ucp describes the store and an MCP endpoint for agents. Under UCP, an agent that belongs to a platform (Google’s, for example) runs the shopping journey and the checkout inside that platform, with your store as the supplier. It is a different model from the Personal Agent Protocol, where the customer’s own assistant comes to your store and pays on your checkout. The two do not compete for the same checkout, and a store can be in both. The comparison is in Personal Agent Protocol, UCP, ACP, AP2 and MCP.

If you want to see what an agent finds at your Shopify store today, fetch https://your-store.com/.well-known/ucp in a browser. That is the UCP document, maintained by Shopify, and you did nothing to make it.

Headless Shopify

A store that uses Shopify as a back end and serves its own front end (Hydrogen, Next.js, or anything on your own hosting) controls its domain’s paths. It can serve poppy.json directly and can run or point at an issuer. That store is in the same position as any custom store: see Headless and custom stores.

What to do this month

1. Fetch /.well-known/ucp and /.well-known/poppy.json at your store. Note the difference.
2. If your DNS is already on Cloudflare with the proxy on, the Worker takes minutes; the Agent Adapt app shows you the exact code and route and checks them.
3. If it is not, decide whether moving DNS to Cloudflare is worth it to you. For many stores it is a change made for other reasons (caching, bot rules) and the Worker comes free with it.
4. Watch Shopify’s own announcements. A platform-level implementation would make all of this unnecessary, and we will update this page the day it happens.

Common questions

Can a Shopify app make my store agent-ready?

Not for discovery on its own: apps cannot serve or proxy /.well-known/ paths. The Agent Adapt app runs the issuer and the agent API for your domain, and a Cloudflare Worker on that one path serves its document on your domain. Without the Worker, the app still shows you what agents see and scores your readiness.

Does Shopify’s agent protocol mean I am already covered?

For agents that use UCP, yes, and that includes the platforms behind it. For a customer’s personal assistant that uses the Personal Agent Protocol, no, unless the assistant also speaks UCP. Which assistants speak which protocol is changing month by month.

Is Agent Adapt available for Shopify?

Yes, as a Shopify app, built and on its way to the Shopify App Store; it is not listed yet. The WooCommerce plugin is the shipped product for WordPress stores. Shopify has no plugins in the WordPress sense, so the app runs the hosted side for you.

Would moving to WooCommerce make me agent-ready?

It would make the plugin route available, with the store’s real accounts and checkout. It is also a platform migration, which nobody should do for one protocol that is still a draft. Decide on the platform for the platform’s reasons.