search_catalog
UCP 2026-04-08 catalog search over the engagement tiers. Returns UCP product objects in structuredContent. Call with no query for the whole catalog.
Parameters
query
Agentic Commerce Readiness
com.expandingwebPublished by expandingweb.comOfficial publisherv1.0.0Updated Oct 25, 2026
Score a Magento or Adobe Commerce store on eight AI agent-readiness checks.
Overview
AI-generated overview
A remote MCP server that scans a storefront for AI agent readiness, lists Expanding Web engagement tiers and opens Stripe checkout sessions.
- What you can do
- Search and look up the engagement catalog, resolving ids to product objects and returning the full catalog when no query is given. List every engagement tier with id, price, currency and inclusions, and read one tier's full record with turnaround, deliverables, pricing policy and limits. Run a free eight-check agent-readiness scan against a live storefront and get the verdicts. Create a Stripe Checkout Session for the readiness sprint or for Pro module licences and return its URL. Report a page, data or request that blocked a task, for a human to read.
- When to use it
- Useful when you want an assistant to assess whether a Magento or Adobe Commerce storefront is readable and transactable for AI agents, to compare Expanding Web engagement tiers, or to start a purchase of the readiness sprint or module licences.
- Requirements
- A remote streamable HTTP endpoint at expandingweb.com; no authentication, environment variables or headers are declared. The scan targets a live storefront URL and is read-only, limited to at most three pages, a 15-second budget, robots.txt honoured and 5 scans per hour.
Before you install
create_checkout_session creates a real Stripe Checkout Session and returns a payment URL; payment is completed by the buyer there, so money can be spent. The scan fetches a third-party storefront, so the target URL is sent to the server. report_problem sends your text to a human. No credentials are declared, but treat checkout links as sensitive.
Installation
In SourceWeft
- Open Agentic Commerce Readiness in the dashboard and add it to a workspace.
- Enable the server for the chats that should use its tools.
Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.
Use with an agent
Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.
Read https://sourceweft.com/mcp/com.expandingweb%2Fagentic-commerce-readiness/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.Other MCP clients
Add this to your client's mcpServers config.
{
"mcpServers": {
"agentic-commerce-readiness": {
"type": "http",
"url": "https://expandingweb.com/mcp"
}
}
}README
AI Agent Readiness for Magento 2
ExpandingWeb_AgentReadiness runs the eight public agent-readiness checks against your own Magento 2 / Adobe Commerce store from inside the admin, and counts the AI agent traffic (GPTBot, ClaudeBot, PerplexityBot, …) your storefront already gets.
It is the free, open-source tier of the Agentic Commerce Suite by Expanding Web. MIT licence. Nothing leaves your store by default (see Privacy).
The eight checks
Same check ids, semantics and verdict language as the public scanner at https://expandingweb.com/#scan — a score means the same thing in your admin, on the public scan and in the quarterly benchmark.
Reading the result:
- Score is checks passed out of applicable checks. It is a readiness measure, not a ranking prediction — nobody can promise placement in an AI answer, and this module does not.
- N/A appears when a check cannot run (no product catalog to sample, the edge refused that one path, the 60-second budget ran out). It does not count against the score.
- Blocked (the scan stops before the checks) means the store refused the scanner's own user agent at the edge; unreachable means nothing answered. Neither is reported as eight failed checks, but every real agent meets the same wall, so an edge rule is usually the first thing to fix.
Where the numbers come from: in the Q3 2026 benchmark of 1,867 Magento stores, 33.9% passed none of the eight checks; on SCHEMA-01 alone, 54% of reachable product pages carried no Product+Offer JSON-LD.
Installation
Requirements: Magento Open Source / Adobe Commerce 2.4.6 or newer, PHP 8.2 or newer, guzzlehttp/guzzle 7 (already part of Magento). Two tables are created: expw_readiness_scan and expw_readiness_daily. bin/magento module:uninstall ExpandingWeb_AgentReadiness drops both and every expw_readiness/* config value.
The module can be installed alongside the Agentic Commerce Suite — tables, config paths, routes, ACL ids and cron jobs do not collide.
In the admin
- Marketing → AI Agent Readiness → Readiness Dashboard: the latest scan as a score gauge and one row per check (short verdict, severity, and the scanner's full technical verdict folded under Technical details), a Run scan now button, and the agent-traffic cards.
- Stores → Configuration → ExpandingWeb → AI Agent Readiness: counting on/off, retention, daily cron scan on/off, TLS verification.
The scan runs on your own server against the default store view's base URL, from the outside in — the same fetches an agent would make: /, /robots.txt, /.well-known/ucp, /llms.txt, /sitemap.xml, up to three product pages, the homepage again as GPTBot and as ClaudeBot, and an MCP handshake if a profile advertises an endpoint. Budget: 60 seconds wall clock, 5 seconds per request, 2 MB per response. Cron expw_readiness_scan runs it daily at 03:15 server time; the last 400 scans are kept.
Run scan now is synchronous: the admin POST waits for the scan, so PHP-FPM's request timeout needs to clear 60 seconds.
How the agent-traffic counter works — and what it cannot see
An observer on controller_action_predispatch matches the request's User-Agent against a list of known AI agent tokens (Model/Tracking/AgentDetector: OAI-SearchBot, ChatGPT-User, GPTBot, Claude-User, Claude-SearchBot, ClaudeBot, Perplexity-User, PerplexityBot, Google-Extended, Applebot-Extended, Amazonbot, Meta-ExternalAgent, Bytespider, CCBot, Bingbot) and, on a match, upserts one row per (day, agent, store view) in expw_readiness_daily. Nothing happens for the other 99.x% of requests beyond one substring scan. "Day" is the store's configured timezone. Rows older than the retention setting (default 400 days) are pruned nightly. The token list is compiled into the module and updated with a module release — a new agent means a new version, never a runtime download.
The dashboard shows 7/30/90-day totals per agent, the change against the previous 30 days, and a 14-day sparkline.
The count is a floor, not a total, for two reasons the dashboard states next to the number:
- Attribution is by declared user-agent. An agent that presents a browser user-agent is invisible to it.
- The observer runs in PHP. A page served entirely from Varnish or the built-in full-page cache never reaches PHP, so cache hits by agents are not counted. On a store with a high hit rate the counter sees mostly cache misses — first visits, uncached URLs, and everything that bypasses the cache.
For a complete picture, count at the edge (CDN or web-server logs). This module deliberately does not ship an edge-log parser.
Privacy
The module makes no request to anything but your own store:
- The self-scan fetches your own storefront URLs (listed above), with the User-Agent
ExpandingWebAgentReadiness/1.0.0 (+https://expandingweb.com/; readiness self-scan). The one exception is MCP-01: if your UCP profile advertises an MCP endpoint on another host, the handshake goes there — because that is what the profile tells agents to do. - The agent-traffic counter reads the request's
User-Agentheader and writes an integer to your own database. No IP addresses, no URLs, no headers are stored. - Scan results and counters live in your database and are shown only in your admin. The dashboard's link to the Agentic Commerce Suite is a static URL with no parameters — it carries nothing about your store.
No telemetry, no licence check, no agent-list download, no phone-home.
Keeping the checks in lock-step with the public scanner
Model/Scanner/Scanner.php and Model/Scanner/UcpProfile.php are generated, not hand-maintained: bin/port-scanner.php re-ports the public scanner's source (app/Agentic/Scanner.php in the expandingweb.com repo, which is not public) into this module's namespace and records the upstream revision in Model/Scanner/.upstream-hash. The script applies exactly five deliberate differences — namespace and strict types, ScanHttp in place of the public scanner's SSRF-hardened client (the only target here is your own base URL, which may legitimately be a private address), sequential instead of concurrent phase-1 fetches, a 60-second instead of 15-second budget (nobody waits on a cron), and the scanner's own identity in the MCP clientInfo and robots.txt matching — and refuses to run if upstream changed shape.
The reason is the promise on the tin: the public scan, the benchmark and the in-store scan have to give the same verdict for the same store. Hand-merging 1,800 lines twice a quarter is how that promise would quietly die, so the file carries a DO NOT EDIT BY HAND marker that CI enforces. Found a check misbehaving? Open an issue with the store shape that trips it; the fix lands upstream and the port is re-run. See CONTRIBUTING.md.
What is not in this module
Merchant-feed syndication (OpenAI, Perplexity, Google Merchant Center), Product/Offer/ProductGroup JSON-LD repair, the agent endpoints (/llms.txt, /.well-known/ucp, MCP server, agent product feed, checkout sessions), agent funnel and revenue-exposure analytics, AI visibility and share-of-voice probes and competitor analysis are the paid tier: the Agentic Commerce Suite. This module diagnoses; the Suite repairs.
For agents and MCP clients
Expanding Web's own MCP servers are listed in the official MCP registry: com.expandingweb/agentic-commerce-readiness (scan a store, read the offer, open a checkout session) and com.expandingweb/nord-trail-store (a reference agent-ready storefront to look at). Both speak JSON-RPC 2.0 over POST — the same shape this module's checks expect to find on a merchant's store.
Development
Tests, static analysis and coding standard: see CONTRIBUTING.md. Version history: CHANGELOG.md.
Source: README.md at commit 6135d99
Tools
7lookup_catalog
UCP 2026-04-08 catalog lookup: resolve engagement ids (e.g. readiness-sprint) to UCP product objects.
Parameters
idsrequiredlist_offers
List every Expanding Web engagement tier with id, price, currency and what it includes.
Takes no parameters.
get_offer
Full record for one engagement tier: price, turnaround, deliverables, pricing policy and limits.
Parameters
idrequiredscan_store
Run the free eight-check agent-readiness scan against a live storefront and return the verdicts. Read-only, at most three pages, 15-second budget, robots.txt honoured. Limited to 5 scans per hour.
Parameters
domainrequiredcreate_checkout_session
Create a Stripe Checkout Session and return its URL — for the Agentic Commerce Readiness Sprint (readiness-sprint) or for Pro licences of the Agentic Commerce Suite Magento module (module-pro, one licence per Magento installation, volume discount from 3). Payment is completed by the buyer at that URL; this tool never charges a card and takes no payment credentials. For the module, the licence key is minted on payment and shown on the success page and by email.
Parameters
offer_idquantityreport_problem
Report something on this site or endpoint that stopped you from completing a task: a page you could not read, data you could not find, a request that was refused. Read by a human. Use this instead of giving up silently — it is the only way we learn that an agent failed here.
Parameters
kindpathcontactsummaryrequiredexpectedVersion history
1- v1.0.0LatestSep 16, 2026
Score
100% of the applicable checks met
How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.
- Reached in the last 30 daysRequired25 pts
- Auth declaredRequired10 pts
- Tools listedRequired15 pts
- DescriptionRequired15 pts
- Logo10 pts
- Documentation15 pts
- License10 pts
