Shopfront Copilot registers real tools on the page itself: document.modelContext.registerTool, so an AI agent searches, filters, compares and manages your cart through the exact code path the storefront’s own UI uses. The one thing it can never do is complete your purchase.
Every tool is registered through document.modelContext and calls the same functions the storefront’s own buttons call, no private backend, no parallel path to purchase.
Search, filters, comparisons and cart changes render on the actual storefront in real time, the same shared session state whether your agent acted or you clicked yourself.
checkout opens a confirmation modal and stops there. confirm_purchase is a plain click handler, it was never registered as a tool at all.
The WebMCP spec’s own authors flagged this exact risk: an ambiguously named tool silently completing a purchase. So checkout never charges anything; it returns confirmation_required and opens a modal only a real click can act on.
No tool’s description promises more than its code delivers. Every mutation is reversible, except the one that isn’t, and that one was never a tool to begin with.
11 of 12 rows are registered as WebMCP tools an agent can call. confirm_purchase is not, it’s a plain click handler, structurally unreachable from document.modelContext.
The trust page renders document.modelContext.getTools() live, in your browser, right now, not a screenshot, not a claim from a video. If a browser supports WebMCP tool discovery, what you see is the real, current tool list this storefront registered.
document.modelContext.getTools() .then(tools => tools.find(t => t.name === "confirm_purchase")) .then(console.log); // undefined
undefined.checkout is the only path toward a purchase reachable from a tool, and it stops at a confirmation modal every time. Completing the order is a plain click handler that was never passed to registerTool.add_to_cart and a shopper’s own click land in the same cart, visibly, without a reload.#enable-webmcp-testing, and tested against ChatGPT’s in-app browser. Built with Next.js, TypeScript and Tailwind, deployed on Vercel.