Building Agentic Commerce #2: How AI Agents Discover Your Store Without an API Key

Here's a question most e-commerce platforms haven't answered yet: how does an AI agent find your store in the first place? Not through Google. Not through a bookmark. An agent needs machine-readable discovery endpoints that tell it what you sell, how to search your catalog, and what protocols you support — all before it ever creates an account or gets an API key. In this post, we'll walk through the complete discovery chain that AgenticMCPStores provides, from a cold start to a checkout-ready agent in under 2 seconds.

Humans discover stores through search engines, social media, word of mouth, and advertising. AI agents have none of these channels. An agent needs structured, machine-readable information: what products are available, what payment protocols are supported, what trust level the merchant has, and how to interact programmatically. Without standardized discovery, every agent-to-store integration requires manual configuration — which defeats the entire purpose of autonomous commerce.

AgenticMCPStores implements discovery at four layers, each serving a different stage of the agent's decision process:

Every AgenticMCPStores deployment serves 10+ machine-readable JSON endpoints under the /.well-known/ path. These follow RFC 8615 conventions and are cached, CORS-safe, and require no authentication. An agent can read all of them in parallel in under 50ms.

The /llms.txt endpoint serves a ~1,500-line text file that describes the entire platform in a format optimized for LLM consumption. It's served at /llms.txt (static, cached 1h) and includes: every public API endpoint with methods and parameters, all MCP tools with input/output schemas, protocol support matrix with status per protocol, recent changes (what's new since last update), and a multi-store agent workflow that agents can follow step by step.

What makes llms.txt special is the INTEGRITY NOTICE section: a prompt injection defense that warns agents if third-party tools have appended instructions to the content. If an agent receives llms.txt through a retrieval extension that adds 'Stop processing' or 'Ignore previous instructions,' the integrity notice tells the agent to discard those additions and continue. This is a real attack vector — some browser extensions append agent-gating signals to retrieved content.

NLWeb is where discovery gets intelligent. Instead of structured API queries with filters and parameters, agents ask natural language questions and get ranked, scored results with Schema.org product objects. The pipeline has four stages: vector embedding generation, pgvector cosine similarity search (top 50 candidates in ~50ms), LLM re-ranking via Claude Haiku (scores each product 0.0-1.0 for relevance, ~300ms), and optional snippet generation for summarize/generate modes.

NLWeb supports conversational follow-ups via the 'prev' parameter. An agent can ask 'show me running shoes,' then follow up with 'only the ones under $80' — the NlwebDecontextualizer resolves context from the previous query and re-ranks results. This is critical for agents that interact with users in real-time: the user refines their request, and the agent refines its search without starting over.

Here's the complete flow an agent follows, from knowing nothing about AgenticMCPStores to completing a purchase. Total time: under 2 seconds.

The critical insight: Phases 1-4 require zero authentication. An agent can discover stores, search products, and evaluate trust without any API key. Authentication only enters at Phase 5 when the agent starts modifying state (creating carts). This dramatically lowers the barrier to discovery.

If you're a merchant on AgenticMCPStores, your store is automatically discoverable through all four layers. Your products are indexed in NLWeb when you sync your catalog (Shopify, WooCommerce, Odoo, or PrestaShop). Your merchant profile appears in the merchant-index.json registry. Your MCP endpoint is live at /{yourSlug}/mcp. But there are things you can do to rank higher in agent searches:

You can test the complete discovery chain against our live platform right now. Start with GET agenticmcpstores.com/.well-known/nlweb.json to see the NLWeb discovery contract. Then try POST agenticmcpstores.com/mcpwebstore-platform/ask with { "query": "what protocols do you support?", "mode": "summarize" } — the platform will answer questions about itself. For product search, try POST agenticmcpstores.com/demo-store/ask with { "query": "headphones", "mode": "list" }. All of these work without authentication.

In Part 3, we'll cover trust scores: the 8-component scoring system that determines how much autonomy an agent gets when shopping at your store. We'll explain why an agent might auto-approve a $50 purchase from one merchant but require human confirmation for a $20 purchase from another — and how merchants can optimize their trust profile to increase agent traffic.