Anthropic has published the parts of an AI shopping agent that are easy to mistake for a product. The repository can search a fictional catalog, build a cart, propose merchant changes, and hand a shopper to checkout. It does not authenticate your users, take payment, or accept production liability.
That boundary makes the release useful. Builders can inspect the control choices instead of trusting a polished demo, then decide what must be added before an agent touches a real store.
Anthropic introduced its commerce-agent blueprint on September 2, 2026. The accompanying shopping and merchant agent repository is licensed under Apache 2.0.
The repository gives you two agents and no service promise
The shopping agent demonstrates discovery, comparison, cart construction, and checkout handoff. The merchant agent demonstrates catalog work and staged operational changes. Examples cover retail, travel, telecom, and entertainment patterns.
Anthropic says the code can run against the Messages API, Agent SDK, or Managed Agents, with deployment paths through Amazon Bedrock, Microsoft Foundry, and Google Vertex AI. The repository is reference material. It is not maintained as a supported product, does not accept contributions, and carries no support commitment or SLA.
The most useful controls live outside the prompt
| Control in the reference | What it protects | What it does not solve |
|---|---|---|
| Input fencing and control-character cleanup | Reduces malformed or hidden instruction paths | Authentication and business authorization |
| Size and loop limits | Bounds runaway requests and repeated actions | Budget policy across users and sessions |
| Cart provenance | Keeps items tied to retrieved catalog records | Inventory truth and fulfillment guarantees |
| Per-item and line caps | Blocks implausible quantities or values | Fraud scoring and account risk |
| UI schema validation | Constrains what the agent can render | Accessibility and brand review |
| Staged merchant writes | Lets a person approve consequential changes | Role-based approval and separation of duties |
I like this architecture because it treats the prompt as one layer, not the policy engine. A cart limit written only in natural language is a suggestion. The same limit enforced by application code is a boundary.
Checkout stays outside the model’s view
The demo does not process a real payment or place a real order. It hands the user to a checkout URL controlled by the host application, and Anthropic’s design keeps that URL from the model. This reduces the chance that payment details or sensitive checkout state become agent context.
A production system still needs order confirmation, idempotency, inventory reservation, tax, refunds, dispute handling, and a record of what the user approved. Do not bridge those gaps with another prompt.
The demo’s missing layers become your responsibility
- Identity for shoppers, merchants, service accounts, and approving staff.
- Authorization for every catalog, price, promotion, inventory, and order action.
- Short-lived credentials and a secret boundary the model cannot read.
- An audit event that records request, retrieved facts, proposed action, approver, and final result.
- Domain controls for payment, privacy, consumer protection, accessibility, tax, and returns.
- A rollback path for catalog writes and a compensation path for completed transactions.
The repository itself warns that the demonstration has no authentication. Its MCP server binds to loopback, which is sensible for local work but not a network security design. Production teams must decide where the trust boundary moves when the agent leaves a laptop.
Start read-only and make the acceptance test human
- Connect a small read-only catalog with synthetic customers and no payment credentials.
- Test product discovery against exact facts: price, availability, variant, policy, and shipping constraint.
- Reject any answer that invents a discount, warranty, delivery date, or stock state.
- Enable cart construction only after retrieval accuracy clears your threshold.
- Keep merchant writes staged until role checks, audit events, and rollback work under failure.
This resembles the boundary in our review of Shopify founders using AI: automate the draft and retrieval work, then keep a human acceptance test where the business consequence lands. Payment operations also deserve their own discipline, as our Chatbase revenue-operations case study shows.
Measure revenue only after measuring wrong promises
A shopping agent can improve conversion while increasing refunds, support tickets, or chargebacks. Track recommendation accuracy and transaction quality before celebrating cart completion.
| Pilot metric | Useful denominator | Failure it exposes |
|---|---|---|
| Unsupported claims | Per 100 answered product questions | Invented policy, feature, stock, or delivery promises |
| Human takeover | Per 100 sessions | Tasks the agent cannot finish safely |
| Refund or cancellation | Per completed order | Low-quality conversion |
| Merchant rollback | Per approved catalog change | Bad writes that passed review |
| Contribution margin | Per retained order | Model, support, promotion, and refund costs |
A retained order is a better business result than an agent-assisted checkout. Include model tokens, search calls, human review, support, payment fees, discounts, and refunds when you calculate the margin.
Run an adversarial catalog test too. Add conflicting product descriptions, expired promotions, unavailable variants, and a policy document that attempts to redirect the agent. The system should prefer the authoritative record, surface uncertainty, and hand control to a person instead of inventing a convenient answer.
Record each failure as a test fixture. That turns one bad session into a regression check for the next model, prompt, or catalog update.
My verdict: use the blueprint to inspect your control plane
Anthropic commerce agents are worth reading even if you never run the demo. The code draws a useful line between model behavior and application enforcement. It also makes the omissions visible.
Fork it as a reference, pin the exact commit, and start with read-only catalog work. The moment the agent can change a price, publish a promotion, or move a shopper toward payment, your identity and audit systems become the product.
Read the primary material
- Read Anthropic’s commerce-agent overview.
- Inspect the Apache 2.0 reference repository.
- Review the repository’s safety and control notes.
- Compare Shopify’s Claude for Commerce examples.
Checked September 2, 2026. Repository capabilities, license, deployment options, and documented control behavior come from Anthropic and the referenced code. The production-control matrix and pilot sequence are Musthave.ai analysis.
