Shopify's storefront MCP is becoming UCP, and the old endpoint retires on 31 August

What changed

Shopify's developer changelog of 24 June 2026 deprecates the get_cart and update_cart tools on the storefront MCP endpoint at /api/mcp, the interface AI shopping agents call to search a store's catalogue, read its policies and manage a cart. The deprecated tools stay live until 31 August 2026, and after that date anything still calling them stops working.

The replacement is a set of Cart MCP tools conforming to the Universal Commerce Protocol, served from a new endpoint at /api/ucp/mcp on every store: create_cart, get_cart, update_cart and cancel_cart. The change completes a migration that started in the spring, and it is the part with a hard deadline attached.

The dates that matter

This is the second half of a two-stage move. The catalogue tools crossed first, and some integrations discovered that the hard way when the old search tool disappeared and their agent connections broke mid-season, a failure mode documented at length on Shopify's own developer forums.

What UCP is, briefly

The Universal Commerce Protocol is the standard Shopify is consolidating its agent-facing commerce interfaces around. Every store already publishes a UCP discovery manifest at /.well-known/ucp describing what it supports, and the protocol defines the request and response shapes agents use to search, cart and check out.

The practical difference from the old storefront MCP is stricter conformance. Calls to the UCP endpoint carry a meta object with a ucp-agent profile, cancel_cart requires an idempotency key, and update_cart uses PUT semantics, so each request replaces the cart's full state and an integration that patches single fields will silently drop the rest of the cart.

Who this affects

Merchants running a standard store have nothing to migrate, because Shopify operates both ends of the pipe for the agentic storefronts channel. The store's own agents.md continues to state the endpoints, and Shopify has been updating the defaults as the protocol moves.

The deadline lands on anyone who built directly against /api/mcp: custom agent integrations, conversational commerce tools, internal chatbots wired to the cart tools, and any agency-built middleware from the first wave of storefront MCP experiments in 2025. If something in your stack transacts with your store through MCP and nobody has touched it since the spring, this is the moment to find out what it calls.

What we saw when we tested it

The deprecation is not hiding in the changelog. When we query a live store's /api/mcp endpoint, every response now carries the migration notice inline, stating the 31 August cutoff and pointing at the Cart MCP documentation, so any developer reading their own logs has been told.

We also probed the new /api/ucp/mcp endpoint directly. It is live, and it rejects anonymous calls without a UCP agent profile URI in the request metadata, which the old endpoint never required. Audit tooling and ad hoc scripts that treated the storefront MCP as an open query surface will need the profile field from day one on the new path, and that requirement is easy to miss in a quick port because the old calls fail with a protocol error rather than an obvious authentication message.

What to do before 31 August

1. Inventory anything that calls /api/mcp on your store, including tools built by past agencies. The store's own logs and the developer responsible for each integration are the fastest route.
2. Migrate cart calls to /api/ucp/mcp and adopt the UCP shapes: the meta object with the agent profile on every request, an idempotency key on cancel_cart, and full line_items on every update_cart call.
3. Retest the full flow after migration, from catalogue search through cart to checkout handoff, because the PUT semantics change is the one that fails quietly.
4. If nothing custom touches the endpoint, confirm that and move on. The agentic storefronts channel itself migrates with the platform.

The direction of travel matters more than the deadline. Shopify is standardising the layer agents transact through, and each of these migrations tightens the assumption that a store's data is structured and accurate, which is the reason to get the store discovery-ready ahead of the next protocol update.