Skip to main content

Changelog

0.0.12 (2026-07-22)

Fixed

  • Fixed broken product and category links given to agents on stores with a custom or empty URL suffix — The agent JSON API and MCP tools built product and category links by hand, always tacking on a .html suffix and, for categories, using the internal category path instead of the storefront's own URL. On any store whose configured URL suffix is empty or something other than .html, every link an agent received pointed at a 404. Links are now read from the store's generated URL rewrites — the same URLs the storefront serves — so they honor your configured suffix and any custom rewrites, per store view. Stores that have no generated rewrites fall back to the url key plus your configured suffix, and product list pages resolve all their links in a single query.

0.0.11 (2026-07-20)

Features

  • Regenerate or recover the UCP signing key on demand — The keypair that signs your UCP merchant profile (/.well-known/ucp) is created automatically during upgrade, but until now there was no way to recover it if it went missing or to rotate it. A new Agentic Commerce → UCP signing key admin section shows whether a key exists and when it was generated, with a Regenerate button; the same is available on the command line via bin/magento mst:agentic:ucp:signing-key (add --regenerate to rotate). Regenerating rotates the published key id, so agents that pinned the old key will re-fetch the profile.

Fixed

  • Agent search returned no results on OpenSearch / ElasticSuite — Every agent catalogue search (search_catalog, lookup_catalog, and the JSON catalog routes) added a store filter on a field those search engines don't index, so it matched zero products and came back empty. The redundant filter was removed; per-store results still come from the correct store index, so standard Elasticsearch installs are unaffected.
  • The signing key is no longer created on a public request — The UCP signing keypair used to be generated lazily on the first anonymous visit to /.well-known/ucp, writing to configuration and clearing the config cache during ordinary bot traffic. It is now generated once during setup:upgrade.
  • Discovery endpoints could be flooded with traffic — /llms.txt, /agents.md, /.well-known/ucp, and the agent sitemap had no rate limit, so crawler traffic could drive unbounded log and database writes. They now share the same per-client rate limit as the rest of the agent surface and return a non-cacheable HTTP 429 when it's exceeded.
  • Anonymous agent endpoints no longer start a PHP session — The discovery, MCP, and JSON API endpoints set a PHPSESSID cookie on every request, which flooded the session store under crawler traffic and prevented a CDN or shared cache from caching these otherwise-cacheable responses. These paths no longer start a session; the "continue in browser" cart handoff still keeps its session as before.
  • Less log noise in production — The Agentic Commerce log channel defaulted to DEBUG, writing a line to agentic_commerce.log on every discovery hit and agent tool call. It now defaults to INFO, so those per-request lines are dropped in production while warnings and errors still log.
  • Product descriptions now fail safely if text filtering errors — When the CMS/Page Builder filter threw an error, the raw, unsanitized product text (including script and style content) was returned to agents as a fallback. On a filter error the module now strips all directives and HTML and returns plain text instead.

0.0.10 (2026-07-17)

Fixed

  • Fixed 404s on the version-pinned UCP profile URLs — The UCP merchant profile at /.well-known/ucp advertises version-pinned URLs in its supported_versions map (e.g. /.well-known/ucp/2026-04-08), but requesting those URLs returned Magento's 404 page, so an agent following the UCP version-discovery flow hit a dead link. Every advertised versioned URL now resolves and serves the profile with ucp.version pinned to the requested version; unknown versions still return 404, and no redirects are introduced. Works with store-code-in-URL setups as well.

0.0.9 (2026-07-13)

Features

  • Control how long shared caches keep your agent discovery files — A new "Discovery Shared-Cache TTL" setting (Stores → Configuration → Agentic Commerce → HTTP Surfaces) lets you decide how long a CDN or Varnish shared cache may store the discovery endpoints (/llms.txt, /agents.md, /.well-known/ucp, and the agent sitemap). Leave it at 0 (the default) so every request reaches Magento and agent-visit telemetry stays exact, or raise it (up to 3600 seconds) to offload repeat requests to your shared cache in exchange for sampled telemetry. The setting is store-view scoped.

Improvements

  • Much faster /llms.txt and /agents.md rendering — The category list embedded in these files used to fire two extra queries for every category (a URL lookup and a product count), so a store with many categories could add hundreds of queries to a cold render. Both values are now batch-loaded, cutting those per-category queries to zero. The rendered URLs and counts are unchanged.
  • Faster Agent Activity dashboard on large stores — The admin dashboard previously scanned the orders table three times per render and grouped searches on unindexed columns. Order aggregates are now computed once per render, and two supporting database indexes were added, so the dashboard loads faster. ⚠️ Adds indexes to the sales_order and mst_agentic_event tables (applied on setup:upgrade).
  • Fewer queries when agents view or search products — The get_product tool and searches that return configurable products issued extra per-variant and per-parent queries that survived the earlier batching work. These are now batched too, so a search page's query count no longer grows with the number of configurable products it returns. The responses are byte-identical.
  • Faster, cheaper single-product and collection URL lookups — The JSON routes for one product (/agent/products/url_key.json) and for a collection's products (/agent/collections/url_key/products.json) resolved the URL key with an unindexed attribute scan whose cost grew with catalogue size (and which an anonymous caller could use to drive expensive uncached requests). They now resolve through the indexed URL-rewrite table, falling back to the old lookup only on stores without generated rewrites, so results are never worse than before.
  • Self-test traffic is now visible for debugging — "Test with an agent" self-test requests used to be discarded entirely. They are now recorded and flagged as test events, so they still stay out of every dashboard metric but remain visible in the underlying event log.
  • ⚠️ Agent rate-limit settings moved — Because the rate limit now covers every agent tool call (MCP and the JSON routes), not just cart creation, its configuration moved from agentic_commerce/cart/rate_limit and agentic_commerce/cart/rate_limit_window to agentic_commerce/mcp/rate_limit and agentic_commerce/mcp/rate_limit_window. Update any app/etc/env.php overrides to the new paths.

Fixed

  • Closed several abuse vectors on the anonymous agent MCP endpoint — The public /agent/mcp endpoint could be tricked into fetching an attacker-supplied "agent profile" URL — including internal or private network addresses (SSRF) — and returned raw internal error detail to callers. The profile fetch now refuses private/non-public hosts, pins the vetted address to block DNS-rebinding, streams and caps the response body so an oversized profile can't exhaust server memory, and limits how long a remote profile result may be cached. Internal errors now return a generic message plus a correlation id (with the detail logged server-side) instead of leaking internals.
  • All agent endpoints now share one rate limit — Previously only cart creation was throttled, so the JSON catalog routes and other MCP tools could be flooded with expensive uncached requests. A single per-client rate limit now applies to every agent tool call and JSON route; a request over the limit is rejected with a non-cacheable HTTP 429 before any search or product load runs.
  • Bounded oversized agent search input — Over-long search queries, oversized lookup_catalog id lists, and deep pagination cursors are now capped at a single shared point before reaching the search engine, preventing the errors and rising cost that crafted requests could otherwise cause on the unauthenticated path. Raw search-engine error detail is no longer passed back to callers.
  • Blocked cross-store and mismatched-currency cart access — An agent cart handle created for one store view could be read or changed under another store view's context, and a request asking for a currency other than the store's was silently ignored. Cart operations now reject a store mismatch, and a mismatched-currency request is rejected outright (the module does not convert currencies).
  • Fixed agents seeing stale collection listings — When a product was added to a category, the cached /agent/collections/url_key/products.json listing was not refreshed until its cache lifetime expired. The listing now carries the category's product-list cache tag, so it updates immediately when a product is added to or removed from that category.
  • MCP notifications no longer receive an unexpected response body — A JSON-RPC notification (a request sent with no id) now correctly returns an empty 204 as the spec requires, instead of a JSON body. Each store view also now reports its own store name in MCP responses instead of the global default.
  • Fixed the mst:agentic:cart CLI command failing with "Area code is not set" — The command now sets up the store and area context before running, so it can be used to exercise the agent cart tools from the command line.

0.0.8 (2026-07-08)

Features

  • Choose which product text feeds the agent description — A new "Description Field Priority" setting (Stores → Configuration → Agentic Commerce → General) lets you control which product text attribute AI agents receive as the product description, and in what order agents fall back between them. Out of the box it reads Description first, then Short Description, then Meta Description — the first one with content wins. You can now also add any of your own custom text attributes to the list, and drag rows by their grip handle to reorder them. The setting is store-view scoped, so different store views can prefer different fields. Applies to both the JSON API and every MCP tool.
  • Separate on/off switches for the robots.txt block and the agentic sitemap — The single "Enable Agent Discovery in Sitemap and Robots" toggle has been split into two independent settings under HTTP Surfaces: "Enable Agent Block in robots.txt" and "Enable Agentic Discovery Sitemap". You can now, for example, keep the robots.txt agent block while turning off the agentic sitemap if you manage your sitemap with a third-party SEO module. ⚠️ The old configuration path agentic_commerce/surfaces/sitemap_robots_enabled has been replaced by robots_agent_block_enabled and agentic_sitemap_enabled. Both default to Yes, so a fresh install behaves as before; but a store that had explicitly turned the old combined toggle off will have both surfaces switched back on after upgrading — re-check this setting if you had disabled it.

Improvements

  • Faster catalogue responses for agents — The JSON product API (used by search_catalog and lookup_catalog) previously ran one product load plus several follow-up queries for every result, so a single search could fire hundreds or thousands of queries. It now loads a whole page of results with a small, fixed set of batched queries, dramatically cutting the query count on catalogue searches.
  • Agent catalogue responses are now cached — JSON API responses are stored in Magento's Full Page Cache and re-served instead of re-running the search each time, and cached entries are automatically cleared the moment a relevant product or category is saved (so agents never see stale data). Very deep pagination requests are also capped to stay within the search engine's result window, avoiding the errors and rising cost that deep page numbers used to cause.
  • Anonymous agent cart endpoint hardened against abuse — The public agent cart endpoint now limits how many carts a single client can create in a short window, caps the number of line items and the per-item quantity a single request can add, and automatically prunes abandoned agent-built guest carts (older than 24 hours by default) via an hourly cron job, so they no longer pile up in the database. The rate-limit window, request rate, and cart lifetime are tunable for operators via app/etc/env.php config overrides. ⚠️ This adds an is_agentic column and a supporting index to the quote table (applied on setup:upgrade).

Fixed

  • Closed a security gap where an agent could keep accessing a shopper's cart after handoff — When a shopper followed a "continue in browser" link, the agent's cart handle stayed valid, so the agent (or anyone who received the link) could keep reading or silently changing items in the shopper's live checkout cart. The agent's cart handle is now invalidated at handoff, so it stops working once the cart is passed to the shopper.
  • Fixed store views sharing each other's agent instructions — On multi-store setups, the /llms.txt and /agents.md instruction files could serve the first store's content (its name, base URLs, categories, and language) to every other store view for up to an hour after a cache flush. Each store view now gets its own correctly cached content.
  • Fixed the agentic sitemap URL being doubled — The agent-discovery sitemap entry in sitemap.xml had the store base URL prepended twice, producing a broken loc. The link is now generated correctly.

0.0.7 (2026-07-03)

Fixed

  • Fixed Page Builder inline CSS (style blocks) and JavaScript (script blocks) leaking into the rendered description output. When a block or widget is built with Page Builder, the rendered HTML includes inline style tags with scoped CSS selectors. These blocks and their contents are now stripped from the description before it is returned, so AI agents do not receive raw CSS or JS as part of the product text.

0.0.6 (2026-07-03)

Fixed

  • Fixed product descriptions containing Magento CMS block directives (block ..., widget ...) appearing as raw template code in the JSON API (/agent/products/url_key.json) and MCP tool responses (get_product, search_catalog, lookup_catalog). Descriptions are now passed through Magento's CMS template filter before being serialised, so AI agents receive the rendered HTML content instead of the directive markup.

Features

  • In-browser agent tools (WebMCP) — Your storefront can now expose its catalogue tools (product search, lookup, and view) directly to a shopper's in-browser AI agent, so an agent acting on the open page can find and inspect your products without a separate connection. Turn it on under Stores → Configuration → Agentic Commerce → HTTP Surfaces → "Enable In-Browser WebMCP Tools" (off by default). The tools are read-only — they can browse the catalogue but never change the cart — and the storefront search box is automatically advertised to agents that support it. Works the same on both Luma and Hyvä themes, and does nothing in browsers that don't support WebMCP. Since WebMCP is currently a Chrome origin trial, an optional "WebMCP Origin Trial Token" field lets you paste your per-store token so it works for shoppers without them turning on a browser flag.

0.0.5 (2026-06-24)

Fixed

  • The "Test with an agent" self-test no longer produces an empty test cart. It now runs against the live agent endpoint, so the test cart persists and its continue_url opens a populated cart. (Real agent carts were unaffected.)

0.0.4 (2026-06-23)

Improvements

  • The activity dashboard's tables (Endpoint usage, Top agent queries, Top agents) now use Magento's standard admin grid styling, so they look and behave like the rest of the admin's listing pages.
  • The Agent Activity dashboard labels are now translatable.

Fixed

  • Fixed the agent-built cart disappearing for signed-in shoppers. When a logged-in customer opened a "continue in browser" link, their own session cart took over and the items the agent had added were lost. The agent cart is now merged into the shopper's cart, so those items carry through to checkout.
  • Fixed the activity dashboard failing to display on stores with Content Security Policy enabled. The dashboard's styles and scripts were embedded inline in the page, which CSP blocked; they have been moved into proper stylesheet and script files so the dashboard renders correctly.

0.0.3 (2026-06-19)

Fixed

  • Fixed an error when an AI agent browsed the catalogue without a search term. Requesting the product feed with no query (for example /agent/products.json with no ?q=, or the search_catalog tool with an empty query) returned a server error instead of products. These requests now list your full catalogue, while searches that include a query term work exactly as before.

Changelog

0.0.2 (2026-06-19)

Improvements

  • The module now installs and runs on Magento 2.4.x (in addition to the previous release line), so a wider range of stores can use it.

Fixed

  • Fixed a crash during module installation. On some setups, running setup:install/setup:upgrade failed because the module's command-line tools tried to load catalog, search, and cart services before the database was ready; those services are now loaded only when a command is actually run.
  • Fixed compatibility with the latest Magento platform updates (PHP 8.4 and the newer logging library), so the module works correctly on freshly updated stores.

0.0.1 (2026-06-18)

Features

  • Initial release of Agentic Commerce v1
  • Core catalogue domain with ProductMapper, SearchService, ContextResolver
  • Three catalogue tools: search_catalog, lookup_catalog, get_product
  • Generic MCP transport at /agent/mcp endpoint
  • Public JSON read API endpoints
  • /.well-known/ucp discovery profile with ES256 signing keys
  • Liquid-templated llms.txt and agents.md generation
  • Phase-2 stubs: AgenticUcp and AgenticAcp modules