sylius-webmcp — read-only, on the page in front of the customer.
The bundle registers shop actions as WebMCP tools in the customer's browser. A page-bound agent can use them to search on exactly the page the customer is looking at. The endpoint address comes from a server-rendered meta tag, not from the script.
An agent that changes the cart is a decision — not a side effect of the installation.
The registered tools are deliberately read-only. Write tools in the customer's browser mean that an agent can change state in the context of a logged-in session. That can make sense — but it is a decision a shop should take deliberately, and not one it picks up along with composer require.
The endpoint address comes from a server-rendered meta tag, not from the script. An address hard-coded in the JavaScript would be a second configuration source alongside the server configuration: it does not survive cache states, multi-channel setups or diverging base paths, and the error only shows up in the customer's browser — where nobody sees it. The server knows where its endpoint is, so it says so.
That is exactly where the value of the page-bound design lies: the agent works on the page the customer currently has open, instead of opening a second, independent route into the shop.
Source code & documentation
Composer package
MIT · Sylius 2.0+ · PHP 8.2+
composer require koh/sylius-webmcp
Built, tested and released under MIT. Public distribution via Packagist is being prepared (coming soon).
Part of the family
MIT
This package belongs to koh/sylius-agent-ready — seventeen bundles that make a Sylius shop usable for AI agents. Each one can be used on its own.