# Bonus agent signals: WebMCP, A2A, AI Catalog, API catalog, rel=ucp

> Bonus signals are five emerging agent-discovery standards (WebMCP, A2A agent cards, AI Catalog, RFC 9727 API catalog and the rel="ucp" link) that the scanner credits when found and ignores when missing. They are early-stage or rarely adopted, so a store is never penalized for skipping them.

- Source: https://is-agentic-storefront.com/checks/bonus-signals
- Updated: 2026-10-15
- Category: Agentic commerce (15% of score)
- Impact: bonus (only adds to the score)

## How do bonus checks affect the agent-readiness score?

Bonus checks cover agent-discovery standards that are new, experimental or rarely used on storefronts. Each has weight 1 (low) in the agentic commerce category and follows one rule: **it only counts when it's found**.

- **Pass**: adds a full-credit, weight-1 result to the category.
- **Fail**: excluded from scoring. Your score is the same as if the check didn't exist.
- **Partial** (only the legacy A2A path): counts at half credit.

The scoring rationale is in the [scoring methodology](https://is-agentic-storefront.com/guides/scoring-methodology). Core agentic commerce checks such as the [UCP profile](https://is-agentic-storefront.com/checks/ucp-profile) matter far more.

<h2 id="webmcp">WebMCP tools for in-browser agents</h2>

[WebMCP](https://webmachinelearning.github.io/webmcp/) is a W3C Community Group draft that lets a page expose actions (search, add to cart) as tools that an in-browser AI agent can call directly instead of clicking through the UI. It is **experimental**: Chrome 149 origin trial only ([Chrome docs](https://developer.chrome.com/docs/ai/webmcp)).

**What the scanner checks** on the homepage and sampled product pages:

- a `<form toolname="...">` element (declarative API), or
- inline script matching `modelContext` … `registerTool` or the string `webmcp`, or
- a `<script src>` URL containing `webmcp`, or
- a `Permissions-Policy` response header that mentions `tools`.

External script contents aren't fetched, and tools registered at runtime by bundled JavaScript can be missed. Pass if any signal is found; otherwise the check doesn't count.

**How to add it:**

```html
<form action="/search" method="get" toolname="search_products" tooldescription="Search the product catalog by keyword">
  <input name="q" type="search" />
</form>
```

```js
document.modelContext?.registerTool({
  name: 'add_to_cart',
  description: 'Add a product variant to the cart',
  inputSchema: {
    type: 'object',
    properties: { variantId: { type: 'string' }, quantity: { type: 'integer' } },
    required: ['variantId'],
  },
  async execute({ variantId, quantity = 1 }) {
    return addToCart(variantId, quantity);
  },
});
```

The API is moving from `navigator.modelContext` to `document.modelContext`. Check the draft before shipping.

<h2 id="a2a-agent-card">A2A agent card</h2>

[A2A (Agent2Agent)](https://a2a-protocol.org/latest/specification/) is a protocol for agents to delegate tasks to other agents. A server describes itself in an **agent card**: name, endpoint, skills and auth. UCP can use A2A as a transport, but no major store probed on 2026-10-14 served an agent card.

**What the scanner checks:**

- `GET /.well-known/agent-card.json` returns JSON with a `name` → **pass**.
- Only the legacy `/.well-known/agent.json` (pre-v0.3) path returns JSON with `name` → **partial**.
- Neither → not counted.

**How to add it:** serve a static JSON card. Fields below are a minimal sketch; follow the [A2A specification](https://a2a-protocol.org/latest/specification/) for the full schema.

```json
{
  "name": "Example Store shopping agent",
  "description": "Search products, build carts and check order status.",
  "url": "https://store.example/a2a",
  "version": "1.0.0",
  "skills": [{ "id": "product-search", "name": "Product search", "description": "Find products by keyword" }]
}
```

<h2 id="ai-catalog">AI Catalog (MCP server cards)</h2>

The [AI Catalog](https://github.com/Agent-Card/ai-catalog) is a Linux Foundation-hosted, cross-protocol index at `/.well-known/ai-catalog.json`. It is the domain-level discovery mechanism chosen by MCP's [SEP-2127 Server Cards](https://modelcontextprotocol.io/seps/2127-mcp-server-cards) (Final, optional). It lists or embeds the store's MCP server cards. Earlier drafts used `/.well-known/mcp` or `/.well-known/mcp/server-card.json`; those paths are superseded and not checked.

**What the scanner checks:** `GET /.well-known/ai-catalog.json` returns a JSON object → pass. The scanner doesn't validate the catalog schema. Adoption is near zero: none of the 10 major retailers probed served one.

**How to add it:** publish `/.well-known/ai-catalog.json` with `Content-Type: application/json`, listing your MCP server card in the format defined in the [AI Catalog repository](https://github.com/Agent-Card/ai-catalog). Each MCP server also serves its own card at `<mcp-url>/server-card` (`application/mcp-server-card+json`). Server cards don't include tools, so clients still call `tools/list`, which is why a working [agent endpoint](https://is-agentic-storefront.com/checks/agent-endpoint) matters more.

<h2 id="api-catalog">API catalog (RFC 9727)</h2>

[RFC 9727](https://www.rfc-editor.org/rfc/rfc9727.html) defines `/.well-known/api-catalog`, a standard place to list a site's public APIs and their OpenAPI descriptions. It is most useful for headless stores whose storefront API is public.

**What the scanner checks:**

- the homepage `Link` header contains `rel="api-catalog"` or `rel="service-desc"` → pass, or
- `GET /.well-known/api-catalog` returns JSON with a `linkset` key → pass.

**How to add it:**

```http
GET /.well-known/api-catalog
Content-Type: application/linkset+json; profile="https://www.rfc-editor.org/info/rfc9727"
```

```json
{
  "linkset": [
    {
      "anchor": "https://store.example/store",
      "service-desc": [{ "href": "https://store.example/openapi.json", "type": "application/vnd.oai.openapi+json" }],
      "service-doc": [{ "href": "https://store.example/docs/api", "type": "text/html" }]
    }
  ]
}
```

And on the homepage: `Link: </.well-known/api-catalog>; rel="api-catalog"`.

Medusa's [Store API reference](https://docs.medusajs.com/api/store) is generated from OpenAPI specs, but exposing an OpenAPI description through `api-catalog` on your store domain is something you add yourself.

<h2 id="ucp-link">UCP profile advertised with rel="ucp"</h2>

A `rel="ucp"` link points agents from any page to your [UCP profile](https://is-agentic-storefront.com/checks/ucp-profile). It isn't in the [UCP spec](https://ucp.dev/2026-08-25/specification/overview/) text. Some hosted storefronts already serve it as both a header and an HTML tag.

**What the scanner checks:** the homepage `Link` response header contains `rel="ucp"`, or the HTML has `<link rel="ucp">` → pass.

**How to add it:**

```http
Link: </.well-known/ucp>; rel="ucp"
```

```html
<link rel="ucp" href="/.well-known/ucp" />
```

## How to fix it on Medusa

None of the five signals is built into Medusa. All can be added:

- **WebMCP and `rel="ucp"`**: in the storefront, as form attributes, a script and a `<link>` tag or response header.
- **Agent card, AI Catalog and API catalog**: as static files or [custom API routes](https://docs.medusajs.com/learn/fundamentals/api-routes).

See the [Medusa agent-readiness guide](https://is-agentic-storefront.com/guides/medusa-agent-readiness).

## Sources

- [WebMCP draft](https://webmachinelearning.github.io/webmcp/) · [Chrome WebMCP docs](https://developer.chrome.com/docs/ai/webmcp)
- [A2A specification](https://a2a-protocol.org/latest/specification/) · [A2A v0.3](https://a2a-protocol.org/v0.3.0/specification/)
- [SEP-2127 MCP Server Cards](https://modelcontextprotocol.io/seps/2127-mcp-server-cards) · [AI Catalog](https://github.com/Agent-Card/ai-catalog)
- [RFC 9727: api-catalog](https://www.rfc-editor.org/rfc/rfc9727.html)
- [UCP specification overview](https://ucp.dev/2026-08-25/specification/overview/)

## Frequently asked questions

### Do missing bonus signals lower my agent-readiness score?

No. A bonus check that fails is excluded from scoring. A bonus check that passes adds a low-weight, full-credit entry to the agentic commerce category.

### What is WebMCP?

WebMCP is a W3C Community Group draft that lets web pages register tools that in-browser AI agents can call, either by annotating forms or with document.modelContext.registerTool(). It is experimental and in a Chrome origin trial.

### Where does an A2A agent card go?

At /.well-known/agent-card.json since A2A v0.3. Older clients also check the legacy /.well-known/agent.json path.

### Which bonus signal should an ecommerce store add first?

The rel="ucp" link, if you already publish a UCP profile. It is one header or one <link> tag and points agents straight to your commerce capabilities.

## Run your store on a platform built for agentic commerce

Medusa is open-source, headless commerce with a full Store API agents can call and storefronts you control end to end.

### Deploy on Medusa Cloud

Open-source commerce with a full Store API, hosted and scaled for you. Your storefront, your data model.

- [Deploy on Medusa Cloud](https://cloud.medusajs.com?utm_source=agent-friendly-scorer&utm_medium=referral&utm_campaign=markdown-cta&utm_content=%2Fchecks%2Fbonus-signals)
- [Medusa Cloud docs](https://docs.medusajs.com/cloud?utm_source=agent-friendly-scorer&utm_medium=referral&utm_campaign=markdown-cta&utm_content=%2Fchecks%2Fbonus-signals)

### Storefront skills for coding agents

Teach Claude Code, Cursor or Codex to build storefronts with the patterns these checks look for.

```bash
npx skills add medusajs/medusa-agent-skills
```

[View the skill on GitHub](https://github.com/medusajs/medusa-agent-skills/tree/main/plugins/ecommerce-storefront/skills/storefront-best-practices)

---

Scan your store for free at https://is-agentic-storefront.com/