Anthropic Ships Open-Source Commerce Agent Blueprints

Introduction

On September 2, 2026, Anthropic published a reference blueprint for building commerce agents on Claude: two working agents, one facing shoppers and one facing the merchant, released on GitHub under the Apache 2.0 licence. Anthropic says retailers already running shopping agents on Claude have seen carts as much as 35% larger and shoppers 60% more likely to complete a purchase. Visa, Mastercard and Accenture are named as partners bringing the blueprint to their merchant networks.

The demo is not the interesting part. The interesting part is a docs/safety.md that splits the agent's rules into two tables — the ones enforced in code, which hold no matter what the model does, and the ones the prompt merely asks for, which do not. Very little published agent tooling draws that line explicitly.

The Two Agents

The shopping agent embeds in a customer-facing app. In the repository's words, it "searches, compares, plans, fills the cart, answers order and policy questions, and remembers what a customer tells it." Its five flows are Agent Skills in a skills directory rather than prompt text, and a deployment implements a StorefrontBackend interface over its own catalogue, cart, order and policy systems.

The merchant agent is the back-office half: it "explains performance, maintains listings, acts on inventory and order alerts, prices and promotes, and drafts campaigns," over a MerchantBackend covering analytics, catalogue, inventory, pricing and campaign systems. Every write it produces is a staged change that the host's approval surface applies.

Both run unchanged on three execution paths — the Messages API, the Claude Agent SDK, and hosted Managed Agents — because all three execute tools through the same executor.

What It Deliberately Does Not Do

The blueprint has no payment protocol, no checkout and no advertising layer. StorefrontBackend simply has no method that places an order or charges a card; the checkout tool renders the cart for the host to complete, and a hosted checkout URL is supplied by the host after the model's call, so the model never sees it.

That is a strategic choice, not an omission. Anthropic is not entering the standards fight over agentic commerce that pits OpenAI and Stripe's Agentic Commerce Protocol against Google's Universal Commerce Protocol. It is supplying the reasoning layer above whichever rails a merchant already uses and leaving the money to Visa, Mastercard and the retailer's processor. No transaction routes through Anthropic, which also removes an entire category of liability.

The Safety Model Is the Real Contribution

Most agent guardrails shipped in 2025 and 2026 were system-prompt text: instructions the model usually follows. This repository separates that from enforcement, and is blunt about which is which — the prompt-level rules "hold only as far as the model follows instructions; the table holds on any model."

What the code enforces, inside the tool call:

• Cart provenance. Cart writes accept only product ids that a catalogue or order tool returned in this session. The model cannot add an item it invented, and staged merchant writes are gated the same way — a content edit also requires a prior get_listing read.
• Host approval. With require_host_approval on by default, apply_change succeeds only for ids the host marked approved through its own route. "A preview card approves nothing; an approval typed in chat sets nothing."
• Fencing. Third-party text is sanitised — invisible and control characters, forged turn markers, transcript and tool-call tags stripped — then wrapped in a fixed-label fence and length-capped before the model reads it. That is a direct prompt-injection defence for catalogue copy and reviews.
• Server-authored disclosures. Fee and terms text comes from get_disclosure; the model names a product, it does not write the disclosure.
• Merchant change limits. Items per change, price move, promotion depth, restock size, campaign budget and protected fields are checked twice, at staging and again at apply.
• UI provenance. Every product, order or metric on a rendered card is re-joined from server records; ids without provenance are dropped.

The design goal is stated plainly: when the model breaks a prompt-level rule, "the error is confined to its text," because the write, figure or disclosure behind that text already passed the code checks. That is a more honest posture than claiming a model will behave.

It is not a complete answer. The approval gate "checks only that your code set the mark" — it verifies a flag, not that a human read anything, so a merchant portal that fires dozens of alerts a day can degrade into rubber-stamping without the gate noticing. And require_host_approval can be switched off, at which point an approval typed into the chat does count; the docs tell you to re-run your evals if you do that, which is a warning, not a barrier.

What a Deployment Still Owns

The repository is explicit that it stops at the boundary of your systems, and the list of what it does not do is longer than most coverage suggests. Authentication and authorisation on every route: the examples "accept any caller," and the reference MCP servers bind to loopback unless an environment variable declares an authenticating gateway in front. Rate limiting. Fraud, eligibility and pricing rules, which belong in the backend — "the gates check provenance and caps; the backend decides whether a write is allowed at all." Payment. Retention and deletion for agent memory, which is personal data. And a genuine operational trap: at DEBUG level the request body is logged, and that body contains every injected memory fact and the whole cart.

Two further caveats are easy to miss. The guardrail defaults in the two config.py modules are "demonstration values" — a price-move limit that is not your price-move limit. And the licence section closes with: "This is a reference implementation; it is not maintained and does not accept contributions." It is code to read and fork, not a dependency to track.

How to Run It

Python 3.11+ and Node 22, with four runnable verticals — retail, travel, telecom and entertainment — over the same libraries. Every company, brand and person in the demos is fictional; the only merchant is ACME.

python scripts/run_demo.py retail     # API :8000 + storefront :3000

--merchant starts the back-office portal instead, --all starts both. There is also a Claude Code plugin, commerce-builder, whose /scaffold-commerce-agent command builds a project against your own stack. No MCP servers ship as connectors — the agents reach your systems through the backend interfaces, with official connectors (Snowflake, BigQuery, Stripe, Square, Slack) as integration targets where one is the source of record. The runtimes accept any anthropic client, so the blueprint runs on the Claude API, Amazon Bedrock, Microsoft Foundry and Google Cloud Vertex AI.

The suggested starting point is deliberately small: a shopping pilot implements search and product details and stubs the rest, and a merchant pilot implements the eight read methods with every write refusing, so digests and metrics run before any write path exists.

Read the Numbers Carefully

The 35% and 60% figures are Anthropic's own. Angela Jiang, Anthropic's head of product, told Reuters the numbers are "cart size up about 30-35% for one partner, and customers about 60% more likely to complete a purchase" — one partner, unnamed, with no sample size or measurement method disclosed. One deployment's uplift is a data point, not a benchmark: it carries that retailer's catalogue, baseline conversion and customer mix with it. Anyone quoting "35% larger carts" as an expected result is quoting a marketing figure.

The named logos deserve the same care. Shopify and Priceline are running customer-facing agents on Claude — Priceline rebuilt its Penny assistant on Anthropic's models — but Visa, Mastercard and Accenture are downstream integrators taking the blueprint to their networks, not co-developers of the code.

Conclusion

The release lands twelve weeks before Black Friday, which is not an accident. For a retail engineering team the value is not the storefront demo, which any team could build; it is the enumeration of which agent rules survive a misbehaving model and which do not, with a file path next to each one. That list transfers to AI agent work well outside commerce.

What does not transfer is the marketing. The blueprint ships no authentication, no fraud rules, demonstration-grade limits and no maintenance commitment, and its headline conversion numbers come from a single unnamed retailer. Whether an agent sells more is still a question each merchant answers with its own A/B test.

Sources

• Building Commerce Agents with Claude — Anthropic announcement, September 2, 2026
• anthropics/commerce-agents — reference implementation on GitHub, Apache 2.0
• commerce-agents docs/safety.md — the enforced-rules table quoted above
• Anthropic launches AI agent blueprints for retailers ahead of holiday shopping season — Reuters, September 2, 2026
• Anthropic Debuts Commerce Agent Blueprint With Visa and Mastercard — PYMNTS, September 2026