Your API Isn't Ready for AI Agents (And Why That Matters Now)

Your API Isn't Ready for AI Agents (And Why That Matters Now)

We've spent years building APIs for mobile apps, SPAs, and internal services. Now there's a new client knocking: AI agents that want to browse your catalogue, compare prices, and complete purchases—autonomously.

If you're running an ecommerce platform, this isn't science fiction. It's happening now, and your existing REST endpoints probably aren't cut out for it.

The Problem: APIs Built for Humans, Not Agents

Most ecommerce APIs assume a human is driving. Pagination works one way. Search expects user-typed queries. Checkout flows require session cookies and CSRF tokens tied to browser contexts.

AI agents don't work like that. They:

• Need machine-readable schemas, not just JSON responses
• Want structured discovery mechanisms ("what can I do here?")
• Expect stateful sessions that persist across model context windows
• Require authentication that works outside cookie-based flows

Your perfectly functional API might be completely opaque to an agent trying to make a purchase.

Enter MCP: The Protocol You Should Know About

Anthropic's Model Context Protocol (MCP) is becoming the de facto standard for LLMs to interact with external services. Think of it as a handshake protocol that lets AI models discover and call your API methods in a structured way.

Here's what matters from a developer perspective:

1. Tool Definitions

You expose your API capabilities as "tools" with explicit schemas:

{
  "name": "search_products",
  "description": "Search product catalogue by query",
  "inputSchema": {
    "type": "object",
    "properties": {
      "query": {"type": "string"},
      "category": {"type": "string", "optional": true},
      "maxPrice": {"type": "number", "optional": true}
    }
  }
}

2. Stateful Sessions

MCP supports session state, so an agent can add items to a basket and complete checkout across multiple interactions—critical for anything beyond simple queries.

3. Authentication That Works

Token-based auth schemes that agents can actually use, not cookie flows that assume a browser.

The llms.txt Convention

Alongside MCP, you'll want an llms.txt file at your domain root. It's the robots.txt for AI—a simple, human-readable file that tells agents what your site offers:

# Product Catalogue API
Base URL: https://api.yourstore.com/v2
MCP Endpoint: https://api.yourstore.com/mcp
Capabilities: product_search, price_check, inventory_status, checkout
Auth: Bearer token required
Rate limits: 100 req/min

It's not a standard yet, but it's emerging as convention. Add one now.

What Actually Needs Doing

If you maintain an ecommerce API, here's the practical checklist:

1. Audit Your Catalogue Endpoints

• Is every SKU accessible via a queryable API?
• Are product attributes structured and consistently typed?
• Can you filter by price, availability, category programmatically?

2. Make Pricing and Inventory Real-Time

Agents won't scrape your frontend. They'll call your API. If your product endpoint returns stale pricing or "call for quote", you're out of the game.

3. Rethink Checkout Flows

Multi-step checkout with CSRF tokens and session cookies doesn't work for agents. You need:

• Stateless or token-based basket management
• Programmatic address validation
• Payment flows that support server-to-server tokens (Stripe Payment Intents, not Checkout.js)

4. Add Machine-Readable Schemas

OpenAPI specs are a start, but MCP tool definitions are better. Describe what your endpoints do and what they return, in terms an LLM can reason about.

B2B Is Where This Gets Real

If you're in B2C, agentic commerce is interesting. If you're B2B—especially procurement, trade supply, wholesale—it's urgent.

Procurement teams are already using AI assistants to research suppliers and compare quotes. The first supplier whose API an agent can actually navigate and purchase from wins the order. The one still requiring a phone call loses.

Agencies specialising in AI automation and software development are seeing this demand spike, particularly from wholesale and manufacturing clients.

Start Small, But Start Now

1. Add an llms.txt file this week
2. Audit your top 10 API endpoints—are they agent-friendly?
3. Pick one flow (search? add to basket?) and write an MCP tool definition for it
4. Test it with Claude or another MCP-aware model

The competitive window is open now. In 12 months, agentic commerce will be table stakes.

If you want to dig deeper into the strategic implications, the article ready to sell to AI covers the broader ecommerce landscape and where the urgency really lies.

But from a dev perspective? The work is concrete, achievable, and needs doing now. Your API is about to get a lot more clients—and they won't be human.