Headless Commerce Platforms Ranked by Whether an Agent Can Run the Store

The headless commerce platforms an agent can run best are not the ones that ship an MCP server for it. Ranked on the two things an agent needs to operate a store, acting on it with no UI and hearing every change without polling, the Headless Index puts Shopify first, Commerce Layer second, and Saleor, commercetools and BigCommerce level in third. The only two vendor MCP servers in the category that act on a live store belong to Wix and Snipcart, and on the same measure they place 10th and 16th of 20.

That split is the buying decision. An MCP server is a layer a team can write itself over a good API. A signed, replayable event stream is something only the vendor can ship, and a platform without one stays a platform an agent has to poll.

How this ranking of headless commerce platforms works

The ranking uses two of the five criteria in The Headless Index, each scored 0 to 20. Headless operation asks: “Can this vendor be operated end-to-end with no UI involvement?” Webhooks and events asks: “Can an agent subscribe to state changes rather than polling?” The score below is their sum, out of 40.

The other three criteria are left out on purpose. API-first design asks whether the API was documented before or alongside the UI, which is a question about how the product was built, not about what an agent can do with it today. Schema asks whether an agent can introspect the schema at runtime, which matters most while someone is writing the integration. MCP posture asks whether the vendor “has invested in agent-native integration”, and this post treats that as the route to the store rather than as a measure of the store, so it gets its own section.

The Index’s commerce category holds 28 platforms, all scored on 2026-08-20 under methodology THI-v1.0. Twenty have all five criteria scored, and only those twenty are ranked here. The other eight, Vendure, Elastic Path, Swell, Reaction Commerce, Vue Storefront, Crystallize, Solidus and Sylius, have at least one criterion the collector could not resolve, so a sum for them would compare a partial score with a full one. The Index’s commerce page ranks all 28 by total score; this list reorders them by operation plus events, and ties are broken by that total.

The ranking: operation plus events, out of 40

The mean across the twenty is 26.3 of 40. Every figure is the Index’s own score for that criterion, and the sum is the only arithmetic.

The admin is a client of the public API

What the top five share is that the vendor’s own back office runs on the same API an agent would call. Commerce Layer is the plainest case: its dashboard “is a client of the same API”, built from public components, and its CLI carries plugins for webhooks, imports, exports and resources. Saleor’s dashboard is a client of the same GraphQL API, and every admin action is reachable through it. Shopify, per its scorecard, makes every store action API-driven, from products and orders to fulfillments, discounts, shipping, taxes and inventory. commercetools exposes every commerce primitive including business units and approval flows, and it is the only one of the five whose scorecard names a Terraform provider, so account state can be declared in code. Further down, Medusa follows the same pattern with an admin that is a separate Next.js app over its Admin API.

When the admin is a client, a task a merchant does by hand is a task an agent can do by call. When the admin owns a setting, the agent stops there. Snipcart is the clear case of the second kind: its orders, refunds and discounts are API-addressable, but webhook URLs, payment gateway selection, email templates and API key rotation live only in the merchant dashboard.

The middle of the list splits on the event contract

From 7th to 17th, operation scores run between 10 and 16 and every platform has some event mechanism. What separates them is what the contract around those events promises. Shopify delivers more than 100 event types with HMAC-SHA256 signatures, a documented retry policy and replay. Tiendanube signs every delivery and states outright that ordering is not guaranteed and duplicates happen, so a consumer has to be idempotent. VTEX pushes order status changes to a registered URL and offers a pull queue with explicit commit, but sends no HMAC body signature, and its catalogue stops at order status. Snipcart’s deliveries are verified by calling back to Snipcart with a request token, and replay is a manual button.

At the bottom the contract is missing. PrestaShop has no outbound event system, only in-process PHP hooks, and Bagisto fires Laravel events in process with nothing that signs, queues, retries or replays an HTTP delivery. Spryker’s events move over RabbitMQ inside the deployment with no published catalogue, and the Index’s verdict is that an agent can operate a Spryker install “only by driving a shell on infrastructure it controls”.

An agent that runs a store acts on what it hears. Tiendanube’s stated duplicate rule is something an agent can be written against; a VTEX callback with no signature is something it has to be told to distrust.

What the vendor MCP servers can actually do

Seven of the 28 commerce scorecards record a vendor MCP server, and 21 record none. Of the seven, two are described as acting on a store, one reads documentation, one reads metrics, and three are listed without a description of their tools.

Snipcart runs a hosted server at ai.snipcart.com/mcp over Streamable HTTP, with 38 tools spanning “orders, refunds, discounts, stock and abandoned carts”. Wix runs a hosted remote server at mcp.wix.com/mcp that searches documentation, generates platform code and, in the Index’s words, “makes authenticated API calls against real sites”. Those are the two that operate something.

Bagisto’s server indexes its API documentation through tools such as search_api_docs and list_endpoints; the Index’s verdict is that “it helps an agent write integration code; it does not operate a store”. Commerce Layer’s one server wraps its Metrics API, and orders, SKUs, prices and markets are not exposed through it. Saleor, Shopware and Vendure each have a repository in their own GitHub organisation listed as the official MCP server, saleor/saleor-mcp, shopware/shopware-admin-mcp and vendurehq/mcp, while the editorial text on each scorecard says no first-party server has been published. Until those records agree, this ranking counts the three as listed and says nothing about what they can do.

The five platforms at the top of the ranking record no MCP server that the Index describes as acting on a store. The Index found no first-party Shopify server published as a core product, none for commercetools or BigCommerce, and only the metrics server for Commerce Layer. OrderCloud, sixth, is the sharpest case: the Index says its OpenAPI document “makes an agent bridge easy to write”, and nobody at the vendor has written it.

This is the commerce form of a pattern our test of whether an agent can run a back office system found in order workflows. Here it inverts the ranking: the platforms an agent can be pointed at today through a vendor server are not the platforms an agent can run best.

Shopware headless: the top MCP score, and a tie for last

Shopware is the one platform the queries behind this post name directly, and its scorecard is the hardest to read. It holds the highest MCP posture score in the category, 20 of 20, and ties with PrestaShop for last on operation plus events, at 16 of 40. Its headless operation score is 12, and the Index notes that the Shopware Administration is a Vue.js application over the same Admin API. Its webhooks and events score is 4, and its schema score is 4, for 50 of 100 in total.

Two things in the record pull against those numbers. The webhook rationale says subscriptions deliver signed platform events, which a score of 4 does not reflect. The MCP signal lists shopware/shopware-admin-mcp in Shopware’s own organisation, while the MCP rationale says no first-party server has been published. And the Index’s separate JAIRF score, computed from a vendor’s public OpenAPI specification, puts Shopware’s at 81.3 of 100, Level 3.

So for Shopware the honest reading is narrower than the rank. Its admin API and published specification are strong. Its event contract and its MCP server are the two places the Index’s data disagrees with itself, and those are the two that decide whether an agent can run a Shopware store without polling. A buyer evaluating Shopware headless for agent work should read the webhook documentation and that repository’s tool list before trusting either the 4 or the 20.

When a lower-ranked platform is the right choice

A team that wants an agent working on a store this week, without writing a tool layer, is better served by the two platforms that ship one. Snipcart’s 38 tools cover orders, refunds, discounts, stock and abandoned carts, and Wix’s server makes authenticated calls against real sites. Both come with limits the Index records. Snipcart’s server has no OAuth 2.1, “so Claude.ai web cannot connect”, and its store configuration lives only in the merchant dashboard. Wix Headless makes catalogue, cart, checkout and bookings programmable, while site structure, page design and theme stay editor-only.

A team that writes its own agent tooling, or will, should buy from the top of the ranking and write the MCP layer itself. The Index’s note on OrderCloud describes that trade: the vendor supplies the documented API and the signed events, and the buyer builds the server.

What this ranking does not show

The scores are the Index’s as of 2026-08-20, and this post has not rechecked them, so a vendor recorded with no MCP server may have shipped one since. Eight of the 28 platforms are not ranked, because a criterion could not be resolved, and Vendure, with an MCP repository on record, is one of them. The MCP records of Saleor, Shopware and Vendure disagree with their own rationales, as the sections above say.

The Index defines commerce readiness as the whole purchase path being callable and says “the gap between vendors is widest at checkout and payment”. This ranking does not score checkout separately: operation and events are measured across the platform, so a platform could rank high and still put a rendered page in front of payment. For the buyer-agent side of checkout, where UCP, ACP and AP2 compete, see our analysis of the agentic commerce protocols. The scores also measure vendor surfaces, not a running store: we have not run an agent against any of these twenty stores, and a store’s own integrations can add or remove surface. The cross-category view of the same Index data is in what the Headless Index found about agent-ready APIs.

What changes in a commerce platform decision

Rank platforms on what the vendor alone can provide. An agent needs every store action callable and every change delivered as a signed event it can replay, and no buyer can add either to a platform that lacks them. The MCP server is the opposite: on a platform like Shopify, Commerce Layer or OrderCloud it is a thin layer over an API that already does the work.

So the vendor MCP server is a convenience to weigh after the shortlist, not a reason to be on it. Of the twenty platforms ranked here, the two that ship a server that runs a store place 10th and 16th, and the top five ship none that does. A shortlist built on the operation and events scores and a tool layer built in-house gives an agent more of the store than any vendor server in the category does today.