Shopify turns on Poppy for every store: a file that tells agents what they are allowed to do

The facts

The file is called poppy.json. It lives at /.well-known/poppy.json. Sierra, the enterprise-agent publisher co-founded by Bret Taylor and Clay Bavor, published version 1.0 of the Personal Agent Protocol, nicknamed Poppy, on 13 November 2026. The protocol tells a personal agent how to introduce itself to a company, identify itself, and learn what it is allowed to do. Shopify turns it on for every merchant. Muse, Meta’s agent, now looks for it first on every site it visits, Sierra says.

Poppy builds on standards already in use: MCP, OpenAPI, and Shopify’s Universal Commerce Protocol (UCP). Authentication goes through OAuth: the customer signs in on the company’s own page and chooses what the agent can see. Since the first draft, Sierra says it has made staged adoption easier, refined how those standards are used, and added extensions, including a commerce extension co-authored with Shopify. An implementation kit, with a validator, is online. Sierra places Shopify in more than 175 countries. Every store, it writes, now publishes a Poppy file with no extra work from the merchant. UCP handles the cart and payment; Poppy handles the arrival: the agent names itself, and asks what it is allowed to do. The commerce extension lets it shop as a guest or after sign-in, and requires it to ask the customer before certain actions. Mercury, Synchrony and Turkish Airlines are cited as already live. Sixty companies are joining as design partners, bringing the total to more than 100, including Aviva, Banco Sabadell, Checkout.com, HelloFresh, Intuit, Salesforce, Stripe, Twilio, Wix and Zoom.

The same day, a Shopify engineer (Wes-Dev-Shopify) confirmed on the developer forum that Online Store domains serve this discovery file, and that it points to the store’s UCP profile. The protocol covers discovery, agent identity and sign-in. Carts, payment and orders stay on the UCP side. Nothing in that day’s documentation marks an order as coming from a Poppy session: the admin can attribute an order to an agent, not to the protocol. The admin’s “Agentic” settings (including direct checkout): the same post says it cannot yet confirm how they apply to agents that arrive through Poppy. The protocol site presents version 1.0 as published. The implementation kit still writes that the specification is a draft. The sources we read do not document Muse being available in France, nor a Poppy interface in French.

Editorial view

The detail that matters is not the list of a hundred partners. It is that a French small business already on Shopify has, since Friday, a file at an address it did not choose. The store has become addressable by a personal agent. That Muse looks for it “first” does not mean a French customer has Muse. The file is there anyway.

What this changes in practice. For a Shopify merchant, nothing to install tomorrow morning. The useful gesture is to open and read what the store says about itself. For a small business not on Shopify, the kit exists, but it is a developer job: a survey, a design to approve, then a build in stages. For an individual in France, Poppy does not give a “send Muse shopping” button. It gives, if you run a store, a doorway to reread before an agent from elsewhere walks through it.

Watch-outs. OAuth, on the company’s own page, is the right path: the password stays with you. The kit also describes an extension where the agent signs in with the credentials the company asks for. That is the other extreme, and it is not a setting to leave “just to see”. An agent that reads orders or a customer account is processing personal data: the GDPR applies, including if the file was published on its own. An agent that acts remains an AI system under the regulation; the transparency duties are in our marker on the 2 December deadline. On cost: the kit assumes Node 22.18 and a coding agent; that is not a public price, it is time. On lock-in: Shopify publishes the file for you; leaving Shopify may mean losing that doorway, or rebuilding it. The sources we read do not say how to refuse Poppy on a Shopify store, nor whether the admin’s Agentic settings apply to it.

Trial, or wait. Worth trying, if you have a Shopify store: open your domain’s poppy.json file, reread it, and note what it exposes. Not worth trying: giving an agent the store password, or wiring a payment agent to this file. Worth waiting for: confirmation, in the Shopify admin, of the settings that actually apply to Poppy agents, and documented availability of Muse in France. Today, it is not in the sources we read.

Where it actually helps

Where a French-speaking Shopify store already has a frame, and a human at the end: translate a Shopify store (listings, SEO, metafields), build an e-commerce returns circuit, compare purchase options before ordering. The Poppy file translates nothing and sends no parcel. It tells an agent that introduces itself what it is allowed to ask. Without that list, reread, an agent’s arrival is not a convenience. It is a door left open with no notice.