For months, the merchant-side gate in agentic commerce was a line in a robots.txt file. Shopify blocked AI crawlers from its checkout and cart paths, Amazon blocked Meta’s Muse agent outright, and the control merchants had over agent traffic was reactive and blunt: the picture mapped in The Fragmenting Gate. Salesforce’s Winter ’27 announcement, dated August 31 and generally available October 12, moves that gate inside the CRM. The blocklist ships as a setting.
What is being productized is authorization, not agent identity. The question the API Catalog answers is not who an agent is but which agents may call which commerce APIs, and which Model Context Protocol (MCP) servers and tools they may reach. The catalog consolidates APIs and MCP servers from MuleSoft, Heroku, and Apex into one managed surface; administrators activate Salesforce-hosted MCP servers for outside clients and register external ones. An allowlist is boring infrastructure. Packaged inside a CRM subscription, it is a control point with a price attached.
The surface keeps widening. The same release ships agent skills and plug-ins that bundle MCP connectors into installable packages, over 100 prebuilt at launch, and third-party orchestration that lets Agentforce drive agents from AWS, Azure, and Google over A2A. Every new surface the platform connects is another set of calls someone has to authorize.
The availability picture is narrower than the release energy suggests. Winter ’27 is the release peg and the product positioning: the allowlist becomes a SKU, order management connects over MCP, and Agentic Commerce Search ships. It is not the ship date for the catalog’s confirmed pair. Per Salesforce’s Winter ’27 release-notes change log, exactly two API Catalog MCP features are explicitly tagged generally available: “Discover Manually Registered MCP Servers in API Catalog” and “Bring MuleSoft MCP Servers into API Catalog,” both recorded as generally available on a rolling basis under the change log’s week of May 11, 2026, five months ahead of the release. The rest of the catalog’s MCP surface (manual registration of external servers, security risk scores, and the mappings from agents, prompt templates, and Connect REST API actions to server tools) carries release-note entries dated May through July with no explicit GA or beta tag. The individual help pages were not retrievable at filing. Confirmed is confirmed; the rest ships with untagged edges.
What closes the loop is one line in the Commerce material: order management connects via MCP. Order management, reachable through the same protocol surface, is the platform answering the postures the Fragmenting Gate mapped. Instead of merchants fencing agents out, the platform decides which agents come in and what they can touch. It does not settle the architectural question the Oracle Fusion Claw piece raised: whether agent transactions run on live write-back or on data copied into the platform. The release material does not say.
Then there is the number everyone will quote. Agentic Commerce Search trains a dedicated small language model on each merchant’s catalog and shopper behavior, and Salesforce’s announcement reports: “Early results show a 13% conversion lift and a 17% increase in add-to-cart rates, and the capability is now standard for all Shopper Agent customers.” Those are vendor-reported early results; no independent test data has been published. It is still the first quantified conversion bet anyone in this market has placed on agent-driven shopping traffic: the first attempt to price the traffic, not just route it.
What the SKU does not move is the part merchants actually argue about. As laid out in the liability gap piece, the merchant still absorbs the cost when an agent buys wrong: no reason code for agent error exists, no framework reallocates the loss, and 93% of merchants believe AI providers should bear it. Merchants are rationing exposure accordingly; only 28% are willing to offer agents their full product range. The API Catalog is platform governance, not an allocation of risk. Salesforce has built the gate and priced the key. Whether the party collecting the toll also carries the liability for what walks through is the question Winter ’27 leaves exactly where it found it.