What autonomous agents actually do when they arrive at a merchant that charges for things over HTTP 402. Every number below comes from this service's own access logs, over the 7 days to 20 September 2026.
Read the limitations before the findings. These are one merchant's logs, not a market survey. The sample is self-selected: every agent here found this site, which lists itself in an MCP registry and answers on a well-known agent card. Popular endpoints are over-represented because crawlers re-check them on a schedule. Address counts are reliable only because this deployment forwards a real client IP — on a platform that hides it, the same counting method would overstate by an order of magnitude. And the classification of an identity as a "client" or a "liveness checker" is inferred from its user-agent string, which any operator can write freely.
86.0% of agent visits went to a single path: the MCP endpoint. Everything else — the catalogue, the store, the agent cards, the feeds — shares the remainder. If you are building for agents and you have to choose one surface to instrument, make it that one.
| Path | Visits |
|---|---|
/mcp | 2327 |
/ | 129 |
/store/ | 113 |
/templates/ | 74 |
/store/catalog.json | 69 |
/micro/ | 66 |
/robots.txt | 63 |
/img/store-hero.jpg | 56 |
/api/v1/services | 54 |
/.well-known/agent-card.json | 52 |
/buy?sku=hcare-reception | 49 |
/img/sectors/automotive.jpg | 49 |
/img/sectors/agriculture.jpg | 49 |
/img/sectors/launch.jpg | 48 |
Sorting the identities by what their user-agent claims, the traffic splits into liveness monitors that check whether the endpoint is up, directories that index what it offers, and clients that may actually call it.
| Category | Visits | Share |
|---|---|---|
| client | 1180 | 43.6% |
| liveness | 669 | 24.7% |
| crawler | 321 | 11.9% |
| directory | 296 | 10.9% |
| other | 77 | 2.8% |
| Identity (as it calls itself) | Visits | Category |
|---|---|---|
node | 780 | client |
Python/3.11 aiohttp/3.14.3 | 165 | client |
python-requests/2.33.0 | 78 | client |
python-httpx/0.28.1 | 73 | client |
aisec-registry/0.2 | 128 | directory |
rokmcp-collector/0.2 | 104 | directory |
lastseen-schema-probe/1.0 | 30 | directory |
io.verifymcp/probe | 12 | directory |
SentinelOracle/0.1 (+https://glimind.com/opt-out; liveness | 345 | liveness |
mcpbeat/0.1 | 315 | liveness |
mcp-server.io-healthcheck/0.1 | 9 | liveness |
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compati | 205 | crawler |
Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compati | 116 | crawler |
no-ua | 24 | other |
Enerlio GmbH FACTANKER marc@enerlio.de | 15 | other |
agent-tools.cloud-crawler/0.1 | 13 | other |
TalandorBot/0.1 | 13 | other |
Across the whole window, agent visits that touched a purchase path — a buy link, a template checkout, a payable item — totalled 270 against 2,707 agent visits overall. That is roughly one attempt per 10 visits.
| Purchase path | Attempts |
|---|---|
/buy?sku=hcare-reception | 49 |
/templates/buy?tpl=clinic-reminder | 45 |
/templates/buy?tpl=restaurant-orders | 45 |
/templates/buy?tpl=robot-fleet-telemetry | 44 |
/templates/buy?tpl=bundle-everything | 44 |
/templates/buy?tpl=real-estate-followup | 43 |
The honest reading: the agent ecosystem today is finding and verifying far more than it is buying. Whether that changes depends on operators granting agents purchasing authority — which is a policy decision, not a protocol one.
Caveat on this figure. Purchase-path requests include our own monitoring and test calls, which this build cannot separate from external ones. Treat it as an upper bound. A future edition will tag them; the number in this edition should not be quoted as "external agents attempted to buy 265 times".
Before calling anything, agents go looking for the machine-readable descriptions of a service: its agent card, its protocol metadata, its authorisation document. These paths are not the API — they are the paperwork an agent reads to decide whether the API is worth calling.
Note on what this table does and does not say: these are the discovery paths that were requested. Request logging here records the path, not the response code, so this table counts demand rather than failures — some of these are served and some are not.
| Discovery path requested | Requests |
|---|---|
/.well-known/agent-card.json | 52 |
Requests are recorded by the merchant itself, with no third-party script and no cookies. Sources are derived from a referrer when present and from the user-agent otherwise. Traffic generated by our own monitors is tagged and excluded (1,940 requests in this window). An address is counted once per category regardless of how many requests it made.
Each build appends a dated snapshot, so the trend matters more than any single edition.
| Date | Agent visits | Identities | Distinct UAs |
|---|---|---|---|
| 2026-09-20 | 2707 | 82 | 25 |
| Source | Requests |
|---|---|
| direct | 8736 |
| direct-store | 515 |
| anthropic/claude | 207 |
| chatgpt | 120 |
| yandex | 12 |
| www.google.com | 11 |
| mcp-registry | 6 |
| bing | 5 |
| 1 | |
| registry.modelcontextprotocol.io | 1 |
Machine-readable: the same data is published as JSON at
https://growaify.com/api/v1/research/agent-commerce.json, so an agent or analyst can
consume it without parsing this page. Cite it as: Growaify, State of Agent Commerce,
edition of 20 September 2026.