The Universal Commerce Protocol (UCP) is an open standard with dated versions. A business publishes a profile at /.well-known/ucp that lists what it supports: catalog search, cart, checkout, orders and a few others. An agent platform reads that profile, picks one protocol version, and the two sides settle on the capabilities they both support.
The part merchants misread: a capability in your profile is an offer to negotiate, not permission to buy. The platform’s own program rules, its trust policy and each checkout response still decide whether a shopper can pay in place or gets sent to your site.
We saw that gap on real stores. On October 27, 2026, four Shopify stores advertised checkout in their UCP profiles. The day before, Shopify’s catalog had marked every one of their products in our search as not eligible for native checkout.
What UCP actually standardizes
UCP describes the conversation between three kinds of party. A business sells and stays the merchant of record. A platform is the agent or AI surface acting for the shopper. Payment providers and credential providers handle the money. UCP’s own site lists the core capabilities as catalog search and lookup, cart building, identity linking, checkout and order management. The specification defines REST, MCP, agent-to-agent (A2A) and embedded transports for carrying them.
Three rules in the specification matter most to a merchant:
- Discovery is a public file. The business publishes its profile at
/.well-known/ucp. It holds the protocol version, the services and their transports, the capabilities and the payment handlers. - Version and capability are negotiated separately. The platform selects one exact protocol version. The business then works out the active capabilities from what both sides advertise. When to drop an old version is the business’s call; UCP sets no deprecation schedule.
- Negotiation is not trust. Agreeing to an extension doesn’t make every later value trusted. A platform may apply its own policy and decline any instance that doesn’t satisfy it.
Two more lines from the capability pages close the loop. Catalog responses “reflect the Business’s current terms” but “are not transactional commitments — checkout is authoritative.” And a checkout session can land in requires_escalation, where the platform must hand the buyer to a continue_url instead of finishing the purchase itself.
The capability map
Use this table to read any UCP profile. Each row is one capability name as it appears in the profile, what it lets a platform do, and what it does not tell you. The names follow UCP’s reverse-domain convention: dev.ucp.* names are governed by ucp.dev, and vendors such as Shopify add their own (dev.shopify.*).
| Capability in the profile | What a platform can do with it | What it does not tell you |
|---|---|---|
dev.ucp.shopping.catalog.search and .lookup |
Search your products and fetch them by ID | Whether any assistant shows them, or in what order |
dev.ucp.shopping.cart |
Build a multi-item cart | Whether the cart is paid for in place or handed to your site |
dev.ucp.shopping.checkout |
Open and update a checkout session with you | Whether a platform has enabled in-place checkout for your store or for a given product |
dev.ucp.shopping.fulfillment, .discount |
Extensions to checkout: delivery options, discount codes | Prices or delivery dates; checkout responses carry those |
dev.ucp.shopping.order |
Follow the order after purchase | Anything about discovery |
dev.ucp.common.identity_linking |
Link a shopper’s account with your store (OAuth 2.0) | Whether shoppers have linked one |
dev.ucp.shopping.buyer_consent, .permalink |
Record buyer consent; build links into your store | Neither is a purchase on its own |
Payment handlers (for example com.google.pay) |
Name the payment methods a checkout could accept | Which one a given platform will offer |
Read the left column as “the store can talk about this”. Read the right column before you tell anyone the store can sell through an agent.
Version notes
| Version | Status on Oct 27, 2026 | What it means for you |
|---|---|---|
| 2026-08-25 | Marked “latest” on ucp.dev; GitHub release published Aug 25, 2026 | The version every profile in our example declared |
| 2026-04-08 | Older release | A platform may still select it if both sides list it |
| 2026-01-23, 2026-01-11 | Earliest releases | Kept for compatibility; drop dates are each business’s policy |
| draft | Unreleased | Never treat draft wording as current behaviour |
The specification and its repository are Apache 2.0 licensed. Version names are dates, so an old date in your profile is worth asking your platform about. The UCP home page also says a lodging draft is available, so expect the capability list to grow beyond retail.
Worked case: four stores that advertise checkout
On October 26, 2026 we searched Shopify’s Global Catalog over UCP for “humidifier for dry winter air large room quiet top fill” and saved the top 10 results. Those ten products came from four sellers. On October 27 we fetched each seller’s /.well-known/ucp, and Shopify’s own catalog profile too.
| What we read | Seller profiles (all four) | Shopify catalog profile | Catalog record for each product (Oct 26) |
|---|---|---|---|
| Protocol version | 2026-08-25 | 2026-08-25 | 2026-08-25 |
| Catalog search and lookup | Advertised | Advertised | Returned the product |
| Checkout capability | Advertised, with cart, order, discount and fulfillment | Not advertised | eligible.native_checkout: false on all 10 |
| Payment handlers | Google Pay, Shopify card, Shop Pay | None | n/a |
| Where the purchase goes | Not stated by a profile | Not stated by a profile | A checkout_url to the seller’s own cart |
Shopify defines eligible.native_checkout as whether a variant “supports native (non-redirect) checkout.” So the same store said two things at once, both true:
- Its profile said it can negotiate checkout with any platform that speaks UCP.
- The catalog route said that, in that context, a buyer should be sent to the store’s cart.
Shopify’s agent docs describe the same split from the builder’s side: agents build carts, convert them to checkouts, and “hand off to the merchant for payment.” And Shopify’s catalog profile, the endpoint our search used, lists search and lookup but no checkout at all. The checkout capability lives with each store, behind whatever rules the platform applies.
Our native-checkout research covers that flag across 1,620 results and how to report it. The point here is narrower: you can’t read purchase permission off a profile.
Discovery, capability and checkout are three different questions
When someone says “my store supports UCP”, split the claim into three. Each needs different evidence.
| Question | Where the evidence lives | What a “yes” looks like |
|---|---|---|
| Can an agent find my products? | Catalog route: Shopify Catalog, Google Merchant Center, or your own catalog capability | Your product returned for a real query, with correct facts |
| What does my store offer to negotiate? | /.well-known/ucp |
Version and capability list you can read and date |
| Can a shopper pay without leaving the agent? | The platform’s program and each checkout session | A platform has enabled you, the product is flagged eligible, and a session reaches ready_for_complete |
Platform programs add their own gates on top of the protocol:
- Google: UCP-powered checkout in AI Mode and Gemini is for select merchants. Each product must set
native_commerce(checkout_eligibility)in Merchant Center, and whole product types are excluded, such as subscriptions, personalized goods and pre-orders. One Google help page names the US, Canada and Australia. Google’s onboarding page says the Merchant Center hub is rolling out in the US first, with Australia and Canada to follow next year. Our Google checkout guide walks that preflight. - Shopify: your products reach agents through Shopify Catalog only if the store is eligible. That means the Starter plan or higher and not in private mode. The exception: on the Agentic plan, products can still be included through agentic storefronts before the online store is published to a paid plan. Account standing is reviewed over time. Our agentic storefronts guide covers the channels.
None of these gates appear in a UCP profile. A profile that lists checkout is consistent with a store no platform has enabled for in-place payment.
Read your own profile in five minutes
- Open
https://yourstore.com/.well-known/ucp. If you get JSON, noteucp.versionand the date you looked. If you get a 404, your platform may not publish one; ask before building anything. - List the capabilities. Copy every name under
capabilities. Mark each against the capability map above: discovery, cart, checkout, post-purchase, or vendor extension. - List the payment handlers. These name methods a checkout could accept. They don’t promise that a platform will offer them.
- Check one product on a real route. For Shopify, see what the catalog returns for one product, including
eligible.native_checkoutandcheckout_url. For Google, check the product’snative_commerce(checkout_eligibility)value in Merchant Center. We haven’t seen the Merchant Center screens, so follow Google’s guide rather than any menu path from us. - Write the claim you can support. For example: “On [date], our profile declared UCP [version] with checkout. On [route], product [ID] was [eligible / not eligible] for native checkout.” Don’t shorten that to “we support agent checkout.”
A blank you can copy:
| Item | What you found | Date checked |
|---|---|---|
| Profile URL and HTTP status | ||
ucp.version |
||
| Capabilities (discovery / cart / checkout / orders / vendor) | ||
| Payment handlers | ||
| One product: route, native-checkout flag, where the purchase goes |
What the profile can’t settle
- Interoperability. A UCP profile is readable by any platform that speaks UCP. Which platforms read yours, and for which shoppers, is not in the profile. Our UCP vs ACP comparison lists what each protocol leaves open, and our ACP guide covers the protocol behind ChatGPT’s merchant program.
- Ranking. Nothing in UCP says how an assistant orders results. Being searchable is not being picked. Our ChatGPT ranking guide covers what OpenAI documents.
- Price at checkout. Catalog prices are not commitments. If a checkout returns a different total, the checkout wins.
How we checked
The catalog snapshot is one unpersonalized search of Shopify’s Global Catalog over its UCP MCP endpoint (catalog.shopify.com/api/ucp/mcp) on October 26, 2026, top 10 results, first variant of each. We read variants[0].eligible.native_checkout and variants[0].checkout_url from the saved response.
On October 27, 2026 we requested /.well-known/ucp from each of the four sellers’ domains and from catalog.shopify.com, and saved the JSON. All four seller profiles were identical in version (2026-08-25), services (MCP and embedded transports), capabilities (11 names) and payment handlers (3). We also requested /.well-known/acp.json from each seller; all four returned 404.
The four stores all run on Shopify, so their profiles are probably generated by the platform rather than written by each merchant. That is a reason not to read a profile as a sign of a merchant’s own integration work. We didn’t open a checkout session or sign in as a buyer.