Make a store agent-ready with UCP

UCP (Universal Commerce Protocol, ucp.dev — led by Google and Shopify) is a machine-readable profile at https://{domain}/.well-known/ucp that tells shopping agents what a store can do (catalog search, cart, checkout, order, identity linking) and over which transports (MCP, REST, A2A, embedded). UCP Checker (ucpchecker.com) is the independent, continuously-observed validator and record of UCP adoption. This skill is served live — always work from a freshly fetched copy; the spec versions quarterly.

Follow the steps in order. Never invent capabilities the store cannot honour: the profile is a declaration agents will act on.

Step 1 — Baseline check

Run a live check (keyless, rate-limited):

POST https://ucpchecker.com/api/v1/check
Content-Type: application/json

{"domain": "example.com"}

From a terminal or CI the same live check is npx ucp-check example.com (exit 0 = verified, --json for the full response).

Or read the current record without re-crawling:

GET https://ucpchecker.com/api/v1/status/example.com

Read from the response: status (verified | not_detected | unreachable | blocked), version, capabilities, transports, score (0–100) and grade, plus errors[] and warnings[] with codes such as UCP_MISSING_SIGNING_KEYS, UCP_UNKNOWN_VERSION, UCP_MISSING_FIELD. The schema for both endpoints is at GET https://ucpchecker.com/api/v1/schema; the scoring model is described at https://ucpchecker.com/methodology.

Report the baseline to the user as: status, version, score/grade, and the list of errors then warnings. If status is blocked, stop and tell the user their robots.txt or bot policy blocks UCPChecker — nothing else can be assessed until the validator is allowed in.

Step 2 — Decide the profile shape

• Shopify stores: UCP is managed by the platform. Do not hand-write the profile. Enable agentic commerce / Shop Catalog in the Shopify admin and re-check; the remaining fixable items are policies, signing keys and bot access.
• Wix, Shopware, WooCommerce, custom: the platform or an official plugin may publish the profile (Shopware's official plugin serves /ucp/*). Check the platform first.
• Custom builds: write /.well-known/ucp by hand using the current spec version at https://ucp.dev — copy the version string (format YYYY-MM-DD) from the spec's latest release, never from memory.

Step 3 — Minimum conformant business profile

A business profile MUST have a root ucp object with version, services and payment_handlers. capabilities is optional but is what agents use to decide whether to shop. Signing keys are published at the root as a JWK Set under keys[] (RFC 7517). Every dev.ucp.* capability you list should reference the spec's schema for that capability.

{
  "ucp": {
    "version": "YYYY-MM-DD",
    "services": {
      "dev.ucp.shopping": [
        {"version": "YYYY-MM-DD", "spec": "https://ucp.dev/YYYY-MM-DD/specification/overview/",
         "transport": "mcp", "endpoint": "https://example.com/api/mcp",
         "schema": "https://ucp.dev/YYYY-MM-DD/services/shopping/mcp.openrpc.json"}
      ]
    },
    "capabilities": {
      "dev.ucp.shopping.checkout": [{"version": "YYYY-MM-DD", "spec": "https://ucp.dev/YYYY-MM-DD/specification/checkout", "schema": "https://ucp.dev/YYYY-MM-DD/schemas/shopping/checkout.json"}],
      "dev.ucp.shopping.cart":     [{"version": "YYYY-MM-DD", "spec": "https://ucp.dev/YYYY-MM-DD/specification/cart",     "schema": "https://ucp.dev/YYYY-MM-DD/schemas/shopping/cart.json"}]
    },
    "payment_handlers": {}
  },
  "keys": [
    {"kty": "OKP", "crv": "Ed25519", "kid": "<RFC 7638 thumbprint>", "x": "<base64url public key>", "use": "sig", "alg": "EdDSA"}
  ]
}

Rules that trip real stores:

• Serve it with Content-Type: application/json, HTTPS, no auth, no bot wall, no JS challenge.
• Do not invent namespaces. Only dev.ucp.* names the spec defines are protocol capabilities; vendor extensions live under your own reverse-domain (com.example.*) and MUST carry a schema URL under an authority you control (namespace governance).
• If you name an MCP transport, the endpoint must answer MCP initialize and list tools.
• Keep version on the profile and on every capability aligned to one release.

Step 4 — Allow the validator and shopping agents in

• robots.txt: do not Disallow: /.well-known/. UCP Checker crawls as UCPChecker and signs requests with Web Bot Auth (RFC 9421); allow it, and allow the agent user-agents you want to sell through.
• CDN/WAF: exempt /.well-known/ucp, your MCP endpoint and checkout endpoints from bot challenges; return honest 429 with Retry-After rather than 403 or a challenge page.
• Publish store policies (returns, shipping, privacy) at stable URLs — agents read them before checkout and UCP Checker records them.

Step 5 — Re-check and gate

Re-run Step 1. The goal is status: verified with zero errors; then work warnings by the score impact the response reports. For CI, fail the build when status != verified or errors is non-empty. Do not chase the number: the score is a summary of observed conformance, and UCP Checker re-observes every verified store daily — what you publish is what the record will show tomorrow.

Step 6 — Prove it end to end (optional)

UCP Playground (ucpplayground.com) runs a real shopping agent against a live UCP store and records the session. Use it to confirm an agent can actually search, add to cart and reach checkout before announcing agent readiness.

Reference

• UCP Checker API schema: https://ucpchecker.com/api/v1/schema
• Methodology and score model: https://ucpchecker.com/methodology
• Public record for any domain: https://ucpchecker.com/status/{domain}
• MCP router (check + shop): https://ucpchecker.com/mcp · card: https://ucpchecker.com/.well-known/mcp/server-card.json
• Find verified stores (ARD): POST https://ucpchecker.com/ard/search
• Spec: https://ucp.dev