UCP Explained — the open checkout protocol that lets AI agents actually buy.

What UCP actually is — and the one adoption fact that matters.

The Universal Commerce Protocol (UCP) is an open standard that gives AI agents a single wire format to discover products, build carts, and complete authenticated purchases across any merchant's backend — without custom per-platform integrations.

As of May 2026, Amazon, Meta, Microsoft, Salesforce, and Stripe joined the UCP Tech Council on April 24, 2026, giving the governing body 10 members spanning search, social, enterprise software, payments, and retail infrastructure (UCP Tech Council announcement, Ken Huang / Substack, April 28, 2026).

The prior AgentMall spokes gave your catalog a Schema.org layer (Spoke 4) and a REST API (Spoke 5). UCP is the final layer: without it, an agent can find your product and evaluate it — but it cannot buy it.

The N-to-N problem, the gaps Schema.org and MCP can't fill, and the ACP parallel.

The N-to-N problem

Before UCP, every platform (AI agent, app, super-app) connecting to every merchant required a custom integration. UCP solves this by having merchants publish a machine-readable profile at /.well-known/ucp that any UCP-compatible platform can read and act on — no prior registration, no custom API key negotiation per partner. Shopify's engineering blog calls this a 1-to-many model: implement once, transact with any compliant agent.

What Schema.org, REST, and MCP can't do

Schema.org is passive and read-only — it has no mechanism for cart state, fulfillment negotiation, payment instrument exchange, or order confirmation. An agent reading Schema.org markup can answer "does this merchant sell blue running shoes?" but cannot answer "can I buy two pairs, select UPS Ground, and pay with a Google Pay token?"

A REST API with no UCP profile has no discoverable capability contract; each agent needs a custom connector. That's the exact N-to-N problem UCP was built to eliminate.

MCP (Model Context Protocol, by Anthropic) is a tool-discovery and invocation layer — it tells an LLM what tools exist, but it does not define checkout session structure, payment negotiation, or order state. MCP is actually one of four UCP transport bindings (alongside REST, A2A, and Embedded). The relationship: MCP handles tool invocation; UCP defines what the commerce tools actually do (Paz.ai MCP explainer).

ACP vs. UCP — the parallel standard

Governance, the discovery manifest, the capabilities registry, and the 8-step checkout flow.

Governance and versions

UCP was announced January 11, 2026. Co-developed by Google, Shopify, Etsy, Wayfair, Target, and Walmart. Open source under Apache 2.0. Governed by the UCP Tech Council. Current stable version: 2026-04-08 (ucp.dev spec overview).

The discovery manifest

Every UCP merchant exposes a JSON profile at /.well-known/ucp. This is the entry point — the first thing any compliant agent fetches. Must be served over HTTPS with Cache-Control: public, max-age=60 minimum.

{
  "ucp": {
    "version": "2026-04-08",
    "services": {
      "dev.ucp.shopping": [
        {
          "version": "2026-04-08",
          "spec": "https://ucp.dev/2026-04-08/specification/overview/",
          "transport": "rest",
          "endpoint": "https://business.example.com/ucp/v1",
          "schema": "https://ucp.dev/2026-04-08/services/shopping/rest.openapi.json"
        },
        {
          "version": "2026-04-08",
          "spec": "https://ucp.dev/2026-04-08/specification/overview/",
          "transport": "mcp",
          "endpoint": "https://business.example.com/ucp/mcp",
          "schema": "https://ucp.dev/2026-04-08/services/shopping/mcp.openrpc.json"
        }
      ]
    },
    "capabilities": { "..." },
    "payment_handlers": { "..." }
  },
  "signing_keys": [
    {
      "kid": "key-1",
      "kty": "EC",
      "crv": "P-256",
      "x": "...",
      "y": "...",
      "use": "sig",
      "alg": "ES256"
    }
  ]
}

Capabilities registry

The checkout flow — 8 steps

Endpoint reference

Service Level Objectives

Source: Google native checkout developer guide.

Live vs. committed — the data centerpiece.

As of May 2026, Etsy and Wayfair are the two confirmed live merchants on Google AI Mode and Gemini. The six original co-developers (Google, Shopify, Etsy, Wayfair, Target, Walmart) shaped the spec. On April 24, 2026, Amazon, Meta, Microsoft, Salesforce, and Stripe joined the Tech Council. 30+ organizations have publicly endorsed UCP.

What each agent surface can and cannot do — without UCP.

The purchase gap is not binary. Agents can discover and evaluate products at non-UCP merchants through existing feeds and web access. The hard stop is at purchase completion — specifically for Google's surfaces (AI Mode, Gemini), where only UCP-registered merchants can complete transactions. For OpenAI's surface (ChatGPT), ACP is the current requirement.

The exact field names, types, and what breaks without each one.

UCP uses exact field names. The most common implementation error is assuming the price format matches the Spoke 5 REST API. It doesn't — UCP has its own price field structure.

Table A — Manifest fields (/.well-known/ucp)

Table B — Checkout request fields (POST /checkout-sessions)

Table C — Checkout response fields

From "no UCP" to spec-compliant server in 18–32 hours.

For a solo founder with an existing product API, the path from "no UCP" to "spec-compliant UCP server" is an 18–32 hour project. The spec is Apache 2.0, reference implementations exist for Python (FastAPI) and Node.js, and there is a local conformance test suite.

The 4 core endpoints

1. GET /.well-known/ucp — returns your capability manifest JSON
2. POST /checkout-sessions — creates session from line_items
3. PUT /checkout-sessions/{id} — updates with buyer/shipping data
4. POST /checkout-sessions/{id}/complete — finalizes with payment credential

Order webhooks are required before going live but not for initial testing.

Reference implementations

# Python (FastAPI)
cd samples/rest/python/server
pip install uv
uv run server

# Node.js
cd samples/rest/nodejs
npm install
npm run dev

# Python SDK
pip install ucp-sdk

Clone from github.com/Universal-Commerce-Protocol/samples.

Estimated hours

Common implementation errors

Sandbox

No public cloud sandbox. Validation is done by running the conformance suite locally:

git clone https://github.com/Universal-Commerce-Protocol/conformance
# Configure to point at localhost:3000

The conformance suite covers: checkout lifecycle, payment credential handling, order creation, idempotency, webhooks, and input validation.

Eight questions builders actually ask.

The decision: build, defer, or skip.

The spec shipped January 2026. The GitHub repo has 2,966 stars. Cart operations were only added in April 2026. The conformance test suite is still new. The six original co-developers — Shopify, Etsy, Wayfair, Target, Walmart, and Google — are the largest online retailers. When Google AI Mode routes a shopping agent to merchants, UCP compliance is the binary that determines whether the agent can checkout or just browse. The tooling is already there: a Python SDK (pip install ucp-sdk), reference FastAPI and Node.js servers, and a local conformance test suite. For a solo founder with an existing product API, this is an 18–32 hour project. See the full AgentMall 30-Day Roadmap for the surrounding spokes.