{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "tool": { "slug": "ucp", "name": "Universal Commerce Protocol (UCP)", "vendor": "UCP Authors (Google, Shopify and co-developers)", "vendorUrl": "https://ucp.dev", "kind": "protocol", "category": "checkout-protocols", "summary": "The Universal Commerce Protocol (UCP) is an open specification, co-developed by Google, Shopify and other retailers and platforms, for agents to discover a business's capabilities and run catalogue, cart, checkout, identity linking and order flows over REST, MCP or A2A.", "url": "https://www.anchorterminal.com/tools/ucp", "markdownUrl": "https://www.anchorterminal.com/tools/ucp.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/ucp.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/ucp.json", "dns": "ucp.grade.anchorterminal.com", "repo": "https://github.com/Universal-Commerce-Protocol/ucp", "license": "Apache-2.0", "transports": [], "packages": [], "auth": "oauth", "authNotes": "A specification, not a service. Identity linking uses OAuth 2.0 for a platform to act for a user at a business. Agent requests carry a UCP-Agent profile, and signed agents send RFC 9421 HTTP message signatures with a Signature-Agent header and a JWK thumbprint key ID. Payment credentials move through payment handlers and token exchange between payment and credential providers, with AP2 mandates supported.", "pricing": "free", "pricingNotes": "The specification, schemas, SDKs and conformance tests are free under Apache-2.0. Costs come from the business's platform and payment provider, not the protocol.", "priceSummary": "Free ยท OSS", "where": "spec", "x402": { "level": "no", "evidence": "A commerce protocol, not a tool that accepts payment; it supports AP2 mandates and payment handlers (checked 2026-11-06).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 3479, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://ucp.dev/latest/specification/overview/", "llmsTxt": "https://ucp.dev/llms.txt", "openapi": "https://github.com/Universal-Commerce-Protocol/ucp/blob/main/source/services/shopping/rest.openapi.json", "capabilities": [ "payments.protocol", "payments.checkout", "payments.mandate" ], "tags": [ "protocol", "open-standard", "open-source", "mcp", "a2a", "ap2", "openapi", "openrpc", "llms-txt", "shopify", "google", "commerce" ], "lastRelease": "2026-08-25", "graded": true, "anchor": { "graded": true, "score": 72, "grade": "BB", "agentReady": true, "rank": 0, "ranked": false, "notRankedWhy": "A protocol, graded on the same scale but not ranked against tools", "rankOf": 1486, "categoryRank": 1, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 82, "maintenance": 70, "payments": 50, "reliability": 79, "schema": 90, "security": 67, "transparency": 47 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 79, "points": 15.8, "reason": "Protocol reading, split as reference implementations 30, live deployments 25, spec stability 25 and test vectors 20. Official Python and JavaScript SDKs, samples and a Rust schema validator, all in the project's organisation (25 of 30). Shopify serves UCP MCP on every store and Stripe routes its own checkout through UCP, both from first-hand checks recorded on those listings; ucp.dev lists about 50 endorsers, which are claims (20 of 25). Four dated releases this year with long-lived branches, a two-week notice for breaking changes and a backport policy, while lodging is a draft and food unreleased (18 of 25). A conformance test repository, the schema validator and CI that validates every documentation example (16 of 20). 25 + 20 + 18 + 16 = 79.", "checked": "2026-11-06" }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 90, "points": 14.63, "reason": "OpenAPI for each REST service, OpenRPC for the MCP and embedded bindings and JSON Schema 2020-12 throughout (25). ucp.dev serves llms.txt, and AGENT_IMPLEMENTER.md guides agents implementing the spec (10). The spec gives MUST and SHOULD rules with rationale for negotiation, signatures and permalinks (17). Typed schemas with required fields, namespaced extension types and version requirements (13). Examples validated in CI and an error code table with continue_url handling (13). Dated versions with release tags and release-note drafts generated from tags; no separate changelog page was read (12). 25 + 10 + 17 + 13 + 13 + 12 = 90.", "checked": "2026-11-06" }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 82, "points": 13.33, "reason": "Protocol reading. Capability negotiation means an agent sees only what both sides support, though the schemas are large (18 of 25). Catalogue search pages with a cursor and has_next_page (15 of 20). An error model with codes and continue_url to hand a buyer to the business when the agent can't finish (18). The MCP binding requires an idempotency-key UUID on checkout calls for retry safety (18). Official SDKs in Python and JavaScript; every request needs a UCP-Agent profile (13 of 15). 18 + 15 + 18 + 18 + 13 = 82.", "checked": "2026-11-06" }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 67, "points": 11.73, "reason": "OAuth 2.0 identity linking, RFC 9421 signatures for signed agents with key IDs bound to JWK thumbprints, and payment handlers with token exchange instead of raw card data (25 of 30). Checkout can hand back to the buyer through continue_url or an embedded checkout, and AP2 mandates record consent, but unattended completion is allowed by design (15 of 20). The permalink spec treats URL inputs as untrusted and requires server-side validation, but we found no guidance on product text reaching an agent (5 of 15). Order events go to business webhooks; we didn't read whether they are signed (8 of 15). SECURITY.md routes reports to Google's intake with a stated response time and GitHub advisories (14 of 20). 25 + 15 + 5 + 8 + 14 = 67.", "checked": "2026-11-06" }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 50, "points": 6.25, "reason": "Protocol reading. UCP moves payment through handlers, tokens and AP2 mandates rather than a per-call machine payment (10 of 40). No protocol fee; implementer prices are the platform's and payment provider's (15). The spec, SDKs and samples are free (20). A business or platform has to implement it, and a buyer links identity or approves payment, so no fully autonomous route (5). 10 + 15 + 20 + 5 = 50.", "checked": "2026-11-06" }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 70, "points": 6.13, "reason": "The latest release is v2026-08-25, 73 days before this check (20). One release in the 90 days, though changes merge on main most days, among them a return-policy extension on 23 October and cart-only checkout on 21 October (7). Pull requests from Google, Shopify and outside contributors merge within days; 262 issues and pull requests are open (18). Official SDKs, updated 5 November (15). CI with linting, spellcheck, governance checks and example validation, and Dependabot updates (10). 20 + 7 + 18 + 15 + 10 = 70.", "checked": "2026-11-06" }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 47, "points": 4.11, "note": "editorial 62, provenance 32", "reason": "Apache-2.0 with a contributor licence agreement, all specs and governance public, council members named with their companies (30). ucp.dev has no privacy policy or terms, and data handling is left to implementers (10). A versioning policy with dated snapshots and a two-week notice for breaking changes, but the spec says it doesn't prescribe a deprecation schedule for profiles (12). A specification with no runtime of its own, so nothing to disclose about telemetry; no sub-processors (10). 30 + 10 + 12 + 10 = 62.", "checked": "2026-11-06" } ], "assessment": { "date": "2026-11-06", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "Protocol reading. Capability negotiation means an agent sees only what both sides support, though the schemas are large (18 of 25). Catalogue search pages with a cursor and has_next_page (15 of 20). An error model with codes and continue_url to hand a buyer to the business when the agent can't finish (18). The MCP binding requires an idempotency-key UUID on checkout calls for retry safety (18). Official SDKs in Python and JavaScript; every request needs a UCP-Agent profile (13 of 15). 18 + 15 + 18 + 18 + 13 = 82.", "maintenance": "The latest release is v2026-08-25, 73 days before this check (20). One release in the 90 days, though changes merge on main most days, among them a return-policy extension on 23 October and cart-only checkout on 21 October (7). Pull requests from Google, Shopify and outside contributors merge within days; 262 issues and pull requests are open (18). Official SDKs, updated 5 November (15). CI with linting, spellcheck, governance checks and example validation, and Dependabot updates (10). 20 + 7 + 18 + 15 + 10 = 70.", "payments": "Protocol reading. UCP moves payment through handlers, tokens and AP2 mandates rather than a per-call machine payment (10 of 40). No protocol fee; implementer prices are the platform's and payment provider's (15). The spec, SDKs and samples are free (20). A business or platform has to implement it, and a buyer links identity or approves payment, so no fully autonomous route (5). 10 + 15 + 20 + 5 = 50.", "reliability": "Protocol reading, split as reference implementations 30, live deployments 25, spec stability 25 and test vectors 20. Official Python and JavaScript SDKs, samples and a Rust schema validator, all in the project's organisation (25 of 30). Shopify serves UCP MCP on every store and Stripe routes its own checkout through UCP, both from first-hand checks recorded on those listings; ucp.dev lists about 50 endorsers, which are claims (20 of 25). Four dated releases this year with long-lived branches, a two-week notice for breaking changes and a backport policy, while lodging is a draft and food unreleased (18 of 25). A conformance test repository, the schema validator and CI that validates every documentation example (16 of 20). 25 + 20 + 18 + 16 = 79.", "schema": "OpenAPI for each REST service, OpenRPC for the MCP and embedded bindings and JSON Schema 2020-12 throughout (25). ucp.dev serves llms.txt, and AGENT_IMPLEMENTER.md guides agents implementing the spec (10). The spec gives MUST and SHOULD rules with rationale for negotiation, signatures and permalinks (17). Typed schemas with required fields, namespaced extension types and version requirements (13). Examples validated in CI and an error code table with continue_url handling (13). Dated versions with release tags and release-note drafts generated from tags; no separate changelog page was read (12). 25 + 10 + 17 + 13 + 13 + 12 = 90.", "security": "OAuth 2.0 identity linking, RFC 9421 signatures for signed agents with key IDs bound to JWK thumbprints, and payment handlers with token exchange instead of raw card data (25 of 30). Checkout can hand back to the buyer through continue_url or an embedded checkout, and AP2 mandates record consent, but unattended completion is allowed by design (15 of 20). The permalink spec treats URL inputs as untrusted and requires server-side validation, but we found no guidance on product text reaching an agent (5 of 15). Order events go to business webhooks; we didn't read whether they are signed (8 of 15). SECURITY.md routes reports to Google's intake with a stated response time and GitHub advisories (14 of 20). 25 + 15 + 5 + 8 + 14 = 67.", "transparency": "Apache-2.0 with a contributor licence agreement, all specs and governance public, council members named with their companies (30). ucp.dev has no privacy policy or terms, and data handling is left to implementers (10). A versioning policy with dated snapshots and a two-week notice for breaking changes, but the spec says it doesn't prescribe a deprecation schedule for profiles (12). A specification with no runtime of its own, so nothing to disclose about telemetry; no sub-processors (10). 30 + 10 + 12 + 10 = 62." }, "sources": [ { "what": "specification repository", "url": "https://github.com/Universal-Commerce-Protocol/ucp", "seen": "2026-11-06" }, { "what": "spec overview", "url": "https://ucp.dev/latest/specification/overview/", "seen": "2026-11-06" }, { "what": "home page", "url": "https://ucp.dev/", "seen": "2026-11-06" }, { "what": "versioning policy", "url": "https://github.com/Universal-Commerce-Protocol/ucp/blob/main/docs/versioning.md", "seen": "2026-11-06" }, { "what": "maintainers", "url": "https://github.com/Universal-Commerce-Protocol/.github/blob/main/MAINTAINERS.md", "seen": "2026-11-06" }, { "what": "governance", "url": "https://github.com/Universal-Commerce-Protocol/.github/blob/main/GOVERNANCE.md", "seen": "2026-11-06" }, { "what": "security policy", "url": "https://github.com/Universal-Commerce-Protocol/.github/blob/main/SECURITY.md", "seen": "2026-11-06" }, { "what": "organisation repositories", "url": "https://github.com/orgs/Universal-Commerce-Protocol/repositories", "seen": "2026-11-06" } ], "openQuestions": [ "unchecked: whether UCP order webhooks are signed.", "unchecked: release notes on GitHub for each tag.", "Adoption beyond Shopify and Stripe; the endorser list on ucp.dev is a claim." ] }, "negative": 0, "verdict": "OpenAPI, OpenRPC and JSON Schema for every surface, official Python and JavaScript SDKs, conformance tests and live use on Shopify stores and Stripe's checkout. Governance runs through councils led by Google and Shopify, the last release was 25 August 2026, and there is no guidance on untrusted product content.", "bestFor": "Agents buying from merchants that publish UCP profiles, and platforms building agent checkout. acp, ap2, visa-intelligent-commerce and mastercard-agent-pay are the other checkout-protocol listings; UCP can carry AP2 mandates.", "strengths": [ "Machine-readable contracts for every transport, OpenAPI, OpenRPC and JSON Schema 2020-12", "Official Python and JavaScript SDKs, a schema validator and a conformance test suite", "Idempotency keys required on MCP checkout calls", "Live on every Shopify store and as Stripe's own-checkout route", "Breaking changes announced two weeks before they merge" ], "weaknesses": [ "No release since v2026-08-25, though main changes most days", "No guidance on product descriptions or business messages as untrusted content for agents", "Lodging is a draft and food ordering unreleased", "Governing and tech councils are led by Google and Shopify members" ], "agentNotes": [ "Read the business profile first and call only the capabilities both profiles declare", "Send a fresh idempotency-key UUID on each checkout call and reuse it on retry", "Hand the buyer the continue_url when a checkout needs a person instead of retrying", "Send a UCP-Agent profile, and sign requests with RFC 9421 if the business requires signed agents" ], "metrics": { "kind": "spec", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 72 } ], "editorialScores": { "ergonomics": 82, "maintenance": 70, "payments": 50, "reliability": 79, "schema": 90, "security": 67, "transparency": 62 }, "provenanceScore": 32, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 }, "scoreHistory": [ { "date": "2026-11-06", "grade": "BB", "kind": "listed", "method": "0.7", "score": 72 } ] }, "connect": {}, "letme": { "capability": "https://letme.dev/payments.protocol", "tool": "https://letme.dev/ucp" }, "notable": [ "Four dated releases, v2026-01-11, v2026-01-23, v2026-04-08 and v2026-08-25, each with a long-lived release branch (https://github.com/Universal-Commerce-Protocol/ucp)", "Breaking changes are announced in Discussions two weeks before they merge, and backports to a release need Governance Council approval if they break (docs/versioning.md)", "OpenAPI files for shopping, lodging, common and permalink REST services and OpenRPC files for the MCP and embedded bindings, with JSON Schema 2020-12 schemas (source/services, source/schemas)", "Official Python and JavaScript SDKs, a Rust schema validator, conformance tests and samples, all updated in November 2026 (https://github.com/orgs/Universal-Commerce-Protocol/repositories)", "The Shopping Tech Council has members from Google, Shopify, Etsy, Meta, Amazon, Target, Microsoft, Stripe, Salesforce and Wayfair; a Food Tech Council has six open seats (https://github.com/Universal-Commerce-Protocol/.github/blob/main/MAINTAINERS.md)", "Shopify serves UCP MCP on every store at https://{shop}/api/ucp/mcp (data/tools/shopify.json), and Stripe's own-checkout route is UCP (data/tools/acp.json, docs.stripe.com read 2 November 2026)", "Lodging has a draft specification and food ordering is marked coming soon (https://ucp.dev/)" ], "area": "payments", "details": [ { "label": "Surface listed", "value": "The specification, schemas and docs in Universal-Commerce-Protocol/ucp (shallow clone, release tags and branches), the organisation's MAINTAINERS, GOVERNANCE and SECURITY files, the repository list and ucp.dev on 6 November 2026" }, { "label": "Spec", "value": "Capabilities (catalogue, cart, checkout, identity linking, order, booking draft) and extensions under dev.ucp namespaces, negotiated between a business profile and a platform profile" }, { "label": "Status", "value": "Shopping released in dated versions, the latest 2026-08-25; lodging draft; food coming soon" }, { "label": "How it works", "value": "A business publishes a profile of supported capabilities and transports; the platform advertises its own; the intersection decides what the agent may call. Checkout can finish without a person or hand over through continue_url or an embedded checkout" }, { "label": "Transports", "value": "REST and JSON-RPC, an MCP binding, A2A, and an embedded checkout protocol" }, { "label": "Agent autonomy", "value": "Checkout sessions run with or without human intervention; AP2 mandates and verifiable credentials are the route for an agent to pay with proof of consent" }, { "label": "Adopters", "value": "Shopify (UCP MCP on every store) and Stripe (own-checkout route), per other listings' first-hand checks; ucp.dev lists about 50 endorsers, among them Adyen, Visa, Mastercard, PayPal, Klarna and Walmart as a co-developer" }, { "label": "Governance", "value": "A Governing Council and Domain Tech Councils elect maintainers; changes need at least one maintainer approval; contributions need a contributor licence agreement" } ], "provenance": { "legalEntity": "", "domain": "ucp.dev", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://github.com/Universal-Commerce-Protocol/ucp/releases", "securityTxt": "unknown", "checked": "2026-11-06", "notes": [ "Files carry \"Copyright 2026 UCP Authors\" under Apache-2.0. No legal entity runs the project; governance is by councils whose members are named with their companies.", "Security reports go to Google's g.co/vulnz with a five-working-day response, coordinated through GitHub Security Advisories (SECURITY.md in the .github repository).", "ucp.dev has no robots.txt and serves llms.txt. No terms or privacy policy found for the site.", "The registration date of ucp.dev wasn't found through RDAP." ], "score": 32, "checks": [ { "check": "Legal entity named", "value": "not found", "points": 0, "max": 20, "state": "no" }, { "check": "Domain age", "value": "ucp.dev, no registry record we could read", "points": 0, "max": 15, "state": "no" }, { "check": "Endpoint on the vendor's domain", "value": "ucp.dev", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Privacy policy", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Status page", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "could not be fetched", "points": 0, "max": 10, "state": "no" }, { "check": "People named", "value": "2 named with their role, none with a public profile", "points": 7, "max": 10, "state": "part" }, { "check": "Support route", "value": "help pages, a community", "points": 5, "max": 5, "state": "ok" } ] }, "humans": { "slug": "ucp", "checked": "2026-11-06", "company": "Universal Commerce Protocol (UCP Authors)", "people": [ { "name": "Amit Handa", "role": "Standing Governing Council member and Shopping and Food Tech Council member, UCP (Google)", "page": "/people/amit-handa/" }, { "name": "Ilya Grigorik", "role": "Shopping Tech Council member, UCP (Shopify)", "page": "/people/ilya-grigorik/" } ], "peopleNote": "MAINTAINERS.md in the project's .github repository, read 6 November 2026, lists the Shopping Tech Council (17 members from Google, Shopify, Etsy, Meta, Amazon, Target, Microsoft, Stripe, Salesforce and Wayfair) and the Food Tech Council, and marks Amit Handa as a standing Governing Council member. Two members are listed here as named first-hand; the others are on that page. UCP is a project, not a company, so it has no investors. GOVERNANCE.md names Google and Shopify as the founding organisations, with permanent Governing Council seats; it calls no person a founder, so nobody is marked founder.", "companySocial": { "github": "https://github.com/Universal-Commerce-Protocol" }, "support": { "urls": [ "https://ucp.dev/" ], "community": [ { "label": "UCP Discussions", "url": "https://github.com/Universal-Commerce-Protocol/ucp/discussions", "kind": "github" }, { "label": "UCP issues", "url": "https://github.com/Universal-Commerce-Protocol/ucp/issues", "kind": "github" } ], "contactUrls": [ "https://g.co/vulnz" ] }, "sources": [ "https://github.com/Universal-Commerce-Protocol/.github/blob/main/MAINTAINERS.md", "https://github.com/Universal-Commerce-Protocol/.github/blob/main/GOVERNANCE.md", "https://ucp.dev/" ], "ownership": { "status": "project", "checked": "2026-11-06", "sources": [ "https://github.com/Universal-Commerce-Protocol/.github/blob/main/GOVERNANCE.md", "https://ucp.dev/" ] } }, "pageJsonUrl": "https://www.anchorterminal.com/tools/ucp.json", "live": { "slug": "ucp", "versions": [ { "registry": "github", "name": "Universal-Commerce-Protocol/ucp", "version": "v2026-08-25", "released": "2026-08-25", "seenAt": "2026-11-07T00:13:40.257304662Z" } ], "githubStars": 3480, "securityTxt": { "url": "https://ucp.dev/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:23.109475398Z" }, "llmsTxt": { "url": "https://ucp.dev/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:34:12.746672159Z" }, "updatedAt": "2026-11-07T16:00:23.109475398Z" } } }