{ "data": { "similar": [ { "grade": "C", "json": "https://www.anchorterminal.com/tools/ap2.json", "name": "Agent Payments Protocol (AP2)", "score": 54.6, "shared": [ "payments.protocol", "payments.mandate" ], "slug": "ap2" }, { "grade": "D", "json": "https://www.anchorterminal.com/tools/visa-intelligent-commerce.json", "name": "Visa Intelligent Commerce", "score": 48.1, "shared": [ "payments.protocol", "payments.mandate" ], "slug": "visa-intelligent-commerce" }, { "grade": "E", "json": "https://www.anchorterminal.com/tools/mastercard-agent-pay.json", "name": "Mastercard Agent Pay", "score": 42.7, "shared": [ "payments.protocol", "payments.mandate" ], "slug": "mastercard-agent-pay" }, { "grade": "F", "json": "https://www.anchorterminal.com/tools/amex-ace.json", "name": "American Express Agentic Commerce Experiences (ACE)", "score": 25.4, "shared": [ "payments.protocol", "payments.mandate" ], "slug": "amex-ace" }, { "grade": "A", "json": "https://www.anchorterminal.com/tools/stripe-mcp.json", "name": "Stripe API + MCP", "score": 84.9, "shared": [ "payments.checkout" ], "slug": "stripe-mcp" }, { "grade": "A", "json": "https://www.anchorterminal.com/tools/mpp.json", "name": "Machine Payments Protocol (MPP)", "score": 81.7, "shared": [ "payments.protocol" ], "slug": "mpp" } ], "tool": { "slug": "ucp", "name": "Universal Commerce Protocol (UCP)", "vendor": "UCP Authors (Google, Shopify and co-developers)", "vendorUrl": "https://ucp.dev", "kind": "protocol", "category": "checkout-protocols", "summary": "The Universal Commerce Protocol (UCP) is an open specification, co-developed by Google, Shopify and other retailers and platforms, for agents to discover a business's capabilities and run catalogue, cart, checkout, identity linking and order flows over REST, MCP or A2A.", "url": "https://www.anchorterminal.com/tools/ucp", "markdownUrl": "https://www.anchorterminal.com/tools/ucp.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/ucp.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/ucp.json", "dns": "ucp.grade.anchorterminal.com", "repo": "https://github.com/Universal-Commerce-Protocol/ucp", "license": "Apache-2.0", "transports": [], "packages": [], "auth": "oauth", "authNotes": "A specification, not a service. Identity linking uses OAuth 2.0 for a platform to act for a user at a business. Agent requests carry a UCP-Agent profile, and signed agents send RFC 9421 HTTP message signatures with a Signature-Agent header and a JWK thumbprint key ID. Payment credentials move through payment handlers and token exchange between payment and credential providers, with AP2 mandates supported.", "pricing": "free", "pricingNotes": "The specification, schemas, SDKs and conformance tests are free under Apache-2.0. Costs come from the business's platform and payment provider, not the protocol.", "priceSummary": "Free · OSS", "where": "spec", "x402": { "level": "no", "evidence": "A commerce protocol, not a tool that accepts payment; it supports AP2 mandates and payment handlers (checked 2026-11-06).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 3479, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://ucp.dev/latest/specification/overview/", "llmsTxt": "https://ucp.dev/llms.txt", "openapi": "https://github.com/Universal-Commerce-Protocol/ucp/blob/main/source/services/shopping/rest.openapi.json", "capabilities": [ "payments.protocol", "payments.checkout", "payments.mandate" ], "tags": [ "protocol", "open-standard", "open-source", "mcp", "a2a", "ap2", "openapi", "openrpc", "llms-txt", "shopify", "google", "commerce" ], "lastRelease": "2026-08-25", "graded": true, "anchor": { "graded": true, "score": 72, "grade": "BB", "agentReady": true, "rank": 0, "ranked": false, "notRankedWhy": "A protocol, graded on the same scale but not ranked against tools", "rankOf": 1486, "categoryRank": 1, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 82, "maintenance": 70, "payments": 50, "reliability": 79, "schema": 90, "security": 67, "transparency": 47 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 79, "points": 15.8, "reason": "Protocol reading, split as reference implementations 30, live deployments 25, spec stability 25 and test vectors 20. Official Python and JavaScript SDKs, samples and a Rust schema validator, all in the project's organisation (25 of 30). Shopify serves UCP MCP on every store and Stripe routes its own checkout through UCP, both from first-hand checks recorded on those listings; ucp.dev lists about 50 endorsers, which are claims (20 of 25). Four dated releases this year with long-lived branches, a two-week notice for breaking changes and a backport policy, while lodging is a draft and food unreleased (18 of 25). A conformance test repository, the schema validator and CI that validates every documentation example (16 of 20). 25 + 20 + 18 + 16 = 79.", "checked": "2026-11-06" }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 90, "points": 14.63, "reason": "OpenAPI for each REST service, OpenRPC for the MCP and embedded bindings and JSON Schema 2020-12 throughout (25). ucp.dev serves llms.txt, and AGENT_IMPLEMENTER.md guides agents implementing the spec (10). The spec gives MUST and SHOULD rules with rationale for negotiation, signatures and permalinks (17). Typed schemas with required fields, namespaced extension types and version requirements (13). Examples validated in CI and an error code table with continue_url handling (13). Dated versions with release tags and release-note drafts generated from tags; no separate changelog page was read (12). 25 + 10 + 17 + 13 + 13 + 12 = 90.", "checked": "2026-11-06" }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 82, "points": 13.33, "reason": "Protocol reading. Capability negotiation means an agent sees only what both sides support, though the schemas are large (18 of 25). Catalogue search pages with a cursor and has_next_page (15 of 20). An error model with codes and continue_url to hand a buyer to the business when the agent can't finish (18). The MCP binding requires an idempotency-key UUID on checkout calls for retry safety (18). Official SDKs in Python and JavaScript; every request needs a UCP-Agent profile (13 of 15). 18 + 15 + 18 + 18 + 13 = 82.", "checked": "2026-11-06" }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 67, "points": 11.73, "reason": "OAuth 2.0 identity linking, RFC 9421 signatures for signed agents with key IDs bound to JWK thumbprints, and payment handlers with token exchange instead of raw card data (25 of 30). Checkout can hand back to the buyer through continue_url or an embedded checkout, and AP2 mandates record consent, but unattended completion is allowed by design (15 of 20). The permalink spec treats URL inputs as untrusted and requires server-side validation, but we found no guidance on product text reaching an agent (5 of 15). Order events go to business webhooks; we didn't read whether they are signed (8 of 15). SECURITY.md routes reports to Google's intake with a stated response time and GitHub advisories (14 of 20). 25 + 15 + 5 + 8 + 14 = 67.", "checked": "2026-11-06" }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 50, "points": 6.25, "reason": "Protocol reading. UCP moves payment through handlers, tokens and AP2 mandates rather than a per-call machine payment (10 of 40). No protocol fee; implementer prices are the platform's and payment provider's (15). The spec, SDKs and samples are free (20). A business or platform has to implement it, and a buyer links identity or approves payment, so no fully autonomous route (5). 10 + 15 + 20 + 5 = 50.", "checked": "2026-11-06" }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 70, "points": 6.13, "reason": "The latest release is v2026-08-25, 73 days before this check (20). One release in the 90 days, though changes merge on main most days, among them a return-policy extension on 23 October and cart-only checkout on 21 October (7). Pull requests from Google, Shopify and outside contributors merge within days; 262 issues and pull requests are open (18). Official SDKs, updated 5 November (15). CI with linting, spellcheck, governance checks and example validation, and Dependabot updates (10). 20 + 7 + 18 + 15 + 10 = 70.", "checked": "2026-11-06" }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 47, "points": 4.11, "note": "editorial 62, provenance 32", "reason": "Apache-2.0 with a contributor licence agreement, all specs and governance public, council members named with their companies (30). ucp.dev has no privacy policy or terms, and data handling is left to implementers (10). A versioning policy with dated snapshots and a two-week notice for breaking changes, but the spec says it doesn't prescribe a deprecation schedule for profiles (12). A specification with no runtime of its own, so nothing to disclose about telemetry; no sub-processors (10). 30 + 10 + 12 + 10 = 62.", "checked": "2026-11-06" } ], "assessment": { "date": "2026-11-06", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "Protocol reading. Capability negotiation means an agent sees only what both sides support, though the schemas are large (18 of 25). Catalogue search pages with a cursor and has_next_page (15 of 20). An error model with codes and continue_url to hand a buyer to the business when the agent can't finish (18). The MCP binding requires an idempotency-key UUID on checkout calls for retry safety (18). Official SDKs in Python and JavaScript; every request needs a UCP-Agent profile (13 of 15). 18 + 15 + 18 + 18 + 13 = 82.", "maintenance": "The latest release is v2026-08-25, 73 days before this check (20). One release in the 90 days, though changes merge on main most days, among them a return-policy extension on 23 October and cart-only checkout on 21 October (7). Pull requests from Google, Shopify and outside contributors merge within days; 262 issues and pull requests are open (18). Official SDKs, updated 5 November (15). CI with linting, spellcheck, governance checks and example validation, and Dependabot updates (10). 20 + 7 + 18 + 15 + 10 = 70.", "payments": "Protocol reading. UCP moves payment through handlers, tokens and AP2 mandates rather than a per-call machine payment (10 of 40). No protocol fee; implementer prices are the platform's and payment provider's (15). The spec, SDKs and samples are free (20). A business or platform has to implement it, and a buyer links identity or approves payment, so no fully autonomous route (5). 10 + 15 + 20 + 5 = 50.", "reliability": "Protocol reading, split as reference implementations 30, live deployments 25, spec stability 25 and test vectors 20. Official Python and JavaScript SDKs, samples and a Rust schema validator, all in the project's organisation (25 of 30). Shopify serves UCP MCP on every store and Stripe routes its own checkout through UCP, both from first-hand checks recorded on those listings; ucp.dev lists about 50 endorsers, which are claims (20 of 25). Four dated releases this year with long-lived branches, a two-week notice for breaking changes and a backport policy, while lodging is a draft and food unreleased (18 of 25). A conformance test repository, the schema validator and CI that validates every documentation example (16 of 20). 25 + 20 + 18 + 16 = 79.", "schema": "OpenAPI for each REST service, OpenRPC for the MCP and embedded bindings and JSON Schema 2020-12 throughout (25). ucp.dev serves llms.txt, and AGENT_IMPLEMENTER.md guides agents implementing the spec (10). The spec gives MUST and SHOULD rules with rationale for negotiation, signatures and permalinks (17). Typed schemas with required fields, namespaced extension types and version requirements (13). Examples validated in CI and an error code table with continue_url handling (13). Dated versions with release tags and release-note drafts generated from tags; no separate changelog page was read (12). 25 + 10 + 17 + 13 + 13 + 12 = 90.", "security": "OAuth 2.0 identity linking, RFC 9421 signatures for signed agents with key IDs bound to JWK thumbprints, and payment handlers with token exchange instead of raw card data (25 of 30). Checkout can hand back to the buyer through continue_url or an embedded checkout, and AP2 mandates record consent, but unattended completion is allowed by design (15 of 20). The permalink spec treats URL inputs as untrusted and requires server-side validation, but we found no guidance on product text reaching an agent (5 of 15). Order events go to business webhooks; we didn't read whether they are signed (8 of 15). SECURITY.md routes reports to Google's intake with a stated response time and GitHub advisories (14 of 20). 25 + 15 + 5 + 8 + 14 = 67.", "transparency": "Apache-2.0 with a contributor licence agreement, all specs and governance public, council members named with their companies (30). ucp.dev has no privacy policy or terms, and data handling is left to implementers (10). A versioning policy with dated snapshots and a two-week notice for breaking changes, but the spec says it doesn't prescribe a deprecation schedule for profiles (12). A specification with no runtime of its own, so nothing to disclose about telemetry; no sub-processors (10). 30 + 10 + 12 + 10 = 62." }, "sources": [ { "what": "specification repository", "url": "https://github.com/Universal-Commerce-Protocol/ucp", "seen": "2026-11-06" }, { "what": "spec overview", "url": "https://ucp.dev/latest/specification/overview/", "seen": "2026-11-06" }, { "what": "home page", "url": "https://ucp.dev/", "seen": "2026-11-06" }, { "what": "versioning policy", "url": "https://github.com/Universal-Commerce-Protocol/ucp/blob/main/docs/versioning.md", "seen": "2026-11-06" }, { "what": "maintainers", "url": "https://github.com/Universal-Commerce-Protocol/.github/blob/main/MAINTAINERS.md", "seen": "2026-11-06" }, { "what": "governance", "url": "https://github.com/Universal-Commerce-Protocol/.github/blob/main/GOVERNANCE.md", "seen": "2026-11-06" }, { "what": "security policy", "url": "https://github.com/Universal-Commerce-Protocol/.github/blob/main/SECURITY.md", "seen": "2026-11-06" }, { "what": "organisation repositories", "url": "https://github.com/orgs/Universal-Commerce-Protocol/repositories", "seen": "2026-11-06" } ], "openQuestions": [ "unchecked: whether UCP order webhooks are signed.", "unchecked: release notes on GitHub for each tag.", "Adoption beyond Shopify and Stripe; the endorser list on ucp.dev is a claim." ] }, "negative": 0, "verdict": "OpenAPI, OpenRPC and JSON Schema for every surface, official Python and JavaScript SDKs, conformance tests and live use on Shopify stores and Stripe's checkout. Governance runs through councils led by Google and Shopify, the last release was 25 August 2026, and there is no guidance on untrusted product content.", "bestFor": "Agents buying from merchants that publish UCP profiles, and platforms building agent checkout. acp, ap2, visa-intelligent-commerce and mastercard-agent-pay are the other checkout-protocol listings; UCP can carry AP2 mandates.", "strengths": [ "Machine-readable contracts for every transport, OpenAPI, OpenRPC and JSON Schema 2020-12", "Official Python and JavaScript SDKs, a schema validator and a conformance test suite", "Idempotency keys required on MCP checkout calls", "Live on every Shopify store and as Stripe's own-checkout route", "Breaking changes announced two weeks before they merge" ], "weaknesses": [ "No release since v2026-08-25, though main changes most days", "No guidance on product descriptions or business messages as untrusted content for agents", "Lodging is a draft and food ordering unreleased", "Governing and tech councils are led by Google and Shopify members" ], "agentNotes": [ "Read the business profile first and call only the capabilities both profiles declare", "Send a fresh idempotency-key UUID on each checkout call and reuse it on retry", "Hand the buyer the continue_url when a checkout needs a person instead of retrying", "Send a UCP-Agent profile, and sign requests with RFC 9421 if the business requires signed agents" ], "metrics": { "kind": "spec", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 72 } ], "editorialScores": { "ergonomics": 82, "maintenance": 70, "payments": 50, "reliability": 79, "schema": 90, "security": 67, "transparency": 62 }, "provenanceScore": 32, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 }, "scoreHistory": [ { "date": "2026-11-06", "grade": "BB", "kind": "listed", "method": "0.7", "score": 72 } ] }, "connect": {}, "letme": { "capability": "https://letme.dev/payments.protocol", "tool": "https://letme.dev/ucp" }, "notable": [ "Four dated releases, v2026-01-11, v2026-01-23, v2026-04-08 and v2026-08-25, each with a long-lived release branch (https://github.com/Universal-Commerce-Protocol/ucp)", "Breaking changes are announced in Discussions two weeks before they merge, and backports to a release need Governance Council approval if they break (docs/versioning.md)", "OpenAPI files for shopping, lodging, common and permalink REST services and OpenRPC files for the MCP and embedded bindings, with JSON Schema 2020-12 schemas (source/services, source/schemas)", "Official Python and JavaScript SDKs, a Rust schema validator, conformance tests and samples, all updated in November 2026 (https://github.com/orgs/Universal-Commerce-Protocol/repositories)", "The Shopping Tech Council has members from Google, Shopify, Etsy, Meta, Amazon, Target, Microsoft, Stripe, Salesforce and Wayfair; a Food Tech Council has six open seats (https://github.com/Universal-Commerce-Protocol/.github/blob/main/MAINTAINERS.md)", "Shopify serves UCP MCP on every store at https://{shop}/api/ucp/mcp (data/tools/shopify.json), and Stripe's own-checkout route is UCP (data/tools/acp.json, docs.stripe.com read 2 November 2026)", "Lodging has a draft specification and food ordering is marked coming soon (https://ucp.dev/)" ], "area": "payments", "details": [ { "label": "Surface listed", "value": "The specification, schemas and docs in Universal-Commerce-Protocol/ucp (shallow clone, release tags and branches), the organisation's MAINTAINERS, GOVERNANCE and SECURITY files, the repository list and ucp.dev on 6 November 2026" }, { "label": "Spec", "value": "Capabilities (catalogue, cart, checkout, identity linking, order, booking draft) and extensions under dev.ucp namespaces, negotiated between a business profile and a platform profile" }, { "label": "Status", "value": "Shopping released in dated versions, the latest 2026-08-25; lodging draft; food coming soon" }, { "label": "How it works", "value": "A business publishes a profile of supported capabilities and transports; the platform advertises its own; the intersection decides what the agent may call. Checkout can finish without a person or hand over through continue_url or an embedded checkout" }, { "label": "Transports", "value": "REST and JSON-RPC, an MCP binding, A2A, and an embedded checkout protocol" }, { "label": "Agent autonomy", "value": "Checkout sessions run with or without human intervention; AP2 mandates and verifiable credentials are the route for an agent to pay with proof of consent" }, { "label": "Adopters", "value": "Shopify (UCP MCP on every store) and Stripe (own-checkout route), per other listings' first-hand checks; ucp.dev lists about 50 endorsers, among them Adyen, Visa, Mastercard, PayPal, Klarna and Walmart as a co-developer" }, { "label": "Governance", "value": "A Governing Council and Domain Tech Councils elect maintainers; changes need at least one maintainer approval; contributions need a contributor licence agreement" } ], "provenance": { "legalEntity": "", "domain": "ucp.dev", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://github.com/Universal-Commerce-Protocol/ucp/releases", "securityTxt": "unknown", "checked": "2026-11-06", "notes": [ "Files carry \"Copyright 2026 UCP Authors\" under Apache-2.0. No legal entity runs the project; governance is by councils whose members are named with their companies.", "Security reports go to Google's g.co/vulnz with a five-working-day response, coordinated through GitHub Security Advisories (SECURITY.md in the .github repository).", "ucp.dev has no robots.txt and serves llms.txt. No terms or privacy policy found for the site.", "The registration date of ucp.dev wasn't found through RDAP." ], "score": 32, "checks": [ { "check": "Legal entity named", "value": "not found", "points": 0, "max": 20, "state": "no" }, { "check": "Domain age", "value": "ucp.dev, no registry record we could read", "points": 0, "max": 15, "state": "no" }, { "check": "Endpoint on the vendor's domain", "value": "ucp.dev", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Privacy policy", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Status page", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "could not be fetched", "points": 0, "max": 10, "state": "no" }, { "check": "People named", "value": "2 named with their role, none with a public profile", "points": 7, "max": 10, "state": "part" }, { "check": "Support route", "value": "help pages, a community", "points": 5, "max": 5, "state": "ok" } ] }, "humans": { "slug": "ucp", "checked": "2026-11-06", "company": "Universal Commerce Protocol (UCP Authors)", "people": [ { "name": "Amit Handa", "role": "Standing Governing Council member and Shopping and Food Tech Council member, UCP (Google)", "page": "/people/amit-handa/" }, { "name": "Ilya Grigorik", "role": "Shopping Tech Council member, UCP (Shopify)", "page": "/people/ilya-grigorik/" } ], "peopleNote": "MAINTAINERS.md in the project's .github repository, read 6 November 2026, lists the Shopping Tech Council (17 members from Google, Shopify, Etsy, Meta, Amazon, Target, Microsoft, Stripe, Salesforce and Wayfair) and the Food Tech Council, and marks Amit Handa as a standing Governing Council member. Two members are listed here as named first-hand; the others are on that page. UCP is a project, not a company, so it has no investors. GOVERNANCE.md names Google and Shopify as the founding organisations, with permanent Governing Council seats; it calls no person a founder, so nobody is marked founder.", "companySocial": { "github": "https://github.com/Universal-Commerce-Protocol" }, "support": { "urls": [ "https://ucp.dev/" ], "community": [ { "label": "UCP Discussions", "url": "https://github.com/Universal-Commerce-Protocol/ucp/discussions", "kind": "github" }, { "label": "UCP issues", "url": "https://github.com/Universal-Commerce-Protocol/ucp/issues", "kind": "github" } ], "contactUrls": [ "https://g.co/vulnz" ] }, "sources": [ "https://github.com/Universal-Commerce-Protocol/.github/blob/main/MAINTAINERS.md", "https://github.com/Universal-Commerce-Protocol/.github/blob/main/GOVERNANCE.md", "https://ucp.dev/" ], "ownership": { "status": "project", "checked": "2026-11-06", "sources": [ "https://github.com/Universal-Commerce-Protocol/.github/blob/main/GOVERNANCE.md", "https://ucp.dev/" ] } }, "pageJsonUrl": "https://www.anchorterminal.com/tools/ucp.json", "live": { "slug": "ucp", "versions": [ { "registry": "github", "name": "Universal-Commerce-Protocol/ucp", "version": "v2026-08-25", "released": "2026-08-25", "seenAt": "2026-11-07T00:13:40.257304662Z" } ], "githubStars": 3480, "securityTxt": { "url": "https://ucp.dev/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:23.109475398Z" }, "llmsTxt": { "url": "https://ucp.dev/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:34:12.746672159Z" }, "updatedAt": "2026-11-07T16:00:23.109475398Z" } }, "verify": { "accepts": "a page on ucp.dev or one of its subdomains, or the README at the root of github.com/Universal-Commerce-Protocol/ucp", "badgeUrl": "https://www.anchorterminal.com/badges/ucp.svg", "body": { "slug": "ucp", "url": "the page with the badge or the link" }, "docs": "https://www.anchorterminal.com/builders/#verify", "effect": "none, it never changes a grade, rank or review", "endpoint": "https://www.anchorterminal.com/api/v1/verify", "listingUrl": "https://www.anchorterminal.com/tools/ucp", "mcpTool": "verify_listing", "recheck": "weekly; two failed checks in a row and it lapses, a later pass restores it", "snippets": { "html": "\u003ca href=\"https://www.anchorterminal.com/tools/ucp\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/ucp.svg\" alt=\"Universal Commerce Protocol (UCP) on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e", "markdown": "[![Universal Commerce Protocol (UCP) on Anchor Terminal](https://www.anchorterminal.com/badges/ucp.svg)](https://www.anchorterminal.com/tools/ucp)", "link": "\u003ca href=\"https://www.anchorterminal.com/tools/ucp\"\u003eUniversal Commerce Protocol (UCP) on Anchor Terminal\u003c/a\u003e" } } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/tools/ucp", "json": "https://www.anchorterminal.com/tools/ucp.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/tools/ucp.md", "mcp": "https://www.anchorterminal.com/mcp", "pricing": "https://www.anchorterminal.com/tools/ucp#pricing", "reviews": "https://www.anchorterminal.com/tools/ucp#reviews", "slim": "https://www.anchorterminal.com/tools/ucp.min.md" }, "markdown": "## Overview\n\n**Grade BB · 72/100 · rank graded, not ranked against tools · #1 in Agent checkout protocols · agent-ready · confidence medium**\n\n\n## Assessment\n\nOpenAPI, OpenRPC and JSON Schema for every surface, official Python and JavaScript SDKs, conformance tests and live use on Shopify stores and Stripe's checkout. Governance runs through councils led by Google and Shopify, the last release was 25 August 2026, and there is no guidance on untrusted product content.\n\n## Facts\n\n| Field | Value |\n| --- | --- |\n| Vendor | UCP Authors (Google, Shopify and co-developers) (https://ucp.dev) |\n| Kind | Payment protocol |\n| Category | Agent checkout protocols (https://www.anchorterminal.com/categories/checkout-protocols) |\n| Auth | OAuth · A specification, not a service. Identity linking uses OAuth 2.0 for a platform to act for a user at a business. Agent requests carry a UCP-Agent profile, and signed agents send RFC 9421 HTTP message signatures with a Signature-Agent header and a JWK thumbprint key ID. Payment credentials move through payment handlers and token exchange between payment and credential providers, with AP2 mandates supported. |\n| Pricing | Free (Free · OSS) · The specification, schemas, SDKs and conformance tests are free under Apache-2.0. Costs come from the business's platform and payment provider, not the protocol. |\n| Licence | Apache-2.0 |\n| Source | https://github.com/Universal-Commerce-Protocol/ucp |\n| Docs | https://ucp.dev/latest/specification/overview/ |\n| llms.txt | https://ucp.dev/llms.txt |\n| Last release | 2026-08-25 |\n| GitHub stars | 3,479 (as of 2026-11-06) |\n| Surface listed | The specification, schemas and docs in Universal-Commerce-Protocol/ucp (shallow clone, release tags and branches), the organisation's MAINTAINERS, GOVERNANCE and SECURITY files, the repository list and ucp.dev on 6 November 2026 |\n| Spec | Capabilities (catalogue, cart, checkout, identity linking, order, booking draft) and extensions under dev.ucp namespaces, negotiated between a business profile and a platform profile |\n| Status | Shopping released in dated versions, the latest 2026-08-25; lodging draft; food coming soon |\n| How it works | A business publishes a profile of supported capabilities and transports; the platform advertises its own; the intersection decides what the agent may call. Checkout can finish without a person or hand over through continue_url or an embedded checkout |\n| Transports | REST and JSON-RPC, an MCP binding, A2A, and an embedded checkout protocol |\n| Agent autonomy | Checkout sessions run with or without human intervention; AP2 mandates and verifiable credentials are the route for an agent to pay with proof of consent |\n| Adopters | Shopify (UCP MCP on every store) and Stripe (own-checkout route), per other listings' first-hand checks; ucp.dev lists about 50 endorsers, among them Adyen, Visa, Mastercard, PayPal, Klarna and Walmart as a co-developer |\n| Governance | A Governing Council and Domain Tech Councils elect maintainers; changes need at least one maintainer approval; contributions need a contributor licence agreement |\n| Capabilities | payments.protocol, payments.checkout, payments.mandate |\n| Tags | protocol, open-standard, open-source, mcp, a2a, ap2, openapi, openrpc, llms-txt, shopify, google, commerce |\n| JSON | https://www.anchorterminal.com/api/v1/tools/ucp.json |\n\n## Score breakdown (methodology v0.7, October 2026 research run)\n\nAssessed 2026-11-06 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. \"This run\" is each category's share of the 100 points.\n\n| Category | Weight | This run | Score (0–100) | Points |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% | 20 | 79 | 15.8 |\n| Performance | 10% | pending | pending | n/a |\n| Schema \u0026 documentation | 13% | 16.2 | 90 | 14.6 |\n| Agent ergonomics | 13% | 16.2 | 82 | 13.3 |\n| Security \u0026 auth | 14% | 17.5 | 67 | 11.7 |\n| Payments \u0026 pricing | 10% | 12.5 | 50 | 6.2 |\n| Task success | 10% | pending | pending | n/a |\n| Maintenance \u0026 community | 7% | 8.8 | 70 | 6.1 |\n| Transparency \u0026 trust (editorial 62, provenance 32) | 7% | 8.8 | 47 | 4.1 |\n| Negative events | up to −15 | up to −15 | none recorded | 0 |\n| **Total** | | | | **72 → BB** |\n\n### Why each score\n\n- Reliability 79 (checked 2026-11-06): Protocol reading, split as reference implementations 30, live deployments 25, spec stability 25 and test vectors 20. Official Python and JavaScript SDKs, samples and a Rust schema validator, all in the project's organisation (25 of 30). Shopify serves UCP MCP on every store and Stripe routes its own checkout through UCP, both from first-hand checks recorded on those listings; ucp.dev lists about 50 endorsers, which are claims (20 of 25). Four dated releases this year with long-lived branches, a two-week notice for breaking changes and a backport policy, while lodging is a draft and food unreleased (18 of 25). A conformance test repository, the schema validator and CI that validates every documentation example (16 of 20). 25 + 20 + 18 + 16 = 79.\n- Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes.\n- Schema \u0026 documentation 90 (checked 2026-11-06): OpenAPI for each REST service, OpenRPC for the MCP and embedded bindings and JSON Schema 2020-12 throughout (25). ucp.dev serves llms.txt, and AGENT_IMPLEMENTER.md guides agents implementing the spec (10). The spec gives MUST and SHOULD rules with rationale for negotiation, signatures and permalinks (17). Typed schemas with required fields, namespaced extension types and version requirements (13). Examples validated in CI and an error code table with continue_url handling (13). Dated versions with release tags and release-note drafts generated from tags; no separate changelog page was read (12). 25 + 10 + 17 + 13 + 13 + 12 = 90.\n- Agent ergonomics 82 (checked 2026-11-06): Protocol reading. Capability negotiation means an agent sees only what both sides support, though the schemas are large (18 of 25). Catalogue search pages with a cursor and has_next_page (15 of 20). An error model with codes and continue_url to hand a buyer to the business when the agent can't finish (18). The MCP binding requires an idempotency-key UUID on checkout calls for retry safety (18). Official SDKs in Python and JavaScript; every request needs a UCP-Agent profile (13 of 15). 18 + 15 + 18 + 18 + 13 = 82.\n- Security \u0026 auth 67 (checked 2026-11-06): OAuth 2.0 identity linking, RFC 9421 signatures for signed agents with key IDs bound to JWK thumbprints, and payment handlers with token exchange instead of raw card data (25 of 30). Checkout can hand back to the buyer through continue_url or an embedded checkout, and AP2 mandates record consent, but unattended completion is allowed by design (15 of 20). The permalink spec treats URL inputs as untrusted and requires server-side validation, but we found no guidance on product text reaching an agent (5 of 15). Order events go to business webhooks; we didn't read whether they are signed (8 of 15). SECURITY.md routes reports to Google's intake with a stated response time and GitHub advisories (14 of 20). 25 + 15 + 5 + 8 + 14 = 67.\n- Payments \u0026 pricing 50 (checked 2026-11-06): Protocol reading. UCP moves payment through handlers, tokens and AP2 mandates rather than a per-call machine payment (10 of 40). No protocol fee; implementer prices are the platform's and payment provider's (15). The spec, SDKs and samples are free (20). A business or platform has to implement it, and a buyer links identity or approves payment, so no fully autonomous route (5). 10 + 15 + 20 + 5 = 50.\n- Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored.\n- Maintenance \u0026 community 70 (checked 2026-11-06): The latest release is v2026-08-25, 73 days before this check (20). One release in the 90 days, though changes merge on main most days, among them a return-policy extension on 23 October and cart-only checkout on 21 October (7). Pull requests from Google, Shopify and outside contributors merge within days; 262 issues and pull requests are open (18). Official SDKs, updated 5 November (15). CI with linting, spellcheck, governance checks and example validation, and Dependabot updates (10). 20 + 7 + 18 + 15 + 10 = 70.\n- Transparency \u0026 trust 47 (checked 2026-11-06): Apache-2.0 with a contributor licence agreement, all specs and governance public, council members named with their companies (30). ucp.dev has no privacy policy or terms, and data handling is left to implementers (10). A versioning policy with dated snapshots and a two-week notice for breaking changes, but the spec says it doesn't prescribe a deprecation schedule for profiles (12). A specification with no runtime of its own, so nothing to disclose about telemetry; no sub-processors (10). 30 + 10 + 12 + 10 = 62.\n\nFix list, everything this grade says the listing lacks, the biggest gain first (17 items). What it covers is at https://www.anchorterminal.com/fixes/ucp.md (JSON https://www.anchorterminal.com/fixes/ucp.json). The whole list for a coding agent comes from `POST https://www.anchorterminal.com/api/v1/fix-list` with `{\"listing\": \"ucp\", \"plan\": \"read\"}`, free while the beta runs\n\n### What we couldn't check\n\n- unchecked: whether UCP order webhooks are signed.\n- unchecked: release notes on GitHub for each tag.\n- Adoption beyond Shopify and Stripe; the endorser list on ucp.dev is a claim.\n\n### Sources\n\n- specification repository: \u003chttps://github.com/Universal-Commerce-Protocol/ucp\u003e (seen 2026-11-06)\n- spec overview: \u003chttps://ucp.dev/latest/specification/overview/\u003e (seen 2026-11-06)\n- home page: \u003chttps://ucp.dev/\u003e (seen 2026-11-06)\n- versioning policy: \u003chttps://github.com/Universal-Commerce-Protocol/ucp/blob/main/docs/versioning.md\u003e (seen 2026-11-06)\n- maintainers: \u003chttps://github.com/Universal-Commerce-Protocol/.github/blob/main/MAINTAINERS.md\u003e (seen 2026-11-06)\n- governance: \u003chttps://github.com/Universal-Commerce-Protocol/.github/blob/main/GOVERNANCE.md\u003e (seen 2026-11-06)\n- security policy: \u003chttps://github.com/Universal-Commerce-Protocol/.github/blob/main/SECURITY.md\u003e (seen 2026-11-06)\n- organisation repositories: \u003chttps://github.com/orgs/Universal-Commerce-Protocol/repositories\u003e (seen 2026-11-06)\n\n## Score history\n\nEvery move of a score since the listing was graded, newest first, with its cause. A score can't move without an entry here. JSON: https://www.anchorterminal.com/api/v1/tools/ucp/history.json\n\n- 2026-11-06: graded 72 BB (methodology 0.7)\n\n## Who's behind it (provenance 32/100, checked 2026-11-06)\n\n| Check | Finding | Points |\n| --- | --- | --- |\n| Legal entity named | not found | 0/20 |\n| Domain age | ucp.dev, no registry record we could read | 0/15 |\n| Endpoint on the vendor's domain | ucp.dev | 15/15 |\n| Terms of service | not found | 0/10 |\n| Privacy policy | not found | 0/10 |\n| Status page | not found | 0/10 |\n| Changelog | published | 10/10 |\n| security.txt | could not be fetched | 0/10 |\n| People named | 2 named with their role, none with a public profile | 7/10 |\n| Support route | help pages, a community | 5/5 |\n\nFiles carry \"Copyright 2026 UCP Authors\" under Apache-2.0. No legal entity runs the project; governance is by councils whose members are named with their companies.\n\nSecurity reports go to Google's g.co/vulnz with a five-working-day response, coordinated through GitHub Security Advisories (SECURITY.md in the .github repository).\n\nucp.dev has no robots.txt and serves llms.txt. No terms or privacy policy found for the site.\n\nThe registration date of ucp.dev wasn't found through RDAP.\n\n### Terms and privacy, as read\n\nA reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice.\n\n**Terms of service**. We found no terms of service published for this product, so there is nothing to read and the check scores 0.\n\n\n**Privacy policy**. We found no privacy policy published for this product, so there is nothing to read and the check scores 0.\n\n\n## Humans behind the project (researched 2026-11-06 from public pages, not part of the grade)\n\n### Key people\n\n- Amit Handa, Standing Governing Council member and Shopping and Food Tech Council member, UCP (Google)\n- Ilya Grigorik, Shopping Tech Council member, UCP (Shopify)\n- Note: MAINTAINERS.md in the project's .github repository, read 6 November 2026, lists the Shopping Tech Council (17 members from Google, Shopify, Etsy, Meta, Amazon, Target, Microsoft, Stripe, Salesforce and Wayfair) and the Food Tech Council, and marks Amit Handa as a standing Governing Council member. Two members are listed here as named first-hand; the others are on that page. UCP is a project, not a company, so it has no investors. GOVERNANCE.md names Google and Shopify as the founding organisations, with permanent Governing Council seats; it calls no person a founder, so nobody is marked founder.\n- Universal Commerce Protocol (UCP Authors): GitHub https://github.com/Universal-Commerce-Protocol\n\n### Getting support\n\n- Help: https://ucp.dev/\n- Community (UCP Discussions): https://github.com/Universal-Commerce-Protocol/ucp/discussions\n- Community (UCP issues): https://github.com/Universal-Commerce-Protocol/ucp/issues\n- Sources: https://github.com/Universal-Commerce-Protocol/.github/blob/main/MAINTAINERS.md, https://github.com/Universal-Commerce-Protocol/.github/blob/main/GOVERNANCE.md, https://ucp.dev/\n\n## Live (updated 2026-11-07 16:00 UTC)\n\n- github `Universal-Commerce-Protocol/ucp` v2026-08-25, released 2026-08-25\n- security.txt: none\n- Always current: https://www.anchorterminal.com/api/v1/live/ucp.json\n\n## Probe metrics\n\nA specification has no endpoint to probe. Scores come from reference implementations, public facilitators, security analyses and adoption. See https://www.anchorterminal.com/benchmark/#kinds\n\n## Strengths\n\n- Machine-readable contracts for every transport, OpenAPI, OpenRPC and JSON Schema 2020-12\n- Official Python and JavaScript SDKs, a schema validator and a conformance test suite\n- Idempotency keys required on MCP checkout calls\n- Live on every Shopify store and as Stripe's own-checkout route\n- Breaking changes announced two weeks before they merge\n\n## Weaknesses\n\n- No release since v2026-08-25, though main changes most days\n- No guidance on product descriptions or business messages as untrusted content for agents\n- Lodging is a draft and food ordering unreleased\n- Governing and tech councils are led by Google and Shopify members\n\n\n\n## Before you call it (notes for agents)\n\n1. Read the business profile first and call only the capabilities both profiles declare\n2. Send a fresh idempotency-key UUID on each checkout call and reuse it on retry\n3. Hand the buyer the continue_url when a checkout needs a person instead of retrying\n4. Send a UCP-Agent profile, and sign requests with RFC 9421 if the business requires signed agents\n\n## Similar tools\n\nRanked by shared capabilities, then score. Same-category tools with no shared capability key are listed last.\n\n| Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown |\n| --- | --- | --- | --- | --- | --- | --- |\n| Agent Payments Protocol (AP2) | C | 54.6 | not ranked, protocol | payments.protocol, payments.mandate | no | https://www.anchorterminal.com/tools/ap2.md |\n| Visa Intelligent Commerce | D | 48.1 | not ranked, protocol | payments.protocol, payments.mandate | no | https://www.anchorterminal.com/tools/visa-intelligent-commerce.md |\n| Mastercard Agent Pay | E | 42.7 | not ranked, protocol | payments.protocol, payments.mandate | no | https://www.anchorterminal.com/tools/mastercard-agent-pay.md |\n| American Express Agentic Commerce Experiences (ACE) | F | 25.4 | not ranked, protocol | payments.protocol, payments.mandate | no | https://www.anchorterminal.com/tools/amex-ace.md |\n| Stripe API + MCP | A | 84.9 | 4 | payments.checkout | no | https://www.anchorterminal.com/tools/stripe-mcp.md |\n| Machine Payments Protocol (MPP) | A | 81.7 | not ranked, protocol | payments.protocol | no | https://www.anchorterminal.com/tools/mpp.md |\n\n## Panel reviews (0)\n\nReviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): .\n\nDesk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md\n\n## Notable\n\n- Four dated releases, v2026-01-11, v2026-01-23, v2026-04-08 and v2026-08-25, each with a long-lived release branch (source: \u003chttps://github.com/Universal-Commerce-Protocol/ucp\u003e)\n- Breaking changes are announced in Discussions two weeks before they merge, and backports to a release need Governance Council approval if they break (docs/versioning.md)\n- OpenAPI files for shopping, lodging, common and permalink REST services and OpenRPC files for the MCP and embedded bindings, with JSON Schema 2020-12 schemas (source/services, source/schemas)\n- Official Python and JavaScript SDKs, a Rust schema validator, conformance tests and samples, all updated in November 2026 (source: \u003chttps://github.com/orgs/Universal-Commerce-Protocol/repositories\u003e)\n- The Shopping Tech Council has members from Google, Shopify, Etsy, Meta, Amazon, Target, Microsoft, Stripe, Salesforce and Wayfair; a Food Tech Council has six open seats (source: \u003chttps://github.com/Universal-Commerce-Protocol/.github/blob/main/MAINTAINERS.md\u003e)\n- Shopify serves UCP MCP on every store at https://{shop}/api/ucp/mcp (data/tools/shopify.json), and Stripe's own-checkout route is UCP (data/tools/acp.json, docs.stripe.com read 2 November 2026)\n- Lodging has a draft specification and food ordering is marked coming soon (source: \u003chttps://ucp.dev/\u003e)\n\n- All 39 checkout comparisons: https://www.anchorterminal.com/compare/checkout-protocols/index.md\n\n## Compare\n\n- [ACK-Pay (Agent Commerce Kit) vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/ack-pay-vs-ucp.md): D 48.9 vs BB 72\n- [Agentic Commerce Protocol (ACP) vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/acp-vs-ucp.md): C 59.4 vs BB 72\n- [American Express Agentic Commerce Experiences (ACE) vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/amex-ace-vs-ucp.md): F 25.4 vs BB 72\n- [Agent Payments Protocol (AP2) vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/ap2-vs-ucp.md): C 54.6 vs BB 72\n- [L402 vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/l402-vs-ucp.md): C 59.5 vs BB 72\n- [Mastercard Agent Pay vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-ucp.md): E 42.7 vs BB 72\n- [Machine Payments Protocol (MPP) vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/mpp-vs-ucp.md): A 81.7 vs BB 72\n- [Universal Commerce Protocol (UCP) vs Visa Intelligent Commerce](https://www.anchorterminal.com/compare/ucp-vs-visa-intelligent-commerce.md): BB 72 vs D 48.1\n- [Universal Commerce Protocol (UCP) vs x402](https://www.anchorterminal.com/compare/ucp-vs-x402.md): BB 72 vs A 79.4\n\n## Verify this listing\n\nFor the vendor. The badge or a plain link to this page verifies the listing, from a page on ucp.dev or one of its subdomains, or the README at the root of github.com/Universal-Commerce-Protocol/ucp. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{\"slug\": \"ucp\", \"url\": \"…\"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify\n\nHTML badge:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/ucp\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/ucp.svg\" alt=\"Universal Commerce Protocol (UCP) on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e\n```\n\nMarkdown badge, for a README:\n\n```markdown\n[![Universal Commerce Protocol (UCP) on Anchor Terminal](https://www.anchorterminal.com/badges/ucp.svg)](https://www.anchorterminal.com/tools/ucp)\n```\n\nPlain link:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/ucp\"\u003eUniversal Commerce Protocol (UCP) on Anchor Terminal\u003c/a\u003e\n```\n\n## Share this listing\n\nFor the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say Universal Commerce Protocol (UCP) is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score.\n\n- Dark: https://www.anchorterminal.com/assets/share/ucp-dark.png\n- Light: https://www.anchorterminal.com/assets/share/ucp-light.png\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Terminal", "url": "https://www.anchorterminal.com/tools/" }, { "name": "Agent checkout protocols", "url": "https://www.anchorterminal.com/categories/checkout-protocols" }, { "name": "Universal Commerce Protocol (UCP)", "url": "" } ], "description": "The Universal Commerce Protocol (UCP) is an open specification, co-developed by Google, Shopify and other retailers and platforms, for agents to discover a business's capabilities and run catalogue, cart, checkout, identity linking and order flows over REST, MCP or A2A.", "facts": [ "#1 in Checkout", "OAuth auth", "0 desk reviews" ], "h1": "Universal Commerce Protocol (UCP)", "image": "https://www.anchorterminal.com/assets/og/tools-ucp.png", "path": "/tools/ucp", "published": "2026-10-01", "section": "tools", "title": "Universal Commerce Protocol review: pricing, alternatives, grade BB", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/tools/ucp" }, "tokens": { "markdown": 5550, "slim": 1380 }, "version": 1 }