# Universal Commerce Protocol (UCP) (slim)

> The Universal Commerce Protocol (UCP) is an open specification, co-developed by Google, Shopify and other retailers and platforms, for agents to discover a business's capabilities and run catalogue, cart, checkout, identity linking and order flows over REST, MCP or A2A.

- Full: https://www.anchorterminal.com/tools/ucp.md (~5,550 tokens) · this version ~1,380 tokens · JSON https://www.anchorterminal.com/tools/ucp.json · canonical https://www.anchorterminal.com/tools/ucp
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07 · pricing https://www.anchorterminal.com/tools/ucp#pricing · reviews https://www.anchorterminal.com/tools/ucp#reviews
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

**BB · 72/100 · rank graded, not ranked against tools · #1 in Agent checkout protocols · agent-ready · confidence medium**


Assessment: OpenAPI, OpenRPC and JSON Schema for every surface, official Python and JavaScript SDKs, conformance tests and live use on Shopify stores and Stripe's checkout. Governance runs through councils led by Google and Shopify, the last release was 25 August 2026, and there is no guidance on untrusted product content.

## Facts

- Kind: Payment protocol · vendor: UCP Authors (Google, Shopify and co-developers) · category: Agent checkout protocols · legal entity: not named · provenance 32/100
- Auth: OAuth · pricing: Free · x402: no · licence: Apache-2.0
- Surface listed: The specification, schemas and docs in Universal-Commerce-Protocol/ucp (shallow clone, release tags and branches), the organisation's MAINTAINERS, GOVERNANCE and SECURITY files, the repository list and ucp.dev on 6 November 2026
- Spec: Capabilities (catalogue, cart, checkout, identity linking, order, booking draft) and extensions under dev.ucp namespaces, negotiated between a business profile and a platform profile
- Status: Shopping released in dated versions, the latest 2026-08-25; lodging draft; food coming soon
- How it works: A business publishes a profile of supported capabilities and transports; the platform advertises its own; the intersection decides what the agent may call. Checkout can finish without a person or hand over through continue_url or an embedded checkout
- Transports: REST and JSON-RPC, an MCP binding, A2A, and an embedded checkout protocol
- Agent autonomy: Checkout sessions run with or without human intervention; AP2 mandates and verifiable credentials are the route for an agent to pay with proof of consent
- Adopters: Shopify (UCP MCP on every store) and Stripe (own-checkout route), per other listings' first-hand checks; ucp.dev lists about 50 endorsers, among them Adyen, Visa, Mastercard, PayPal, Klarna and Walmart as a co-developer
- Governance: A Governing Council and Domain Tech Councils elect maintainers; changes need at least one maintainer approval; contributions need a contributor licence agreement

- Scores: Reliability 79, Performance pending, Schema & documentation 90, Agent ergonomics 82, Security & auth 67, Payments & pricing 50, Task success pending, Maintenance & community 70, Transparency & trust 47 · total over the 7 assessed categories
- Why: Reliability, Protocol reading, split as reference implementations 30, live deployments 25, spec stability 25 and test vectors 20. Official Python and Jav… · Schema & documentation, OpenAPI for each REST service, OpenRPC for the MCP and embedded bindings and JSON Schema 2020-12 throughout (25). · Agent ergonomics, Protocol reading. · Security & auth, OAuth 2.0 identity linking, RFC 9421 signatures for signed agents with key IDs bound to JWK thumbprints, and payment handlers with token exc… · Payments & pricing, Protocol reading. · Maintenance & community, The latest release is v2026-08-25, 73 days before this check (20). · Transparency & trust, Apache-2.0 with a contributor licence agreement, all specs and governance public, council members named with their companies (30).
- Sources: 8, open questions: 3, both in the full twin
- Capabilities: payments.protocol, payments.checkout, payments.mandate
- JSON: https://www.anchorterminal.com/api/v1/tools/ucp.json
- Verify (for the vendor): the badge `https://www.anchorterminal.com/badges/ucp.svg` or a link to https://www.anchorterminal.com/tools/ucp from a page on ucp.dev or one of its subdomains, or the README at the root of github.com/Universal-Commerce-Protocol/ucp, then `POST https://www.anchorterminal.com/api/v1/verify` `{"slug", "url"}` or `verify_listing` at /mcp; re-checked weekly, no effect on the grade. Snippets in the full twin.
- Support: https://ucp.dev/; more in the full twin

## Before you call it

1. Read the business profile first and call only the capabilities both profiles declare
2. Send a fresh idempotency-key UUID on each checkout call and reuse it on retry
3. Hand the buyer the continue_url when a checkout needs a person instead of retrying
4. Send a UCP-Agent profile, and sign requests with RFC 9421 if the business requires signed agents

## Similar tools

| Tool | Grade | Score | Shared capabilities | Slim |
| --- | --- | --- | --- | --- |
| Agent Payments Protocol (AP2) | C | 54.6 | payments.protocol, payments.mandate | https://www.anchorterminal.com/tools/ap2.min.md |
| Visa Intelligent Commerce | D | 48.1 | payments.protocol, payments.mandate | https://www.anchorterminal.com/tools/visa-intelligent-commerce.min.md |
| Mastercard Agent Pay | E | 42.7 | payments.protocol, payments.mandate | https://www.anchorterminal.com/tools/mastercard-agent-pay.min.md |
| American Express Agentic Commerce Experiences (ACE) | F | 25.4 | payments.protocol, payments.mandate | https://www.anchorterminal.com/tools/amex-ace.min.md |
| Stripe API + MCP | A | 84.9 | payments.checkout | https://www.anchorterminal.com/tools/stripe-mcp.min.md |


## Panel reviews (0, desk reviews from public material, no calls made)