Universal Commerce Protocol: how AI agents are reshaping online shopping

The Universal Commerce Protocol (UCP) is an open standard that lets AI agents discover products, build carts and complete checkout with a merchant directly from an AI interface. A merchant publishes a profile at /.well-known/ucp, declares which capabilities it supports, and the agent negotiates the overlap. Google launched it in January 2026 together with Shopify, Etsy, Wayfair, Target and Walmart, and runs it in AI Mode in Search and in Gemini.

#What is the Universal Commerce Protocol

Universal Commerce Protocol (UCP) is an open standard that defines how AI systems interact with merchants to discover products, check pricing and availability, and complete transactions. Google’s developer documentation calls it “an open standard designed for the future of commerce” (Google Merchant UCP docs). It answers a practical problem: an AI assistant that has found the right product still needs a reliable way to buy it without a human clicking through a storefront.

Unlike traditional e-commerce, where users browse websites, add items to carts and fill in checkout forms by hand, UCP enables what Google calls “agentic commerce”: AI agents act on behalf of users to find products matching their criteria, compare options, verify details and execute purchases.

#Who created UCP and who maintains it

UCP is not a Google-only specification. Sundar Pichai announced it at the NRF retail conference on 11 January 2026, describing it as built together with Shopify, Etsy, Wayfair, Target and Walmart and endorsed by more than 20 other companies (Google, NRF 2026 remarks). Shopify published its own engineering account the same day, written by Ilya Grigorik (Shopify Engineering).

The project site, ucp.dev, now lists co-developers per vertical: shopping (including Google, Shopify, Etsy, Wayfair, Target, Walmart, Salesforce and Stripe), lodging (including Booking.com, Expedia Group, Hilton and Marriott) and food (including DoorDash, Square, Toast and Uber Eats). The specification is published on GitHub under the Apache License 2.0, copyright “UCP Authors”, with a public contributing guide (ucp.dev). The practical consequence: Google surfaces are the biggest consumer of UCP today, but the protocol itself is open source and any platform can implement it.

#How UCP changes SEO and product discovery

For over two decades, search engine optimization (SEO) has been the primary mechanism through which businesses make their products and services discoverable online. Companies optimized pages with relevant keywords, built backlinks and created content to rank higher in search results.

UCP moves part of that work from the presentation layer (web pages) to the data layer (feeds, profiles and APIs). Google’s UCP FAQ is explicit on two points. Product discovery on its surfaces is still backed by the Shopping Graph and Merchant Center feeds, and a native UCP integration does not change ranking; it adds a direct purchase option to eligible offers (Google UCP FAQ). So the questions that decide visibility are about data:

• Data quality: is your product feed complete, accurate and current?
• Schema compliance: do product pages carry the right Schema.org types (Product, Offer, PriceSpecification)?
• Availability signals: can an agent verify stock and delivery times in real time?
• Transaction readiness: can the agent complete the purchase without sending the buyer to a form?

#How a merchant publishes a UCP profile

Discovery starts with one file. Google’s implementation guide says to publish the UCP profile at /.well-known/ucp on the merchant’s domain (publish your profile). Google’s engineers describe it as a standard JSON manifest that lists the services and capabilities a business supports, so agents find features, endpoints and payment configuration without a hard-coded integration (Google Developers Blog, Under the Hood).

A shortened profile following the structure of Google’s sample looks like this (endpoint and schema URLs omitted):

{
  "ucp": {
    "version": "2026-04-08",
    "services": {
      "dev.ucp.shopping": [{ "transport": "rest", "endpoint": "..." }]
    },
    "capabilities": {
      "dev.ucp.shopping.checkout": [{ "version": "2026-04-08" }],
      "dev.ucp.shopping.discount": [{ "extends": "dev.ucp.shopping.checkout" }]
    },
    "payment_handlers": { "com.google.pay": [{ "config": { } }] }
  },
  "signing_keys": [{ "kid": "...", "kty": "EC", "crv": "P-256" }]
}

The ucp object carries the protocol version, services and capabilities. signing_keys holds public keys in JWK format. Google’s text calls the payment configuration a sibling of ucp while its sample nests payment_handlers inside it, so check the specification for the version you target before copying either form.

#Services, capabilities and extensions

Grigorik describes UCP as three layers. The shopping service holds the core primitives. Capabilities such as Checkout, Orders and Catalog sit on top and are versioned independently. Extensions add domain-specific schemas through composition, for example discounts or fulfillment extending checkout. Names use reverse-domain notation (dev.ucp.shopping.checkout), so a company can publish its own extension under its own domain without a central registry.

Both sides publish profiles. The agent fetches the merchant’s profile and “negotiation computes their intersection” (Shopify Engineering): the transaction uses only the capabilities both parties support. A store that implements checkout but not cart still works with an agent that supports both; the session then runs without cart features.

The capability names in Google’s sample profile are dev.ucp.shopping.checkout, dev.ucp.shopping.cart, dev.ucp.shopping.order, dev.ucp.shopping.fulfillment, dev.ucp.shopping.discount and dev.ucp.common.identity_linking. On 19 March 2026 Google added three optional capabilities on its surfaces: Cart (several items from one store at once), Catalog (live product details such as variants, inventory and price) and Identity Linking (logged-in shoppers keep loyalty or member benefits) (Google, UCP updates).

#Checkout integration options

UCP supports two checkout models:

1. Native checkout: the default on Google surfaces. The checkout logic integrates directly with AI Mode and Gemini, and the agent works against the merchant’s checkout API.

2. Embedded checkout: an optional, iframe-based path that Google reserves for specific, approved merchants with highly bespoke branding or complex checkout flows.

Shopify’s account explains how the embedded path hands control to a person. The Embedded Checkout Protocol, derived from Shopify’s Checkout Kit, opens a JSON-RPC 2.0 channel between the agent’s interface and the merchant’s checkout. A checkout moves through the states incomplete, requires_escalation and ready_for_complete; the escalation state is where the buyer is asked to act, for example to confirm a payment method or accept terms.

#UCP vs MCP vs A2A vs AP2 in agentic commerce

UCP does not exist in isolation. It defines the commerce semantics and leaves transport to other standards: Google’s engineers list REST APIs, MCP and A2A as supported transports, so one checkout capability can have a REST binding and an MCP binding at the same time.

#Model Context Protocol (MCP)

MCP (Model Context Protocol) lets AI agents call external systems as typed tools. Originally developed by Anthropic for Claude, MCP allows AI systems to:

• Execute searches and lookups programmatically
• Read content without rendering HTML
• Submit structured actions instead of filling forms
• Access APIs and data endpoints

Think of MCP as the tool layer and UCP as the commerce vocabulary that can travel over it. For WooCommerce stores, keep the two apart: catalogue Q&A over REST belongs in a read-only MCP such as woocommerce-mcp on GitHub, while agent checkout and merchant feeds belong in this UCP guide. Custom MCP delivery scope sits under MCP server development.

#Agent-to-Agent Protocol (A2A)

Developed by Google, A2A (Agent2Agent) handles communication between different AI agents. It enables workflows where specialized agents collaborate: one handles product discovery while another manages the purchase. UCP lists A2A as one of its transports.

#Agent Payments Protocol (AP2)

AP2 is Google’s protocol for agent-initiated payments. Google’s FAQ describes the split: UCP orchestrates the purchase lifecycle and AP2 can serve as the specialized payment layer. Payment instruments (what the buyer pays with) are kept separate from payment handlers (who processes the payment), and Google’s engineers state that every authorization is backed by cryptographic proof of user consent.

#What is WebMCP and how it complements UCP

WebMCP is a draft specification from the W3C Web Machine Learning Community Group, edited by engineers from Microsoft and Google. It lets a web page expose JavaScript functions as tools an agent can call, through document.modelContext.registerTool() (WebMCP draft). It is a community draft, not a W3C standard. Where UCP talks to a merchant’s backend, WebMCP covers the page the user already has open in a browser.

Update, 2 November 2026. Cloudflare documented how Commerce.com turned on edge WebMCP across almost 100,000 storefronts without merchants editing themes. Cloudflare injects a small bridge script at the edge; tools such as search_products and add_to_cart run inside the shopper’s browser session on the store domain, so prices and cart match what a human sees and checkout stays on the merchant site. Individual merchants can opt out through hostname metadata and a Configuration Rule (cf.hostname.metadata.webmcp_opt_out), and the MCP URL can be set to a custom path such as /api/mcp instead of /mcp. For a WooCommerce shop already on Cloudflare, the useful lesson is the split: UCP still covers backend checkout with Google surfaces, while edge WebMCP covers agents that already sit in the buyer’s browser - without a theme rewrite.

Screenshot: Cloudflare Blog, How Commerce.com and Cloudflare are getting storefronts ready for AI agents, 21 October 2026.

#How UCP differs from the Agentic Commerce Protocol

UCP has a parallel standard. The Agentic Commerce Protocol (ACP) was developed by Stripe and OpenAI, is also open source under Apache 2.0, and names ChatGPT as the first AI platform to implement it, with Stripe’s Shared Payment Token as the first compatible payment method (agenticcommerce.dev). The two protocols solve the same problem for different ecosystems, so a merchant who wants checkout in both Google surfaces and ChatGPT plans for both. WPPoland publishes discovery files for each: /.well-known/ucp and /.well-known/acp.json.

Update, 3 November 2026. Shopify’s Fall ‘26 Edition puts WebMCP tools on every Liquid and Hydrogen storefront and checkout: browser agents can search products, update the cart and complete checkout once the buyer approves, with the same validation as the checkout page, and get structured data back instead of reading screenshots (Shopify, Fall ‘26 Edition for developers). The same release adds Shop.dev, one connection for any agent or app to Shopify Catalog, cart, checkout and Shop Pay, and an app security check in the Shopify CLI. For a Shopify merchant this layer is now on by default; a WooCommerce shop has to build the equivalent itself, which is what the UCP profile and the steps below are for.

Update, 28 October 2026. On 24 March 2026 OpenAI changed how ChatGPT uses ACP. Instant Checkout in ChatGPT is now open only to approved partners, other merchants keep their own checkout, and OpenAI says it is focusing on product discovery (OpenAI). Merchants now use ACP mainly to share product feeds and promotions, and feed onboarding is also limited to approved partners for the moment (OpenAI developer docs). If you plan a store for both ecosystems, ChatGPT now needs a product feed and a checkout on your own site that a buyer arriving from the chat can complete. Checkout endpoints of the kind described in this guide remain a UCP task, and Google admits merchants to that integration through a waitlist (Google for Developers).

Together these protocols form the current stack for agentic commerce:

• UCP: commerce and transaction layer (Google surfaces and any adopter)
• ACP: commerce and checkout layer in the OpenAI and Stripe ecosystem
• MCP: tool interaction and API access
• A2A: agent-to-agent communication
• AP2: agent payments and consent proof
• WebMCP: tools exposed by a page in the browser

#What Google expects from a UCP merchant

Google’s UCP FAQ lists operational requirements that are easy to miss when the profile file looks finished:

• Merchant Center stays central. Product feeds, brand assets, return policies and business contact details must be complete and current; UCP builds on the existing shopping feed.
• The merchant stays merchant of record. It owns the customer relationship and transaction data, and its own terms and conditions govern the purchase and must be accepted during checkout.
• Real-time stock. The merchant checks inventory at checkout and returns the out_of_stock error code when an item is gone.
• Address validation. Users can change the shipping address, the merchant recalculates shipping and tax, and returns address_undeliverable when it cannot ship.
• Recoverable errors. A message that the buyer can fix must carry severity recoverable in the messages array, otherwise the user hits a blocking error.
• Payments. The merchant does not need the Google Pay API on its own site, but its payment service provider must process Google’s tokens. Only PAN_ONLY is used for allowed_auth_methods.
• Versioning. A new specification version goes on a separate endpoint, so Google can route traffic back if the new one fails.
• One profile, many countries. Separate profiles per country are not needed.

#Which businesses need UCP

#E-commerce stores

For product-based stores the case is direct. If competing offers in AI Mode carry a direct purchase option and yours do not, the agent completes the purchase elsewhere.

Key actions:

• Publish a UCP profile at /.well-known/ucp
• Keep Merchant Center feeds and Schema.org markup (Product, Offer, PriceSpecification) complete
• Make availability and pricing APIs answer in real time
• Test product discovery through AI assistants

Update, 30 October 2026. On 29 October 2026 Microsoft Clarity published an analysis of more than 5.2 million agent sessions across 230,511 Clarity projects, collected between 13 August and 9 September 2026 (Microsoft Clarity). A session counted as agentic when Clarity detected an agentic browser from the OpenAI, Google or Anthropic ecosystems. A checkout event appeared in 25.21% of those sessions against 14.65% of human sessions, a form submission in 19.85% against 18.56%, and add to cart in 2.33% against 3.31%. Agents clicked outbound links less often (14.28% against 26.99%). Clarity notes that a human may have taken over during an agent session and that the figures do not prove an agent completed a purchase on its own. The study does not measure conversion either.

For a WooCommerce store the takeaway is that agents head straight for the checkout, so the checkout and the product data have to work without guesswork:

• Keep the Merchant Center feed in line with the site (price, stock, variants, GTIN), since UCP and checkout on Google surfaces build on it.
• Generate Product and Offer markup on the product page from the same fields as the feed, so an agent never sees two prices.
• Run through checkout as a guest: every field labelled, error messages in text, and no account required just to see the shipping cost.
• Measure agent sessions: Clarity now offers an Agent Activity Dashboard for this, and UCP traffic shows up in your server logs through the UCP-Agent header.

I review feeds, product data and checkout for WooCommerce stores as part of my WooCommerce development service.

#Service companies

For agencies, consultants and professional services the calculus differs. Services are rarely bought in one step; they need consultation, a quote and an agreed scope. The UCP specification has no inquiry or quote capability, so a service company uses the standard for discovery and adds its own data around it:

• Use ProfessionalService and Offer schemas instead of Product schemas
• Describe services and how pricing is set
• Declare inquiry and quote workflows in a clearly custom block (WPPoland uses supportsInquiry and supportsQuote, which are its own fields, not UCP capabilities)
• Provide structured FAQ and process information

#Content publishers

Media companies and content publishers should focus on:

• Implementing Schema.org Article and FAQ schemas
• Structuring content for AI citation (see my LLMO optimization guide)
• Creating structured data for entities, topics and relationships

#How to implement UCP in five steps

#Step 1: Audit your current data

Before implementing UCP, establish what data you already have:

• Do product or service pages carry Schema.org markup?
• Is the Merchant Center feed complete and current?
• Are prices, availability and delivery times structured or in free text?

#Step 2: Publish your UCP profile

Follow the implementation guide for the version you target and publish /.well-known/ucp with your services, capabilities, payment handlers and signing keys. Merchants who want checkout on Google surfaces register through Google’s UCP merchant interest form linked from the documentation, and Google announced a simplified onboarding flow in Merchant Center rolling out over the coming months.

#Step 3: Implement Schema.org markup

Enhance your website with Schema.org data:

• For products: Product, Offer, Brand, Review schemas
• For services: ProfessionalService, Offer, PriceSpecification schemas
• For both: Organization, ContactPoint, FAQPage schemas

#Step 4: Build the checkout endpoints

Implement the services you declared, starting with checkout. Google’s walkthrough uses a Python sample server and a UCP SDK with sample product data (a demo flower shop) to show discovery, checkout creation and a discount code end to end; the official SDKs are on the Universal-Commerce-Protocol GitHub organisation. Beyond UCP, a service company can add its own endpoints such as /agent.json.

#Step 5: Test and monitor

Once implemented:

• Confirm /.well-known/ucp returns valid JSON
• Watch server logs for the UCP-Agent header and User-Agent strings starting with Google/UCP
• Test error paths (out_of_stock, address_undeliverable) before going live
• Query AI assistants about your products and services

#How a service company implements UCP

As a service company rather than a product retailer, WPPoland had a specific question: how to publish agent-readable data without a checkout to offer.

The live file at /.well-known/ucp (also served as /.well-known/ucp.json) answers it in two parts. The ucp object declares version 2026-04-08 with empty services and capabilities, because no UCP checkout is offered. Next to it sits a custom block describing the business:

• A merchant profile with legal name, VAT ID, address and served countries
• Capabilities: supportsInquiry and supportsQuote set to true, supportsPayment and supportsBooking set to false
• 8 core service offerings
• Six languages: Polish, English, German, Norwegian, Portuguese and Spanish
• EUR as the quoting currency and a stated policy that no price list is published and the binding quote follows a written brief
• An additional endpoint, /agent.json, with service data in JSON-LD

This keeps the standard part honest (nothing is declared that the business cannot do) while still giving agents structured facts about the company.

#How UCP evolved through 2026

• 11 January 2026: launch at NRF, co-developed with Shopify, Etsy, Wayfair, Target and Walmart; native checkout announced for AI Mode in Search and Gemini.
• 19 March 2026: optional Cart, Catalog and Identity Linking capabilities; simplified onboarding in Merchant Center; Commerce Inc, Salesforce and Stripe named as platforms that will implement UCP.
• April 2026: Google’s implementation guide moves to specification version 2026-04-08.
• 20 May 2026 (Google Marketing Live): a Universal Cart that works across retailers and Google services, Affirm and Klarna options inside Google Pay, purchases from Direct Offers promotions, and UCP-powered checkout rolling out to Canada and Australia, later the U.K. Hotel booking and local food ordering were announced as new categories (Google Marketing Live 2026).

The public roadmap on ucp.dev lists loyalty and member benefits, native cross-sell and upsell, local and omnichannel journeys, global markets, and the food and lodging verticals. It states that it “does not constitute a commitment to deliver specific features” (UCP roadmap).

#How to secure a UCP integration and meet GDPR

#Identify and verify agent traffic

• UCP requests carry a UCP-Agent header with the agent’s profile and a User-Agent starting with Google/UCP.
• Google may probe endpoints for health with the User-Agent Google-UCP-Prober/1.0.
• Verify that traffic is really Google’s with reverse DNS lookups and Google’s published IP ranges.
• Georestriction is not supported; Google recommends OAuth 2.0 Bearer tokens or other signatures instead.
• Publish signing keys in JWK format in the profile and rotate them like any other key.

#Handle GDPR requirements

• Data ownership: the merchant remains merchant of record and owns transaction data.
• Retention: Google keeps standard order data until the user requests deletion; the merchant’s own retention obligations still apply to its systems.
• Remarketing: standard privacy and consent rules apply; Google lists an opt-in feature as planned.
• Data minimisation: pass agents only the data the transaction needs.

#Common UCP errors and how to fix them

#Why AI agents cannot find the store’s capabilities

Possible causes:

1. Profile not reachable at /.well-known/ucp (404)
2. JSON syntax errors
3. Capabilities declared without a matching service endpoint

Solutions:

• Request the URL directly and check the status code
• Run the file through a JSON validator
• Compare declared capabilities with the endpoints that actually answer

#Why AI agents show wrong prices

Possible causes:

1. Wrong currency formatting
2. Feed and checkout returning different prices
3. Time zone or format issues

Solutions:

• Use ISO 4217 currency codes
• Recalculate price, shipping and tax at checkout and keep the feed current
• Store timestamps in UTC

#Why UCP checkout fails

Possible causes:

1. Out-of-stock items without the out_of_stock code
2. Fixable problems sent without severity recoverable
3. Authentication problems or a PSP that cannot process Google’s tokens

Solutions:

• Return the documented error codes
• Mark buyer-fixable messages as recoverable
• Validate tokens and confirm token support with your payment provider

#How to prepare your store for agentic commerce

Agentic checkout is live on Google surfaces, Shopify co-developed the protocol, and payment platforms have announced support. Part of the discovery layer has moved from web pages to protocols. Whether you sell products or services, data that is structured, complete and reachable by agents now matters as much as the pages themselves.

For businesses, the action items are clear:

1. Audit your current data structures and feeds
2. Publish a UCP profile that declares only what you support
3. Test agent discovery and checkout error paths
4. Track specification versions and the public roadmap

Related articles:

• LLMO: The Definitive Technical Guide to Optimizing for AI Bots
• Semantic SEO for WordPress in 2026
• Core Web Vitals: Achieving 100/100 Score
• Headless WordPress vs Traditional WordPress
• WooCommerce Performance Guide 2026
• AI-Driven WordPress Development in 2026
• Technical SEO Audit Guide
• Programmatic SEO with WordPress

Service pages:

• AI Commerce Readiness: UCP Implementation
• WordPress Development Services
• WooCommerce Development
• Speed Optimization
• Security Audit
• LLMO & AI Visibility Optimization

Technical resources:

• WPPoland UCP profile
• Agent Data Endpoint
• AI Services API
• LLMs discovery
• Google UCP Documentation
• UCP specification
• Schema.org Offer Documentation
• JSON-LD Specification
• Model Context Protocol