What is UCP? The Universal Commerce Protocol explained

The Universal Commerce Protocol is an open standard for describing a business to software. You publish a small JSON document on your own domain saying what you sell, what you support, and how to transact. Any AI agent that speaks UCP can read it and act on it, without anyone at your company negotiating an integration first.

That last part is the interesting bit. There is no registry to join, no partner programme, and nobody to ask for permission. The specification calls this permissionless onboarding. If you publish the file correctly, you are participating.

Accurate as of July 2026. The current version is 2026-04-08.

Where the file lives

One fixed location, on your own domain:

GET https://yourstore.com/.well-known/ucp

Anything that speaks UCP knows to look there. Because it is served from your infrastructure and needs no authentication, anyone can read it, including you and including tools like our free UCP checker.

A trimmed version of a real profile looks roughly like this:

{
  "ucp": {
    "version": "2026-04-08",
    "supported_versions": {
      "2026-04-08": "https://yourstore.com/.well-known/ucp/2026-04-08"
    },
    "services": {
      "dev.ucp.shopping": { "transports": ["mcp", "embedded"] }
    },
    "capabilities": {
      "dev.ucp.shopping.cart": {},
      "dev.ucp.shopping.checkout": {},
      "dev.ucp.shopping.catalog.search": {}
    },
    "payment_handlers": {
      "com.google.pay": {}
    }
  }
}

Four things are being communicated. The version you speak. The services you offer and the transports they are reachable over. The capabilities within those services, such as cart, checkout and catalogue search. And the payment handlers you accept.

An agent reads this before it loads a single page of your site. It is closer to reading a menu in the window than walking in and looking around.

Who is behind it

UCP launched in January 2026 with eleven co-developing companies, including Google, Shopify, Amazon, Microsoft, Meta, Salesforce, Stripe, Walmart and Target. Around fifty further organisations are listed as endorsing it.

That matters less as a popularity contest and more as a signal about where transactions are heading. Google announced its agent-driven Universal Cart in May 2026 naming Nike, Sephora, Target, Ulta Beauty, Walmart and Wayfair, alongside Shopify merchants. The surfaces your customers already use are being wired for this.

You may already have one

This is the part that surprises people. Shopify publishes UCP profiles on behalf of its merchants. If you run a Shopify store, there is a good chance you are already serving a profile you never created and have never read.

When we ran our checker against a set of well known direct to consumer stores in July 2026, five of them were serving live profiles: Allbirds, Rothys, Skims, Brooklinen and Glossier. None of those merchants published those files by hand.

So for most shops the useful question is not should I implement UCP. It is what does the profile I already have actually say, and is it being served correctly.

The two rules people get wrong

Having a profile and having a working profile are different things. Two requirements account for most real world failures.

Redirects are not allowed

The specification is explicit that implementations must not follow redirects when fetching a profile. Agents obey this. Your browser does not.

The failure mode is quiet and common. Your apex domain redirects to www, or the other way around, and the profile only resolves on one of them. You open the URL in a browser, the redirect is followed silently, you see valid JSON, and you conclude everything is fine. An agent hitting the other host gets a 301 and stops. No error reaches you, because from your server's point of view a redirect is a completely normal response.

The fix is to serve the profile directly, with a 200, on every host a customer might reach.

Worth knowing: some implementations vary their behaviour by request headers. When we checked Allbirds with a browser-style request the apex returned a redirect, but with Accept: application/json it returned the profile directly. That is why a checker has to send what an agent sends rather than what a browser sends.

Caching is required, not a nice to have

The profile response is meant to carry a Cache-Control header so agents can hold on to it rather than re-fetching on every discovery.

This is the single most common finding we see. All five of the live profiles mentioned above were missing it. Since all five are served by the same platform, that is one upstream gap rather than five separate mistakes, but the effect on your origin is the same: every discovery is a fresh request.

The fix is one response header:

Cache-Control: public, max-age=3600

Versions are dates

UCP versions are dates, not semantic version numbers. The current one is 2026-04-08. Earlier tags are 2026-01-23 and 2026-01-11.

This has a practical consequence. A date tells you when something changed but nothing about whether it breaks you. Semantic versioning at least promises that a major bump means incompatibility. Here you have to read the release.

And you should. The 2026-01-23 release was a breaking refactor that landed twelve days after the first tagged version, and its upstream notes do not spell out what moved. We keep a plain English UCP changelog precisely because the version string on its own will not tell you whether to act.

The 2026-04-08 release was the substantial one so far: it added cart as a first-class capability, introduced a defined shape for errors during negotiation, and added signing for UCP requests and responses.

Is this SEO?

No, and the distinction is worth being precise about because the two get conflated constantly.

SEO is about being found and ranked among links, for a person to read and click. UCP is about whether software can determine what you offer and then complete an action against it. A site can rank first for every term it cares about and still be invisible to an agent, because the two things test entirely different capabilities. One asks can this be found and understood by a reader. The other asks can this be operated by a program.

What to do now

If you sell online, the sensible order is:

1. Find out whether you already have a profile. Fetch https://yourdomain.com/.well-known/ucp, or run a check that reads it the way an agent would.
2. Check both hosts. Apex and www. A profile on only one of them is a profile that half of callers cannot see.
3. Look at the response headers, not just the body. Missing caching is the most likely problem you have.
4. Decide who owns it. If your platform publishes the profile for you, the fixes may not be yours to make, but knowing that is still better than assuming it is handled.

If you do not sell online, UCP is safe to ignore for now. WebMCP is the one that applies to any site.

Read next

• What is WebMCP? — the other half of the picture, and the one that is not commerce specific
• UCP vs ACP vs AP2 — how the competing agentic commerce standards differ
• How agents see your website — what actually happens when one arrives