UCP Part 1: Understanding the Universal Commerce Protocol (UCP)

August 11th, 1994. Phil Brandenberger sits at his computer, types in his credit card number, and buys a Sting CD through a website called NetMarket.

It was the first ever internet transaction.

Fast forward thirty years. That one transaction has turned into an $8 trillion behemoth. Over 25% of all retail happens online now. We’ve built "Buy" buttons on every corner of the digital world.

Thirty years later, a revolution to the way we shop is about to happen again.

In late 2025, OpenAI and Stripe announced the Agentic Commerce Protocol (ACP). Months later, Google hit back with the Universal Commerce Protocol (UCP)

Their aim? Rebuild online shopping for a world where AI agents — not humans — do the shopping.

Why Should You Care About Agentic Commerce?

The main idea behind the push is that instead of humans browsing websites, AI agents will take care of the shopping. It may sound far-fetched, but to be honest, the data indicates that it is actually quite close:

The Market is Huge

• Morgan Stanley estimates that by 2030, 10 - 20% of all US ecommerce spending will happen through agentic commerce. That is, around 190 to 385 billion dollars.
• Mckinsey is a little bit more optimistic, estimating that by 2030 the US B2C market could reach $1 trillion, while the global market could reach up to $5 trillion being orchestrated through agentic commerce.

Consumer Behavior is Already There

• ChatGPT reports 900 million weekly active users while Gemini is at 750 Million monthly. The numbers keep growing every week.
• In 2025, Adobe Analytics reported a 700% yoy spike in AI traffic across industries.
• Meanwhile, Semrush found that AI traffic converts at 4.4x the rate of organic search traffic. Is AI the new high intent channel?
• According to IBM, 45% of consumers use AI for product discovery and comparision.

Now, you might say that it's convenient that the ones talking about the hype are the ones selling the shovels. I would tend to agree with you. But come on, don't tell me you haven't chatted with a LLM trying to find the perfect product before?

Even my mom is doing it.

How Will It Change Marketing?

I won't lie, I'm not sure yet.

That's what this series is about — an opportunity to deep dive into the commerce protocols with the hope of getting some clarity on the matter. In this first part, we'll understand what UCP actually is and how it works. In Part 2, we'll explore what it means for marketers.

So What IS UCP?

UCP vs ACP - The War of the Protocols

As a Google fanboy, I focused my research on UCP, but you should know it's not the only protocol in town. It wasn't even first — OpenAI and Stripe released V1 of their Agentic Commerce Protocol (ACP) four months earlier.

Both protocols are open source and both aim to let AI agents buy stuff on your behalf. In both, the business is the "merchant of record". However, the philosophy behind both is different.

ACP is platform-centric. 

It's built to let you buy things directly inside ChatGPT. You're chatting with ChatGPT, it finds a product, you click buy, Stripe processes the payment (and takes a cut).

UCP is open-source, but Google-oriented.

It doesn't care which AI you're using. It doesn't care which payment processor you choose. It's a standard. Google, Shopify, Etsy, Wayfair, Target, Walmart, American Express, and Mastercard all co-developed it.

Now, let's not be naive.

UCP's main distribution channels will be Search, Gemini, Google Shopping, and Merchant Center. "Open" and "neutral" are relative terms when the company with the world's largest product and website index is the one writing the specs.

Still, a merchant integrating with UCP can theoretically support any agent — not just Gemini, while a merchant integrating with ACP is, for now, mostly building for ChatGPT.

Why Build a Protocol?

Before the protocol, if an AI agent wanted to buy something it needed a bespoke API integration with the merchant. Multiply that by all the merchants on the internet, and you had an impossible-to-scale task.

The purpose of the protocols is to collapse this NxN complexity into a 1×N standard, by establishing a common language for any AI to communicate with any business.

In essence, act as the "USB-C port" for agentic commerce.

What Can UCP Do Today?

When I first heard about it, I imagined a standard that covers the entire shopping journey — discovering products, browsing catalogs, comparing prices, checkout, payment, order tracking.

But that's not what UCP v1 is. At least not yet. The UCP homepage says it clearly:

"UCP is designed to facilitate the entire commerce lifecycle, from initial product discovery and search to final sale and post-purchase support. The initial launch focuses on Checkout, Identity Linking, and Order Management."

Product discovery, loyalty programs, and cross-sell modules are on the roadmap, but right now, UCP v1 focuses on the checkout. That said, it's not hard to speculate on how those other features will function once we understand the protocol's foundation.

UCP Deep Dive

The Players

UCP defines four roles in every transaction:

The Platform

• The consumer-facing surface acting on behalf of the user.
• Responsibilities: Discovering businesses capabilities via profiles, initiating checkout sessions, and presenting the UI or conversational interface to the user.
• Gemini, ChatGPT, a dedicated shopping agent.

The Business

• The merchant selling goods. They remain the merchant of record — they own the order, the liability, and the customer relationship.
• Responsabilities: Exposing commerce capabilities (inventory, pricing, tax calculation), fulfilling orders, and processing payments via their chosen PSP.
• Victorinox, Zara, etc

The Credential Provider

• A trusted entity responsible for securely managing and sharing sensitive user data, particularly payment instruments and shipping addresses
• Responsibilities: Authenticating the user, issuing payment tokens (to keep raw card data off the platform), and holding PII securely to minimize compliance scope for other parties.
• Google Wallet, Apple Pay, Auth provider

The Payment Provider

• The financial infrastructure provider that processes payments on behalf of businesses.
• Responsibilities: Authorizing and capturing transactions, handling settlements, and communicating with card networks. The PSP often interacts directly with tokens provided by the Credential Provider.
•  Stripe, Lemonsqueezy, etc.

Discovery — How Agents Find Merchants

The first step for an agent to interact with a business is understanding if and how it may do so. To enable this, every UCP merchant publishes a machine-readable file at a well-known URL.

https://example.com/.well-known/ucp

If you've worked with robots.txt or sitemap.xml, it's the same concept. But instead of telling Google how to crawl your pages, you're telling AI agents how to buy from your store.

{
 "ucp": {
   "version": "2026-01-11",
  
   "services": {                              // ← SECTION 1: HOW to connect
     "dev.ucp.shopping": {
       "rest": { "endpoint": "http://..." },  //   Option A: REST API
       "mcp": null,                           //   Option B: MCP       
       "a2a": null,           //   Option C: A2A agent       
       "embedded": null                       //   Option D: Embedded
     }
   },
  
   "capabilities": [                     // ← SECTION 2: WHAT it can do
     { "name": "dev.ucp.shopping.checkout" },
     { "name": "dev.ucp.shopping.fulfillment",
       "extends": "dev.ucp.shopping.checkout" }, // ← Extensions for managing fullfillment
     { "name": "dev.ucp.shopping.discount",
       "extends": "dev.ucp.shopping.checkout" } / ← Extension for applying discounts!
   ]
 },
  "payment": {                      // ← SECTION 3: Payment methods
   "handlers": [
     { "id": "google_pay", "name": "google.pay", "config": {...} },
     { "id": "shop_pay", "name": "com.shopify.shop_pay", "config": {...} },
   ]
 },
  "signing_keys": null                   // ← SECTION 4: Cryptographic signing
}

This file tells the agent three things:

1. How to connect — REST API? A2A agent? MCP tools?
2. What's supported — Checkout, shipping, discounts, consent?
3. How to pay — Google Pay? Shop Pay? Card?

And it's bidirectional. The buyer's agent also publishes a profile. When Gemini starts a checkout at example.com, it sends its own capabilities in the request. The merchant checks what the buyer supports and configures the checkout accordingly.

Services, Capabilities and Extensions

UCP organizes its functionality into constructs that are discovered through the .well-known/ucp file. At its current state, the file contains:

Services - How do I speak to this merchant?

It defines the API surface and the communication channels available for the agent as it connects to the merchant.

Currently the protocol allows for:

• REST: The primary transport. Standard HTTP — POST to create, GET to retrieve, PUT to update. Responses in JSON. 
• MCP (Model Context Protocol): MCP lets AI agents call merchant tools directly. It's kind of like a fancier version of REST, where the Agent has access to API / Code based tools, and the instruction manual on how to use them.

Ghost CMS MCP Server: Give Your Blog an AI Assistant

I built an MCP server for Ghost CMS that lets you manage your entire blog through conversation with Claude. Here’s how it works, why it matters, and what’s coming next.

Data With JaviJavier Cabrera

• A2A (Agent-to-Agent): The merchant runs its own AI agent. Kind of like having a salesperson do the talking for the merchant. For example, the buyer's agent says "my user wants a camping knife under €80." The merchant's agent can reason, recommend, upsell. The UCP data (checkout sessions, catalog responses) rides inside the A2A conversation as structured data.
• Embedded Protocol (EP) The merchant embeds a UI inside the platform. This is triggered through the continue_url that a business returns — for example, when the checkout hits requires_escalation (age verification, complex configuration). The embedded interface handles the human interaction and delegates key actions back to the platform.

A merchant can and should support multiple transports simultaneously. REST for basic agent access, A2A for premium conversational shopping, EP for edge cases.

The Capabilities — What UCP Can Actually Do

At the moment, UCP is built around:

Catalog — Product Discovery

Allows platform agents to search and browse business product catalogs. The goal being to enable product discovery before checkout.

• dev.ucp.shopping.catalog.search— agents search a business's product catalog and the merchant returns matching products with variants, prices, images, ratings, and availability.
• dev.ucp.shopping.catalog.lookup— retrieve specific products/variants by ID

Want to take a look at what the data schema looks like?

Checkout - The Transaction

The capability that allows platforms to facilitate checkout sessions. The checkout is the heart of UCP. It's a standardized state machine — every merchant follows the same operations, the same statuses, the same data format.

The checkout process consists of 5 operations:

1. Create Checkout: Initiates a new checkout session. Called as soon as a user adds an item to a cart.
2. Get Checkout: Retrieves the current state of a checkout session.
3. Update Checkout: Updates a checkout session.
4. Complete Checkout: Finalizes the checkout and places the order. Placed when the user has commited to the final transaction.
5. Cancel Checkout: Cancels a checkout session.

These operations are bound too and update a pre-defined schema.

The real elegance is in the checkout status field. The merchant sets it and the agent reads it and reacts.

• incomplete: Something's missing — email, address, shipping. The agent then checks the messages array, and fixes what's missing via the Update operation.
• requires_escalation: Checkout session requires information that cannot be provided via API, or buyer input is required. The agent should inspect messages to understand what's needed and hand off to buyer to the merchants website via a continue_url.
• ready_for_complete: Checkout session has all necessary information and platform can finalize programmatically. Platform Agent can call Complete Checkout.
• complete_in_progress: Business is processing the Complete Checkout request.
• completed: Order placed successfully.
• canceled: Checkout session is invalid or expired. Platform should start a new checkout session if needed.

In essence, the checkout is a conversation that allows for user in the loop.

Identity Linking — "Remember Me"

The Identity Linking capability enables a platform (e.g., Google, an agentic service) to obtain authorization to perform actions on behalf of a user on a merchants site.

This linkage is foundational for commerce experiences, such as accessing loyalty benefits, utilizing personalized offers, managing wishlists, and executing authenticated checkouts.

Order — Post-Purchase

The Order capability handles what happens after checkout completes. The merchant returns an order confirmation with an order ID, and UCP provides a standard way to track order status. For the full details, check the order specification.

The End-to-End Flow

We've covered the pieces, now let's see them all working together.

Imagine you ask Gemini to find you a camping knife. Behind the scenes, there are four participants: you, your buyer agent (Gemini), the A2A transport(how the agents talk), and the merchant's agent (Victorinox). Here's the full conversation:

Step 1 - Discovery

There are two parts to the discovery phase.

If you're chatting with an agent about a camping knife, at some point, it has to figure out which websites actually have what you need. A lot of people say this is where AEO (Agentic SEO) comes in. I agree, but let's be real—you're delusional if you think Google won't turn Agentic Paid Search (just coined that term!) into a massive reality too.

Once it knows it should check Victorinox, Amazon, and CheapKnives.com, the discovery of the UCP capabilities kicks in. The goal: figuring out the capabilities each of these stores allow.

Step 2 - Browsing the Catalog

Once it knows the capabilities, the agent will help find products that fit what the user is looking for. In the screenshot below, you can see me chatting directly with a merchant agent, but the idea is that in the future, your agent will probably be having these conversations and going back to you for some feedback.

Step 3 - Checkout

Once you add a product to the cart, you can proceed to checkout. Notice here that the agent responded by asking for more data from the user to complete the checkout flow. This is probably because the merchant agent has passed a "requires escalation" flag to the platform.

Once the data is there, its just as easy as asking for a final confirmation.

What's Next

Now that we know how UCP works, the obvious question is: what does this mean for marketing?

When an AI agent buys something, there is no browser. There are no cookies. There are no UTMs or GCLIDs to track. The traditional marketing funnel as we know it is changing.

But as I was digging through the UCP spec, I found some flickering signals. There are data points—buyer IPs, user agents, catalog search queries—that hint at a new kind of measurement.

In Part 2, I want to explore that fog. I’m hoping to get some clarity on what the future of digital marketing looks like when humans stop clicking Add to Cart.

Stay tuned.