eg

ucp readiness checker.

check your /.well-known/ucp profile against the published spec, or paste one before it goes live

we request https://yourstore.com/.well-known/ucp from our server and read what comes back. nothing is stored. try , ,

> why run this at all

agents read one file, and this is it

Under the Universal Commerce Protocol, an agent finds out what your store can do by fetching https://yourdomain.com/.well-known/ucp. That single file says which version you speak, where your endpoints are, what an agent may do once it arrives, and how it can pay you. If the file is missing, malformed or behind a bot filter, the store is invisible to that agent no matter how good the site is.

the failure mode is silence

Nothing tells you the file 404s on your apex domain, that your WAF answers agents with a challenge page, or that it is served as text/html so strict clients refuse it. There is no console, no warning email, no drop in a chart you already watch. You find out by looking.

valid and useful are different bars

A profile can pass every required field and still declare almost nothing an agent can act on. Capabilities are the part that says whether an agent can search your catalogue, build a cart, complete a purchase and read the order afterwards. The purchase path stops at the first step you have not declared.

your platform generates it, you still own it

If you are on a platform that publishes UCP for you, the file appears without you writing it, and it changes when the platform changes. Knowing what it currently says, which version it is pinned to and which capabilities it claims is the difference between assuming you are covered and knowing.

> worked example

A Shopify store checked in September 2026 returns a profile on version 2026-08-25, with an MCP service endpoint, an embedded binding, eight capabilities covering search, lookup, cart, checkout, order, fulfilment and discounts, and three payment handlers. It scores 97. The one flag is that no signing keys are published, so neither side can verify signed traffic. A store on a hand-rolled profile with a valid file but no capabilities block scores in the seventies: readable, but an agent arrives and finds nothing declared to do.

takeaway, Most of the score is decided by your platform. What is left, the signing keys, the version you are pinned to, and whether the file is reachable on the host you actually use, is yours.

> when operators reach for this

  • Ecommerce managers confirming their store publishes a profile at all, and on the host customers and agents actually reach.
  • Developers hand-building a profile who want it validated against the spec before it goes live, without publishing a broken file first.
  • Agencies auditing a client stack, checking which protocol version the platform pinned them to and which capabilities came with it.
  • Teams comparing their own profile against a competitor's to see which capabilities the other store declares and they do not.
  • Anyone who has just moved domain, added a WAF rule or changed CDN, and needs to know the well-known path still answers.

> the calculation

  • discoveryreachable, 200, parses as json, correct content type, no redirect, answers quickly
  • profile validitythe fields the business schema requires, in the shapes it requires
  • what an agent can docoverage of search, lookup, cart, checkout and order, plus valid capability entries
  • payments and trustpayment handlers complete, signing keys published and public-only, endpoints https
  • overall scorediscovery 20% + profile validity 35% + agent capability 25% + payments and trust 20%A failed check scores zero, a partial check scores half. Checks that cannot apply, such as transport checks on a pasted file, are excluded rather than counted as failures.
  • verdictany schema error → invalid · no errors → valid profile · 404 → no profile · 401, 403 or 429 → blockedVerdict and score are separate. A profile can be valid and still score badly, which is the common case.

Frequently asked questions

What is UCP?
The Universal Commerce Protocol, an open specification for how AI agents discover a store, read its catalogue, build a cart and complete a purchase. It is published at ucp.dev with the schemas on GitHub under Apache-2.0. Rather than every agent scraping every site differently, a store declares what it supports in one file and agents negotiate against it.
What is /.well-known/ucp?
The fixed path where a business publishes its UCP profile. It is a JSON document containing a ucp object with the protocol version, a services registry saying where agents send requests and over which transport, an optional capabilities registry saying what they may do, and a payment_handlers registry saying how they can pay. Public signing keys, if you use them, sit in a keys array at the root.
Do I have to build this myself?
Often not. Some platforms publish and maintain the profile for you, Shopify among them, which is why stores on the same platform return near-identical documents. If you are on a custom stack you write and host the file yourself, and this tool is most useful before you publish it rather than after.
What counts as a good score?
Above 90 means valid, current and declaring the whole path from search through to reading the order back. 70 to 90 usually means valid with real gaps, most often no signing keys or a partial capability set. Below 45 there is normally either a schema error or an almost empty profile that an agent can read but cannot use.
The verdict says valid but the score is low. Which matters?
Both, differently. The verdict answers whether a strict client will accept the document. The score answers how much an agent can actually do with you once it has. A minimal profile with the required fields and nothing else is valid and close to useless, which is exactly the case worth catching.
Why does it flag missing signing keys as a warning rather than an error?
Because the schema makes keys optional, and plenty of live profiles publish none. It still matters: without published keys neither side can verify signed requests or webhooks, so you are relying on transport security alone. It is a gap to close, not a reason for an agent to refuse you.
What can this tool not check?
It reads the profile document and nothing else. It does not call your endpoints, so it cannot confirm your checkout actually works, that your catalogue returns products, or that a purchase completes. It does not verify signatures or fetch the schema URLs you reference. A perfect score means the declaration is right, not that the implementation behind it is.
Is the domain I check stored anywhere?
No. We request the file from our server because your browser cannot fetch another domain directly, read the response, and return it. Nothing is written to a database, there is no account, and no email is asked for. Pasted profiles never leave your browser at all.
How is UCP different from the other agentic commerce protocols?
It is one of several, alongside the Agentic Commerce Protocol and AP2, and they solve overlapping problems in different ways. Supporting one does not preclude another, and which of them your buyers' agents use is not something a store controls. Publishing a correct UCP profile is cheap when the platform does it for you and expensive to discover you got wrong.

> related calculators, ai & llm visibility