Justin Chau

Posted on Nov 11 Edited on Nov 11 AI-assisted

UCP Explained: How AI Agents Actually Complete a Purchase on Your Store

#ucp #agenticcommerce #agents

You may be familiar with JSON-LD and GEO (which allow AI agents to read your page) as well as WebMCP (which lets them interact with it). These aspects are important for online agentic commerce, allowing AI agents to understand and browse the information on online shops akin to human customers, even being capable of buying products on the behalf of their users. But what should happen when an agent needs to undergo the purchase transaction?

That’s where the Universal Commerce Protocol (UCP) comes in.

Launched as an open standard, UCP was co-developed by Google alongside Shopify, Etsy, Wayfair, Target, and Walmart, with backing from over 20 organizations including Mastercard, Visa, Stripe, and American Express. Essentially, it defines a common language so AI agents, merchants, and payment providers can discover products, negotiate capabilities, and complete transactions end-to-end.

For store owners, the most important thing to start with is what UCP doesn’t do. It doesn’t replace your storefront, your checkout, or your payment stack. You remain the Merchant of Record, keeping full ownership of the customer relationship, pricing, inventory, and fulfillment. UCP is simply the protocol layer that lets an agent talk to your existing systems without requiring a custom integration for every new AI platform.

How UCP Works: Capability Negotiation

The core mechanism of UCP is capability negotiation. Your store publishes a profile at a standardized endpoint (/.well-known/ucp) declaring what you support—such as Checkout, Orders, and Catalog—alongside your implemented payment handlers and extensions. Agents publish their own profiles, and every transaction starts with your store computing the intersection of what both sides can handle.

If this sounds familiar, it's because it mirrors HTTP, where every request negotiates accepted headers and content types. UCP applies that exact same proven mechanism to commerce.

The architecture maps closely to TCP/IP:

The Shopping Service defines core primitives like checkout sessions and line items.
Capabilities add functional areas (Checkout, Orders, Catalog) that are independently versioned.
Extensions handle domain-specific needs like loyalty programs or fulfillment windows.

You only implement what you need, and the agent only negotiates what it can handle.

The Checkout State Machine

For merchants worried about edge cases and broken flows, the checkout state machine provides a reliable safety net through three clear states:

incomplete: Required information is missing. The agent attempts to resolve it via API calls.
requires_escalation: The agent hits a capability gap. The merchant response includes a continue_url, letting the buyer complete the step manually with their session state preserved.
ready_for_complete: All requirements are met, and the agent finalizes the transaction programmatically.

This ensures no transaction gets stranded because an agent couldn't handle a custom checkout flow; the protocol always provides a path forward, including human handoff.

Transport is flexible, running over REST (primary), MCP, A2A, or embedded bindings. This ties back to our previous layers: MCP is how the agent talks to tools, while UCP is the commerce vocabulary those tools speak.

Example of UCP Structure

Here is what a standard UCP configuration profile looks like in practice:

{
  "ucp": {
    "version": "2026-01-23",
    "services": {
      "dev.ucp.shopping": [
        {
          "version": "2026-01-23",
          "spec": "https://ucp.dev/specification/overview",
          "transport": "rest",
          "endpoint": "https://business.example.com/ucp/v1",
          "schema": "https://ucp.dev/2026-01-23/services/shopping/openapi.json"
        }
      ]
    },
    "capabilities": {
      "dev.ucp.shopping.checkout": [
        {
          "version": "2026-01-23",
          "spec": "https://ucp.dev/specification/checkout",
          "schema": "https://ucp.dev/2026-01-23/schemas/shopping/checkout.json"
        }
      ],
      "dev.ucp.shopping.fulfillment": [
        {
          "version": "2026-01-23",
          "spec": "https://ucp.dev/specification/fulfillment",
          "schema": "https://ucp.dev/2026-01-23/schemas/shopping/fulfillment.json",
          "extends": "dev.ucp.shopping.checkout"
        }
      ],
      "dev.ucp.shopping.discount": [
        {
          "version": "2026-01-23",
          "spec": "https://ucp.dev/specification/discount",
          "schema": "https://ucp.dev/2026-01-23/schemas/shopping/discount.json",
          "extends": "dev.ucp.shopping.checkout"
        }
      ],
      "dev.ucp.shopping.order": [
        {
          "version": "2026-01-23",
          "spec": "https://ucp.dev/latest/specification/order",
          "schema": "https://ucp.dev/2026-01-23/schemas/shopping/order.json"
        }
      ]
    }
  }
}

How Agents Use UCP: A Concrete Flow

Let's walk through a transaction using a simple coffee beans reorder. A user tells their browser agent, "Reorder my usual coffee beans," and the agent opens your store.

Discovery: The agent asks your store's Catalog for the product details. Because UCP provides real-time data, the agent confirms the coffee beans are in stock and checks the current price before showing the item to the user.
Negotiation: The agent reads your /.well-known/ucp profile to see what your store supports. Your store also checks what the agent supports. They agree on the shared rules (for example, standard Checkout and accepting Google Pay).
Checkout Session: The agent starts a checkout session and receives a unique ID for this specific order. It then sends the shipping address and a secure payment token to your store. If the user has a loyalty discount, the agent applies it during this step.
Completion: If the shipping and payment details are correct, the agent finalizes the purchase. If something is missing (like a required phone number), UCP safely pauses the checkout and prompts the user to fill in the blank.
Post-Purchase: Your store sends order updates and tracking information back to the AI assistant, which can then tell the user when their coffee is on the way.

One detail worth highlighting here is how payments are handled. UCP uses tokenized payment handlers, so the agent never touches raw card data. Protocols like AP2 (Agent Payments Protocol) can also step in as a specialized layer to provide cryptographic proof as a "mandate," verifying that the user actually consented to the transaction.

What UCP Enables Today

UCP is still maturing, but it is already active. Right now, single-item and multi-item cart checkouts are live on Google AI Mode and Gemini for eligible US merchants.

If you use Google Merchant Center, getting started is relatively simple. You can enable it directly through your settings rather than treating it as a major engineering project. You just need to use native_commerce product attributes to trigger a checkout button. Additionally, major platforms like Salesforce, Stripe, and Commerce Inc. are building UCP directly into their systems, meaning merchants who use these platforms won't have to build the integration from scratch.

Stepping back, UCP is fundamentally a bid to make agentic commerce open rather than captive. By keeping merchants as the Merchant of Record and designing for vendor-neutral negotiation, it offers a counterweight to closed ecosystems. Whether that holds as the protocol matures remains to be seen, but the design intent is worth understanding. The fact that Stripe now sits on the UCP Governing Council alongside Google and Shopify suggests the payment layer is consolidating around shared infrastructure rather than fragmenting.

Connecting Back to Your AI-Readiness Stack

This is where the series comes together. Your AI-readiness stack now has three distinct layers:

JSON-LD / GEO tells a parser what your page contains.
WebMCP tells a browser agent what your page can do.
UCP tells a commerce agent how to complete a transaction with your backend.

The practical takeaway is that UCP compliance is actually testable. Does your /.well-known/ucp endpoint exist and declare the right capabilities? Do your product feeds include the attributes agents need? Is your checkout state machine returning the right escalation paths? If the answer to any of these is "no," an agent might successfully discover your products—only to hit a wall at checkout.

Summary

As agentic commerce standards mature, understanding where execution happens is everything.

Use JSON-LD to tell parsers what you sell. Use WebMCP to tell browser agents what your page can do. Use UCP to tell commerce agents how to complete a purchase with your backend.

Your storefront stays yours, and you remain the Merchant of Record. UCP simply provides the open protocol that makes autonomous transactions frictionless without forcing an agent to guess its way through your checkout.

In case you want a better understanding of the previously introduced topics, you can read our prior articles in this series; the first on JSON-LD and GEO, as well as the second on MCP and WebMCP.

DEV Community