What is the difference between UCP and ACP?

UCP, an open standard published at ucp.dev, publishes a public profile at /.well-known/ucp that any agent can discover. ACP, from OpenAI and Stripe, works through product feeds and checkout endpoints registered privately with OpenAI, so it cannot be detected from a store's URL.

Which agentic commerce protocol should my store implement first?

Start with UCP: publish /.well-known/ucp backed by a working MCP or REST endpoint and cart/checkout permalinks. It is shipped, multi-vendor and the only one AI agents can discover from your domain alone.

Is MCP an ecommerce protocol?

No. MCP (Model Context Protocol) is a general way for AI models to call tools. In commerce it is most often the transport a UCP profile points to, for example an MCP server at /api/ucp/mcp.

Do I need to support Visa Trusted Agent Protocol or Mastercard Agent Pay?

They are verified by your payment provider or CDN, not your storefront code. The scanner treats them as info-only. What matters on your side is not blocking legitimate agent traffic.

Does ChatGPT still check out inside the chat?

OpenAI pulled back Instant Checkout in March 2026. ChatGPT now focuses on product discovery and sends buyers to the merchant's checkout, which makes crawlable product pages and checkout links more important.

Agentic commerce protocols explained: UCP, ACP, MCP, A2A, AP2, WebMCP

What are agentic commerce protocols?

Agentic commerce protocols are open specifications that let AI shopping agents act on a shopper’s behalf: discover a store, search its catalog, build a cart, check out and pay. They cover different layers:

Commerce: what a store sells and how to buy it (UCP, ACP).
Transport: how an agent calls the store’s functions (MCP, A2A, WebMCP).
Payment and identity: proving the shopper authorized the agent and the agent is who it claims to be (AP2, Web Bot Auth, Visa TAP, Mastercard Agent Pay).

For a store, the practical question is which of these it needs to publish and whether an agent can find it from the store URL alone. That is what our agent-readiness scanner measures. For definitions of terms used here, see the glossary.

What is UCP (Universal Commerce Protocol)?

The Universal Commerce Protocol is an open standard (Apache-2.0) for agents to discover a merchant’s capabilities and then run catalog, cart, checkout and order operations over REST, MCP, A2A or an embedded transport.

Backed by: Google and industry partners. It launched in January 2026 and is governed by a multi-company Tech Council.
Status: shipped. The latest spec version is 2026-08-25. It powers Google AI Mode and Gemini.
What a store publishes: a JSON business profile at /.well-known/ucp listing version, services (endpoints and transports), capabilities (such as dev.ucp.shopping.checkout) and payment_handlers, plus the endpoints themselves. Optional extras are a permalink capability for cart links and an identity linking capability.
Detectable: yes. It’s the only commerce protocol with a public, crawlable discovery file.

Some hosted commerce platforms serve a full UCP profile by default. Headless storefronts on custom domains usually don’t, and Medusa doesn’t include UCP: you build it with custom API routes. See the UCP profile check.

What is ACP (Agentic Commerce Protocol)?

The Agentic Commerce Protocol is OpenAI and Stripe’s spec for product feeds, an agentic checkout API, delegated payment through a Shared Payment Token, and webhooks. In April 2026 it added cart, feed, orders, auth and an MCP binding (OpenAI commerce docs).

Status: beta. In March 2026 OpenAI pulled back ChatGPT Instant Checkout (“moving to Apps”). ChatGPT now focuses on discovery and sends buyers to merchant checkout (Digital Commerce 360).
What a store publishes: nothing public. Feeds are pushed to OpenAI by API or SFTP, and checkout endpoints are registered privately.
Detectable: no. There is no .well-known path, so we don’t score it. Its visible prerequisites are scored elsewhere: crawlable product pages and allowing OAI-SearchBot in robots.txt.

Medusa has an official ACP tutorial covering the product feed, checkout APIs and webhooks. It was written before the Instant Checkout pullback.

What is MCP (Model Context Protocol)?

MCP is a general protocol for AI models to call external tools. It’s governed under the Linux Foundation’s Agentic AI Foundation, and the current spec is 2026-07-28. MCP isn’t commerce-specific. In ecommerce it’s most often the transport behind UCP: a UCP profile points to an MCP server, such as one at /api/ucp/mcp, that exposes tools such as search_catalog, create_cart and complete_checkout.

Discovery: MCP’s SEP-2127 Server Cards (Final, optional) use /.well-known/ai-catalog.json at the domain level and <mcp-url>/server-card per server. Older /.well-known/mcp paths from earlier drafts are superseded.
Auth: MCP servers publish RFC 9728 protected resource metadata so clients can start OAuth.
Detectable: yes, by sending tools/list to the endpoint named in the UCP profile.

Medusa’s own MCP server is merchant-facing and read-only (beta, Medusa Cloud), not a shopper-facing storefront endpoint. See the agent endpoint check and OAuth discovery check.

What is A2A (Agent2Agent)?

A2A lets agents hand tasks to other agents. A server publishes an agent card (identity, skills, endpoint, auth) at /.well-known/agent-card.json. The legacy path before v0.3 was /.well-known/agent.json. The spec is at v1.0 with JSON-RPC, gRPC and REST bindings.

Ecommerce relevance: low today. UCP can bind to A2A, but none of the major retailers probed on 2026-10-14 served an agent card.
Detectable: yes. It’s scored as a bonus signal.

What is AP2 (Agent Payments Protocol)?

AP2 is a payment-authorization layer built on signed mandates (intent and cart) that prove a user authorized an agent’s purchase. v0.2 adds “human not present” payments. Google donated AP2 to the FIDO Alliance on 2026-04-28.

Status: draft and pilots. UCP references AP2 mandates through an extension.
What a store publishes: nothing standalone. Merchants adopt it through payment providers.
Detectable: only indirectly, through a UCP profile. Not scored separately.

What is WebMCP?

WebMCP is a W3C Community Group draft that lets a web page register tools for in-browser agents, with document.modelContext.registerTool() or toolname attributes on forms. Access is gated by Permissions-Policy: tools.

Status: experimental. It’s in a Chrome 149 origin trial and no other browser supports it (Chrome docs).
Detectable: partly. Static HTML shows declarative forms and inline registration. Tools registered at runtime need a real browser to see. Scored as a bonus signal.

What about Web Bot Auth, Visa TAP and Mastercard Agent Pay?

These standards prove an agent’s identity and payment authority. Verification happens at the merchant’s CDN or payment provider, not in storefront HTML, so we treat them as info-only.

Web Bot Auth: agents sign requests with RFC 9421 HTTP Message Signatures and publish keys on their own domain. It’s an IETF working group draft.
Visa Trusted Agent Protocol: agent identity plus payment intent based on Web Bot Auth. Shipped.
Mastercard Agent Pay: agentic payment tokens plus Web Bot Auth verification. Shipped.
Cloudflare verifies Web Bot Auth for Visa, Mastercard and Amex.

What a store can control, and what we score, is the result: legitimate agents aren’t blocked. See the agent access check and the AI user agents guide.

How do the agentic commerce protocols compare?

Protocol	Purpose	Backed by	Discovery location	Detectable over HTTP?	How we score it
UCP	Catalog, cart, checkout, orders	Google + industry Tech Council	`/.well-known/ucp`, `rel="ucp"`	Yes	High weight, graded by capabilities; permalinks medium; `rel="ucp"` bonus
MCP	Tool-calling transport	Linux Foundation (Agentic AI Foundation)	Endpoint in UCP profile; `/.well-known/ai-catalog.json`	Yes	Live endpoint high; OAuth metadata medium; AI Catalog bonus
ACP	Feeds + checkout in ChatGPT	OpenAI, Stripe	None (private registration)	No	Info only
A2A	Agent-to-agent tasks	A2A project	`/.well-known/agent-card.json`	Yes	Bonus
AP2	Payment mandates	Google → FIDO Alliance	None standalone	Indirect (via UCP)	Not scored
WebMCP	In-browser page tools	W3C Community Group, Chrome	Page HTML/JS, `Permissions-Policy`	Partly	Bonus
Web Bot Auth / Visa TAP / Mastercard Agent Pay	Agent identity + payment	IETF, Visa, Mastercard, Cloudflare	Agent’s domain / CDN	No	Info only; we score agent access

All agentic commerce checks together make up 15% of the overall score. See the scoring methodology.

Which agentic commerce protocol should a store implement first?

Don’t block agents. No protocol helps if your WAF challenges AI user agents or your cart page loads a CAPTCHA. Fix agent access and CAPTCHAs first.
Publish a UCP profile at /.well-known/ucp that declares catalog, cart, checkout and order. It’s shipped, multi-vendor, and discoverable from your domain alone.
Back it with a live MCP or REST endpoint that answers tools/list, plus cart/checkout permalinks so agents can hand shoppers a ready-to-pay link.
Add OAuth discovery if agents should act on signed-in accounts.
Add ACP if ChatGPT discovery matters to you. It runs through OpenAI’s merchant program, not your public site.
Treat A2A, AI Catalog, WebMCP and API catalog as bonuses. They’re cheap to add but early.

Some hosted platforms do steps 2–4 for you. On a headless stack they are custom work. On Medusa:

ACP has an official tutorial.
UCP, a shopper-facing MCP server, permalinks and OAuth discovery aren’t built in. You can implement them with custom API routes over the Store API. A third-party UCP and ACP plugin is listed in the Medusa integrations directory; Medusa doesn’t maintain it.

The Medusa agent-readiness guide maps every check to the Medusa starter.