# Agentic commerce protocols explained: UCP, ACP, MCP, A2A, AP2, WebMCP > Agentic commerce protocols let AI agents discover a store, build carts, check out and pay. UCP (an open standard published at ucp.dev) is the shipped standard with a public discovery file; MCP is the usual transport; ACP (OpenAI and Stripe) is feed-based and invisible from a URL; A2A, AP2 and WebMCP are early-stage. - Source: https://is-agentic-storefront.com/guides/agentic-commerce-protocols - Updated: 2026-10-15 ## What are agentic commerce protocols? Agentic commerce protocols are open specifications that let **AI shopping agents** act on a shopper's behalf: discover a store, search its catalog, build a cart, check out and pay. They cover different layers: - **Commerce**: what a store sells and how to buy it (UCP, ACP). - **Transport**: how an agent calls the store's functions (MCP, A2A, WebMCP). - **Payment and identity**: proving the shopper authorized the agent and the agent is who it claims to be (AP2, Web Bot Auth, Visa TAP, Mastercard Agent Pay). For a store, the practical question is which of these it needs to **publish** and whether an agent can **find** it from the store URL alone. That is what our [agent-readiness scanner](https://is-agentic-storefront.com/guides/agent-ready-ecommerce) measures. For definitions of terms used here, see the [glossary](https://is-agentic-storefront.com/glossary). ## What is UCP (Universal Commerce Protocol)? The [Universal Commerce Protocol](https://ucp.dev/2026-08-25/specification/overview/) is an open standard (Apache-2.0) for agents to discover a merchant's capabilities and then run catalog, cart, checkout and order operations over REST, MCP, A2A or an embedded transport. - **Backed by**: Google and industry partners. It launched in January 2026 and is governed by a multi-company Tech Council. - **Status**: shipped. The latest spec version is `2026-08-25`. It powers Google AI Mode and Gemini. - **What a store publishes**: a JSON business profile at `/.well-known/ucp` listing `version`, `services` (endpoints and transports), `capabilities` (such as `dev.ucp.shopping.checkout`) and `payment_handlers`, plus the endpoints themselves. Optional extras are a [permalink](https://ucp.dev/2026-08-25/specification/permalink/) capability for cart links and an identity linking capability. - **Detectable**: yes. It's the only commerce protocol with a public, crawlable discovery file. Some hosted commerce platforms serve a full UCP profile by default. Headless storefronts on custom domains usually don't, and Medusa doesn't include UCP: you build it with [custom API routes](https://docs.medusajs.com/learn/fundamentals/api-routes). See the [UCP profile check](https://is-agentic-storefront.com/checks/ucp-profile). ## What is ACP (Agentic Commerce Protocol)? The [Agentic Commerce Protocol](https://github.com/agentic-commerce-protocol/agentic-commerce-protocol) is OpenAI and Stripe's spec for product feeds, an agentic checkout API, delegated payment through a Shared Payment Token, and webhooks. In April 2026 it added cart, feed, orders, auth and an MCP binding ([OpenAI commerce docs](https://developers.openai.com/commerce)). - **Status**: beta. In March 2026 OpenAI pulled back ChatGPT Instant Checkout ("moving to Apps"). ChatGPT now focuses on discovery and sends buyers to merchant checkout ([Digital Commerce 360](https://www.digitalcommerce360.com/2026/03/06/openai-shifts-checkout-plans-agentic-commerce-strategy/)). - **What a store publishes**: nothing public. Feeds are pushed to OpenAI by API or SFTP, and checkout endpoints are registered privately. - **Detectable**: no. There is no `.well-known` path, so we don't score it. Its visible prerequisites are scored elsewhere: crawlable product pages and allowing `OAI-SearchBot` in [robots.txt](https://is-agentic-storefront.com/checks/robots-txt). Medusa has an [official ACP tutorial](https://docs.medusajs.com/resources/how-to-tutorials/tutorials/agentic-commerce) covering the product feed, checkout APIs and webhooks. It was written before the Instant Checkout pullback. ## What is MCP (Model Context Protocol)? [MCP](https://blog.modelcontextprotocol.io/posts/2026-07-28/) is a general protocol for AI models to call external tools. It's governed under the Linux Foundation's Agentic AI Foundation, and the current spec is `2026-07-28`. MCP isn't commerce-specific. In ecommerce it's most often the **transport** behind UCP: a UCP profile points to an MCP server, such as one at `/api/ucp/mcp`, that exposes tools such as `search_catalog`, `create_cart` and `complete_checkout`. - **Discovery**: MCP's [SEP-2127 Server Cards](https://modelcontextprotocol.io/seps/2127-mcp-server-cards) (Final, optional) use `/.well-known/ai-catalog.json` at the domain level and `/server-card` per server. Older `/.well-known/mcp` paths from earlier drafts are superseded. - **Auth**: MCP servers publish [RFC 9728](https://datatracker.ietf.org/doc/html/rfc9728) protected resource metadata so clients can start OAuth. - **Detectable**: yes, by sending `tools/list` to the endpoint named in the UCP profile. Medusa's own [MCP server](https://docs.medusajs.com/cloud/medusa-mcp) is merchant-facing and read-only (beta, Medusa Cloud), not a shopper-facing storefront endpoint. See the [agent endpoint check](https://is-agentic-storefront.com/checks/agent-endpoint) and [OAuth discovery check](https://is-agentic-storefront.com/checks/oauth-discovery). ## What is A2A (Agent2Agent)? [A2A](https://a2a-protocol.org/latest/specification/) lets agents hand tasks to other agents. A server publishes an **agent card** (identity, skills, endpoint, auth) at `/.well-known/agent-card.json`. The legacy path before v0.3 was `/.well-known/agent.json`. The spec is at v1.0 with JSON-RPC, gRPC and REST bindings. - **Ecommerce relevance**: low today. UCP can bind to A2A, but none of the major retailers probed on 2026-10-14 served an agent card. - **Detectable**: yes. It's scored as a [bonus signal](https://is-agentic-storefront.com/checks/bonus-signals#a2a-agent-card). ## What is AP2 (Agent Payments Protocol)? AP2 is a payment-authorization layer built on signed **mandates** (intent and cart) that prove a user authorized an agent's purchase. v0.2 adds "human not present" payments. Google [donated AP2 to the FIDO Alliance](https://blog.google/products-and-platforms/platforms/google-pay/agent-payments-protocol-fido-alliance/) on 2026-04-28. - **Status**: draft and pilots. UCP references AP2 mandates through an extension. - **What a store publishes**: nothing standalone. Merchants adopt it through payment providers. - **Detectable**: only indirectly, through a UCP profile. Not scored separately. ## What is WebMCP? [WebMCP](https://webmachinelearning.github.io/webmcp/) is a W3C Community Group draft that lets a web page register tools for **in-browser** agents, with `document.modelContext.registerTool()` or `toolname` attributes on forms. Access is gated by `Permissions-Policy: tools`. - **Status**: experimental. It's in a Chrome 149 origin trial and no other browser supports it ([Chrome docs](https://developer.chrome.com/docs/ai/webmcp)). - **Detectable**: partly. Static HTML shows declarative forms and inline registration. Tools registered at runtime need a real browser to see. Scored as a [bonus signal](https://is-agentic-storefront.com/checks/bonus-signals#webmcp). ## What about Web Bot Auth, Visa TAP and Mastercard Agent Pay? These standards prove an agent's identity and payment authority. Verification happens at the merchant's CDN or payment provider, not in storefront HTML, so we treat them as **info-only**. - **[Web Bot Auth](https://datatracker.ietf.org/doc/draft-ietf-webbotauth-httpsig-protocol/)**: agents sign requests with RFC 9421 HTTP Message Signatures and publish keys on **their own** domain. It's an IETF working group draft. - **[Visa Trusted Agent Protocol](https://github.com/visa/trusted-agent-protocol)**: agent identity plus payment intent based on Web Bot Auth. Shipped. - **[Mastercard Agent Pay](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/use-cases/agent-pay/)**: agentic payment tokens plus Web Bot Auth verification. Shipped. - **Cloudflare** [verifies Web Bot Auth](https://blog.cloudflare.com/secure-agentic-commerce/) for Visa, Mastercard and Amex. What a store can control, and what we score, is the result: **legitimate agents aren't blocked**. See the [agent access check](https://is-agentic-storefront.com/checks/agent-access) and the [AI user agents guide](https://is-agentic-storefront.com/guides/ai-user-agents). ## How do the agentic commerce protocols compare? | Protocol | Purpose | Backed by | Discovery location | Detectable over HTTP? | How we score it | | -------------------------------------------------- | ------------------------------- | ---------------------------------------- | ------------------------------------------------------- | --------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **UCP** | Catalog, cart, checkout, orders | Google + industry Tech Council | `/.well-known/ucp`, `rel="ucp"` | Yes | [High weight](https://is-agentic-storefront.com/checks/ucp-profile), graded by capabilities; [permalinks](https://is-agentic-storefront.com/checks/checkout-permalinks) medium; `rel="ucp"` [bonus](https://is-agentic-storefront.com/checks/bonus-signals#ucp-link) | | **MCP** | Tool-calling transport | Linux Foundation (Agentic AI Foundation) | Endpoint in UCP profile; `/.well-known/ai-catalog.json` | Yes | [Live endpoint](https://is-agentic-storefront.com/checks/agent-endpoint) high; [OAuth metadata](https://is-agentic-storefront.com/checks/oauth-discovery) medium; [AI Catalog](https://is-agentic-storefront.com/checks/bonus-signals#ai-catalog) bonus | | **ACP** | Feeds + checkout in ChatGPT | OpenAI, Stripe | None (private registration) | No | Info only | | **A2A** | Agent-to-agent tasks | A2A project | `/.well-known/agent-card.json` | Yes | [Bonus](https://is-agentic-storefront.com/checks/bonus-signals#a2a-agent-card) | | **AP2** | Payment mandates | Google → FIDO Alliance | None standalone | Indirect (via UCP) | Not scored | | **WebMCP** | In-browser page tools | W3C Community Group, Chrome | Page HTML/JS, `Permissions-Policy` | Partly | [Bonus](https://is-agentic-storefront.com/checks/bonus-signals#webmcp) | | **Web Bot Auth / Visa TAP / Mastercard Agent Pay** | Agent identity + payment | IETF, Visa, Mastercard, Cloudflare | Agent's domain / CDN | No | Info only; we score [agent access](https://is-agentic-storefront.com/checks/agent-access) | All agentic commerce checks together make up 15% of the overall score. See the [scoring methodology](https://is-agentic-storefront.com/guides/scoring-methodology). ## Which agentic commerce protocol should a store implement first? 1. **Don't block agents.** No protocol helps if your WAF challenges AI user agents or your cart page loads a CAPTCHA. Fix [agent access](https://is-agentic-storefront.com/checks/agent-access) and [CAPTCHAs](https://is-agentic-storefront.com/checks/no-captcha) first. 2. **Publish a UCP profile** at `/.well-known/ucp` that declares catalog, cart, checkout and order. It's shipped, multi-vendor, and discoverable from your domain alone. 3. **Back it with a live MCP or REST endpoint** that answers `tools/list`, plus [cart/checkout permalinks](https://is-agentic-storefront.com/checks/checkout-permalinks) so agents can hand shoppers a ready-to-pay link. 4. **Add OAuth discovery** if agents should act on signed-in accounts. 5. **Add ACP** if ChatGPT discovery matters to you. It runs through OpenAI's merchant program, not your public site. 6. **Treat A2A, AI Catalog, WebMCP and API catalog as bonuses.** They're cheap to add but early. Some hosted platforms do steps 2–4 for you. On a headless stack they are custom work. On Medusa: - **ACP** has an [official tutorial](https://docs.medusajs.com/resources/how-to-tutorials/tutorials/agentic-commerce). - **UCP, a shopper-facing MCP server, permalinks and OAuth discovery** aren't built in. You can implement them with [custom API routes](https://docs.medusajs.com/learn/fundamentals/api-routes) over the Store API. A [third-party UCP and ACP plugin](https://medusajs.com/integrations/@financedistrictmedusa-plugin-agentic-commerce) is listed in the Medusa integrations directory; Medusa doesn't maintain it. The [Medusa agent-readiness guide](https://is-agentic-storefront.com/guides/medusa-agent-readiness) maps every check to the Medusa starter. ## Frequently asked questions ### What is the difference between UCP and ACP? UCP, an open standard published at ucp.dev, publishes a public profile at /.well-known/ucp that any agent can discover. ACP, from OpenAI and Stripe, works through product feeds and checkout endpoints registered privately with OpenAI, so it cannot be detected from a store's URL. ### Which agentic commerce protocol should my store implement first? Start with UCP: publish /.well-known/ucp backed by a working MCP or REST endpoint and cart/checkout permalinks. It is shipped, multi-vendor and the only one AI agents can discover from your domain alone. ### Is MCP an ecommerce protocol? No. MCP (Model Context Protocol) is a general way for AI models to call tools. In commerce it is most often the transport a UCP profile points to, for example an MCP server at /api/ucp/mcp. ### Do I need to support Visa Trusted Agent Protocol or Mastercard Agent Pay? They are verified by your payment provider or CDN, not your storefront code. The scanner treats them as info-only. What matters on your side is not blocking legitimate agent traffic. ### Does ChatGPT still check out inside the chat? OpenAI pulled back Instant Checkout in March 2026. ChatGPT now focuses on product discovery and sends buyers to the merchant's checkout, which makes crawlable product pages and checkout links more important. ## Run your store on a platform built for agentic commerce Medusa is open-source, headless commerce with a full Store API agents can call and storefronts you control end to end. ### Deploy on Medusa Cloud Open-source commerce with a full Store API, hosted and scaled for you. Your storefront, your data model. - [Deploy on Medusa Cloud](https://cloud.medusajs.com?utm_source=agent-friendly-scorer&utm_medium=referral&utm_campaign=markdown-cta&utm_content=%2Fguides%2Fagentic-commerce-protocols) - [Medusa Cloud docs](https://docs.medusajs.com/cloud?utm_source=agent-friendly-scorer&utm_medium=referral&utm_campaign=markdown-cta&utm_content=%2Fguides%2Fagentic-commerce-protocols) ### Storefront skills for coding agents Teach Claude Code, Cursor or Codex to build storefronts with the patterns these checks look for. ```bash npx skills add medusajs/medusa-agent-skills ``` [View the skill on GitHub](https://github.com/medusajs/medusa-agent-skills/tree/main/plugins/ecommerce-storefront/skills/storefront-best-practices) --- Scan your store for free at https://is-agentic-storefront.com/