How Shopify Agentic Commerce’s scores are calculated

Point an agent at llms.txt or agent-oriented docsweight 2

2 (weight) × 7 (quality) × 0.6 (partial) = 8.4 of 20 max

• [probe] https://shopify.dev/llms.txt“PROBE llms.txt: HTTP 404 at https://shopify.dev/llms.txt”
• [probe] https://shopify.dev/docs/agents.md“PROBE docs-md: HTTP 200 at https://shopify.dev/docs/agents.md --- title: Agentic commerce description: >- Build AI agents that authenticate with Shopify, search the Catalog, build”
• [probe] https://ucp.dev/“PROBE runtime (recorded 2026-09-14): the Universal Commerce Protocol spec is published in the open — https://ucp.dev/llms.txt serves the versioned specification index ('# Universal Commerce Protocol (UCP)... an open standard that enables gen AI agents to safely, securely, and privately execute commerce actions'), with dated releases (2026-08-25, 2026-04-08, ...) and the GitHub org Universal-Commerce-Protocol.”
• [claimed-docs] https://shopify.dev/docs/agents/get-started/quickstart.md“Initialize a local UCP profile.”
• [claimed-docs] https://shopify.dev/docs/agents/get-started/quickstart.md“This quickstart runs the full agentic commerce flow with the UCP CLI, from product discovery to order tracking, in about five minutes.”

Run the product headlessly / in CI for automationweight 2

2 (weight) × 8 (quality) × 1.0 (full) = 16.0 of 20 max

• [claimed-docs] https://shopify.dev/docs/agents/get-started/quickstart.md“Initialize a local UCP profile.”
• [claimed-docs] https://shopify.dev/docs/agents/get-started/quickstart.md“This quickstart runs the full agentic commerce flow with the UCP CLI, from product discovery to order tracking, in about five minutes.”
• [claimed-docs] https://shopify.dev/docs/agents/get-started/quickstart.md“The CLI uses a local profile to identify your agent on every merchant-scoped request. Initialize it once and the CLI reuses it for every operation.”
• [claimed-docs] https://shopify.dev/docs/agents.md“Shopify's agent surface is UCP end to end via "Shopify's UCP-compliant MCP servers": the UCP CLI "provides structured commands to search the Catalog, build carts, create checkouts, hand off buyers, and track orders" (install with `npm install -g @shopify/ucp-cli` plus the AI Toolkit plugin, e.g. `claude plugin install shopify-ai-toolkit@claude-plugins-official`). The four-stage journey is explicit — discovery ("Search across hundreds of millions of Shopify listings"), carts/checkout ("Build carts, convert them to checkouts, and hand off to the merchant for payment", though "Trusted agents can complete checkouts directly"), and orders ("Receive order webhooks and fetch fresh order state on demand"). A cross-merchant wallet-of-goods is waitlisted: "One Cart, every brand. The Universal Cart API lets AI agents collect items from any merchant, on or off Shopify, into a single, unified cart, all via UCP."”
• [probe] https://shopify.dev/docs/agents/carts-and-checkout/cart-mcp“PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/ucp-cli with a self-generated local profile searched the live catalog (variant gid://shopify/ProductVariant/47695038775318) and ucp cart create returned a live gid://shopify/Cart/ id plus the documented next steps (ucp checkout create from the cart id). Ephemeral; no checkout, no payment.”
• [probe] https://shopify.dev/docs/agents/profiles/auth-and-rate-limiting“PROBE runtime (recorded 2026-09-14): the documented agent-profile trust gate behaves as specified — a keyless raw tools/call search_catalog against catalog.shopify.com/api/ucp/mcp without a hosted agent profile returned the structured error invalid_profile_url, matching the documented requirement that agents identify themselves via a hosted profile before acting.”
• [probe] https://shopify.dev/docs/agents/get-started/quickstart“official CLI documented at https://shopify.dev/docs/agents/get-started/quickstart”

Plug MCP servers into this product so it can use their toolsweight 3

n/a — not applicable to this product: excluded from numerator and denominator

• [claimed-docs] https://shopify.dev/docs/agents“the CLI provides structured commands to search the Catalog, build carts, create checkouts, hand off buyers, and track orders”
• [claimed-docs] https://shopify.dev/docs/agents.md“Shopify's agent surface is UCP end to end via "Shopify's UCP-compliant MCP servers": the UCP CLI "provides structured commands to search the Catalog, build carts, create checkouts, hand off buyers, and track orders" (install with `npm install -g @shopify/ucp-cli` plus the AI Toolkit plugin, e.g. `claude plugin install shopify-ai-toolkit@claude-plugins-official`). The four-stage journey is explicit — discovery ("Search across hundreds of millions of Shopify listings"), carts/checkout ("Build carts, convert them to checkouts, and hand off to the merchant for payment", though "Trusted agents can complete checkouts directly"), and orders ("Receive order webhooks and fetch fresh order state on demand"). A cross-merchant wallet-of-goods is waitlisted: "One Cart, every brand. The Universal Cart API lets AI agents collect items from any merchant, on or off Shopify, into a single, unified cart, all via UCP."”
• [claimed-docs] https://shopify.dev/docs/agents/catalog/global-catalog.md“"The Global Catalog MCP server enables AI agents to search and discover products across the entire Shopify ecosystem, helping buyers find products from multiple merchants." Tools at catalog.shopify.com/api/ucp/mcp conform to the UCP catalog spec: search_catalog "supports a text query, an image, or a set of product IDs to find similar items" and "Results are clustered by Universal Product ID (UPID) and include offers from multiple merchants"; lookup_catalog resolves known IDs and product URLs; get_product narrows variants with availability signals. Access requires identity — "Every request must include a `meta.ucp-agent.profile` URL pointing to your agent's UCP profile" — and machine-usable filters cover price in minor units, ships_to / ships_from, condition, rating, price_tier and taxonomy attributes, with cursor pagination ("You can paginate up to 1,000 results").”
• [claimed-docs] https://shopify.dev/docs/agents/carts-and-checkout/cart-mcp.md“"Cart tools accept unauthenticated requests, which lets you estimate totals and share a cart with the buyer before collecting credentials" — create_cart / get_cart / update_cart / cancel_cart run as JSON-RPC against the merchant's /api/ucp/mcp endpoint, and by design "Carts have a long TTL." while "Checkouts are short-lived." Each cart returns estimated totals plus a continue_url "that the buyer can use to pick up the cart on the merchant's storefront", and carts carry agent attribution ("Supported fields include `referring_domain`, `click_id_tag`, `click_id_value`, `activity_id_tag`, `activity_id_value`, `utm_campaign`, `utm_source`, `utm_medium`, `utm_content`, and `utm_term`"); cancel_cart additionally requires an idempotency-key UUID "for retry safety".”

Connect an agent via an official MCP serverweight 3

3 (weight) × 9 (quality) × 1.0 (full) = 27.0 of 30 max

• [claimed-docs] https://shopify.dev/docs/agents.md“Shopify's agent surface is UCP end to end via "Shopify's UCP-compliant MCP servers": the UCP CLI "provides structured commands to search the Catalog, build carts, create checkouts, hand off buyers, and track orders" (install with `npm install -g @shopify/ucp-cli` plus the AI Toolkit plugin, e.g. `claude plugin install shopify-ai-toolkit@claude-plugins-official`). The four-stage journey is explicit — discovery ("Search across hundreds of millions of Shopify listings"), carts/checkout ("Build carts, convert them to checkouts, and hand off to the merchant for payment", though "Trusted agents can complete checkouts directly"), and orders ("Receive order webhooks and fetch fresh order state on demand"). A cross-merchant wallet-of-goods is waitlisted: "One Cart, every brand. The Universal Cart API lets AI agents collect items from any merchant, on or off Shopify, into a single, unified cart, all via UCP."”
• [claimed-docs] https://shopify.dev/docs/agents/catalog/global-catalog.md“"The Global Catalog MCP server enables AI agents to search and discover products across the entire Shopify ecosystem, helping buyers find products from multiple merchants." Tools at catalog.shopify.com/api/ucp/mcp conform to the UCP catalog spec: search_catalog "supports a text query, an image, or a set of product IDs to find similar items" and "Results are clustered by Universal Product ID (UPID) and include offers from multiple merchants"; lookup_catalog resolves known IDs and product URLs; get_product narrows variants with availability signals. Access requires identity — "Every request must include a `meta.ucp-agent.profile` URL pointing to your agent's UCP profile" — and machine-usable filters cover price in minor units, ships_to / ships_from, condition, rating, price_tier and taxonomy attributes, with cursor pagination ("You can paginate up to 1,000 results").”
• [claimed-docs] https://shopify.dev/docs/agents/catalog/storefront-catalog.md“"The Storefront Catalog MCP server enables AI agents to search and discover products from a single merchant's catalog, helping buyers find and purchase products from that store" — the same UCP catalog tools served per-merchant at the shop's own /api/ucp/mcp endpoint. Agents introspect each shop's contract at runtime: "Use `--input-schema` against any of these commands to fetch the merchant's live input schema before composing a payload." Search responses include a UCP metadata envelope and "products with title, description, price range (minor units), media, and variants".”
• [claimed-docs] https://shopify.dev/docs/agents/carts-and-checkout/cart-mcp.md“"Cart tools accept unauthenticated requests, which lets you estimate totals and share a cart with the buyer before collecting credentials" — create_cart / get_cart / update_cart / cancel_cart run as JSON-RPC against the merchant's /api/ucp/mcp endpoint, and by design "Carts have a long TTL." while "Checkouts are short-lived." Each cart returns estimated totals plus a continue_url "that the buyer can use to pick up the cart on the merchant's storefront", and carts carry agent attribution ("Supported fields include `referring_domain`, `click_id_tag`, `click_id_value`, `activity_id_tag`, `activity_id_value`, `utm_campaign`, `utm_source`, `utm_medium`, `utm_content`, and `utm_term`"); cancel_cart additionally requires an idempotency-key UUID "for retry safety".”
• [claimed-docs] https://shopify.dev/docs/agents/carts-and-checkout/checkout-mcp.md“"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens are minted from Dev Dashboard client credentials at api.shopify.com/auth/access_token ("JWT tokens created from Dev Dashboard credentials have a 60-minute TTL"). create_checkout converts carts — with cart_id, "the server loads the referenced cart and inherits its `line_items`, `context`, `buyer`, and associated attribution metadata" — and complete_checkout is the purchase commit ("Submit payment and place the order."), to be called only when "Checkout status is `ready_for_complete`", the "Buyer has reviewed and confirmed the order", and the "Payment credential has been collected"; the documented create_checkout response advertises negotiated payment_handlers such as com.google.pay.”
• [claimed-docs] https://shopify.dev/docs/agents/orders/order-mcp.md“"The Order MCP server enables AI agents to fetch the current state of an order placed through their agent, including line items, fulfillment events, and post-purchase adjustments" via the single UCP tool get_order. Access is the highest trust gate: "Order MCP is available only to Token-tier agents." and "`get_order` requires a Global API JWT with the `read_global_api_orders` scope, which Signed-tier and Anonymous-tier agents can't obtain." Guidance: "Use webhooks as the primary update channel." and reserve get_order for buyer-initiated reads and reconciling missed webhooks.”
• [probe] https://shopify.dev/docs/agents/catalog/global-catalog“PROBE runtime (recorded 2026-09-14): Shopify's Global Catalog MCP server is live — a keyless JSON-RPC initialize POST to https://catalog.shopify.com/api/ucp/mcp completed a FULL handshake (HTTP 200, serverInfo universal-ucp-mcp, header x-shopify-ucp-mcp-api-version: 2026-08-25).”
• [probe] https://shopify.dev/docs/agents/catalog/storefront-catalog“PROBE runtime (recorded 2026-09-14): a Shopify-operated storefront's own UCP endpoint is live — a keyless JSON-RPC initialize POST to https://hardware.shopify.com/api/ucp/mcp completed a FULL handshake (serverInfo universal-commerce), the per-merchant /api/ucp/mcp surface every UCP-enabled storefront exposes to agents.”
• [probe] https://shopify.dev/docs/agents/carts-and-checkout/cart-mcp“PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/ucp-cli with a self-generated local profile searched the live catalog (variant gid://shopify/ProductVariant/47695038775318) and ucp cart create returned a live gid://shopify/Cart/ id plus the documented next steps (ucp checkout create from the cart id). Ephemeral; no checkout, no payment.”
• [probe] https://shopify.dev/docs/agents/profiles/auth-and-rate-limiting“PROBE runtime (recorded 2026-09-14): the documented agent-profile trust gate behaves as specified — a keyless raw tools/call search_catalog against catalog.shopify.com/api/ucp/mcp without a hosted agent profile returned the structured error invalid_profile_url, matching the documented requirement that agents identify themselves via a hosted profile before acting.”
• [claimed-docs] https://shopify.dev/docs/apps/build/storefront-mcp.md“Connect any AI assistant to real-time commerce data from Shopify stores with Model Context Protocol (MCP) servers”

Use an official CLIweight 2

2 (weight) × 8 (quality) × 1.0 (full) = 16.0 of 20 max

• [claimed-docs] https://shopify.dev/docs/agents.md“Shopify's agent surface is UCP end to end via "Shopify's UCP-compliant MCP servers": the UCP CLI "provides structured commands to search the Catalog, build carts, create checkouts, hand off buyers, and track orders" (install with `npm install -g @shopify/ucp-cli` plus the AI Toolkit plugin, e.g. `claude plugin install shopify-ai-toolkit@claude-plugins-official`). The four-stage journey is explicit — discovery ("Search across hundreds of millions of Shopify listings"), carts/checkout ("Build carts, convert them to checkouts, and hand off to the merchant for payment", though "Trusted agents can complete checkouts directly"), and orders ("Receive order webhooks and fetch fresh order state on demand"). A cross-merchant wallet-of-goods is waitlisted: "One Cart, every brand. The Universal Cart API lets AI agents collect items from any merchant, on or off Shopify, into a single, unified cart, all via UCP."”
• [claimed-docs] https://shopify.dev/docs/agents/get-started/quickstart.md“Initialize a local UCP profile.”
• [claimed-docs] https://shopify.dev/docs/agents/get-started/quickstart.md“This quickstart runs the full agentic commerce flow with the UCP CLI, from product discovery to order tracking, in about five minutes.”
• [claimed-docs] https://shopify.dev/docs/agents/get-started/quickstart.md“The CLI uses a local profile to identify your agent on every merchant-scoped request. Initialize it once and the CLI reuses it for every operation.”
• [probe] https://shopify.dev/docs/agents/get-started/quickstart“official CLI documented at https://shopify.dev/docs/agents/get-started/quickstart”
• [probe] https://shopify.dev/docs/agents/carts-and-checkout/cart-mcp“PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/ucp-cli with a self-generated local profile searched the live catalog (variant gid://shopify/ProductVariant/47695038775318) and ucp cart create returned a live gid://shopify/Cart/ id plus the documented next steps (ucp checkout create from the cart id). Ephemeral; no checkout, no payment.”
• [claimed-docs] https://shopify.dev/docs/agents/carts-and-checkout/checkout-mcp.md“Buyer handoff is a first-class state: "Build for escalations regardless of how you authenticate." A checkout in requires_escalation means "Checkout requires buyer input or review not available via API" — messages carry severity requires_buyer_input "(merchant needs input not available via API)" or requires_buyer_review — and the agent must "hand off to the buyer via `continue_url`" to the merchant's own checkout. The CLI automates the gate: "Set `UCP_ON_ESCALATION` before completing a checkout to open the merchant's `continue_url` in the buyer's browser automatically."”

Drive the product through a documented public APIweight 3

3 (weight) × 9 (quality) × 1.0 (full) = 27.0 of 30 max

• [claimed-docs] https://shopify.dev/docs/agents“the CLI provides structured commands to search the Catalog, build carts, create checkouts, hand off buyers, and track orders”
• [claimed-docs] https://shopify.dev/docs/agents.md“Shopify's agent surface is UCP end to end via "Shopify's UCP-compliant MCP servers": the UCP CLI "provides structured commands to search the Catalog, build carts, create checkouts, hand off buyers, and track orders" (install with `npm install -g @shopify/ucp-cli` plus the AI Toolkit plugin, e.g. `claude plugin install shopify-ai-toolkit@claude-plugins-official`). The four-stage journey is explicit — discovery ("Search across hundreds of millions of Shopify listings"), carts/checkout ("Build carts, convert them to checkouts, and hand off to the merchant for payment", though "Trusted agents can complete checkouts directly"), and orders ("Receive order webhooks and fetch fresh order state on demand"). A cross-merchant wallet-of-goods is waitlisted: "One Cart, every brand. The Universal Cart API lets AI agents collect items from any merchant, on or off Shopify, into a single, unified cart, all via UCP."”
• [claimed-docs] https://shopify.dev/docs/agents/catalog/global-catalog.md“"The Global Catalog MCP server enables AI agents to search and discover products across the entire Shopify ecosystem, helping buyers find products from multiple merchants." Tools at catalog.shopify.com/api/ucp/mcp conform to the UCP catalog spec: search_catalog "supports a text query, an image, or a set of product IDs to find similar items" and "Results are clustered by Universal Product ID (UPID) and include offers from multiple merchants"; lookup_catalog resolves known IDs and product URLs; get_product narrows variants with availability signals. Access requires identity — "Every request must include a `meta.ucp-agent.profile` URL pointing to your agent's UCP profile" — and machine-usable filters cover price in minor units, ships_to / ships_from, condition, rating, price_tier and taxonomy attributes, with cursor pagination ("You can paginate up to 1,000 results").”
• [claimed-docs] https://shopify.dev/docs/agents/carts-and-checkout/cart-mcp.md“"Cart tools accept unauthenticated requests, which lets you estimate totals and share a cart with the buyer before collecting credentials" — create_cart / get_cart / update_cart / cancel_cart run as JSON-RPC against the merchant's /api/ucp/mcp endpoint, and by design "Carts have a long TTL." while "Checkouts are short-lived." Each cart returns estimated totals plus a continue_url "that the buyer can use to pick up the cart on the merchant's storefront", and carts carry agent attribution ("Supported fields include `referring_domain`, `click_id_tag`, `click_id_value`, `activity_id_tag`, `activity_id_value`, `utm_campaign`, `utm_source`, `utm_medium`, `utm_content`, and `utm_term`"); cancel_cart additionally requires an idempotency-key UUID "for retry safety".”
• [claimed-docs] https://shopify.dev/docs/agents/carts-and-checkout/checkout-mcp.md“"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens are minted from Dev Dashboard client credentials at api.shopify.com/auth/access_token ("JWT tokens created from Dev Dashboard credentials have a 60-minute TTL"). create_checkout converts carts — with cart_id, "the server loads the referenced cart and inherits its `line_items`, `context`, `buyer`, and associated attribution metadata" — and complete_checkout is the purchase commit ("Submit payment and place the order."), to be called only when "Checkout status is `ready_for_complete`", the "Buyer has reviewed and confirmed the order", and the "Payment credential has been collected"; the documented create_checkout response advertises negotiated payment_handlers such as com.google.pay.”
• [claimed-docs] https://shopify.dev/docs/agents/orders/order-mcp.md“"The Order MCP server enables AI agents to fetch the current state of an order placed through their agent, including line items, fulfillment events, and post-purchase adjustments" via the single UCP tool get_order. Access is the highest trust gate: "Order MCP is available only to Token-tier agents." and "`get_order` requires a Global API JWT with the `read_global_api_orders` scope, which Signed-tier and Anonymous-tier agents can't obtain." Guidance: "Use webhooks as the primary update channel." and reserve get_order for buyer-initiated reads and reconciling missed webhooks.”
• [claimed-docs] https://shopify.dev/docs/agents/orders/order-webhooks.md“"Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (fulfillment progress, refunds, returns, exchanges, order edits, or cancellations)." Each delivery is the full order state ("Treat the latest payload as the source of truth"), HMAC-SHA256 signed, and durable — "Failed deliveries are retried up to 8 times over 4 hours with exponential backoff." Subscription is not self-serve: "There's no self-serve subscription API today: your delivery URL and topic scoping are registered server-side. To set up or update an order webhook subscription, contact your Shopify partner manager." — and although the UCP spec lets agents advertise a webhook_url in their profile, "Shopify doesn't honor that field today."”
• [claimed-docs] https://shopify.dev/docs/agents/profiles.md“In UCP, "a platform profile is a JSON document that describes the protocol version and capabilities the platform supports"; the business side publishes its own at the storefront origin ({shop}.myshopify.com/.well-known/ucp), which "describes that party’s protocol version, services, capabilities, payment handlers, and signing keys". "Negotiation is server-selects. The business computes the intersection of its capabilities with the platform’s and chooses the active set", and "If the profile cannot be loaded, is invalid, or yields no compatible capabilities, you get an error path instead of a successful negotiation."”
• [probe] https://shopify.dev/docs/agents/catalog/global-catalog“PROBE runtime (recorded 2026-09-14): Shopify's Global Catalog MCP server is live — a keyless JSON-RPC initialize POST to https://catalog.shopify.com/api/ucp/mcp completed a FULL handshake (HTTP 200, serverInfo universal-ucp-mcp, header x-shopify-ucp-mcp-api-version: 2026-08-25).”
• [probe] https://shopify.dev/docs/agents/carts-and-checkout/cart-mcp“PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/ucp-cli with a self-generated local profile searched the live catalog (variant gid://shopify/ProductVariant/47695038775318) and ucp cart create returned a live gid://shopify/Cart/ id plus the documented next steps (ucp checkout create from the cart id). Ephemeral; no checkout, no payment.”
• [probe] https://shopify.dev/docs/agents/profiles/auth-and-rate-limiting“PROBE runtime (recorded 2026-09-14): the documented agent-profile trust gate behaves as specified — a keyless raw tools/call search_catalog against catalog.shopify.com/api/ucp/mcp without a hosted agent profile returned the structured error invalid_profile_url, matching the documented requirement that agents identify themselves via a hosted profile before acting.”

Issue scoped/least-privilege API credentials for an agentweight 2

2 (weight) × 7 (quality) × 1.0 (full) = 14.0 of 20 max

• [claimed-docs] https://shopify.dev/docs/agents/profiles/auth-and-rate-limiting.md“"UCP traffic to Shopify's MCP servers is classified into three tiers based on how your agent identifies itself" — Token, Signed, Anonymous — and "Stronger identification means higher rate limits and access to more sensitive tools." "Rate limits scale with identification." ("The Token tier gets the highest limits, Signed gets lower limits, and Anonymous gets the lowest."), "Checkout MCP is rate-limited more strictly than Cart MCP at every tier.", and complete_checkout is Token-tier only, "When the token is granted permission to complete purchases". The Signed tier authenticates with RFC 9421 HTTP Message Signatures "using ECDSA P-256", verified "against the public key published in your agent's" well-known UCP profile.”
• [claimed-docs] https://shopify.dev/docs/agents/orders/order-mcp.md“"The Order MCP server enables AI agents to fetch the current state of an order placed through their agent, including line items, fulfillment events, and post-purchase adjustments" via the single UCP tool get_order. Access is the highest trust gate: "Order MCP is available only to Token-tier agents." and "`get_order` requires a Global API JWT with the `read_global_api_orders` scope, which Signed-tier and Anonymous-tier agents can't obtain." Guidance: "Use webhooks as the primary update channel." and reserve get_order for buyer-initiated reads and reconciling missed webhooks.”
• [claimed-docs] https://shopify.dev/docs/agents/carts-and-checkout/checkout-mcp.md“"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens are minted from Dev Dashboard client credentials at api.shopify.com/auth/access_token ("JWT tokens created from Dev Dashboard credentials have a 60-minute TTL"). create_checkout converts carts — with cart_id, "the server loads the referenced cart and inherits its `line_items`, `context`, `buyer`, and associated attribution metadata" — and complete_checkout is the purchase commit ("Submit payment and place the order."), to be called only when "Checkout status is `ready_for_complete`", the "Buyer has reviewed and confirmed the order", and the "Payment credential has been collected"; the documented create_checkout response advertises negotiated payment_handlers such as com.google.pay.”
• [probe] https://shopify.dev/docs/agents/profiles/auth-and-rate-limiting“PROBE runtime (recorded 2026-09-14): the documented agent-profile trust gate behaves as specified — a keyless raw tools/call search_catalog against catalog.shopify.com/api/ucp/mcp without a hosted agent profile returned the structured error invalid_profile_url, matching the documented requirement that agents identify themselves via a hosted profile before acting.”

Build against official SDKsweight 2

2 (weight) × 6 (quality) × 0.6 (partial) = 7.2 of 20 max

• [claimed-docs] https://shopify.dev/docs/agents.md“Shopify's agent surface is UCP end to end via "Shopify's UCP-compliant MCP servers": the UCP CLI "provides structured commands to search the Catalog, build carts, create checkouts, hand off buyers, and track orders" (install with `npm install -g @shopify/ucp-cli` plus the AI Toolkit plugin, e.g. `claude plugin install shopify-ai-toolkit@claude-plugins-official`). The four-stage journey is explicit — discovery ("Search across hundreds of millions of Shopify listings"), carts/checkout ("Build carts, convert them to checkouts, and hand off to the merchant for payment", though "Trusted agents can complete checkouts directly"), and orders ("Receive order webhooks and fetch fresh order state on demand"). A cross-merchant wallet-of-goods is waitlisted: "One Cart, every brand. The Universal Cart API lets AI agents collect items from any merchant, on or off Shopify, into a single, unified cart, all via UCP."”
• [claimed-docs] https://shopify.dev/docs/apps/build/ai-toolkit.md“validate GraphQL queries, Liquid templates, and Shopify Extensions against Shopify schemas to catch issues earlier”
• [claimed-docs] https://shopify.dev/docs/agents/catalog/global-catalog.md“"The Global Catalog MCP server enables AI agents to search and discover products across the entire Shopify ecosystem, helping buyers find products from multiple merchants." Tools at catalog.shopify.com/api/ucp/mcp conform to the UCP catalog spec: search_catalog "supports a text query, an image, or a set of product IDs to find similar items" and "Results are clustered by Universal Product ID (UPID) and include offers from multiple merchants"; lookup_catalog resolves known IDs and product URLs; get_product narrows variants with availability signals. Access requires identity — "Every request must include a `meta.ucp-agent.profile` URL pointing to your agent's UCP profile" — and machine-usable filters cover price in minor units, ships_to / ships_from, condition, rating, price_tier and taxonomy attributes, with cursor pagination ("You can paginate up to 1,000 results").”
• [claimed-docs] https://shopify.dev/docs/agents/carts-and-checkout/cart-mcp.md“"Cart tools accept unauthenticated requests, which lets you estimate totals and share a cart with the buyer before collecting credentials" — create_cart / get_cart / update_cart / cancel_cart run as JSON-RPC against the merchant's /api/ucp/mcp endpoint, and by design "Carts have a long TTL." while "Checkouts are short-lived." Each cart returns estimated totals plus a continue_url "that the buyer can use to pick up the cart on the merchant's storefront", and carts carry agent attribution ("Supported fields include `referring_domain`, `click_id_tag`, `click_id_value`, `activity_id_tag`, `activity_id_value`, `utm_campaign`, `utm_source`, `utm_medium`, `utm_content`, and `utm_term`"); cancel_cart additionally requires an idempotency-key UUID "for retry safety".”
• [claimed-docs] https://shopify.dev/docs/agents/carts-and-checkout/checkout-mcp.md“"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens are minted from Dev Dashboard client credentials at api.shopify.com/auth/access_token ("JWT tokens created from Dev Dashboard credentials have a 60-minute TTL"). create_checkout converts carts — with cart_id, "the server loads the referenced cart and inherits its `line_items`, `context`, `buyer`, and associated attribution metadata" — and complete_checkout is the purchase commit ("Submit payment and place the order."), to be called only when "Checkout status is `ready_for_complete`", the "Buyer has reviewed and confirmed the order", and the "Payment credential has been collected"; the documented create_checkout response advertises negotiated payment_handlers such as com.google.pay.”
• [probe] https://shopify.dev/docs/agents/carts-and-checkout/cart-mcp“PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/ucp-cli with a self-generated local profile searched the live catalog (variant gid://shopify/ProductVariant/47695038775318) and ucp cart create returned a live gid://shopify/Cart/ id plus the documented next steps (ucp checkout create from the cart id). Ephemeral; no checkout, no payment.”
• [claimed-docs] https://shopify.dev/docs/agents/get-started/quickstart.md“Initialize a local UCP profile.”

Subscribe to events via webhooksweight 2

2 (weight) × 5 (quality) × 0.6 (partial) = 6.0 of 20 max

• [claimed-docs] https://shopify.dev/docs/agents/orders/order-webhooks.md“Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change”
• [claimed-docs] https://shopify.dev/docs/agents/orders/order-webhooks.md“"Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (fulfillment progress, refunds, returns, exchanges, order edits, or cancellations)." Each delivery is the full order state ("Treat the latest payload as the source of truth"), HMAC-SHA256 signed, and durable — "Failed deliveries are retried up to 8 times over 4 hours with exponential backoff." Subscription is not self-serve: "There's no self-serve subscription API today: your delivery URL and topic scoping are registered server-side. To set up or update an order webhook subscription, contact your Shopify partner manager." — and although the UCP spec lets agents advertise a webhook_url in their profile, "Shopify doesn't honor that field today."”
• [claimed-docs] https://shopify.dev/docs/agents/orders/order-webhooks.md“Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (fulfillment progress, refunds, returns, exchanges, order edits, or cancellations).”

Explore an interactive API reference with runnable examplesweight 2

2 (weight) × 4 (quality) × 0.6 (partial) = 4.8 of 20 max

• [claimed-docs] https://shopify.dev/docs/agents/get-started/quickstart.md“This quickstart runs the full agentic commerce flow with the UCP CLI, from product discovery to order tracking, in about five minutes.”
• [claimed-docs] https://shopify.dev/docs/agents/catalog/storefront-catalog.md“"The Storefront Catalog MCP server enables AI agents to search and discover products from a single merchant's catalog, helping buyers find and purchase products from that store" — the same UCP catalog tools served per-merchant at the shop's own /api/ucp/mcp endpoint. Agents introspect each shop's contract at runtime: "Use `--input-schema` against any of these commands to fetch the merchant's live input schema before composing a payload." Search responses include a UCP metadata envelope and "products with title, description, price range (minor units), media, and variants".”
• [probe] https://shopify.dev/docs/agents/catalog/global-catalog“PROBE runtime (recorded 2026-09-14): Shopify's Global Catalog MCP server is live — a keyless JSON-RPC initialize POST to https://catalog.shopify.com/api/ucp/mcp completed a FULL handshake (HTTP 200, serverInfo universal-ucp-mcp, header x-shopify-ucp-mcp-api-version: 2026-08-25).”
• [probe] https://shopify.dev/docs/agents/carts-and-checkout/cart-mcp“PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/ucp-cli with a self-generated local profile searched the live catalog (variant gid://shopify/ProductVariant/47695038775318) and ucp cart create returned a live gid://shopify/Cart/ id plus the documented next steps (ucp checkout create from the cart id). Ephemeral; no checkout, no payment.”
• [probe] https://shopify.dev/llms.txt“PROBE llms.txt: HTTP 404 at https://shopify.dev/llms.txt”
• [probe] https://shopify.dev/openapi.json“PROBE openapi: all candidate paths 404 (https://shopify.dev/openapi.json, https://shopify.dev/swagger.json, https://shopify.dev/api/openapi.json, https://shopify.dev/.well-known/openapi.json)”

Download a machine-readable API spec (OpenAPI or equivalent)weight 2

2 (weight) × 4 (quality) × 0.6 (partial) = 4.8 of 20 max

• [probe] https://shopify.dev/openapi.json“PROBE openapi: all candidate paths 404 (https://shopify.dev/openapi.json, https://shopify.dev/swagger.json, https://shopify.dev/api/openapi.json, https://shopify.dev/.well-known/openapi.json)”
• [claimed-docs] https://shopify.dev/docs/agents/catalog/storefront-catalog.md“"The Storefront Catalog MCP server enables AI agents to search and discover products from a single merchant's catalog, helping buyers find and purchase products from that store" — the same UCP catalog tools served per-merchant at the shop's own /api/ucp/mcp endpoint. Agents introspect each shop's contract at runtime: "Use `--input-schema` against any of these commands to fetch the merchant's live input schema before composing a payload." Search responses include a UCP metadata envelope and "products with title, description, price range (minor units), media, and variants".”
• [claimed-docs] https://ucp.dev/index.md“ucp.dev positions the protocol as industry-governed rather than single-vendor: "UCP is built by the industry, to enable seamless agentic experiences", with a co-developer wall listing "Google Shopify Etsy Wayfair Target Walmart Amazon Microsoft Meta Salesforce Stripe" (plus lodging and food players such as Booking.com, Marriott, DoorDash and Uber Eats). Design commitments: businesses "remain the Merchant of Record, with full ownership of customer relationships"; it is built on "REST and JSON-RPC transports" with AP2, A2A, and MCP support; payments ride "secure payment (AP2) via payment mandates and verifiable credentials"; and "The complete technical specification, documentation, and reference implementations are hosted in our public GitHub repository."”
• [probe] https://ucp.dev/“PROBE runtime (recorded 2026-09-14): the Universal Commerce Protocol spec is published in the open — https://ucp.dev/llms.txt serves the versioned specification index ('# Universal Commerce Protocol (UCP)... an open standard that enables gen AI agents to safely, securely, and privately execute commerce actions'), with dated releases (2026-08-25, 2026-04-08, ...) and the GitHub org Universal-Commerce-Protocol.”

Test against a sandbox environment without touching production dataweight 1

1 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 10 max

• [probe] https://shopify.dev/docs/agents/carts-and-checkout/cart-mcp“PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/ucp-cli with a self-generated local profile searched the live catalog (variant gid://shopify/ProductVariant/47695038775318) and ucp cart create returned a live gid://shopify/Cart/ id plus the documented next steps (ucp checkout create from the cart id). Ephemeral; no checkout, no payment.”
• [probe] https://shopify.dev/docs/agents/catalog/storefront-catalog“PROBE runtime (recorded 2026-09-14): a Shopify-operated storefront's own UCP endpoint is live — a keyless JSON-RPC initialize POST to https://hardware.shopify.com/api/ucp/mcp completed a FULL handshake (serverInfo universal-commerce), the per-merchant /api/ucp/mcp surface every UCP-enabled storefront exposes to agents.”

Rely on versioned APIs with a documented deprecation policyweight 2

2 (weight) × 4 (quality) × 0.6 (partial) = 4.8 of 20 max

• [probe] https://shopify.dev/docs/agents/catalog/global-catalog“PROBE runtime (recorded 2026-09-14): Shopify's Global Catalog MCP server is live — a keyless JSON-RPC initialize POST to https://catalog.shopify.com/api/ucp/mcp completed a FULL handshake (HTTP 200, serverInfo universal-ucp-mcp, header x-shopify-ucp-mcp-api-version: 2026-08-25).”
• [probe] https://ucp.dev/“PROBE runtime (recorded 2026-09-14): the Universal Commerce Protocol spec is published in the open — https://ucp.dev/llms.txt serves the versioned specification index ('# Universal Commerce Protocol (UCP)... an open standard that enables gen AI agents to safely, securely, and privately execute commerce actions'), with dated releases (2026-08-25, 2026-04-08, ...) and the GitHub org Universal-Commerce-Protocol.”
• [claimed-docs] https://shopify.dev/docs/agents/profiles.md“In UCP, "a platform profile is a JSON document that describes the protocol version and capabilities the platform supports"; the business side publishes its own at the storefront origin ({shop}.myshopify.com/.well-known/ucp), which "describes that party’s protocol version, services, capabilities, payment handlers, and signing keys". "Negotiation is server-selects. The business computes the intersection of its capabilities with the platform’s and chooses the active set", and "If the profile cannot be loaded, is invalid, or yields no compatible capabilities, you get an error path instead of a successful negotiation."”

Do everything through the API that I can do in the UIweight 2

2 (weight) × 7 (quality) × 0.6 (partial) = 8.4 of 20 max

• [claimed-docs] https://shopify.dev/docs/agents/carts-and-checkout/checkout-mcp.md“"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens are minted from Dev Dashboard client credentials at api.shopify.com/auth/access_token ("JWT tokens created from Dev Dashboard credentials have a 60-minute TTL"). create_checkout converts carts — with cart_id, "the server loads the referenced cart and inherits its `line_items`, `context`, `buyer`, and associated attribution metadata" — and complete_checkout is the purchase commit ("Submit payment and place the order."), to be called only when "Checkout status is `ready_for_complete`", the "Buyer has reviewed and confirmed the order", and the "Payment credential has been collected"; the documented create_checkout response advertises negotiated payment_handlers such as com.google.pay.”
• [claimed-docs] https://shopify.dev/docs/agents/carts-and-checkout/checkout-mcp.md“Buyer handoff is a first-class state: "Build for escalations regardless of how you authenticate." A checkout in requires_escalation means "Checkout requires buyer input or review not available via API" — messages carry severity requires_buyer_input "(merchant needs input not available via API)" or requires_buyer_review — and the agent must "hand off to the buyer via `continue_url`" to the merchant's own checkout. The CLI automates the gate: "Set `UCP_ON_ESCALATION` before completing a checkout to open the merchant's `continue_url` in the buyer's browser automatically."”
• [claimed-docs] https://shopify.dev/docs/agents/profiles/auth-and-rate-limiting.md“"UCP traffic to Shopify's MCP servers is classified into three tiers based on how your agent identifies itself" — Token, Signed, Anonymous — and "Stronger identification means higher rate limits and access to more sensitive tools." "Rate limits scale with identification." ("The Token tier gets the highest limits, Signed gets lower limits, and Anonymous gets the lowest."), "Checkout MCP is rate-limited more strictly than Cart MCP at every tier.", and complete_checkout is Token-tier only, "When the token is granted permission to complete purchases". The Signed tier authenticates with RFC 9421 HTTP Message Signatures "using ECDSA P-256", verified "against the public key published in your agent's" well-known UCP profile.”
• [claimed-docs] https://shopify.dev/docs/agents/carts-and-checkout/cart-mcp.md“"Cart tools accept unauthenticated requests, which lets you estimate totals and share a cart with the buyer before collecting credentials" — create_cart / get_cart / update_cart / cancel_cart run as JSON-RPC against the merchant's /api/ucp/mcp endpoint, and by design "Carts have a long TTL." while "Checkouts are short-lived." Each cart returns estimated totals plus a continue_url "that the buyer can use to pick up the cart on the merchant's storefront", and carts carry agent attribution ("Supported fields include `referring_domain`, `click_id_tag`, `click_id_value`, `activity_id_tag`, `activity_id_value`, `utm_campaign`, `utm_source`, `utm_medium`, `utm_content`, and `utm_term`"); cancel_cart additionally requires an idempotency-key UUID "for retry safety".”
• [probe] https://shopify.dev/docs/agents/carts-and-checkout/cart-mcp“PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/ucp-cli with a self-generated local profile searched the live catalog (variant gid://shopify/ProductVariant/47695038775318) and ucp cart create returned a live gid://shopify/Cart/ id plus the documented next steps (ucp checkout create from the cart id). Ephemeral; no checkout, no payment.”
• [claimed-docs] https://shopify.dev/docs/agents/orders/order-mcp.md“"The Order MCP server enables AI agents to fetch the current state of an order placed through their agent, including line items, fulfillment events, and post-purchase adjustments" via the single UCP tool get_order. Access is the highest trust gate: "Order MCP is available only to Token-tier agents." and "`get_order` requires a Global API JWT with the `read_global_api_orders` scope, which Signed-tier and Anonymous-tier agents can't obtain." Guidance: "Use webhooks as the primary update channel." and reserve get_order for buyer-initiated reads and reconciling missed webhooks.”
• [claimed-docs] https://shopify.dev/docs/agents/orders/order-webhooks.md“"Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (fulfillment progress, refunds, returns, exchanges, order edits, or cancellations)." Each delivery is the full order state ("Treat the latest payload as the source of truth"), HMAC-SHA256 signed, and durable — "Failed deliveries are retried up to 8 times over 4 hours with exponential backoff." Subscription is not self-serve: "There's no self-serve subscription API today: your delivery URL and topic scoping are registered server-side. To set up or update an order webhook subscription, contact your Shopify partner manager." — and although the UCP spec lets agents advertise a webhook_url in their profile, "Shopify doesn't honor that field today."”

Export all of my data in open formats and leaveweight 3

3 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 30 max

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh

Read the product's source under an open licenseweight 2

2 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 20 max

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh

Self-host the core productweight 3

n/a — not applicable to this product: excluded from numerator and denominator

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh

Get AI-generated insights and suggestions from my data inside the productweight 2

n/a — not applicable to this product: excluded from numerator and denominator

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh

Set up automations that run autonomously in the backgroundweight 2

2 (weight) × 4 (quality) × 0.6 (partial) = 4.8 of 20 max

• [claimed-docs] https://shopify.dev/docs/agents/carts-and-checkout/checkout-mcp.md“"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens are minted from Dev Dashboard client credentials at api.shopify.com/auth/access_token ("JWT tokens created from Dev Dashboard credentials have a 60-minute TTL"). create_checkout converts carts — with cart_id, "the server loads the referenced cart and inherits its `line_items`, `context`, `buyer`, and associated attribution metadata" — and complete_checkout is the purchase commit ("Submit payment and place the order."), to be called only when "Checkout status is `ready_for_complete`", the "Buyer has reviewed and confirmed the order", and the "Payment credential has been collected"; the documented create_checkout response advertises negotiated payment_handlers such as com.google.pay.”
• [claimed-docs] https://shopify.dev/docs/agents/profiles/auth-and-rate-limiting.md“"UCP traffic to Shopify's MCP servers is classified into three tiers based on how your agent identifies itself" — Token, Signed, Anonymous — and "Stronger identification means higher rate limits and access to more sensitive tools." "Rate limits scale with identification." ("The Token tier gets the highest limits, Signed gets lower limits, and Anonymous gets the lowest."), "Checkout MCP is rate-limited more strictly than Cart MCP at every tier.", and complete_checkout is Token-tier only, "When the token is granted permission to complete purchases". The Signed tier authenticates with RFC 9421 HTTP Message Signatures "using ECDSA P-256", verified "against the public key published in your agent's" well-known UCP profile.”
• [claimed-docs] https://shopify.dev/docs/agents/orders/order-webhooks.md“"Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (fulfillment progress, refunds, returns, exchanges, order edits, or cancellations)." Each delivery is the full order state ("Treat the latest payload as the source of truth"), HMAC-SHA256 signed, and durable — "Failed deliveries are retried up to 8 times over 4 hours with exponential backoff." Subscription is not self-serve: "There's no self-serve subscription API today: your delivery URL and topic scoping are registered server-side. To set up or update an order webhook subscription, contact your Shopify partner manager." — and although the UCP spec lets agents advertise a webhook_url in their profile, "Shopify doesn't honor that field today."”
• [claimed-docs] https://shopify.dev/docs/agents/carts-and-checkout/checkout-mcp.md“Buyer handoff is a first-class state: "Build for escalations regardless of how you authenticate." A checkout in requires_escalation means "Checkout requires buyer input or review not available via API" — messages carry severity requires_buyer_input "(merchant needs input not available via API)" or requires_buyer_review — and the agent must "hand off to the buyer via `continue_url`" to the merchant's own checkout. The CLI automates the gate: "Set `UCP_ON_ESCALATION` before completing a checkout to open the merchant's `continue_url` in the buyer's browser automatically."”

Delegate tasks to a built-in AI assistant inside the productweight 3

3 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 30 max

• [claimed-docs] https://shopify.dev/docs/agents“the CLI provides structured commands to search the Catalog, build carts, create checkouts, hand off buyers, and track orders”
• [claimed-docs] https://shopify.dev/docs/apps/build/storefront-mcp.md“Connect any AI assistant to real-time commerce data from Shopify stores with Model Context Protocol (MCP) servers”
• [claimed-docs] https://shopify.dev/docs/agents.md“Shopify's agent surface is UCP end to end via "Shopify's UCP-compliant MCP servers": the UCP CLI "provides structured commands to search the Catalog, build carts, create checkouts, hand off buyers, and track orders" (install with `npm install -g @shopify/ucp-cli` plus the AI Toolkit plugin, e.g. `claude plugin install shopify-ai-toolkit@claude-plugins-official`). The four-stage journey is explicit — discovery ("Search across hundreds of millions of Shopify listings"), carts/checkout ("Build carts, convert them to checkouts, and hand off to the merchant for payment", though "Trusted agents can complete checkouts directly"), and orders ("Receive order webhooks and fetch fresh order state on demand"). A cross-merchant wallet-of-goods is waitlisted: "One Cart, every brand. The Universal Cart API lets AI agents collect items from any merchant, on or off Shopify, into a single, unified cart, all via UCP."”

Operate the product with natural-language commandsweight 2

2 (weight) × 7 (quality) × 1.0 (full) = 14.0 of 20 max

• [claimed-docs] https://shopify.dev/docs/agents/catalog/global-catalog.md“Ask your assistant in natural language ("find me crewneck sweaters under $50") and the skill picks the right UCP CLI command”
• [claimed-docs] https://shopify.dev/docs/agents“the CLI provides structured commands to search the Catalog, build carts, create checkouts, hand off buyers, and track orders”
• [claimed-docs] https://shopify.dev/docs/agents.md“Shopify's agent surface is UCP end to end via "Shopify's UCP-compliant MCP servers": the UCP CLI "provides structured commands to search the Catalog, build carts, create checkouts, hand off buyers, and track orders" (install with `npm install -g @shopify/ucp-cli` plus the AI Toolkit plugin, e.g. `claude plugin install shopify-ai-toolkit@claude-plugins-official`). The four-stage journey is explicit — discovery ("Search across hundreds of millions of Shopify listings"), carts/checkout ("Build carts, convert them to checkouts, and hand off to the merchant for payment", though "Trusted agents can complete checkouts directly"), and orders ("Receive order webhooks and fetch fresh order state on demand"). A cross-merchant wallet-of-goods is waitlisted: "One Cart, every brand. The Universal Cart API lets AI agents collect items from any merchant, on or off Shopify, into a single, unified cart, all via UCP."”
• [probe] https://shopify.dev/docs/agents/carts-and-checkout/cart-mcp“PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/ucp-cli with a self-generated local profile searched the live catalog (variant gid://shopify/ProductVariant/47695038775318) and ucp cart create returned a live gid://shopify/Cart/ id plus the documented next steps (ucp checkout create from the cart id). Ephemeral; no checkout, no payment.”
• [probe] https://shopify.dev/docs/agents/catalog/global-catalog“PROBE runtime (recorded 2026-09-14): Shopify's Global Catalog MCP server is live — a keyless JSON-RPC initialize POST to https://catalog.shopify.com/api/ucp/mcp completed a FULL handshake (HTTP 200, serverInfo universal-ucp-mcp, header x-shopify-ucp-mcp-api-version: 2026-08-25).”

Perform bulk operations across many items at onceweight 2

2 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 20 max

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh

Define rules that trigger actions automatically on eventsweight 3

3 (weight) × 3 (quality) × 0.6 (partial) = 5.4 of 30 max

• [claimed-docs] https://shopify.dev/docs/agents/orders/order-webhooks.md“"Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (fulfillment progress, refunds, returns, exchanges, order edits, or cancellations)." Each delivery is the full order state ("Treat the latest payload as the source of truth"), HMAC-SHA256 signed, and durable — "Failed deliveries are retried up to 8 times over 4 hours with exponential backoff." Subscription is not self-serve: "There's no self-serve subscription API today: your delivery URL and topic scoping are registered server-side. To set up or update an order webhook subscription, contact your Shopify partner manager." — and although the UCP spec lets agents advertise a webhook_url in their profile, "Shopify doesn't honor that field today."”
• [claimed-docs] https://shopify.dev/docs/agents/orders/order-webhooks.md“Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change”
• [claimed-docs] https://shopify.dev/docs/agents/orders/order-webhooks.md“Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (fulfillment progress, refunds, returns, exchanges, order edits, or cancellations).”

Schedule recurring jobs or workflowsweight 2

n/a — not applicable to this product: excluded from numerator and denominator

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh

Version, review, and roll back my automationsweight 1

n/a — not applicable to this product: excluded from numerator and denominator

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh