Shopify Agentic Commerce vs Coinbase x402

Cart

1. ai-native userMy agent can create and update a cart or order draft through a documented protocol call

   weight 3 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce✓fullprobed9/10

   Cart MCP and Checkout MCP are documented UCP protocol calls (create_cart, update_cart, create_checkout, complete_checkout) with JSON-RPC schemas, and a runtime probe confirms a real cart was created keylessly against a live Shopify store via the CLI/protocol. missing for 10: no independent (non-Shopify) hands-on corroboration of a full end-to-end checkout completion.

   • [claimed-docs] “"Cart tools accept unauthenticated requests, which lets you estimate totals and share a cart with the buyer before collecting credentials" —…”
   • [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”
   • [claimed-docs] “The Cart MCP server enables AI agents to build and iterate on a cart before the buyer commits to purchase. When the buyer is ready to buy, c…”
   • [claimed-docs] “The Checkout MCP server enables AI agents to create and manage checkout sessions, convert carts into checkouts, and refer buyers to the merc…”

   proof ↗⚑ flag

   Coinbase x402—none0/10

   x402 documents per-request HTTP 402 payment flows (quote price, sign payment, verify, settle) but nothing in the evidence describes a cart or order-draft object that an agent can create/update via a protocol call — the protocol is stateless pay-per-request, not cart/order management, and even the 'merchant checkout' integration mention (doc-13) only says agents can 'authorize payment sessions,' not manage draft orders. Missing for 10: any documented cart/order object, create/update API or protocol verbs, and evidence of persisted order state across calls.

   • [claimed-docs] “x402-enable a merchant checkout built on Payment Acceptance so agents can authorize payment sessions directly.”
   • [claimed-docs] “"x402 is an open standard for adding per-request payments to HTTP, so APIs and services can charge without checkout pages, subscriptions, or…”

   proof ↗⚑ flag

Checkout

1. ai-native userMy agent can complete a purchase end-to-end — checkout session, delegated payment credential, confirmed order

   weight 3 · round drawn
   Shopify Agentic Commerce~partialprobed7/10

   Docs describe a full documented path — create_checkout, payment_handlers (e.g. com.google.pay) negotiation, complete_checkout requiring a collected payment credential, and order confirmation via get_order/order webhooks — and even name complete_checkout as Token-tier gated 'when the token is granted permission to complete purchases.' However, the default flow explicitly hands off to the buyer's browser for payment ('Build carts, convert them to checkouts, and hand off to the merchant for payment') and the only hands-on runtime probe reached cart creation only, explicitly stopping 'no checkout, no payment.' Missing for 10: an independent/hands-on trace of an actual complete_checkout call with a delegated payment credential and a resulting confirmed order, and clarity on how broadly (vs. only select trusted agents) autonomous payment completion is actually granted.

   • [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
   • [claimed-docs] “Buyer handoff is a first-class state: "Build for escalations regardless of how you authenticate." A checkout in requires_escalation means "C…”
   • [claimed-docs] “"UCP traffic to Shopify's MCP servers is classified into three tiers based on how your agent identifies itself" — Token, Signed, Anonymous —…”
   • [claimed-docs] “"The Order MCP server enables AI agents to fetch the current state of an order placed through their agent, including line items, fulfillment…”
   • [claimed-docs] “"Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (fu…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”

   proof ↗⚑ flag

   Coinbase x402~partialprobed7/10

   Docs describe a complete flow — an agent hitting a 402 response, resolving payment terms, signing with an agentic wallet/account (delegated credential), the CDP Facilitator verifying and settling onchain, and the resource server returning the confirmed resource — and probes confirm the discovery and facilitator endpoints behave live as documented. However this is a per-request HTTP payment handshake rather than a traditional multi-step 'checkout session', and there is no independent/hands-on trace of an agent completing a full purchase (discovery→credential→confirmed order) end-to-end; community commentary even flags unresolved trust gaps in confirming delivered work post-payment. Missing for 10: independent third-party demonstration of a full agent purchase transcript, and clarity on session-like continuity versus single-request settlement.

   • [claimed-docs] “"x402 is an open standard for adding per-request payments to HTTP, so APIs and services can charge without checkout pages, subscriptions, or…”
   • [claimed-docs] “Agent wallets: "Agentic accounts let an AI agent hold funds and act through a Coinbase account or wallet. For an x402 buyer, the account is …”
   • [claimed-docs] “Payable-service discovery is open: "The x402 Bazaar is a catalog of payment-gated services discovered by the CDP Facilitator." and "Bazaar d…”
   • [claimed-docs] “Agentic accounts let an AI agent hold funds and act through a Coinbase account or wallet. For an x402 buyer, the account is the source of US…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the x402 Bazaar discovery index is keyless by design and live — a plain GET to https://api.cdp.coinbase…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the hosted CDP facilitator auth-gates as documented — a keyless GET to https://api.cdp.coinbase.com/pla…”
   • [community] “We run 124 x402 endpoints at httpay.xyz and the 'verify work was done' problem is real — especially for compute-heavy tasks like image gener…”

   proof ↗⚑ flag

Embedded surfaces

1. merchantBuyers can complete purchases of my products inside chat and assistant surfaces (ChatGPT, Claude, Gemini, Copilot and peers)

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce~partialprobed6/10

   Shopify ships a real, live UCP checkout stack — Catalog, Cart, and Checkout MCP servers with a documented complete_checkout tool that can 'submit payment and place the order' for Token-tier trusted agents, backed by a runtime-verified cart creation and marketing claiming buyers 'check out right in the chat' — and UCP itself is co-developed with Google, Microsoft, OpenAI-adjacent ecosystem players. However, the docs make buyer handoff/escalation a first-class, common path ('hand off to the buyer via continue_url', 'Build for escalations regardless of how you authenticate'), meaning many purchases route the buyer out to the merchant's own checkout page rather than completing fully inside the chat UI, and named surfaces beyond Claude (only a Claude plugin is documented) — ChatGPT, Gemini, Copilot — have no confirmed live integration in the evidence. Missing for 10: confirmed named integrations with ChatGPT/Gemini/Copilot, evidence that in-chat completion (not handoff) is the norm rather than the exception, and independent buyer-side confirmation of an end-to-end in-chat purchase.

   • [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
   • [claimed-docs] “Buyer handoff is a first-class state: "Build for escalations regardless of how you authenticate." A checkout in requires_escalation means "C…”
   • [claimed-docs] “"UCP traffic to Shopify's MCP servers is classified into three tiers based on how your agent identifies itself" — Token, Signed, Anonymous —…”
   • [claimed-docs] “Get discovered across AI channels. Shoppers check out right in the chat.”
   • [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”
   • [claimed-docs] “ucp.dev positions the protocol as industry-governed rather than single-vendor: "UCP is built by the industry, to enable seamless agentic exp…”

   proof ↗⚑ flag

   Coinbase x402—none0/10

   x402 documents agent-to-agent/API payment infrastructure (MCP-compatible tool-call discovery, AWS Bedrock AgentCore, Agentic Wallets) but there is no evidence of integration with named consumer chat/assistant surfaces like ChatGPT, Claude, Gemini, or Copilot enabling buyers to complete purchases inside those chat UIs. The protocol targets machine-to-machine settlement, not consumer chat checkout flows in these specific products.

   • [claimed-docs] “Give an AgentCore agent access to x402 services through an AWS Payment Manager and Coinbase CDP connector.”
   • [claimed-docs] “Let an MCP-compatible agent discover services with tool calls.”
   • [claimed-docs] “Payable-service discovery is open: "The x402 Bazaar is a catalog of payment-gated services discovered by the CDP Facilitator." and "Bazaar d…”
   • [claimed-docs] “Agent wallets: "Agentic accounts let an AI agent hold funds and act through a Coinbase account or wallet. For an x402 buyer, the account is …”

   proof ↗⚑ flag

Protocol conformance

1. developerBuild against a versioned commerce protocol with a published schema and conformance or validation tooling

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce✓fullprobed7/10

   UCP is documented as a versioned protocol (dated releases like 2026-08-25, 2026-04-08) with a publicly hosted spec and reference implementations on GitHub, and Shopify's MCP servers enforce schema/profile validation at runtime (e.g. `--input-schema` to fetch a merchant's live input schema, and a probed `invalid_profile_url` error when an agent lacks a valid hosted profile), plus an AI Toolkit that validates GraphQL/Liquid/Extensions against Shopify schemas. Missing for 10: an explicit standalone conformance test suite or certification program for third-party UCP implementations, and independent (non-Shopify) corroboration of schema stability across versions.

   • [claimed-docs] “In UCP, "a platform profile is a JSON document that describes the protocol version and capabilities the platform supports"; the business sid…”
   • [claimed-docs] “"The Storefront Catalog MCP server enables AI agents to search and discover products from a single merchant's catalog, helping buyers find a…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the documented agent-profile trust gate behaves as specified — a keyless raw tools/call search_catalog …”
   • [claimed-docs] “ucp.dev positions the protocol as industry-governed rather than single-vendor: "UCP is built by the industry, to enable seamless agentic exp…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the Universal Commerce Protocol spec is published in the open — https://ucp.dev/llms.txt serves the ver…”
   • [claimed-docs] “validate GraphQL queries, Liquid templates, and Shopify Extensions against Shopify schemas to catch issues earlier”

   proof ↗⚑ flag

   Coinbase x402~partialprobed5/10

   x402 is documented as a versioned protocol under open Linux Foundation governance (v2 support tables, TSC oversight, npm package with SLSA provenance) and has clear spec docs (how-it-works, facilitator support tables), but there is no published formal schema (e.g., JSON Schema/OpenAPI) or explicit conformance/validation test suite in evidence — the openapi probe returned 404s and no conformance-testing tool is mentioned. missing for 10: published machine-readable schema (OpenAPI/JSON Schema), an official conformance or validation test suite/tool, and independent confirmation of protocol versioning practices beyond npm version numbers.

   • [claimed-docs] “The hosted CDP Facilitator "validates signed payments, screens transactions, submits settlement onchain, and reports the result to your reso…”
   • [claimed-docs] “Governance: "x402 was originally incubated at Coinbase." — then the "x402 Foundation launched under the Linux Foundation" and "Coinbase comp…”
   • [claimed-docs] “Named governance seats on x402.org: "The x402 Governing Board is responsible for marketing, business oversight, and budget decisions for the…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.cdp.coinbase.com/openapi.json, https://docs.cdp.coinbase.com/swagger.json, https://docs…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the hosted CDP facilitator auth-gates as documented — a keyless GET to https://api.cdp.coinbase.com/pla…”

   proof ↗⚑ flag

Agent search

1. ai-native userMy agent can programmatically search products or services across merchants — keylessly or with self-service credentials, no private partnership required

   weight 3 · round to Coinbase x402
   Shopify Agentic Commerce✓fullprobed8/10

   Shopify's Global Catalog MCP server explicitly supports keyless, self-service cross-merchant product search ('search and discover products across the entire Shopify ecosystem... from multiple merchants'), requiring only a self-hosted UCP agent profile URL rather than a private partnership — confirmed by a live runtime probe showing a full keyless JSON-RPC handshake and catalog search against catalog.shopify.com/api/ucp/mcp, and another probe showing the profile-gate behaves as documented (self-service profile, not vendor approval). Storefront-level search is similarly self-service per-merchant. Missing for 10: independent (non-Shopify) developer corroboration of onboarding friction, and confirmation that profile creation itself has no gatekeeping/approval step.

   • [claimed-docs] “"The Global Catalog MCP server enables AI agents to search and discover products across the entire Shopify ecosystem, helping buyers find pr…”
   • [probe] “PROBE runtime (recorded 2026-09-14): Shopify's Global Catalog MCP server is live — a keyless JSON-RPC initialize POST to https://catalog.sho…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the documented agent-profile trust gate behaves as specified — a keyless raw tools/call search_catalog …”
   • [claimed-docs] “In UCP, "a platform profile is a JSON document that describes the protocol version and capabilities the platform supports"; the business sid…”
   • [claimed-docs] “"The Storefront Catalog MCP server enables AI agents to search and discover products from a single merchant's catalog, helping buyers find a…”

   proof ↗⚑ flag

   Coinbase x402✓fullprobed9/10

   The x402 Bazaar provides a public, keyless discovery API and MCP-tool-call interface for agents to search payable services across merchants without any partnership or API key, and a live runtime probe confirms the keyless GET returned real payable-service listings exactly as documented. Docs also detail self-service alternative (CDP API key) and automatic listing without registration, and community sources corroborate agents using x402 to discover/pay for services without prior accounts. Missing for 10: independent third-party evaluation of discovery relevance/quality beyond Coinbase's own docs and the single runtime probe.

   • [claimed-docs] “When you build with the CDP SDK's x402 building blocks, x402 Bazaar support is enabled automatically. There is no registration form or separ…”
   • [claimed-docs] “Bazaar discovery is public. You do not need a CDP API key to use the discovery APIs or the corresponding TypeScript SDK functions.”
   • [claimed-docs] “Let an MCP-compatible agent discover services with tool calls.”
   • [claimed-docs] “Payable-service discovery is open: "The x402 Bazaar is a catalog of payment-gated services discovered by the CDP Facilitator." and "Bazaar d…”
   • [claimed-docs] “"Getting discovered makes your endpoint available to tens of thousands of agents through CDP APIs, the Bazaar MCP server, and Amazon Bedrock…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the x402 Bazaar discovery index is keyless by design and live — a plain GET to https://api.cdp.coinbase…”
   • [community] “It's a great way for developers or ai agents to test drive an API without creating an account and getting an API key from the api provider. …”

   proof ↗⚑ flag

Machine readable offers

1. developerRead machine-readable offer data — price, availability, variants, checkout links — for any listed product or service

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce✓fullprobed9/10

   Shopify's Catalog MCP servers (global and storefront) expose structured, machine-readable product data — price (minor units), availability, variants, media, checkout links (continue_url) — verified live via runtime probes (get_product, search_catalog, cart continue_url), and Cart/Checkout MCP further surface checkout links and negotiated payment handlers. Missing for 10: no independent third-party benchmark of data completeness/accuracy across many merchants beyond Shopify's own demo store.

   • [claimed-docs] “"The Global Catalog MCP server enables AI agents to search and discover products across the entire Shopify ecosystem, helping buyers find pr…”
   • [claimed-docs] “"The Storefront Catalog MCP server enables AI agents to search and discover products from a single merchant's catalog, helping buyers find a…”
   • [claimed-docs] “"Cart tools accept unauthenticated requests, which lets you estimate totals and share a cart with the buyer before collecting credentials" —…”
   • [probe] “PROBE runtime (recorded 2026-09-14): Shopify's Global Catalog MCP server is live — a keyless JSON-RPC initialize POST to https://catalog.sho…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a Shopify-operated storefront's own UCP endpoint is live — a keyless JSON-RPC initialize POST to https:…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”

   proof ↗⚑ flag

   Coinbase x402~partialprobed7/10

   The x402 Bazaar discovery API/SDK returns machine-readable listings for payable services — price (USDC amount), network/asset/scheme, timeout, and a resource endpoint that itself acts as the 'checkout' call — and this was independently confirmed live via a keyless GET returning real listings (probe-rt-1), matching docs on public discovery with no API key needed (docs-6, supp-5, supp-6). Availability is implicit (30-day settlement pruning keeps the catalog live) but the docs never explicitly frame data as 'variants' or provide a distinct 'checkout link' field beyond the resource URL itself. Missing for 10: explicit variant/option metadata in listings, an explicit checkout-link field distinct from the resource endpoint, and independent (non-Coinbase) confirmation of listing completeness/accuracy.

   • [claimed-docs] “When you build with the CDP SDK's x402 building blocks, x402 Bazaar support is enabled automatically. There is no registration form or separ…”
   • [claimed-docs] “Bazaar discovery is public. You do not need a CDP API key to use the discovery APIs or the corresponding TypeScript SDK functions.”
   • [claimed-docs] “Payable-service discovery is open: "The x402 Bazaar is a catalog of payment-gated services discovered by the CDP Facilitator." and "Bazaar d…”
   • [claimed-docs] “"Getting discovered makes your endpoint available to tens of thousands of agents through CDP APIs, the Bazaar MCP server, and Amazon Bedrock…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the x402 Bazaar discovery index is keyless by design and live — a plain GET to https://api.cdp.coinbase…”

   proof ↗⚑ flag

Merchant feeds

1. merchantPublish my product or service catalog into agent surfaces through a documented feed or import API so AI agents can discover what I sell

   weight 3 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce✓fullprobed9/10

   Shopify's Storefront Catalog MCP server exposes each merchant's product catalog at a documented, live endpoint ({shop}.myshopify.com/api/ucp/mcp), confirmed by both docs and a runtime probe (hardware.shopify.com handshake), and merchants are also discoverable via the cross-merchant Global Catalog MCP server, with a documented UCP profile mechanism for agent identification/negotiation. missing for 10: no separate static feed/file-based import format (e.g., XML/JSON feed upload) is documented beyond the live MCP query interface, and no independent third-party merchant case study confirms adoption.

   • [claimed-docs] “"The Storefront Catalog MCP server enables AI agents to search and discover products from a single merchant's catalog, helping buyers find a…”
   • [claimed-docs] “"The Global Catalog MCP server enables AI agents to search and discover products across the entire Shopify ecosystem, helping buyers find pr…”
   • [probe] “PROBE runtime (recorded 2026-09-14): Shopify's Global Catalog MCP server is live — a keyless JSON-RPC initialize POST to https://catalog.sho…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a Shopify-operated storefront's own UCP endpoint is live — a keyless JSON-RPC initialize POST to https:…”
   • [claimed-docs] “In UCP, "a platform profile is a JSON document that describes the protocol version and capabilities the platform supports"; the business sid…”
   • [claimed-docs] “enables AI agents to search and discover products from a single merchant's catalog, helping buyers find and purchase products from that stor…”

   proof ↗⚑ flag

   Coinbase x402~partialprobed6/10

   x402 Bazaar auto-lists any x402-enabled endpoint into a discoverable catalog (23,000+ resources) accessible via API, TypeScript SDK, or MCP tool calls, with no registration form needed once payment settles — this functions as a merchant discovery feed for agents. However, it is not a true 'catalog/import API' in the product-catalog sense: listing requires actually running a live payable endpoint and a successful settled payment (not a bulk import of a product list), items expire after 30 days without settlement, and there's no support for describing multiple SKUs/services or rich product metadata beyond price/asset/network. Missing for 10: a genuine bulk catalog-import or feed format for multiple products/services at once, richer product metadata (descriptions, categories) beyond payment terms, and independent hands-on confirmation that discovery surfaces reliably drive agent traffic to listed merchants.

   • [claimed-docs] “When you build with the CDP SDK's x402 building blocks, x402 Bazaar support is enabled automatically. There is no registration form or separ…”
   • [claimed-docs] “Bazaar discovery is public. You do not need a CDP API key to use the discovery APIs or the corresponding TypeScript SDK functions.”
   • [claimed-docs] “Payable-service discovery is open: "The x402 Bazaar is a catalog of payment-gated services discovered by the CDP Facilitator." and "Bazaar d…”
   • [claimed-docs] “"Getting discovered makes your endpoint available to tens of thousands of agents through CDP APIs, the Bazaar MCP server, and Amazon Bedrock…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the x402 Bazaar discovery index is keyless by design and live — a plain GET to https://api.cdp.coinbase…”

   proof ↗⚑ flag

Service discovery

1. ai-native userMy agent can discover payable services and APIs through a published directory or discovery index

   weight 2 · round to Coinbase x402
   Shopify Agentic Commerce✓fullprobed8/10

   Shopify publishes UCP-compliant Global Catalog and Storefront Catalog MCP servers that agents can discover payable services/products through, with documented endpoints, tool schemas, and profile-based discovery negotiation, corroborated by live runtime probes showing real handshakes and search/cart flows against catalog.shopify.com and a merchant storefront. The broader UCP spec is also openly published (ucp.dev) as an industry discovery standard. Missing for 10: a single canonical top-level directory/index listing all payable services across merchants (discovery is per-server/per-merchant plus a global catalog, not one unified public index), and independent (non-Shopify) confirmation of third-party agent adoption discovering via this index.

   • [claimed-docs] “enables AI agents to search and discover products across the entire Shopify ecosystem, helping buyers find products from multiple merchants”
   • [claimed-docs] “enables AI agents to search and discover products from a single merchant's catalog, helping buyers find and purchase products from that stor…”
   • [claimed-docs] “"The Global Catalog MCP server enables AI agents to search and discover products across the entire Shopify ecosystem, helping buyers find pr…”
   • [claimed-docs] “"The Storefront Catalog MCP server enables AI agents to search and discover products from a single merchant's catalog, helping buyers find a…”
   • [claimed-docs] “In UCP, "a platform profile is a JSON document that describes the protocol version and capabilities the platform supports"; the business sid…”
   • [probe] “PROBE runtime (recorded 2026-09-14): Shopify's Global Catalog MCP server is live — a keyless JSON-RPC initialize POST to https://catalog.sho…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a Shopify-operated storefront's own UCP endpoint is live — a keyless JSON-RPC initialize POST to https:…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the documented agent-profile trust gate behaves as specified — a keyless raw tools/call search_catalog …”
   • [claimed-docs] “ucp.dev positions the protocol as industry-governed rather than single-vendor: "UCP is built by the industry, to enable seamless agentic exp…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the Universal Commerce Protocol spec is published in the open — https://ucp.dev/llms.txt serves the ver…”

   proof ↗⚑ flag

   Coinbase x402✓fullprobed9/10

   The x402 Bazaar is a documented, keyless, public discovery index (23,000+ resources) that agents can query via search API, TypeScript SDK, or MCP tool calls, and a runtime probe confirmed live discovery results without an API key. missing for 10: independent (non-Coinbase) hands-on confirmation of agents successfully using the discovery index end-to-end in production beyond the single runtime probe.

   • [claimed-docs] “When you build with the CDP SDK's x402 building blocks, x402 Bazaar support is enabled automatically. There is no registration form or separ…”
   • [claimed-docs] “Bazaar discovery is public. You do not need a CDP API key to use the discovery APIs or the corresponding TypeScript SDK functions.”
   • [claimed-docs] “Let an MCP-compatible agent discover services with tool calls.”
   • [claimed-docs] “Payable-service discovery is open: "The x402 Bazaar is a catalog of payment-gated services discovered by the CDP Facilitator." and "Bazaar d…”
   • [claimed-docs] “"Getting discovered makes your endpoint available to tens of thousands of agents through CDP APIs, the Bazaar MCP server, and Amazon Bedrock…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the x402 Bazaar discovery index is keyless by design and live — a plain GET to https://api.cdp.coinbase…”

   proof ↗⚑ flag

Agent access

1. ai-native userPoint an agent at llms.txt or agent-oriented docs

   weight 2 · round to Coinbase x402
   Shopify Agentic Commerce~partialprobed7/10

   Shopify does not host its own llms.txt (shopify.dev/llms.txt returns 404), but it provides extensive agent-oriented documentation reachable via .md suffixed URLs (e.g. shopify.dev/docs/agents.md returns 200 with structured content) covering catalog, cart, checkout, orders, and profiles — exactly the kind of agent-consumable docs the story asks for. The related UCP spec (ucp.dev/llms.txt) does serve a proper llms.txt index, showing the ecosystem partially satisfies this pattern even though Shopify's own domain doesn't. Missing for 10: a working llms.txt directly at shopify.dev, and independent (non-Shopify) confirmation that agents reliably parse these .md docs as intended.

   • [probe] “PROBE llms.txt: HTTP 404 at https://shopify.dev/llms.txt”
   • [probe] “PROBE docs-md: HTTP 200 at https://shopify.dev/docs/agents.md --- title: Agentic commerce description: >- Build AI agents that authenticat…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the Universal Commerce Protocol spec is published in the open — https://ucp.dev/llms.txt serves the ver…”
   • [claimed-docs] “Initialize a local UCP profile.”
   • [claimed-docs] “This quickstart runs the full agentic commerce flow with the UCP CLI, from product discovery to order tracking, in about five minutes.”

   proof ↗⚑ flag

   Coinbase x402✓fullprobed8/10

   Probes confirm a live llms.txt at docs.cdp.coinbase.com/llms.txt (200) and per-page .md docs (e.g. x402/welcome.md) that explicitly point agents to the llms.txt index, plus docs explicitly describe agent/MCP-oriented discovery flows. missing for 10: no independent third-party report of an agent actually consuming llms.txt to complete a task, and no OpenAPI spec (404s) as a complementary machine-readable format.

   • [probe] “PROBE llms.txt: HTTP 200 at https://docs.cdp.coinbase.com/llms.txt # Coinbase Developer Documentation - [Docs (537 pages)](https://docs.cdp…”
   • [probe] “PROBE docs-md: HTTP 200 at https://docs.cdp.coinbase.com/x402/welcome.md > ## Documentation Index > Fetch the complete documentation index a…”
   • [claimed-docs] “Let an MCP-compatible agent discover services with tool calls.”
   • [claimed-docs] “Payable-service discovery is open: "The x402 Bazaar is a catalog of payment-gated services discovered by the CDP Facilitator." and "Bazaar d…”

   proof ↗⚑ flag

2. ai-native userRun the product headlessly / in CI for automation

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce✓fullprobed8/10

   The UCP CLI is explicitly designed as a scriptable, headless tool with structured commands (search, cart, checkout, order tracking) usable via npm install and local profile init, and probes confirm real keyless CLI runs against live endpoints (catalog search, cart creation) succeeding non-interactively — consistent with CI/automation use. missing for 10: no explicit CI pipeline example (e.g., GitHub Actions), no documented exit codes/machine-readable output format guarantees, and no independent third-party report of running it in a CI environment.

   • [claimed-docs] “Initialize a local UCP profile.”
   • [claimed-docs] “This quickstart runs the full agentic commerce flow with the UCP CLI, from product discovery to order tracking, in about five minutes.”
   • [claimed-docs] “The CLI uses a local profile to identify your agent on every merchant-scoped request. Initialize it once and the CLI reuses it for every ope…”
   • [claimed-docs] “Shopify's agent surface is UCP end to end via "Shopify's UCP-compliant MCP servers": the UCP CLI "provides structured commands to search the…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the documented agent-profile trust gate behaves as specified — a keyless raw tools/call search_catalog …”
   • [probe] “official CLI documented at https://shopify.dev/docs/agents/get-started/quickstart”

   proof ↗⚑ flag

   Coinbase x402~partialclaimed4/10

   x402 is an HTTP-based payment protocol designed to be invoked programmatically by servers/agents (e.g., 'agent purchasing a tool call mid-task', SDK-based integration, MCP tool-call discovery), which implies it can run in automated/headless contexts like CI, but there is no explicit evidence of a CLI, CI pipeline example, or headless automation harness/test suite. missing for 10: explicit CI/headless automation examples, a documented CLI, non-interactive test/dev workflow guidance, and independent confirmation of running x402 flows unattended in build pipelines.

   • [claimed-docs] “an agent purchasing a tool call mid-task”
   • [claimed-docs] “AI agent pays instantly with stablecoins No signups or approvals required”
   • [claimed-docs] “Let an MCP-compatible agent discover services with tool calls.”
   • [claimed-docs] “Agentic accounts let an AI agent hold funds and act through a Coinbase account or wallet. For an x402 buyer, the account is the source of US…”
   • [claimed-docs] “Agent wallets: "Agentic accounts let an AI agent hold funds and act through a Coinbase account or wallet. For an x402 buyer, the account is …”

   proof ↗⚑ flag

3. ai-native userConnect an agent via an official MCP server

   weight 3 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce✓fullprobed9/10

   Shopify ships multiple official UCP-compliant MCP servers (Global Catalog, Storefront Catalog, Cart, Checkout, Order) plus a Storefront MCP, all documented and independently probe-verified with live handshakes (catalog.shopify.com/api/ucp/mcp, per-merchant endpoints) and real cart creation via the CLI. Agent identification/authentication via hosted profiles and tiered trust is also verified in runtime probes. Missing for 10: independent third-party (non-Shopify) developer accounts of connecting an arbitrary agent end-to-end beyond Shopify's own probes.

   • [claimed-docs] “Shopify's agent surface is UCP end to end via "Shopify's UCP-compliant MCP servers": the UCP CLI "provides structured commands to search the…”
   • [claimed-docs] “"The Global Catalog MCP server enables AI agents to search and discover products across the entire Shopify ecosystem, helping buyers find pr…”
   • [claimed-docs] “"The Storefront Catalog MCP server enables AI agents to search and discover products from a single merchant's catalog, helping buyers find a…”
   • [claimed-docs] “"Cart tools accept unauthenticated requests, which lets you estimate totals and share a cart with the buyer before collecting credentials" —…”
   • [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
   • [claimed-docs] “"The Order MCP server enables AI agents to fetch the current state of an order placed through their agent, including line items, fulfillment…”
   • [probe] “PROBE runtime (recorded 2026-09-14): Shopify's Global Catalog MCP server is live — a keyless JSON-RPC initialize POST to https://catalog.sho…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a Shopify-operated storefront's own UCP endpoint is live — a keyless JSON-RPC initialize POST to https:…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the documented agent-profile trust gate behaves as specified — a keyless raw tools/call search_catalog …”
   • [claimed-docs] “Connect any AI assistant to real-time commerce data from Shopify stores with Model Context Protocol (MCP) servers”

   proof ↗⚑ flag

   Coinbase x402~partialclaimed6/10

   Docs explicitly describe an official 'Bazaar MCP server' letting MCP-compatible agents discover payment-gated x402 services via tool calls, which is a genuine first-party MCP server integration for the agentic discovery flow. However, the MCP server appears scoped to discovery only (finding payable resources), not the full pay/settle transaction flow, and there's no independent/hands-on corroboration of the MCP server itself (only docs mention it). Missing for 10: evidence that payment execution (not just discovery) can be driven through the MCP server, and independent/community verification of the MCP server working end-to-end.

   • [claimed-docs] “Let an MCP-compatible agent discover services with tool calls.”
   • [claimed-docs] “Payable-service discovery is open: "The x402 Bazaar is a catalog of payment-gated services discovered by the CDP Facilitator." and "Bazaar d…”
   • [claimed-docs] “"Getting discovered makes your endpoint available to tens of thousands of agents through CDP APIs, the Bazaar MCP server, and Amazon Bedrock…”

   proof ↗⚑ flag

4. ai-native userUse an official CLI

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce✓fullprobed8/10

   Shopify documents and ships an official UCP CLI (`@shopify/ucp-cli`) with structured commands for catalog search, cart building, checkout, and order tracking, backed by a quickstart guide and runtime probes confirming live functionality (cart creation, catalog search) against real endpoints. missing for 10: independent third-party (non-Shopify) hands-on reviews of the CLI itself and broader adoption evidence beyond Shopify's own docs/probes.

   • [claimed-docs] “Shopify's agent surface is UCP end to end via "Shopify's UCP-compliant MCP servers": the UCP CLI "provides structured commands to search the…”
   • [claimed-docs] “Initialize a local UCP profile.”
   • [claimed-docs] “This quickstart runs the full agentic commerce flow with the UCP CLI, from product discovery to order tracking, in about five minutes.”
   • [claimed-docs] “The CLI uses a local profile to identify your agent on every merchant-scoped request. Initialize it once and the CLI reuses it for every ope…”
   • [probe] “official CLI documented at https://shopify.dev/docs/agents/get-started/quickstart”
   • [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”
   • [claimed-docs] “Buyer handoff is a first-class state: "Build for escalations regardless of how you authenticate." A checkout in requires_escalation means "C…”

   proof ↗⚑ flag

   Coinbase x402—none0/10

   No evidence pack item mentions an official CLI tool for x402; the documentation focuses on SDKs, facilitator APIs, MCP integration, and discovery, but nothing describes a CLI product. missing for 10: any mention of an x402 CLI, its commands, or install instructions.

   ⚑ flag

5. ai-native userDrive the product through a documented public API

   weight 3 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce✓fullprobed9/10

   Shopify documents and exposes a full public, documented agent-facing API surface (UCP CLI + MCP servers for Catalog, Cart, Checkout, Order) with schemas, auth tiers, negotiation, webhooks, and runtime probes confirming live handshakes, keyless catalog search, and real cart creation — clearly enabling an AI-native user to drive the product programmatically. Missing for 10: no publicly documented OpenAPI/REST spec found (404s on openapi.json/llms.txt) and no independent third-party developer report beyond Shopify's own docs/probes.

   • [claimed-docs] “the CLI provides structured commands to search the Catalog, build carts, create checkouts, hand off buyers, and track orders”
   • [claimed-docs] “Shopify's agent surface is UCP end to end via "Shopify's UCP-compliant MCP servers": the UCP CLI "provides structured commands to search the…”
   • [claimed-docs] “"The Global Catalog MCP server enables AI agents to search and discover products across the entire Shopify ecosystem, helping buyers find pr…”
   • [claimed-docs] “"Cart tools accept unauthenticated requests, which lets you estimate totals and share a cart with the buyer before collecting credentials" —…”
   • [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
   • [claimed-docs] “"The Order MCP server enables AI agents to fetch the current state of an order placed through their agent, including line items, fulfillment…”
   • [claimed-docs] “"Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (fu…”
   • [claimed-docs] “In UCP, "a platform profile is a JSON document that describes the protocol version and capabilities the platform supports"; the business sid…”
   • [probe] “PROBE runtime (recorded 2026-09-14): Shopify's Global Catalog MCP server is live — a keyless JSON-RPC initialize POST to https://catalog.sho…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the documented agent-profile trust gate behaves as specified — a keyless raw tools/call search_catalog …”

   proof ↗⚑ flag

   Coinbase x402~partialprobed6/10

   x402 exposes a documented HTTP-based protocol (402 flow, discovery APIs, facilitator endpoints) that AI agents can drive programmatically, with runtime probes confirming the discovery endpoint is live and keyless and the facilitator auth-gates as documented. However this is a payment/discovery protocol, not a general product API — there's no OpenAPI spec (probe-3 shows 404s across candidate paths), and full programmatic control (e.g., managing wallets, settlement, compliance rules) still routes through CDP SDKs rather than a single unified public API surface. missing for 10: a formal OpenAPI/swagger spec, independent hands-on confirmation of the full request/pay/retry loop beyond discovery, and evidence of broader API coverage beyond payments/discovery.

   • [claimed-docs] “Add one line of code to require payment for each incoming request. If a request arrives without payment, the server responds with HTTP 402, …”
   • [claimed-docs] “Bazaar discovery is public. You do not need a CDP API key to use the discovery APIs or the corresponding TypeScript SDK functions.”
   • [claimed-docs] “Let an MCP-compatible agent discover services with tool calls.”
   • [probe] “PROBE runtime (recorded 2026-09-14): the x402 Bazaar discovery index is keyless by design and live — a plain GET to https://api.cdp.coinbase…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the hosted CDP facilitator auth-gates as documented — a keyless GET to https://api.cdp.coinbase.com/pla…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.cdp.coinbase.com/openapi.json, https://docs.cdp.coinbase.com/swagger.json, https://docs…”
   • [claimed-docs] “"x402 is an open standard for adding per-request payments to HTTP, so APIs and services can charge without checkout pages, subscriptions, or…”
   • [claimed-docs] “Payable-service discovery is open: "The x402 Bazaar is a catalog of payment-gated services discovered by the CDP Facilitator." and "Bazaar d…”

   proof ↗⚑ flag

6. ai-native userIssue scoped/least-privilege API credentials for an agent

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce✓fullprobed7/10

   Shopify's UCP documents concrete least-privilege mechanics: three trust tiers (Anonymous/Signed/Token) that gate which tools and rate limits an agent gets, a specific scope (read_global_api_orders) required for Order MCP, short-lived (60-minute TTL) JWTs minted from Dev Dashboard client credentials, and checkout completion gated on the token being 'granted permission to complete purchases.' A runtime probe confirms the profile/identity gate rejects unauthenticated calls (invalid_profile_url), corroborating the scoped-access model works as documented. Missing for 10: a full catalog of all available scopes/permissions beyond the few named, self-service credential/scope management UI, explicit revocation workflow, and independent third-party verification of least-privilege enforcement in production.

   • [claimed-docs] “"UCP traffic to Shopify's MCP servers is classified into three tiers based on how your agent identifies itself" — Token, Signed, Anonymous —…”
   • [claimed-docs] “"The Order MCP server enables AI agents to fetch the current state of an order placed through their agent, including line items, fulfillment…”
   • [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the documented agent-profile trust gate behaves as specified — a keyless raw tools/call search_catalog …”

   proof ↗⚑ flag

   Coinbase x402~partialclaimed4/10

   x402 replaces API keys with pay-per-request payments rather than issuing scoped API credentials, so there's no OAuth-style scope/permission system; however, 'Agentic accounts'/'Agentic Wallet' let a user give an agent a wallet to autonomously pay for services, and batch-settlement escrow includes cryptographically signed spending limits and defined refund/withdrawal semantics, which functions as a loose least-privilege spend-limit mechanism for the agent's payment authority. Missing for 10: explicit API-credential scoping (read/write/resource-level permissions), granular per-service access control beyond payment limits, and independent confirmation that these spend-limit controls are enforced in practice.

   • [claimed-docs] “Agentic accounts let an AI agent hold funds and act through a Coinbase account or wallet. For an x402 buyer, the account is the source of US…”
   • [claimed-docs] “Agent wallets: "Agentic accounts let an AI agent hold funds and act through a Coinbase account or wallet. For an x402 buyer, the account is …”
   • [claimed-docs] “The batch-settlement scheme targets high-frequency agent loops: "Batch settlement lets agents perform thousands of granular interactions whi…”

   proof ↗⚑ flag

7. ai-native userBuild against official SDKs

   weight 2 · round drawn
   Shopify Agentic Commerce~partialprobed6/10

   Shopify provides official developer tooling for agentic commerce — the `@shopify/ucp-cli`, UCP-compliant MCP servers (Catalog, Cart, Checkout, Order), profile/negotiation docs, and an AI Toolkit that validates GraphQL/Liquid/Extensions — all documented with schemas and confirmed live via runtime probes. However, this is CLI/MCP/JSON-RPC tooling rather than a conventional language-specific SDK (e.g., a Python or JS client library) that an AI-native developer could import directly. Missing for 10: dedicated SDK packages/libraries beyond the CLI and MCP JSON-RPC interface, and independent third-party corroboration of SDK usability.

   • [claimed-docs] “Shopify's agent surface is UCP end to end via "Shopify's UCP-compliant MCP servers": the UCP CLI "provides structured commands to search the…”
   • [claimed-docs] “validate GraphQL queries, Liquid templates, and Shopify Extensions against Shopify schemas to catch issues earlier”
   • [claimed-docs] “"The Global Catalog MCP server enables AI agents to search and discover products across the entire Shopify ecosystem, helping buyers find pr…”
   • [claimed-docs] “"Cart tools accept unauthenticated requests, which lets you estimate totals and share a cart with the buyer before collecting credentials" —…”
   • [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”
   • [claimed-docs] “Initialize a local UCP profile.”

   proof ↗⚑ flag

   Coinbase x402~partialprobed6/10

   Docs reference SDK building blocks (CDP SDK's x402 building blocks, TypeScript SDK discovery functions, npm package x402 confirmed live at v1.2.0 with SLSA provenance) and MCP/AgentCore integrations, showing real SDK-based build paths for AI agents. However, evidence lacks concrete SDK code samples, comprehensive language coverage, or independent developer corroboration beyond one HN comment expressing intent to try it with FastAPI. missing for 10: actual SDK code examples/API reference beyond npm existence, multi-language SDK coverage evidence, independent hands-on developer reports of building with the SDK successfully.

   • [claimed-docs] “When you build with the CDP SDK's x402 building blocks, x402 Bazaar support is enabled automatically. There is no registration form or separ…”
   • [claimed-docs] “Let an MCP-compatible agent discover services with tool calls.”
   • [claimed-docs] “Payable-service discovery is open: "The x402 Bazaar is a catalog of payment-gated services discovered by the CDP Facilitator." and "Bazaar d…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the hosted CDP facilitator auth-gates as documented — a keyless GET to https://api.cdp.coinbase.com/pla…”
   • [community] “this looks great, gonna look into writing something to use with fastapi”

   proof ↗⚑ flag

Agentic features

1. ai-native userSet up automations that run autonomously in the background

   weight 2 · round to Coinbase x402
   Shopify Agentic Commerce~partialclaimed4/10

   UCP's trust-tier model lets Token-tier agents call complete_checkout autonomously once granted permission, and order webhooks push background state updates to a registered endpoint without polling — both hint at unattended, background-capable agent operation. But there is no documented feature for an AI-native user to configure a scheduled or trigger-based automation (e.g., recurring reorders, price-watch, monitor-and-act loops) that runs unsupervised over time; the evidence only covers per-session agent tool calls (search/cart/checkout/order) and merchant-side webhook delivery, not user-configurable autonomous background jobs. Missing for 10: explicit scheduling/trigger mechanism, evidence of a persistent background agent process, and independent confirmation of real autonomous (no-human-in-loop) purchase completion.

   • [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
   • [claimed-docs] “"UCP traffic to Shopify's MCP servers is classified into three tiers based on how your agent identifies itself" — Token, Signed, Anonymous —…”
   • [claimed-docs] “"Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (fu…”
   • [claimed-docs] “Buyer handoff is a first-class state: "Build for escalations regardless of how you authenticate." A checkout in requires_escalation means "C…”

   proof ↗⚑ flag

   Coinbase x402~partialclaimed5/10

   x402 enables agent wallets to autonomously discover and pay for services mid-task (agentic accounts, Bazaar discovery, MCP tool-call discovery, batch settlement for high-frequency loops), which supports background autonomous payment automations, but the product itself is a payment protocol/infrastructure layer, not a scheduler or automation orchestrator — there's no evidence of triggers, cron-like scheduling, or persistent background task management outside of payment transactions. missing for 10: evidence of actual task/workflow scheduling or orchestration beyond payment execution, independent hands-on validation of autonomous background operation over time, and details on error handling/retry logic for unattended long-running agent loops.

   • [claimed-docs] “Agentic accounts let an AI agent hold funds and act through a Coinbase account or wallet. For an x402 buyer, the account is the source of US…”
   • [claimed-docs] “Let an MCP-compatible agent discover services with tool calls.”
   • [claimed-docs] “an agent purchasing a tool call mid-task”
   • [claimed-docs] “The x402 protocol is introducing batch settlement, enabling agents to transact at extremely low latency and fractions of a cent.”
   • [claimed-docs] “Agent wallets: "Agentic accounts let an AI agent hold funds and act through a Coinbase account or wallet. For an x402 buyer, the account is …”
   • [claimed-docs] “The batch-settlement scheme targets high-frequency agent loops: "Batch settlement lets agents perform thousands of granular interactions whi…”
   • [claimed-docs] “Payable-service discovery is open: "The x402 Bazaar is a catalog of payment-gated services discovered by the CDP Facilitator." and "Bazaar d…”

   proof ↗⚑ flag

Api quality

1. ai-native userExplore an interactive API reference with runnable examples

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce~partialprobed4/10

   Shopify's UCP docs provide a step-by-step quickstart with real, copy-pasteable CLI commands that run the full discovery→cart→checkout→order flow, and MCP tools are self-describing (agents can fetch live input schemas via `--input-schema`), which gives AI-native users a way to explore and run real examples against live endpoints (confirmed by runtime probes actually executing search/cart calls). However, there is no dedicated interactive API-reference surface — probes explicitly found no OpenAPI/Swagger spec and no llms.txt at shopify.dev (404s), so there's no Postman/Swagger-style 'try it' reference page, only linear docs plus CLI/MCP introspection. Missing for 10: a dedicated interactive API-reference UI (OpenAPI/Swagger explorer or embedded try-it-now widgets), and independent hands-on confirmation that non-CLI docs pages let users run examples inline.

   • [claimed-docs] “This quickstart runs the full agentic commerce flow with the UCP CLI, from product discovery to order tracking, in about five minutes.”
   • [claimed-docs] “"The Storefront Catalog MCP server enables AI agents to search and discover products from a single merchant's catalog, helping buyers find a…”
   • [probe] “PROBE runtime (recorded 2026-09-14): Shopify's Global Catalog MCP server is live — a keyless JSON-RPC initialize POST to https://catalog.sho…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”
   • [probe] “PROBE llms.txt: HTTP 404 at https://shopify.dev/llms.txt”
   • [probe] “PROBE openapi: all candidate paths 404 (https://shopify.dev/openapi.json, https://shopify.dev/swagger.json, https://shopify.dev/api/openapi.…”

   proof ↗⚑ flag

   Coinbase x402—none0/10

   The evidence pack shows extensive text documentation but no mention of an interactive API reference or runnable examples; a probe explicitly found no OpenAPI/Swagger spec at any candidate path (404s), indicating no interactive reference tooling is exposed.

   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.cdp.coinbase.com/openapi.json, https://docs.cdp.coinbase.com/swagger.json, https://docs…”

   proof ↗⚑ flag

2. ai-native userDownload a machine-readable API spec (OpenAPI or equivalent)

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce~partialprobed4/10

   There's no downloadable OpenAPI/Swagger file — a direct probe found openapi.json, swagger.json, and similar candidate paths all 404 — but the underlying protocol is machine-readable in other ways: MCP servers expose live input schemas agents can introspect at runtime (--input-schema) and the UCP protocol itself has a published, versioned technical specification with reference implementations in a public GitHub repo (ucp.dev/llms.txt). missing for 10: an actual OpenAPI/JSON-Schema-equivalent document downloadable in one shot, and confirmation that the GitHub spec repo is machine-readable in OpenAPI-equivalent form rather than prose/markdown protocol docs.

   • [probe] “PROBE openapi: all candidate paths 404 (https://shopify.dev/openapi.json, https://shopify.dev/swagger.json, https://shopify.dev/api/openapi.…”
   • [claimed-docs] “"The Storefront Catalog MCP server enables AI agents to search and discover products from a single merchant's catalog, helping buyers find a…”
   • [claimed-docs] “ucp.dev positions the protocol as industry-governed rather than single-vendor: "UCP is built by the industry, to enable seamless agentic exp…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the Universal Commerce Protocol spec is published in the open — https://ucp.dev/llms.txt serves the ver…”

   proof ↗⚑ flag

   Coinbase x402—none0/10

   A direct probe for OpenAPI/swagger specs at all standard paths on the CDP docs site returned 404s, and no other evidence pack item points to a downloadable machine-readable API spec; the docs only offer markdown/llms.txt style documentation, not an OpenAPI equivalent.

   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.cdp.coinbase.com/openapi.json, https://docs.cdp.coinbase.com/swagger.json, https://docs…”

   proof ↗⚑ flag

3. ai-native userTest against a sandbox environment without touching production data

   weight 1 · round to Coinbase x402
   Shopify Agentic Commerce—none0/10

   No evidence pack item describes a dedicated sandbox/test environment for UCP agent development; the only relevant runtime probe shows testing being done directly against a live production Shopify store ('a REAL cart was created keylessly on Shopify's own hardware store'), not a sandbox. No test-mode flag, dev store, or mock UCP endpoint is documented anywhere in the pack.

   • [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a Shopify-operated storefront's own UCP endpoint is live — a keyless JSON-RPC initialize POST to https:…”

   proof ↗⚑ flag

   Coinbase x402~partialclaimed3/10

   The only sandbox-relevant evidence is a passing mention that the facilitator's supported-network table includes Base Sepolia (a public testnet) alongside mainnet networks, implying developers could test payments without real funds — but there is no dedicated 'sandbox mode', test facilitator, or explicit developer guidance for testing against non-production data. missing for 10: explicit sandbox/testnet documentation or tutorial, dedicated test facilitator or test-mode API keys, guidance on faucet/test USDC usage, and any community/hands-on confirmation of a working testnet flow.

   • [claimed-docs] “The hosted CDP Facilitator "validates signed payments, screens transactions, submits settlement onchain, and reports the result to your reso…”

   proof ↗⚑ flag

4. ai-native userRely on versioned APIs with a documented deprecation policy

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce~partialprobed4/10

   Evidence shows real API versioning (protocol version headers like x-shopify-ucp-mcp-api-version: 2026-08-25, dated UCP spec releases on ucp.dev, and profile negotiation based on 'the protocol version and capabilities the platform supports'), which supports the 'versioned APIs' half of the story. However, no evidence anywhere describes a documented deprecation policy, sunset timelines, or backward-compatibility guarantees for older versions. Missing for 10: explicit deprecation/sunset policy documentation, version-support lifecycle commitments, migration guidance between dated versions.

   • [probe] “PROBE runtime (recorded 2026-09-14): Shopify's Global Catalog MCP server is live — a keyless JSON-RPC initialize POST to https://catalog.sho…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the Universal Commerce Protocol spec is published in the open — https://ucp.dev/llms.txt serves the ver…”
   • [claimed-docs] “In UCP, "a platform profile is a JSON document that describes the protocol version and capabilities the platform supports"; the business sid…”

   proof ↗⚑ flag

   Coinbase x402—none0/10

   The evidence pack shows a 'v2' support table for the facilitator API but nowhere documents an API versioning scheme, backward-compatibility guarantees, or a deprecation policy for x402 endpoints/SDKs; no changelog, sunset timeline, or version-support-window language appears anywhere in the docs or probes.

   ⚑ flag

1. ai-native userPerform bulk operations across many items at once

   weight 2 · round to Coinbase x402
   Shopify Agentic Commerce—none0/10

   The evidence describes single-item/cart-at-a-time flows (search, build a cart, checkout, track one order) and catalog pagination for browsing, but nothing documents a bulk operation primitive — e.g., adding many items to a cart in one call, batch checkout, or bulk order management — for an AI agent to act on many items at once.

   ⚑ flag

   Coinbase x402~partialclaimed7/10

   x402's batch-settlement scheme is documented specifically to let agents perform 'thousands of granular interactions' bundled into a single onchain settlement, which is the protocol's version of bulk/batch operations across many payment items (vouchers redeemed together). This is first-party documented with mechanics (escrow, cryptographic vouchers, refund semantics) but there is no independent or hands-on verification that this batching works at scale in production, and no evidence of bulk operations outside the payment-settlement context (e.g., bulk discovery or bulk resource management). Missing for 10: third-party/hands-on confirmation of batch settlement at scale, and evidence of bulk operations beyond payment batching.

   • [claimed-docs] “Charge however you price. Fixed-price, usage-based, and batched payments through the exact, upto, and batch-settlement schemes.”
   • [claimed-docs] “The x402 protocol is introducing batch settlement, enabling agents to transact at extremely low latency and fractions of a cent.”
   • [claimed-docs] “The batch-settlement scheme targets high-frequency agent loops: "Batch settlement lets agents perform thousands of granular interactions whi…”

   proof ↗⚑ flag

2. ai-native userDefine rules that trigger actions automatically on events

   weight 3 · round to Coinbase x402
   Shopify Agentic Commerce~partialclaimed3/10

   Shopify's UCP order webhooks push event notifications (fulfillment, refunds, cancellations) to a registered endpoint whenever a committed change occurs, giving a basic event-trigger backbone, but there is no evidence of an actual rules/automation engine where an AI-native user declares conditional logic ("if X then do Y") that Shopify executes on their behalf. Missing for 10: a rule-definition interface or automation engine, support for triggers beyond order state changes, and any evidence of user-authored conditional actions rather than raw webhook delivery.

   • [claimed-docs] “"Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (fu…”
   • [claimed-docs] “Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change”
   • [claimed-docs] “Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (ful…”

   proof ↗⚑ flag

   Coinbase x402~partialclaimed4/10

   x402 has some built-in event→action automation (a 402 response auto-triggers a client to sign and retry with payment; unpaid resources are auto-removed from the Bazaar after 30 days without settlement), but there is no evidence of a general rules engine where an AI-native user can define arbitrary custom triggers/conditions and actions — the automation is hardwired protocol behavior, not user-configurable rule authoring. missing for 10: a rule-definition interface or config, support for arbitrary event types beyond payment/settlement, user-set conditional logic (if/then) beyond the protocol's fixed retry-and-settle flow.

   • [claimed-docs] “Add one line of code to require payment for each incoming request. If a request arrives without payment, the server responds with HTTP 402, …”
   • [claimed-docs] “"Getting discovered makes your endpoint available to tens of thousands of agents through CDP APIs, the Bazaar MCP server, and Amazon Bedrock…”
   • [claimed-docs] “The x402 protocol is introducing batch settlement, enabling agents to transact at extremely low latency and fractions of a cent.”
   • [claimed-docs] “The batch-settlement scheme targets high-frequency agent loops: "Batch settlement lets agents perform thousands of granular interactions whi…”

   proof ↗⚑ flag

Fees transparency

1. merchantThe fees for agent-originated transactions are published — I can price agentic channels without asking sales

   weight 2 · round to Coinbase x402
   Shopify Agentic Commerce—none0/10

   The evidence pack thoroughly documents UCP's technical architecture (catalog, cart, checkout, orders, trust tiers) but contains no mention of transaction fees, take rates, commission percentages, or pricing terms for agent-originated sales — nothing addresses what a merchant would pay for agentic-channel transactions.

   ⚑ flag

   Coinbase x402✓fullclaimed8/10

   Coinbase publishes a concrete, self-serve fee schedule for the CDP Facilitator (first 1,000 onchain transactions/month free, then $0.001 per additional transaction, verification always free, batch settlement amortizing costs further), letting a merchant price agentic payment flows without contacting sales. Missing for 10: independent/third-party verification of real-world billed fees, and any published fee variance across supported networks (Base, Polygon, Arbitrum, Solana) beyond the flat headline rate.

   • [claimed-docs] “Free to start, inexpensive to scale. The first 1,000 onchain Facilitator transactions each month are free, then each additional onchain tran…”
   • [claimed-docs] “Facilitator fees, verbatim: "Free to start, inexpensive to scale." — "The first 1,000 onchain Facilitator transactions each month are free",…”
   • [claimed-docs] “Built-in screening. OFAC and Know Your Transaction (KYT) checks identify and decline payments involving sanctioned or high-risk addresses.”

   proof ↗⚑ flag

Payouts

1. merchantAgent-originated payments settle through documented payout and reporting flows, reconcilable like any other channel

   weight 1 · round to Coinbase x402
   Shopify Agentic Commerce—none0/10

   The evidence documents order creation, checkout/payment completion, order-state webhooks, and get_order reconciliation of order state, but nothing addresses payout, settlement, or financial reporting flows that let a merchant reconcile agent-originated revenue against other channels (no mention of payout reports, settlement schedules, or accounting/export integration). Since payout/reporting reconciliation is a normal, fair expectation for any commerce channel with real payments, this axis applies but is unaddressed in the pack.

   ⚑ flag

   Coinbase x402~partialcommunity5/10

   Docs confirm the CDP Facilitator validates and settles payments onchain and 'reports the result to your resource server,' and sellers can receive to custodial or self-custody wallets, giving a baseline settlement/reporting hook comparable to other channels. However there's no documented merchant-facing statement/ledger/dashboard, refund/chargeback handling, or tax/accounting reconciliation tooling, and community reports (comm-10) note real-world friction around verifying settlement timing for variable-length agent tasks. Missing for 10: dedicated payout statements or ledger exports, refund/dispute reconciliation flow, and independent confirmation that merchants can reconcile x402 settlements against traditional accounting systems.

   • [claimed-docs] “The CDP Facilitator handles that work as a hosted service: it validates signed payments, screens transactions, submits settlement onchain, a…”
   • [claimed-docs] “Sellers receive at any address they control — including CDP custodial wallets, Coinbase Business, Prime, or a self-custody wallet”
   • [claimed-docs] “The hosted CDP Facilitator "validates signed payments, screens transactions, submits settlement onchain, and reports the result to your reso…”
   • [claimed-docs] “Facilitator fees, verbatim: "Free to start, inexpensive to scale." — "The first 1,000 onchain Facilitator transactions each month are free",…”
   • [community] “We run 124 x402 endpoints at httpay.xyz and the 'verify work was done' problem is real — especially for compute-heavy tasks like image gener…”

   proof ↗⚑ flag

Attribution analytics

1. merchantOrders are attributed to the originating agent and I can report on or filter transactions by agent

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce~partialclaimed5/10

   Cart/checkout objects carry explicit agent-attribution metadata (referring_domain, click_id_tag, activity_id, utm_* fields) and orders are tied to a specific agent's UCP profile via checkout creation, giving Shopify the raw data needed to attribute orders to an agent. However, there is no evidence of a merchant-facing report, analytics dashboard, or order-list filter that lets a merchant actually query or segment transactions by originating agent — only developer-facing MCP/webhook data plumbing is documented. Missing for 10: merchant admin UI or reporting API to filter/segment orders by agent, aggregate agent-performance analytics, independent confirmation that attribution data surfaces in Shopify's order admin.

   • [claimed-docs] “"Cart tools accept unauthenticated requests, which lets you estimate totals and share a cart with the buyer before collecting credentials" —…”
   • [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
   • [claimed-docs] “"Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (fu…”
   • [claimed-docs] “"The Order MCP server enables AI agents to fetch the current state of an order placed through their agent, including line items, fulfillment…”
   • [claimed-docs] “In UCP, "a platform profile is a JSON document that describes the protocol version and capabilities the platform supports"; the business sid…”

   proof ↗⚑ flag

   Coinbase x402—none0/10

   The evidence pack covers payment settlement, discovery (Bazaar), wallets, screening, and fees, but nowhere describes agent-identity attribution on orders or a merchant-facing report/filter-by-agent capability. No dashboard, transaction log, or agent-ID field is documented.

   ⚑ flag

Onboarding to agents

1. merchantI have a documented self-serve path to start accepting agent traffic — enable a setting, sign an agreement, or publish an endpoint

   weight 3 · round to Coinbase x402
   Shopify Agentic Commerce~partialprobed5/10

   Docs show every UCP-enabled storefront automatically exposes a /api/ucp/mcp endpoint and a merchant publishes a UCP profile at {shop}.myshopify.com/.well-known/ucp for capability negotiation — that's a documented, quasi-self-serve publishing path, and probes confirm live merchant endpoints exist. But the pack explicitly contradicts full self-serve: order webhook subscription is 'not self-serve... contact your Shopify partner manager,' and there is no merchant-facing admin setting or signed agreement flow described (all guidance is developer/CLI-facing, not merchant-console-facing). missing for 10: a merchant-admin toggle/setting in Shopify admin UI, an explicit merchant agreement/terms step, and self-serve webhook registration (currently manual via partner manager).

   • [claimed-docs] “In UCP, "a platform profile is a JSON document that describes the protocol version and capabilities the platform supports"; the business sid…”
   • [claimed-docs] “"Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (fu…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a Shopify-operated storefront's own UCP endpoint is live — a keyless JSON-RPC initialize POST to https:…”
   • [claimed-docs] “Negotiation is server-selects. The business computes the intersection of its capabilities with the platform's and chooses the active set”

   proof ↗⚑ flag

   Coinbase x402✓fullprobed8/10

   Docs give a concrete self-serve merchant path: add one line of code (or use CDP SDK x402 building blocks) to require payment, receive at any wallet address (custodial, self-custody, Business, Prime), and Bazaar discovery/listing happens automatically with no registration form or API call once payments settle — confirmed live via runtime probe of the discovery endpoint. missing for 10: no independent hands-on merchant onboarding report/case study corroborating the frictionless claim beyond docs+probe, and no explicit merchant-facing 'agreement' or ToS acceptance step is documented.

   • [claimed-docs] “Add one line of code to require payment for each incoming request. If a request arrives without payment, the server responds with HTTP 402, …”
   • [claimed-docs] “Sellers receive at any address they control — including CDP custodial wallets, Coinbase Business, Prime, or a self-custody wallet”
   • [claimed-docs] “When you build with the CDP SDK's x402 building blocks, x402 Bazaar support is enabled automatically. There is no registration form or separ…”
   • [claimed-docs] “Bazaar discovery is public. You do not need a CDP API key to use the discovery APIs or the corresponding TypeScript SDK functions.”
   • [claimed-docs] “Payable-service discovery is open: "The x402 Bazaar is a catalog of payment-gated services discovered by the CDP Facilitator." and "Bazaar d…”
   • [claimed-docs] “"Getting discovered makes your endpoint available to tens of thousands of agents through CDP APIs, the Bazaar MCP server, and Amazon Bedrock…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the x402 Bazaar discovery index is keyless by design and live — a plain GET to https://api.cdp.coinbase…”

   proof ↗⚑ flag

Traffic controls

1. merchantRate-limit, allow, or deny specific agents and agent platforms accessing my catalog and checkout

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce~partialclaimed3/10

   Shopify's UCP documents a platform-wide trust-tier system (Token/Signed/Anonymous) where 'rate limits scale with identification' and certain tools (like complete_checkout or Order MCP) are gated to higher trust tiers, which provides some rate-limiting infrastructure. However, this is a Shopify-controlled protocol mechanism based on identification strength, not a merchant-facing dashboard/setting to specifically allow, deny, or rate-limit named agents or agent platforms (e.g. blocking 'Agent X' or 'Platform Y' by name). Missing for 10: merchant-configurable allow/deny lists for specific agents/platforms, merchant UI or API to set custom rate limits per agent, and any evidence of per-merchant policy enforcement beyond the global trust-tier scheme.

   • [claimed-docs] “"UCP traffic to Shopify's MCP servers is classified into three tiers based on how your agent identifies itself" — Token, Signed, Anonymous —…”
   • [claimed-docs] “In UCP, "a platform profile is a JSON document that describes the protocol version and capabilities the platform supports"; the business sid…”
   • [claimed-docs] “"The Order MCP server enables AI agents to fetch the current state of an order placed through their agent, including line items, fulfillment…”

   proof ↗⚑ flag

   Coinbase x402—none0/10

   The evidence shows built-in OFAC/KYT screening for sanctioned addresses and general facilitator validation, but nothing about merchants configuring per-agent or per-platform allow/deny lists or rate limits. Access control in the docs is limited to compliance screening, not merchant-defined agent-level policies.

   • [claimed-docs] “Built-in screening. OFAC and Know Your Transaction (KYT) checks identify and decline payments involving sanctioned or high-risk addresses.”
   • [claimed-docs] “The hosted CDP Facilitator "validates signed payments, screens transactions, submits settlement onchain, and reports the result to your reso…”

   proof ↗⚑ flag

1. ai-native userRead the product's source under an open license

   weight 2 · round to Coinbase x402
   Shopify Agentic Commerce—none0/10

   Evidence shows the UCP protocol specification and reference implementations are published openly on GitHub, but this is the industry-wide protocol spec (ucp.dev), not Shopify's own Agentic Commerce product source code, servers, or CLI implementation. No citation shows Shopify's actual MCP server/checkout implementation, storefront code, or platform source is released under an open license.

   ⚑ flag

   Coinbase x402~partialprobed5/10

   The evidence shows x402 was contributed to the Linux Foundation and is now developed under 'open, vendor-neutral governance' with public docs and an npm-published SDK (v1.2.0) with SLSA provenance, implying source availability, but no citation ever names a specific open-source license (MIT/Apache/etc.) or points to a public repository. Missing for 10: explicit license text/repo citation, confirmation of source-code (not just protocol spec) openness, and independent verification that the code itself (not just governance) is freely licensed.

   • [claimed-docs] “Governance: "x402 was originally incubated at Coinbase." — then the "x402 Foundation launched under the Linux Foundation" and "Coinbase comp…”
   • [claimed-docs] “Named governance seats on x402.org: "The x402 Governing Board is responsible for marketing, business oversight, and budget decisions for the…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the hosted CDP facilitator auth-gates as documented — a keyless GET to https://api.cdp.coinbase.com/pla…”
   • [community] “The Linux Foundation... today announced it is launching the x402 Foundation with the contribution of the x402 protocol from Coinbase... It s…”

   proof ↗⚑ flag

Delegated credentials

1. ai-native userHand my agent a scoped, limited-use payment credential — amount limits, expiry, merchant restrictions — instead of a raw card number

   weight 3 · round to Coinbase x402
   Shopify Agentic Commerce~partialclaimed4/10

   UCP references AP2 payment mandates as "cryptographically signed payment authorizations that are mathematically tied to the specific state of the cart" and verifiable credentials, plus short-lived (60-minute) JWT checkout tokens and Token-tier gating for complete_checkout — gesturing at scoped, non-raw-card credentials, but this describes protocol/session tokens for API access, not a user-issued payment instrument with explicit amount limits, expiry, and merchant restrictions handed to the agent. Missing for 10: concrete documentation of a user-facing scoped payment credential (spending caps, expiry dates, merchant allow-lists) rather than just agent-identity/session auth tokens, and no independent/hands-on evidence of this credential-issuance flow in practice.

   • [claimed-docs] “allows Platforms to provide cryptographically signed payment authorizations that are mathematically tied to the specific state of the cart”
   • [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
   • [claimed-docs] “"UCP traffic to Shopify's MCP servers is classified into three tiers based on how your agent identifies itself" — Token, Signed, Anonymous —…”
   • [claimed-docs] “ucp.dev positions the protocol as industry-governed rather than single-vendor: "UCP is built by the industry, to enable seamless agentic exp…”

   proof ↗⚑ flag

   Coinbase x402~partialclaimed5/10

   x402 lets an agent's wallet make cryptographically signed, per-request payments with authorized-but-not-exceeded amounts (the 'upto' scheme) and batch-settlement vouchers where 'limits are cryptographically signed' and buyers retain 'refund and withdrawal semantics' — functioning like a scoped, capped credential rather than a raw card number. However, there is no documented mechanism for setting an explicit expiry window or restricting a credential to specific merchants; the wallet/agentic account simply holds USDC and signs payments to whatever service it calls. Missing for 10: explicit credential expiry configuration, merchant/service allow-listing, and a unified 'issue a scoped credential' UX rather than per-request signing.

   • [claimed-docs] “The hosted CDP Facilitator "validates signed payments, screens transactions, submits settlement onchain, and reports the result to your reso…”
   • [claimed-docs] “Agent wallets: "Agentic accounts let an AI agent hold funds and act through a Coinbase account or wallet. For an x402 buyer, the account is …”
   • [claimed-docs] “The batch-settlement scheme targets high-frequency agent loops: "Batch settlement lets agents perform thousands of granular interactions whi…”
   • [claimed-docs] “Charge however you price. Fixed-price, usage-based, and batched payments through the exact, upto, and batch-settlement schemes.”
   • [claimed-docs] “Agentic accounts let an AI agent hold funds and act through a Coinbase account or wallet. For an x402 buyer, the account is the source of US…”

   proof ↗⚑ flag

Settlement rails

1. developerSettle agent-initiated payments in stablecoins over documented rails

   weight 2 · round to Coinbase x402
   Shopify Agentic Commerce—none0/10

   Evidence documents payment_handlers like com.google.pay, credit-card style checkout, and AP2/payment mandate concepts, but nowhere mentions stablecoins, crypto rails, or any stablecoin settlement path for agent-initiated payments. This is a documented gap, not a category mismatch, since UCP explicitly discusses payment handler negotiation and could plausibly include stablecoin rails.

   • [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
   • [claimed-docs] “ucp.dev positions the protocol as industry-governed rather than single-vendor: "UCP is built by the industry, to enable seamless agentic exp…”
   • [claimed-docs] “allows Platforms to provide cryptographically signed payment authorizations that are mathematically tied to the specific state of the cart”

   proof ↗⚑ flag

   Coinbase x402✓fullprobed9/10

   x402 is purpose-built for agent-initiated stablecoin (USDC/ERC-20/SPL) payments over a documented HTTP 402 protocol, with a hosted CDP Facilitator that verifies, screens (OFAC/KYT), and settles onchain across Base, Solana, Polygon, Arbitrum and World, and agent wallet integrations (Agentic Accounts, AgentCore, MCP) for autonomous payment flows. Runtime probes confirm the discovery API is live and keyless and the facilitator auth-gates as documented, and community hands-on reports (124 live x402 endpoints, HN builders using it with FastAPI) corroborate real-world settlement usage. missing for 10: independent large-scale audit of settlement finality/reliability, and resolution of the community-flagged 'verify work was done before settling' friction reported by production operators.

   • [claimed-docs] “The CDP Facilitator handles that work as a hosted service: it validates signed payments, screens transactions, submits settlement onchain, a…”
   • [claimed-docs] “Built-in screening. OFAC and Know Your Transaction (KYT) checks identify and decline payments involving sanctioned or high-risk addresses.”
   • [claimed-docs] “Accept ERC-20 tokens on supported EVM networks and SPL tokens on Solana.”
   • [claimed-docs] “Agentic accounts let an AI agent hold funds and act through a Coinbase account or wallet. For an x402 buyer, the account is the source of US…”
   • [claimed-docs] “"x402 is an open standard for adding per-request payments to HTTP, so APIs and services can charge without checkout pages, subscriptions, or…”
   • [claimed-docs] “The hosted CDP Facilitator "validates signed payments, screens transactions, submits settlement onchain, and reports the result to your reso…”
   • [claimed-docs] “Agent wallets: "Agentic accounts let an AI agent hold funds and act through a Coinbase account or wallet. For an x402 buyer, the account is …”
   • [probe] “PROBE runtime (recorded 2026-09-14): the x402 Bazaar discovery index is keyless by design and live — a plain GET to https://api.cdp.coinbase…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the hosted CDP facilitator auth-gates as documented — a keyless GET to https://api.cdp.coinbase.com/pla…”
   • [community] “The protocol is pretty simple. Make a request and get back payment headers. Sign the data, with the proper amounts. The signed transaction i…”
   • [community] “We run 124 x402 endpoints at httpay.xyz and the 'verify work was done' problem is real — especially for compute-heavy tasks like image gener…”

   proof ↗⚑ flag

Wallets

1. ai-native userProvision a wallet my agent holds and spends from — funded and controlled by me, with balance visibility

   weight 3 · round to Coinbase x402
   Shopify Agentic Commerce—none0/10

   Shopify's UCP evidence covers checkout, payment-handler negotiation (e.g., com.google.pay), and AP2 payment mandates/verifiable credentials tied to cart state, but there is no documentation of a user-funded, agent-held wallet construct with balance visibility — payment credentials are collected per-checkout, not provisioned as a standing wallet.

   • [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
   • [claimed-docs] “allows Platforms to provide cryptographically signed payment authorizations that are mathematically tied to the specific state of the cart”
   • [claimed-docs] “"UCP traffic to Shopify's MCP servers is classified into three tiers based on how your agent identifies itself" — Token, Signed, Anonymous —…”

   proof ↗⚑ flag

   Coinbase x402~partialclaimed5/10

   Coinbase's Agentic Accounts docs explicitly describe giving an agent a CDP wallet that holds USDC and pays for x402 services, and note the account is user/organization-controlled via a Coinbase account or wallet — directly matching the 'agent holds/spends' and 'user-controlled' parts of the story. However, there is no documentation describing an explicit funding flow or a balance-visibility dashboard/API for monitoring the agent's wallet spend, which is a core part of the story. missing for 10: explicit funding mechanism for the agent wallet, balance/spend visibility UI or API for the controlling user.

   • [claimed-docs] “Agentic accounts let an AI agent hold funds and act through a Coinbase account or wallet. For an x402 buyer, the account is the source of US…”
   • [claimed-docs] “Agent wallets: "Agentic accounts let an AI agent hold funds and act through a Coinbase account or wallet. For an x402 buyer, the account is …”

   proof ↗⚑ flag

1. ai-native userControl data retention and deletion

   weight 2 · round drawn
   Shopify Agentic Commerce—none0/10

   The evidence pack covers UCP agent profiles, catalog/cart/checkout/order MCP servers, webhooks, and trust tiers, but nowhere describes any mechanism for an AI-native user to control retention or deletion of their data (e.g., profile data, cart history, order records) — no privacy/data-deletion API, retention policy, or opt-out control is documented.

   ⚑ flag

   Coinbase x402—none0/10

   The evidence pack covers payment mechanics, facilitator screening, discovery, and governance, but nothing addresses user-controlled data retention or deletion policies for transaction/KYT data collected by the CDP Facilitator. Given onchain settlement is inherently immutable and off-chain screening data governance is unaddressed, there is no evidence of any retention/deletion controls for AI-native users.

   ⚑ flag

2. ai-native userOpt out of telemetry and usage tracking

   weight 2 · round drawn
   Shopify Agentic Commerce—none0/10

   The evidence pack covers UCP CLI, MCP servers, cart/checkout/order flows, trust tiers, and profile negotiation, but nowhere mentions telemetry collection, usage analytics, or any opt-out mechanism for the CLI or MCP servers. Since CLI/SDK tools commonly report usage telemetry, this axis is a fair question, but no evidence supports or denies it.

   ⚑ flag

   Coinbase x402—none0/10

   No evidence in the pack addresses telemetry or usage-tracking opt-out settings for x402 SDKs, facilitator, or Bazaar; the documentation focuses on payment flows, compliance screening (OFAC/KYT), and discovery, not client-side telemetry controls.

   ⚑ flag

Ecosystem adoption

1. developerAt least two independent parties beyond the vendor implement the protocol or platform — it is an ecosystem, not a private integration

   weight 2 · round to Coinbase x402
   Shopify Agentic Commerce✓fullprobed7/10

   UCP is documented as an industry-governed open standard rather than a Shopify-only integration: ucp.dev's co-developer wall names Google, Etsy, Wayfair, Target, Walmart, Amazon, Microsoft, Meta, Salesforce and Stripe as builders of the spec, with 'The complete technical specification, documentation, and reference implementations are hosted in our public GitHub repository' and versioned releases confirmed live via ucp.dev/llms.txt. Shopify itself ships a conformant implementation (catalog/cart/checkout/order MCP servers, verified live via runtime probes), demonstrating at least one non-founding-spec-author adopting the protocol. Missing for 10: independent, hands-on evidence that another named co-developer (e.g., Etsy, Walmart) has a live production UCP endpoint analogous to Shopify's, rather than just being listed as a spec co-author.

   • [claimed-docs] “ucp.dev positions the protocol as industry-governed rather than single-vendor: "UCP is built by the industry, to enable seamless agentic exp…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the Universal Commerce Protocol spec is published in the open — https://ucp.dev/llms.txt serves the ver…”
   • [probe] “PROBE runtime (recorded 2026-09-14): Shopify's Global Catalog MCP server is live — a keyless JSON-RPC initialize POST to https://catalog.sho…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a Shopify-operated storefront's own UCP endpoint is live — a keyless JSON-RPC initialize POST to https:…”

   proof ↗⚑ flag

   Coinbase x402✓fullcommunity8/10

   x402 was contributed to the vendor-neutral Linux Foundation x402 Foundation, with 40+ member organizations (AWS, American Express, Cloudflare, Google, Mastercard, Shopify, Stripe, Visa, Solana Foundation, etc.) and a named Governing Board/Technical Steering Committee independent of Coinbase, plus independent implementations like httpay.xyz and Apiosk running their own x402 endpoints/gateways. This is clear evidence of multiple independent parties beyond Coinbase implementing and governing the protocol, though community commentary notes Coinbase/US firms still dominate influence. Missing for 10: deeper technical detail on independent (non-Coinbase) facilitator implementations or interoperability testing between competing implementations, and stronger independent audit of the foundation's actual decentralization in practice.

   • [claimed-docs] “Governance: "x402 was originally incubated at Coinbase." — then the "x402 Foundation launched under the Linux Foundation" and "Coinbase comp…”
   • [claimed-docs] “Named governance seats on x402.org: "The x402 Governing Board is responsible for marketing, business oversight, and budget decisions for the…”
   • [community] “The Linux Foundation... today announced it is launching the x402 Foundation with the contribution of the x402 protocol from Coinbase... It s…”
   • [community] “We run 124 x402 endpoints at httpay.xyz and the 'verify work was done' problem is real — especially for compute-heavy tasks like image gener…”
   • [community] “Apiosk approaches it from the server side: a gateway that enforces per-request x402 payments so API providers can monetize without accounts …”
   • [community] “It's worth noting that this protocol is primarily supported by Coinbase today -- You'd be using USDC on the Base network (Layer 2 on top of …”

   proof ↗⚑ flag

Spec publication

1. developerThe commerce protocol this product speaks is published as an open, versioned specification I can read and implement without signing anything

   weight 3 · round drawn
   Shopify Agentic Commerce✓fullprobed8/10

   UCP is documented as an open, industry-governed standard with versioned releases and a public GitHub repository hosting the full spec and reference implementations, and ucp.dev/llms.txt confirms a dated, versioned spec index with no signup gate. Shopify's own docs and runtime probes show keyless, unauthenticated access to core UCP endpoints (catalog search, cart creation) without any signature required to read or implement the protocol. missing for 10: no direct evidence of the actual spec text/license terms confirming implementation rights, and no independent third-party (non-Shopify, non-ucp.dev) confirmation of the openness claim.

   • [claimed-docs] “ucp.dev positions the protocol as industry-governed rather than single-vendor: "UCP is built by the industry, to enable seamless agentic exp…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the Universal Commerce Protocol spec is published in the open — https://ucp.dev/llms.txt serves the ver…”
   • [claimed-docs] “Allows autonomous AI agents to transact on behalf of users with pre-defined, verifiable boundaries.”
   • [probe] “PROBE runtime (recorded 2026-09-14): the documented agent-profile trust gate behaves as specified — a keyless raw tools/call search_catalog …”

   proof ↗⚑ flag

   Coinbase x402✓fullprobed8/10

   x402 is documented as an open, versioned protocol now governed by the vendor-neutral x402 Foundation under the Linux Foundation, with a public spec site (x402.org), published governance/TSC structure, and no signup, API key, or account required to read the spec or implement the handshake (docs, discovery APIs, and npm SDK are all keyless per probes). Community evidence corroborates that it's self-hostable on any chain/token and not gated behind Coinbase agreements, though some skepticism exists about de facto Coinbase influence. Missing for 10: an explicit versioned spec document/changelog (e.g., semver spec repo) directly cited, and stronger independent confirmation that implementers never need to sign any agreement with Coinbase or the Foundation.

   • [claimed-docs] “Governance: "x402 was originally incubated at Coinbase." — then the "x402 Foundation launched under the Linux Foundation" and "Coinbase comp…”
   • [claimed-docs] “Named governance seats on x402.org: "The x402 Governing Board is responsible for marketing, business oversight, and budget decisions for the…”
   • [community] “The Linux Foundation... today announced it is launching the x402 Foundation with the contribution of the x402 protocol from Coinbase... It s…”
   • [community] “It's worth noting that this protocol is primarily supported by Coinbase today -- You'd be using USDC on the Base network (Layer 2 on top of …”
   • [probe] “PROBE runtime (recorded 2026-09-14): the x402 Bazaar discovery index is keyless by design and live — a plain GET to https://api.cdp.coinbase…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the hosted CDP facilitator auth-gates as documented — a keyless GET to https://api.cdp.coinbase.com/pla…”
   • [claimed-docs] “Bazaar discovery is public. You do not need a CDP API key to use the discovery APIs or the corresponding TypeScript SDK functions.”

   proof ↗⚑ flag

Disputes

1. developerDisputes and chargebacks on agent transactions can be handled via API — evidence submission, status, outcomes

   weight 2 · round drawn
   Shopify Agentic Commerce—none0/10

   The evidence pack covers catalog, cart, checkout, order state, and order webhooks (which surface refunds/returns/cancellations), but nowhere mentions a dispute or chargeback API, evidence submission, dispute status tracking, or dispute outcome handling for agent transactions.

   ⚑ flag

   Coinbase x402—none0/10

   No evidence describes a dispute/chargeback API, evidence-submission workflow, or outcome/status tracking; x402 payments settle irreversibly onchain via the Facilitator, and community comments even flag 'verify work was done' as an unresolved trust problem with no built-in resolution mechanism. Missing for 10: any dispute-filing API, evidence submission, adjudication process, or chargeback/refund status endpoint.

   • [community] “We run 124 x402 endpoints at httpay.xyz and the 'verify work was done' problem is real — especially for compute-heavy tasks like image gener…”
   • [claimed-docs] “The hosted CDP Facilitator "validates signed payments, screens transactions, submits settlement onchain, and reports the result to your reso…”
   • [claimed-docs] “The batch-settlement scheme targets high-frequency agent loops: "Batch settlement lets agents perform thousands of granular interactions whi…”

   proof ↗⚑ flag

Refunds

1. developerRefunds on agent-placed orders can be initiated and tracked programmatically

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce~partialclaimed4/10

   Refunds are only surfaced as read/notification events — order webhooks fire on committed changes including refunds, and get_order can be polled to see post-purchase adjustments — but there is no documented API/tool for a developer to programmatically initiate a refund on an agent-placed order; webhook subscription itself is not self-serve ('contact your Shopify partner manager'). missing for 10: an actual refund-initiation endpoint/tool (create_refund or equivalent), self-serve webhook subscription for refund events, and any tracking dashboard/status API dedicated to refund lifecycle beyond generic order state.

   • [claimed-docs] “"Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (fu…”
   • [claimed-docs] “"The Order MCP server enables AI agents to fetch the current state of an order placed through their agent, including line items, fulfillment…”
   • [claimed-docs] “Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (ful…”
   • [claimed-docs] “enables AI agents to fetch the current state of an order placed through their agent, including line items, fulfillment events, and post-purc…”

   proof ↗⚑ flag

   Coinbase x402~partialclaimed3/10

   The only refund-relevant evidence is a single line about the batch-settlement scheme stating that 'buyers retain defined refund and withdrawal semantics,' but this is not elaborated into an actual API, dashboard, or programmatic tracking mechanism, and no other docs address refunds/disputes for standard (non-batch) x402 payments. missing for 10: a documented refund API or endpoint, dispute-resolution workflow, refund status tracking, and coverage for non-batch payment flows.

   • [claimed-docs] “The batch-settlement scheme targets high-frequency agent loops: "Batch settlement lets agents perform thousands of granular interactions whi…”

   proof ↗⚑ flag

Agent identity

1. merchantAgents identify themselves verifiably — registered profiles, signatures, or trust tiers — so I can tell trusted agent traffic from anonymous bots

   weight 3 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce✓fullprobed9/10

   Shopify's UCP documents a concrete three-tier trust model (Token, Signed, Anonymous) tied to agent identity, with Signed-tier requiring RFC 9421 ECDSA P-256 signature verification against a published public key in the agent's UCP profile, and access/rate-limits scaling with identification strength; a live probe confirms the trust gate actually enforces this (invalid_profile_url error when no hosted profile is presented). This gives merchants a verifiable way to distinguish anonymous vs. cryptographically-signed vs. token-authenticated agent traffic. missing for 10: no independent/third-party audit of the signature verification in production merchant traffic, and no merchant-facing dashboard/reporting evidence showing how tier data is surfaced to merchants themselves.

   • [claimed-docs] “"UCP traffic to Shopify's MCP servers is classified into three tiers based on how your agent identifies itself" — Token, Signed, Anonymous —…”
   • [claimed-docs] “In UCP, "a platform profile is a JSON document that describes the protocol version and capabilities the platform supports"; the business sid…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the documented agent-profile trust gate behaves as specified — a keyless raw tools/call search_catalog …”
   • [claimed-docs] “Shopify uses your profile to learn what your agent declares, intersect it with what the shop supports, and settle on a single negotiated set…”
   • [claimed-docs] “Negotiation is server-selects. The business computes the intersection of its capabilities with the platform's and chooses the active set”

   proof ↗⚑ flag

   Coinbase x402—none0/10

   x402 verifies and screens the *payment* (signed payment proof, OFAC/KYT checks on wallet addresses) but has no mechanism for merchants to identify or tier *agents* themselves — no registered agent profiles, agent-level signatures/identity credentials, or trust tiers are described; the protocol is explicitly designed for signup-free, pseudonymous access ('No signups or approvals required'), the opposite of verifiable agent identity.

   • [claimed-docs] “AI agent pays instantly with stablecoins No signups or approvals required”
   • [claimed-docs] “The hosted CDP Facilitator "validates signed payments, screens transactions, submits settlement onchain, and reports the result to your reso…”
   • [claimed-docs] “Built-in screening. OFAC and Know Your Transaction (KYT) checks identify and decline payments involving sanctioned or high-risk addresses.”

   proof ↗⚑ flag

Human oversight

1. ai-native userSensitive agent spending requires my documented approval — a confirmation step, signed mandate, or per-purchase consent — before money moves

   weight 3 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce~partialclaimed6/10

   Shopify's UCP checkout flow documents explicit pre-purchase gates: complete_checkout must only be called once 'Checkout status is ready_for_complete', the 'Buyer has reviewed and confirmed the order', and the 'Payment credential has been collected', and unresolved cases force a hand-off to the buyer via continue_url (requires_escalation/requires_buyer_review). AP2 integration adds 'cryptographically signed payment authorizations that are mathematically tied to the specific state of the cart', which maps to a signed-mandate model, and trust tiers restrict complete_checkout to Token-tier agents with explicit purchase permission. However, the docs also note 'Trusted agents can complete checkouts directly,' implying some agents can skip buyer-facing confirmation, and enforcement of the 'buyer reviewed' precondition appears to rely on agent self-attestation rather than a Shopify-verified user signature captured at time of purchase. Missing for 10: independent/third-party confirmation that buyer consent is cryptographically captured (not just agent-declared) and clarity on exactly which agents qualify as 'trusted' to bypass buyer review.

   • [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
   • [claimed-docs] “Buyer handoff is a first-class state: "Build for escalations regardless of how you authenticate." A checkout in requires_escalation means "C…”
   • [claimed-docs] “"UCP traffic to Shopify's MCP servers is classified into three tiers based on how your agent identifies itself" — Token, Signed, Anonymous —…”
   • [claimed-docs] “allows Platforms to provide cryptographically signed payment authorizations that are mathematically tied to the specific state of the cart”
   • [claimed-docs] “ucp.dev positions the protocol as industry-governed rather than single-vendor: "UCP is built by the industry, to enable seamless agentic exp…”

   proof ↗⚑ flag

   Coinbase x402—none0/10

   x402's own documentation frames the protocol as removing friction rather than adding human oversight — 'AI agent pays instantly with stablecoins, No signups or approvals required' (docs-17) — and the signing step in the handshake is the agent's wallet cryptographically authorizing payment (supp-1, comm-7), not a documented user-facing confirmation, mandate, or per-purchase consent screen. Compliance checks (OFAC/KYT) screen counterparties for sanctions risk, not spending authorization by the user, so there is no evidence of the confirmation/consent mechanism the story requires.

   • [claimed-docs] “AI agent pays instantly with stablecoins No signups or approvals required”
   • [claimed-docs] “"x402 is an open standard for adding per-request payments to HTTP, so APIs and services can charge without checkout pages, subscriptions, or…”
   • [community] “The protocol is pretty simple. Make a request and get back payment headers. Sign the data, with the proper amounts. The signed transaction i…”
   • [claimed-docs] “Built-in screening. OFAC and Know Your Transaction (KYT) checks identify and decline payments involving sanctioned or high-risk addresses.”

   proof ↗⚑ flag

Liability

1. merchantThe fraud, liability, and chargeback rules for agent-initiated transactions are documented so I know who bears the risk

   weight 2 · round drawn
   Shopify Agentic Commerce—none0/10

   The evidence pack documents UCP's protocol mechanics (catalog, cart, checkout, order webhooks, trust tiers, profile negotiation) but nowhere specifies fraud liability, chargeback responsibility, or dispute-resolution rules for agent-initiated purchases. The only tangential mention is UCP's general 'Merchant of Record' framing on ucp.dev, which addresses customer-relationship ownership, not who bears fraud/chargeback risk in an agent transaction — no Shopify-specific policy, contract terms, or dispute process is documented.

   • [claimed-docs] “ucp.dev positions the protocol as industry-governed rather than single-vendor: "UCP is built by the industry, to enable seamless agentic exp…”

   proof ↗⚑ flag

   Coinbase x402—none0/10

   Evidence covers OFAC/KYT screening for sanctioned addresses and onchain settlement finality, but nowhere documents fraud liability allocation, chargeback rules, or who bears risk for disputed/unauthorized agent-initiated transactions. Community comments even flag unresolved 'verify work was done' and settlement trust problems, but no merchant-facing liability/dispute-resolution policy is cited.

   • [claimed-docs] “Built-in screening. OFAC and Know Your Transaction (KYT) checks identify and decline payments involving sanctioned or high-risk addresses.”
   • [community] “We run 124 x402 endpoints at httpay.xyz and the 'verify work was done' problem is real — especially for compute-heavy tasks like image gener…”

   proof ↗⚑ flag

Spend controls

1. ai-native userSet per-agent spend caps and usage limits and revoke an agent's payment authority instantly

   weight 2 · round to Coinbase x402
   Shopify Agentic Commerce—none0/10

   The evidence describes trust tiers, rate limiting, token TTLs, and JWT scopes, but nowhere documents per-agent spend caps, usage limits, or an instant revoke-payment-authority mechanism — tokens simply expire after 60 minutes rather than being explicitly revocable on demand, and no dollar-limit or usage-cap controls are mentioned anywhere in the pack.

   ⚑ flag

   Coinbase x402~partialcommunity3/10

   x402 documents per-transaction spend limits via the 'upto' authorize-and-settle scheme and batch-settlement's cryptographically signed voucher limits/escrow, and agentic accounts let an agent hold a funding source — but there is no documented mechanism to set a persistent per-agent spend cap/usage quota across sessions or to instantly revoke an agent's payment authority; a community commenter even suggests pairing x402 with a third-party 'budget SDK' for spending ceilings, implying it's not native. missing for 10: native per-agent spend-cap configuration, usage-limit dashboards, and an instant revocation/kill-switch mechanism for agent payment authority.

   • [claimed-docs] “Agentic accounts let an AI agent hold funds and act through a Coinbase account or wallet. For an x402 buyer, the account is the source of US…”
   • [claimed-docs] “Agent wallets: "Agentic accounts let an AI agent hold funds and act through a Coinbase account or wallet. For an x402 buyer, the account is …”
   • [claimed-docs] “The batch-settlement scheme targets high-frequency agent loops: "Batch settlement lets agents perform thousands of granular interactions whi…”
   • [community] “Apiosk approaches it from the server side: a gateway that enforces per-request x402 payments so API providers can monetize without accounts …”

   proof ↗⚑ flag