Shopify Agentic Commerce vs Crossmint

Cart

1. ai-native userMy agent can create and update a cart or order draft through a documented protocol call

   weight 3 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce✓fullprobed9/10

   Cart MCP and Checkout MCP are documented UCP protocol calls (create_cart, update_cart, create_checkout, complete_checkout) with JSON-RPC schemas, and a runtime probe confirms a real cart was created keylessly against a live Shopify store via the CLI/protocol. missing for 10: no independent (non-Shopify) hands-on corroboration of a full end-to-end checkout completion.

   • [claimed-docs] “"Cart tools accept unauthenticated requests, which lets you estimate totals and share a cart with the buyer before collecting credentials" —…”
   • [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”
   • [claimed-docs] “The Cart MCP server enables AI agents to build and iterate on a cart before the buyer commits to purchase. When the buyer is ready to buy, c…”
   • [claimed-docs] “The Checkout MCP server enables AI agents to create and manage checkout sessions, convert carts into checkouts, and refer buyers to the merc…”

   proof ↗⚑ flag

   Crossmint✓fullprobed8/10

   Crossmint's Agent Checkouts API is a documented protocol call that lets an agent submit a product URL and spending cap to create an order/checkout, and runtime probing confirms the endpoint is live and agent-scoped (requiring ServerKeyAgent auth). The lifecycle supports polling for status updates, which functions as order-draft state updates, and agent cards similarly document order-intent creation/tracking (total, reserved, spent, available). missing for 10: no explicit 'update cart' verb or partial-order-edit API, no OpenAPI/schema confirmation (openapi.json probes 404), and no independent third-party corroboration beyond first-party docs and the vendor's own runtime probe.

   • [claimed-docs] “Let your agent buy from any merchant with a single API.”
   • [claimed-docs] “Merchant coverage is URL-universal: "Let your agent buy from any merchant with a single API." — hand it "a product URL and a spending cap, a…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the Agent Checkouts endpoint is live and agent-scoped — a keyless POST to https://www.crossmint.com/api…”
   • [claimed-docs] “"An agent card is an order intent that gives an agent a bounded amount to spend before a fixed expiration." Merchant locking: "The merchant …”
   • [claimed-docs] “Scoped card spending: "An order intent gives the agent a fixed allowance with an amount, description, and expiration, enforced through Visa …”

   proof ↗⚑ flag

Checkout

1. ai-native userMy agent can complete a purchase end-to-end — checkout session, delegated payment credential, confirmed order

   weight 3 · round to Crossmint
   Shopify Agentic Commerce~partialprobed7/10

   Docs describe a full documented path — create_checkout, payment_handlers (e.g. com.google.pay) negotiation, complete_checkout requiring a collected payment credential, and order confirmation via get_order/order webhooks — and even name complete_checkout as Token-tier gated 'when the token is granted permission to complete purchases.' However, the default flow explicitly hands off to the buyer's browser for payment ('Build carts, convert them to checkouts, and hand off to the merchant for payment') and the only hands-on runtime probe reached cart creation only, explicitly stopping 'no checkout, no payment.' Missing for 10: an independent/hands-on trace of an actual complete_checkout call with a delegated payment credential and a resulting confirmed order, and clarity on how broadly (vs. only select trusted agents) autonomous payment completion is actually granted.

   • [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
   • [claimed-docs] “Buyer handoff is a first-class state: "Build for escalations regardless of how you authenticate." A checkout in requires_escalation means "C…”
   • [claimed-docs] “"UCP traffic to Shopify's MCP servers is classified into three tiers based on how your agent identifies itself" — Token, Signed, Anonymous —…”
   • [claimed-docs] “"The Order MCP server enables AI agents to fetch the current state of an order placed through their agent, including line items, fulfillment…”
   • [claimed-docs] “"Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (fu…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”

   proof ↗⚑ flag

   Crossmint✓fullprobed8/10

   Crossmint's Agent Checkouts API lets an agent be handed a product URL and spending cap and complete checkout on the user's behalf, with delegated payment credentials (agent cards/order intents or delegated wallet signer permissions) and a poll-driven order lifecycle to confirm terminal state; runtime probe confirms the endpoint is live and enforces agent-scoped auth. missing for 10: independent/third-party confirmation of a fully completed order in production (docs note no staging/test environment and no webhooks in v1, so end-to-end success is self-reported), and no public case study of a real merchant purchase completing.

   • [claimed-docs] “Let your agent buy from any merchant with a single API.”
   • [claimed-docs] “Merchant coverage is URL-universal: "Let your agent buy from any merchant with a single API." — hand it "a product URL and a spending cap, a…”
   • [claimed-docs] “"An agent card is an order intent that gives an agent a bounded amount to spend before a fixed expiration." Merchant locking: "The merchant …”
   • [claimed-docs] “Agent wallets are user-owned with onchain-enforced delegation: "The user owns a non-custodial wallet and grants the agent scoped permissions…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the Agent Checkouts endpoint is live and agent-scoped — a keyless POST to https://www.crossmint.com/api…”

   proof ↗⚑ flag

Embedded surfaces

1. merchantBuyers can complete purchases of my products inside chat and assistant surfaces (ChatGPT, Claude, Gemini, Copilot and peers)

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce~partialprobed6/10

   Shopify ships a real, live UCP checkout stack — Catalog, Cart, and Checkout MCP servers with a documented complete_checkout tool that can 'submit payment and place the order' for Token-tier trusted agents, backed by a runtime-verified cart creation and marketing claiming buyers 'check out right in the chat' — and UCP itself is co-developed with Google, Microsoft, OpenAI-adjacent ecosystem players. However, the docs make buyer handoff/escalation a first-class, common path ('hand off to the buyer via continue_url', 'Build for escalations regardless of how you authenticate'), meaning many purchases route the buyer out to the merchant's own checkout page rather than completing fully inside the chat UI, and named surfaces beyond Claude (only a Claude plugin is documented) — ChatGPT, Gemini, Copilot — have no confirmed live integration in the evidence. Missing for 10: confirmed named integrations with ChatGPT/Gemini/Copilot, evidence that in-chat completion (not handoff) is the norm rather than the exception, and independent buyer-side confirmation of an end-to-end in-chat purchase.

   • [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
   • [claimed-docs] “Buyer handoff is a first-class state: "Build for escalations regardless of how you authenticate." A checkout in requires_escalation means "C…”
   • [claimed-docs] “"UCP traffic to Shopify's MCP servers is classified into three tiers based on how your agent identifies itself" — Token, Signed, Anonymous —…”
   • [claimed-docs] “Get discovered across AI channels. Shoppers check out right in the chat.”
   • [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”
   • [claimed-docs] “ucp.dev positions the protocol as industry-governed rather than single-vendor: "UCP is built by the industry, to enable seamless agentic exp…”

   proof ↗⚑ flag

   Crossmint~partialclaimed3/10

   Crossmint documents generic agent-payment infrastructure (Agent Cards, Agent Wallets, Agent Checkouts) that lets any AI agent buy from merchants via API, which could theoretically be wired into chat surfaces, but there is no evidence of concrete integration or partnership with ChatGPT, Claude, Gemini, Copilot or similar assistant surfaces. Missing for 10: named integrations/plugins with specific chat/assistant platforms, evidence of buyers actually completing purchases inside those surfaces, and any merchant-facing onboarding flow tied to those platforms.

   • [claimed-docs] “Let your agent buy from any merchant with a single API.”
   • [claimed-docs] “Crossmint's agent stack is three composable products, verbatim: Agent Cards — "a card for your agent to pay with, secured by Visa VIC and Ma…”
   • [claimed-docs] “Merchant coverage is URL-universal: "Let your agent buy from any merchant with a single API." — hand it "a product URL and a spending cap, a…”

   proof ↗⚑ flag

Protocol conformance

1. developerBuild against a versioned commerce protocol with a published schema and conformance or validation tooling

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce✓fullprobed7/10

   UCP is documented as a versioned protocol (dated releases like 2026-08-25, 2026-04-08) with a publicly hosted spec and reference implementations on GitHub, and Shopify's MCP servers enforce schema/profile validation at runtime (e.g. `--input-schema` to fetch a merchant's live input schema, and a probed `invalid_profile_url` error when an agent lacks a valid hosted profile), plus an AI Toolkit that validates GraphQL/Liquid/Extensions against Shopify schemas. Missing for 10: an explicit standalone conformance test suite or certification program for third-party UCP implementations, and independent (non-Shopify) corroboration of schema stability across versions.

   • [claimed-docs] “In UCP, "a platform profile is a JSON document that describes the protocol version and capabilities the platform supports"; the business sid…”
   • [claimed-docs] “"The Storefront Catalog MCP server enables AI agents to search and discover products from a single merchant's catalog, helping buyers find a…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the documented agent-profile trust gate behaves as specified — a keyless raw tools/call search_catalog …”
   • [claimed-docs] “ucp.dev positions the protocol as industry-governed rather than single-vendor: "UCP is built by the industry, to enable seamless agentic exp…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the Universal Commerce Protocol spec is published in the open — https://ucp.dev/llms.txt serves the ver…”
   • [claimed-docs] “validate GraphQL queries, Liquid templates, and Shopify Extensions against Shopify schemas to catch issues earlier”

   proof ↗⚑ flag

   Crossmint—none0/10

   Crossmint documents payment flows (x402, MPP, agent checkouts) but there is no evidence of a versioned commerce protocol with a published schema or conformance/validation tooling — probes for OpenAPI/swagger specs all 404'd, and the live agent-checkouts endpoint is explicitly path-versioned as '/api/unstable/', signaling the opposite of a stable published protocol.

   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.crossmint.com/openapi.json, https://docs.crossmint.com/swagger.json, https://docs.cross…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the Agent Checkouts endpoint is live and agent-scoped — a keyless POST to https://www.crossmint.com/api…”
   • [claimed-docs] “Merchant coverage is URL-universal: "Let your agent buy from any merchant with a single API." — hand it "a product URL and a spending cap, a…”

   proof ↗⚑ flag

Agent search

1. ai-native userMy agent can programmatically search products or services across merchants — keylessly or with self-service credentials, no private partnership required

   weight 3 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce✓fullprobed8/10

   Shopify's Global Catalog MCP server explicitly supports keyless, self-service cross-merchant product search ('search and discover products across the entire Shopify ecosystem... from multiple merchants'), requiring only a self-hosted UCP agent profile URL rather than a private partnership — confirmed by a live runtime probe showing a full keyless JSON-RPC handshake and catalog search against catalog.shopify.com/api/ucp/mcp, and another probe showing the profile-gate behaves as documented (self-service profile, not vendor approval). Storefront-level search is similarly self-service per-merchant. Missing for 10: independent (non-Shopify) developer corroboration of onboarding friction, and confirmation that profile creation itself has no gatekeeping/approval step.

   • [claimed-docs] “"The Global Catalog MCP server enables AI agents to search and discover products across the entire Shopify ecosystem, helping buyers find pr…”
   • [probe] “PROBE runtime (recorded 2026-09-14): Shopify's Global Catalog MCP server is live — a keyless JSON-RPC initialize POST to https://catalog.sho…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the documented agent-profile trust gate behaves as specified — a keyless raw tools/call search_catalog …”
   • [claimed-docs] “In UCP, "a platform profile is a JSON document that describes the protocol version and capabilities the platform supports"; the business sid…”
   • [claimed-docs] “"The Storefront Catalog MCP server enables AI agents to search and discover products from a single merchant's catalog, helping buyers find a…”

   proof ↗⚑ flag

   Crossmint—none0/10

   Crossmint's agent products (Agent Cards, Agent Wallets, Agent Checkouts) are all payment/execution infrastructure that require the agent to already have a specific product URL or merchant endpoint — 'hand it a product URL and a spending cap' — none of the evidence describes a search or product-discovery API across merchants. There is no documented catalog search, product query, or merchant-discovery endpoint; discovery is assumed to happen elsewhere before Crossmint is invoked.

   • [claimed-docs] “Merchant coverage is URL-universal: "Let your agent buy from any merchant with a single API." — hand it "a product URL and a spending cap, a…”
   • [claimed-docs] “Let your agent buy from any merchant with a single API.”
   • [claimed-docs] “Crossmint's agent stack is three composable products, verbatim: Agent Cards — "a card for your agent to pay with, secured by Visa VIC and Ma…”

   proof ↗⚑ flag

Machine readable offers

1. developerRead machine-readable offer data — price, availability, variants, checkout links — for any listed product or service

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce✓fullprobed9/10

   Shopify's Catalog MCP servers (global and storefront) expose structured, machine-readable product data — price (minor units), availability, variants, media, checkout links (continue_url) — verified live via runtime probes (get_product, search_catalog, cart continue_url), and Cart/Checkout MCP further surface checkout links and negotiated payment handlers. Missing for 10: no independent third-party benchmark of data completeness/accuracy across many merchants beyond Shopify's own demo store.

   • [claimed-docs] “"The Global Catalog MCP server enables AI agents to search and discover products across the entire Shopify ecosystem, helping buyers find pr…”
   • [claimed-docs] “"The Storefront Catalog MCP server enables AI agents to search and discover products from a single merchant's catalog, helping buyers find a…”
   • [claimed-docs] “"Cart tools accept unauthenticated requests, which lets you estimate totals and share a cart with the buyer before collecting credentials" —…”
   • [probe] “PROBE runtime (recorded 2026-09-14): Shopify's Global Catalog MCP server is live — a keyless JSON-RPC initialize POST to https://catalog.sho…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a Shopify-operated storefront's own UCP endpoint is live — a keyless JSON-RPC initialize POST to https:…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”

   proof ↗⚑ flag

   Crossmint—none0/10

   Crossmint's docs describe agent checkout as handing it a merchant product URL and letting Crossmint execute the purchase, but nowhere is there evidence that Crossmint itself exposes machine-readable offer data (price, availability, variants, checkout links) for developers to read — it's a payment/checkout executor, not a product-data or listing API. Missing for 10: any API/schema returning structured product price/availability/variant data, any catalog or listing endpoint, any documentation of reading offer metadata rather than just completing a purchase given a URL.

   • [claimed-docs] “Merchant coverage is URL-universal: "Let your agent buy from any merchant with a single API." — hand it "a product URL and a spending cap, a…”
   • [claimed-docs] “Let your agent buy from any merchant with a single API.”

   proof ↗⚑ flag

Service discovery

1. ai-native userMy agent can discover payable services and APIs through a published directory or discovery index

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce✓fullprobed8/10

   Shopify publishes UCP-compliant Global Catalog and Storefront Catalog MCP servers that agents can discover payable services/products through, with documented endpoints, tool schemas, and profile-based discovery negotiation, corroborated by live runtime probes showing real handshakes and search/cart flows against catalog.shopify.com and a merchant storefront. The broader UCP spec is also openly published (ucp.dev) as an industry discovery standard. Missing for 10: a single canonical top-level directory/index listing all payable services across merchants (discovery is per-server/per-merchant plus a global catalog, not one unified public index), and independent (non-Shopify) confirmation of third-party agent adoption discovering via this index.

   • [claimed-docs] “enables AI agents to search and discover products across the entire Shopify ecosystem, helping buyers find products from multiple merchants”
   • [claimed-docs] “enables AI agents to search and discover products from a single merchant's catalog, helping buyers find and purchase products from that stor…”
   • [claimed-docs] “"The Global Catalog MCP server enables AI agents to search and discover products across the entire Shopify ecosystem, helping buyers find pr…”
   • [claimed-docs] “"The Storefront Catalog MCP server enables AI agents to search and discover products from a single merchant's catalog, helping buyers find a…”
   • [claimed-docs] “In UCP, "a platform profile is a JSON document that describes the protocol version and capabilities the platform supports"; the business sid…”
   • [probe] “PROBE runtime (recorded 2026-09-14): Shopify's Global Catalog MCP server is live — a keyless JSON-RPC initialize POST to https://catalog.sho…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a Shopify-operated storefront's own UCP endpoint is live — a keyless JSON-RPC initialize POST to https:…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the documented agent-profile trust gate behaves as specified — a keyless raw tools/call search_catalog …”
   • [claimed-docs] “ucp.dev positions the protocol as industry-governed rather than single-vendor: "UCP is built by the industry, to enable seamless agentic exp…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the Universal Commerce Protocol spec is published in the open — https://ucp.dev/llms.txt serves the ver…”

   proof ↗⚑ flag

   Crossmint—none0/10

   The evidence covers Crossmint's payment rails (cards, wallets, x402, MPP, checkouts) but nothing describes a published directory or discovery index of payable services/APIs that an agent could browse or query; llms.txt is a docs-crawling aid, not a service discovery index. This is a fair axis for an agent-payments platform, but no capability is evidenced.

   ⚑ flag

Agent access

1. ai-native userPoint an agent at llms.txt or agent-oriented docs

   weight 2 · round to Crossmint
   Shopify Agentic Commerce~partialprobed7/10

   Shopify does not host its own llms.txt (shopify.dev/llms.txt returns 404), but it provides extensive agent-oriented documentation reachable via .md suffixed URLs (e.g. shopify.dev/docs/agents.md returns 200 with structured content) covering catalog, cart, checkout, orders, and profiles — exactly the kind of agent-consumable docs the story asks for. The related UCP spec (ucp.dev/llms.txt) does serve a proper llms.txt index, showing the ecosystem partially satisfies this pattern even though Shopify's own domain doesn't. Missing for 10: a working llms.txt directly at shopify.dev, and independent (non-Shopify) confirmation that agents reliably parse these .md docs as intended.

   • [probe] “PROBE llms.txt: HTTP 404 at https://shopify.dev/llms.txt”
   • [probe] “PROBE docs-md: HTTP 200 at https://shopify.dev/docs/agents.md --- title: Agentic commerce description: >- Build AI agents that authenticat…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the Universal Commerce Protocol spec is published in the open — https://ucp.dev/llms.txt serves the ver…”
   • [claimed-docs] “Initialize a local UCP profile.”
   • [claimed-docs] “This quickstart runs the full agentic commerce flow with the UCP CLI, from product discovery to order tracking, in about five minutes.”

   proof ↗⚑ flag

   Crossmint✓fullprobed9/10

   Crossmint serves a live llms.txt (confirmed by direct probe returning HTTP 200 with agent-oriented content) and every docs page is also available as markdown via the same URL + .md suffix, directly matching the story of pointing an agent at llms.txt or agent-oriented docs. Missing for 10: no independent third-party report of an agent successfully consuming these docs end-to-end, and no OpenAPI spec (all candidates 404) to complement the llms.txt for structured agent consumption.

   • [probe] “PROBE llms.txt: HTTP 200 at https://docs.crossmint.com/llms.txt # Crossmint > Crossmint is a blockchain infrastructure platform for develop…”
   • [probe] “PROBE runtime (recorded 2026-09-14): docs.crossmint.com serves llms.txt keylessly — '# Crossmint... checkout for onchain and physical-world …”
   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.crossmint.com/openapi.json, https://docs.crossmint.com/swagger.json, https://docs.cross…”

   proof ↗⚑ flag

2. ai-native userRun the product headlessly / in CI for automation

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce✓fullprobed8/10

   The UCP CLI is explicitly designed as a scriptable, headless tool with structured commands (search, cart, checkout, order tracking) usable via npm install and local profile init, and probes confirm real keyless CLI runs against live endpoints (catalog search, cart creation) succeeding non-interactively — consistent with CI/automation use. missing for 10: no explicit CI pipeline example (e.g., GitHub Actions), no documented exit codes/machine-readable output format guarantees, and no independent third-party report of running it in a CI environment.

   • [claimed-docs] “Initialize a local UCP profile.”
   • [claimed-docs] “This quickstart runs the full agentic commerce flow with the UCP CLI, from product discovery to order tracking, in about five minutes.”
   • [claimed-docs] “The CLI uses a local profile to identify your agent on every merchant-scoped request. Initialize it once and the CLI reuses it for every ope…”
   • [claimed-docs] “Shopify's agent surface is UCP end to end via "Shopify's UCP-compliant MCP servers": the UCP CLI "provides structured commands to search the…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the documented agent-profile trust gate behaves as specified — a keyless raw tools/call search_catalog …”
   • [probe] “official CLI documented at https://shopify.dev/docs/agents/get-started/quickstart”

   proof ↗⚑ flag

   Crossmint~partialprobed6/10

   Crossmint's core products are REST/headless APIs (explicit 'headless checkout API', agent checkouts API, wallet API) designed for programmatic, UI-less automation, and probes confirm keyless API-key-based auth suitable for scripted/CI calls. However there is no explicit documentation of CI pipeline usage, SDK examples for automated test suites, or non-interactive auth setup, and agent-checkouts testing is noted as production-only with no staging environment, complicating CI use. Missing for 10: documented CI/automation examples, staging/sandbox support for safe automated testing, and explicit non-interactive credential provisioning guidance.

   • [claimed-docs] “Crossmint's headless checkout API is a set of REST APIs that allow you to integrate credit card and cross-chain crypto payments inside your …”
   • [claimed-docs] “Let your agent buy from any merchant with a single API.”
   • [claimed-docs] “Merchant coverage is URL-universal: "Let your agent buy from any merchant with a single API." — hand it "a product URL and a spending cap, a…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the Agent Checkouts endpoint is live and agent-scoped — a keyless POST to https://www.crossmint.com/api…”
   • [claimed-docs] “Crossmint offers secure, programmable smart wallet infrastructure through a single API that is configurable for any use case”

   proof ↗⚑ flag

3. ai-native userDrive the product through a documented public API

   weight 3 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce✓fullprobed9/10

   Shopify documents and exposes a full public, documented agent-facing API surface (UCP CLI + MCP servers for Catalog, Cart, Checkout, Order) with schemas, auth tiers, negotiation, webhooks, and runtime probes confirming live handshakes, keyless catalog search, and real cart creation — clearly enabling an AI-native user to drive the product programmatically. Missing for 10: no publicly documented OpenAPI/REST spec found (404s on openapi.json/llms.txt) and no independent third-party developer report beyond Shopify's own docs/probes.

   • [claimed-docs] “the CLI provides structured commands to search the Catalog, build carts, create checkouts, hand off buyers, and track orders”
   • [claimed-docs] “Shopify's agent surface is UCP end to end via "Shopify's UCP-compliant MCP servers": the UCP CLI "provides structured commands to search the…”
   • [claimed-docs] “"The Global Catalog MCP server enables AI agents to search and discover products across the entire Shopify ecosystem, helping buyers find pr…”
   • [claimed-docs] “"Cart tools accept unauthenticated requests, which lets you estimate totals and share a cart with the buyer before collecting credentials" —…”
   • [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
   • [claimed-docs] “"The Order MCP server enables AI agents to fetch the current state of an order placed through their agent, including line items, fulfillment…”
   • [claimed-docs] “"Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (fu…”
   • [claimed-docs] “In UCP, "a platform profile is a JSON document that describes the protocol version and capabilities the platform supports"; the business sid…”
   • [probe] “PROBE runtime (recorded 2026-09-14): Shopify's Global Catalog MCP server is live — a keyless JSON-RPC initialize POST to https://catalog.sho…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the documented agent-profile trust gate behaves as specified — a keyless raw tools/call search_catalog …”

   proof ↗⚑ flag

   Crossmint✓fullprobed8/10

   Crossmint exposes a documented REST API surface (wallets, agent cards, agent checkouts, payment flows) with quickstarts and runtime probes confirming the endpoints are live and API-key/agent-key authenticated, and llms.txt/markdown docs are served for machine consumption. The main gap is the absence of a discoverable formal OpenAPI/Swagger spec (probe-2 shows all standard OpenAPI paths 404), so full machine-readable API introspection isn't confirmed. Missing for 10: a published OpenAPI/Swagger schema, independent third-party confirmation of API robustness beyond Crossmint's own docs.

   • [claimed-docs] “Crossmint offers secure, programmable smart wallet infrastructure through a single API that is configurable for any use case”
   • [claimed-docs] “Let your agent buy from any merchant with a single API.”
   • [probe] “PROBE llms.txt: HTTP 200 at https://docs.crossmint.com/llms.txt # Crossmint > Crossmint is a blockchain infrastructure platform for develop…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.crossmint.com/openapi.json, https://docs.crossmint.com/swagger.json, https://docs.cross…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the Agent Checkouts endpoint is live and agent-scoped — a keyless POST to https://www.crossmint.com/api…”
   • [probe] “PROBE runtime (recorded 2026-09-14): docs.crossmint.com serves llms.txt keylessly — '# Crossmint... checkout for onchain and physical-world …”
   • [claimed-docs] “Crossmint's agent stack is three composable products, verbatim: Agent Cards — "a card for your agent to pay with, secured by Visa VIC and Ma…”

   proof ↗⚑ flag

4. ai-native userIssue scoped/least-privilege API credentials for an agent

   weight 2 · round drawn
   Shopify Agentic Commerce✓fullprobed7/10

   Shopify's UCP documents concrete least-privilege mechanics: three trust tiers (Anonymous/Signed/Token) that gate which tools and rate limits an agent gets, a specific scope (read_global_api_orders) required for Order MCP, short-lived (60-minute TTL) JWTs minted from Dev Dashboard client credentials, and checkout completion gated on the token being 'granted permission to complete purchases.' A runtime probe confirms the profile/identity gate rejects unauthenticated calls (invalid_profile_url), corroborating the scoped-access model works as documented. Missing for 10: a full catalog of all available scopes/permissions beyond the few named, self-service credential/scope management UI, explicit revocation workflow, and independent third-party verification of least-privilege enforcement in production.

   • [claimed-docs] “"UCP traffic to Shopify's MCP servers is classified into three tiers based on how your agent identifies itself" — Token, Signed, Anonymous —…”
   • [claimed-docs] “"The Order MCP server enables AI agents to fetch the current state of an order placed through their agent, including line items, fulfillment…”
   • [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the documented agent-profile trust gate behaves as specified — a keyless raw tools/call search_catalog …”

   proof ↗⚑ flag

   Crossmint✓fullprobed7/10

   Crossmint documents explicit least-privilege delegation for agents: user-owned wallets grant an agent a bound signer key with a spend cap, allowed counterparties, and a time window, all enforced onchain and revocable at any time; agent cards similarly use order-intent 'fixed allowance' credentials with amount/expiration limits and network-level enforcement. A runtime probe further shows an agent-specific credential type (ServerKeyAgent) is live on the Agent Checkouts API, confirming agent-scoped API keys exist in practice, not just in docs. Missing for 10: independent/third-party corroboration of these scoping guarantees, and clearer documentation of general-purpose (non-payment) API key scoping/role management beyond the wallet/card/checkout domain.

   • [claimed-docs] “Agent wallets are user-owned with onchain-enforced delegation: "The user owns a non-custodial wallet and grants the agent scoped permissions…”
   • [claimed-docs] “Scoped card spending: "An order intent gives the agent a fixed allowance with an amount, description, and expiration, enforced through Visa …”
   • [claimed-docs] “"An agent card is an order intent that gives an agent a bounded amount to spend before a fixed expiration." Merchant locking: "The merchant …”
   • [probe] “PROBE runtime (recorded 2026-09-14): the Agent Checkouts endpoint is live and agent-scoped — a keyless POST to https://www.crossmint.com/api…”
   • [claimed-docs] “Crossmint's agent stack is three composable products, verbatim: Agent Cards — "a card for your agent to pay with, secured by Visa VIC and Ma…”

   proof ↗⚑ flag

5. ai-native userBuild against official SDKs

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce~partialprobed6/10

   Shopify provides official developer tooling for agentic commerce — the `@shopify/ucp-cli`, UCP-compliant MCP servers (Catalog, Cart, Checkout, Order), profile/negotiation docs, and an AI Toolkit that validates GraphQL/Liquid/Extensions — all documented with schemas and confirmed live via runtime probes. However, this is CLI/MCP/JSON-RPC tooling rather than a conventional language-specific SDK (e.g., a Python or JS client library) that an AI-native developer could import directly. Missing for 10: dedicated SDK packages/libraries beyond the CLI and MCP JSON-RPC interface, and independent third-party corroboration of SDK usability.

   • [claimed-docs] “Shopify's agent surface is UCP end to end via "Shopify's UCP-compliant MCP servers": the UCP CLI "provides structured commands to search the…”
   • [claimed-docs] “validate GraphQL queries, Liquid templates, and Shopify Extensions against Shopify schemas to catch issues earlier”
   • [claimed-docs] “"The Global Catalog MCP server enables AI agents to search and discover products across the entire Shopify ecosystem, helping buyers find pr…”
   • [claimed-docs] “"Cart tools accept unauthenticated requests, which lets you estimate totals and share a cart with the buyer before collecting credentials" —…”
   • [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”
   • [claimed-docs] “Initialize a local UCP profile.”

   proof ↗⚑ flag

   Crossmint~partialprobed5/10

   Crossmint's docs show a single REST API accessed via quickstarts (agent checkouts, cards, stablecoin wallets) and protocol-specific clients like @x402/core and mppx, implying SDK-style tooling, but no evidence names an official multi-language SDK package (e.g., npm/pip installable Crossmint SDK) and the OpenAPI probe found no published spec, undercutting a clean 'official SDK' story. missing for 10: explicit official SDK package names/install instructions, multi-language SDK coverage, and a discoverable OpenAPI/schema reference.

   • [claimed-docs] “Create a user-owned smart wallet, authorize an agent as a delegated signer, and send USDXM on Base Sepolia.”
   • [claimed-docs] “Let your agent buy from any merchant with a single API.”
   • [claimed-docs] “MPP support is a first-class payment flow: "This guide shows how to pay MPP (Machine Payment Protocol) endpoints using a Crossmint wallet." …”
   • [claimed-docs] “Crossmint wallets pay x402 endpoints through the @x402/core client (prerequisite: "A funded Crossmint EVM wallet on Base with USDC."): on a …”
   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.crossmint.com/openapi.json, https://docs.crossmint.com/swagger.json, https://docs.cross…”

   proof ↗⚑ flag

6. ai-native userSubscribe to events via webhooks

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce~partialclaimed5/10

   Shopify does deliver order webhooks — UCP-shaped payloads pushed to a registered endpoint on committed order changes, HMAC-signed and retried — but the subscription mechanism itself is not agent-native: 'There's no self-serve subscription API today... contact your Shopify partner manager,' and although the UCP profile spec allows agents to declare a webhook_url, 'Shopify doesn't honor that field today.' This means an AI-native user cannot programmatically subscribe/register for webhook events themselves — it requires a manual, human, out-of-band process, undercutting the 'agentic' self-serve subscription story. missing for 10: self-serve/programmatic webhook subscription API, honoring the agent-declared webhook_url in the UCP profile, and any evidence of agent-driven (not partner-manager-mediated) event subscription.

   • [claimed-docs] “Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change”
   • [claimed-docs] “"Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (fu…”
   • [claimed-docs] “Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (ful…”

   proof ↗⚑ flag

   Crossmint—none0/10

   The only explicit evidence about webhooks states the opposite of the story: Agent Checkouts documentation says 'no webhooks in v1' and requires polling until a terminal state is reached, with no other evidence pack item describing a webhook subscription mechanism anywhere in Crossmint's API.

   • [claimed-docs] “Merchant coverage is URL-universal: "Let your agent buy from any merchant with a single API." — hand it "a product URL and a spending cap, a…”

   proof ↗⚑ flag

Agentic features

1. ai-native userSet up automations that run autonomously in the background

   weight 2 · round to Crossmint
   Shopify Agentic Commerce~partialclaimed4/10

   UCP's trust-tier model lets Token-tier agents call complete_checkout autonomously once granted permission, and order webhooks push background state updates to a registered endpoint without polling — both hint at unattended, background-capable agent operation. But there is no documented feature for an AI-native user to configure a scheduled or trigger-based automation (e.g., recurring reorders, price-watch, monitor-and-act loops) that runs unsupervised over time; the evidence only covers per-session agent tool calls (search/cart/checkout/order) and merchant-side webhook delivery, not user-configurable autonomous background jobs. Missing for 10: explicit scheduling/trigger mechanism, evidence of a persistent background agent process, and independent confirmation of real autonomous (no-human-in-loop) purchase completion.

   • [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
   • [claimed-docs] “"UCP traffic to Shopify's MCP servers is classified into three tiers based on how your agent identifies itself" — Token, Signed, Anonymous —…”
   • [claimed-docs] “"Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (fu…”
   • [claimed-docs] “Buyer handoff is a first-class state: "Build for escalations regardless of how you authenticate." A checkout in requires_escalation means "C…”

   proof ↗⚑ flag

   Crossmint~partialclaimed5/10

   Crossmint lets agents transact autonomously once delegated: onchain-enforced spend limits, counterparties, and time windows mean the agent acts 'with no user prompt per action' and checkouts/x402/MPP payments proceed without human intervention ([crossmint-supp-4], [crossmint-supp-6], [crossmint-supp-7]). However this is scoped strictly to payment/checkout automation, not a general-purpose background job/workflow scheduler, and agent checkouts require manual polling with no webhooks or staging ('no webhooks in v1', 'no staging environment') ([crossmint-supp-7]). Missing for 10: general-purpose automation/scheduling framework beyond payments, webhook/event-driven triggers, and evidence of autonomous background operation outside the payment domain.

   • [claimed-docs] “Agent wallets are user-owned with onchain-enforced delegation: "The user owns a non-custodial wallet and grants the agent scoped permissions…”
   • [claimed-docs] “Crossmint wallets pay x402 endpoints through the @x402/core client (prerequisite: "A funded Crossmint EVM wallet on Base with USDC."): on a …”
   • [claimed-docs] “Merchant coverage is URL-universal: "Let your agent buy from any merchant with a single API." — hand it "a product URL and a spending cap, a…”
   • [claimed-docs] “MPP support is a first-class payment flow: "This guide shows how to pay MPP (Machine Payment Protocol) endpoints using a Crossmint wallet." …”

   proof ↗⚑ flag

2. ai-native userOperate the product with natural-language commands

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce✓fullprobed7/10

   Shopify's UCP stack is explicitly designed so a natural-language request to an AI assistant ('find me crewneck sweaters under $50') is mapped by a skill/plugin to the right structured UCP CLI/MCP command, and runtime probes confirm the underlying MCP catalog/cart tools actually work end-to-end (search, cart creation) via the CLI with a local profile. Missing for 10: independent third-party evidence of a user issuing free-form natural-language commands (only one first-party doc line makes this claim) and no evidence of NL support beyond the catalog-search example (checkout/order flows are shown as structured CLI/MCP calls, not demonstrated NL-driven).

   • [claimed-docs] “Ask your assistant in natural language ("find me crewneck sweaters under $50") and the skill picks the right UCP CLI command”
   • [claimed-docs] “the CLI provides structured commands to search the Catalog, build carts, create checkouts, hand off buyers, and track orders”
   • [claimed-docs] “Shopify's agent surface is UCP end to end via "Shopify's UCP-compliant MCP servers": the UCP CLI "provides structured commands to search the…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”
   • [probe] “PROBE runtime (recorded 2026-09-14): Shopify's Global Catalog MCP server is live — a keyless JSON-RPC initialize POST to https://catalog.sho…”

   proof ↗⚑ flag

   Crossmint—none0/10

   Crossmint's evidence describes REST APIs, SDKs, and agent-delegated payment flows (cards, wallets, checkouts, x402/MPP), but nothing shows a natural-language command interface for the human/AI-native user to directly operate Crossmint itself — no chat UI, NL-to-API translation layer, or documented conversational control surface. The axis is fair to ask of a product marketed as 'payment infrastructure for AI agents,' but no such capability is evidenced.

   • [claimed-docs] “Crossmint offers secure, programmable smart wallet infrastructure through a single API that is configurable for any use case”
   • [claimed-docs] “Crossmint's agent stack is three composable products, verbatim: Agent Cards — "a card for your agent to pay with, secured by Visa VIC and Ma…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.crossmint.com/openapi.json, https://docs.crossmint.com/swagger.json, https://docs.cross…”

   proof ↗⚑ flag

Api quality

1. ai-native userExplore an interactive API reference with runnable examples

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce~partialprobed4/10

   Shopify's UCP docs provide a step-by-step quickstart with real, copy-pasteable CLI commands that run the full discovery→cart→checkout→order flow, and MCP tools are self-describing (agents can fetch live input schemas via `--input-schema`), which gives AI-native users a way to explore and run real examples against live endpoints (confirmed by runtime probes actually executing search/cart calls). However, there is no dedicated interactive API-reference surface — probes explicitly found no OpenAPI/Swagger spec and no llms.txt at shopify.dev (404s), so there's no Postman/Swagger-style 'try it' reference page, only linear docs plus CLI/MCP introspection. Missing for 10: a dedicated interactive API-reference UI (OpenAPI/Swagger explorer or embedded try-it-now widgets), and independent hands-on confirmation that non-CLI docs pages let users run examples inline.

   • [claimed-docs] “This quickstart runs the full agentic commerce flow with the UCP CLI, from product discovery to order tracking, in about five minutes.”
   • [claimed-docs] “"The Storefront Catalog MCP server enables AI agents to search and discover products from a single merchant's catalog, helping buyers find a…”
   • [probe] “PROBE runtime (recorded 2026-09-14): Shopify's Global Catalog MCP server is live — a keyless JSON-RPC initialize POST to https://catalog.sho…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”
   • [probe] “PROBE llms.txt: HTTP 404 at https://shopify.dev/llms.txt”
   • [probe] “PROBE openapi: all candidate paths 404 (https://shopify.dev/openapi.json, https://shopify.dev/swagger.json, https://shopify.dev/api/openapi.…”

   proof ↗⚑ flag

   Crossmint—none0/10

   The evidence shows only markdown-based docs and an llms.txt feed; explicit probes for an OpenAPI/Swagger spec (openapi.json, swagger.json, etc.) all returned 404, and no evidence mentions an interactive API console, sandbox, or runnable code examples.

   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.crossmint.com/openapi.json, https://docs.crossmint.com/swagger.json, https://docs.cross…”
   • [probe] “PROBE llms.txt: HTTP 200 at https://docs.crossmint.com/llms.txt # Crossmint > Crossmint is a blockchain infrastructure platform for develop…”
   • [probe] “PROBE runtime (recorded 2026-09-14): docs.crossmint.com serves llms.txt keylessly — '# Crossmint... checkout for onchain and physical-world …”

   proof ↗⚑ flag

2. ai-native userDownload a machine-readable API spec (OpenAPI or equivalent)

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce~partialprobed4/10

   There's no downloadable OpenAPI/Swagger file — a direct probe found openapi.json, swagger.json, and similar candidate paths all 404 — but the underlying protocol is machine-readable in other ways: MCP servers expose live input schemas agents can introspect at runtime (--input-schema) and the UCP protocol itself has a published, versioned technical specification with reference implementations in a public GitHub repo (ucp.dev/llms.txt). missing for 10: an actual OpenAPI/JSON-Schema-equivalent document downloadable in one shot, and confirmation that the GitHub spec repo is machine-readable in OpenAPI-equivalent form rather than prose/markdown protocol docs.

   • [probe] “PROBE openapi: all candidate paths 404 (https://shopify.dev/openapi.json, https://shopify.dev/swagger.json, https://shopify.dev/api/openapi.…”
   • [claimed-docs] “"The Storefront Catalog MCP server enables AI agents to search and discover products from a single merchant's catalog, helping buyers find a…”
   • [claimed-docs] “ucp.dev positions the protocol as industry-governed rather than single-vendor: "UCP is built by the industry, to enable seamless agentic exp…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the Universal Commerce Protocol spec is published in the open — https://ucp.dev/llms.txt serves the ver…”

   proof ↗⚑ flag

   Crossmint—none0/10

   A direct probe found no OpenAPI/Swagger spec at any standard path (all 404s), and while an llms.txt/markdown docs format exists, that is not a machine-readable API spec. missing for 10: an OpenAPI/Swagger JSON or YAML spec, any documented spec download link, or equivalent machine-readable API schema.

   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.crossmint.com/openapi.json, https://docs.crossmint.com/swagger.json, https://docs.cross…”
   • [probe] “PROBE llms.txt: HTTP 200 at https://docs.crossmint.com/llms.txt # Crossmint > Crossmint is a blockchain infrastructure platform for develop…”

   proof ↗⚑ flag

3. ai-native userTest against a sandbox environment without touching production data

   weight 1 · round to Crossmint
   Shopify Agentic Commerce—none0/10

   No evidence pack item describes a dedicated sandbox/test environment for UCP agent development; the only relevant runtime probe shows testing being done directly against a live production Shopify store ('a REAL cart was created keylessly on Shopify's own hardware store'), not a sandbox. No test-mode flag, dev store, or mock UCP endpoint is documented anywhere in the pack.

   • [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a Shopify-operated storefront's own UCP endpoint is live — a keyless JSON-RPC initialize POST to https:…”

   proof ↗⚑ flag

   Crossmint~partialclaimed4/10

   Crossmint documents genuine testnet sandboxes for some flows (e.g., the stablecoin wallet quickstart runs on Base Sepolia, crossmint-docs-3), but for Agent Checkouts the docs explicitly state 'there is no staging environment for it' and testing is production-only (crossmint-supp-7). So sandboxed testing exists for part of the agent stack but is explicitly absent for another major agent capability. missing for 10: a unified sandbox/staging environment across all agent products (cards, checkouts, wallets), independent confirmation of testnet behavior beyond docs, and any sandbox coverage for Agent Cards/Checkouts specifically.

   • [claimed-docs] “Create a user-owned smart wallet, authorize an agent as a delegated signer, and send USDXM on Base Sepolia.”
   • [claimed-docs] “Merchant coverage is URL-universal: "Let your agent buy from any merchant with a single API." — hand it "a product URL and a spending cap, a…”

   proof ↗⚑ flag

4. ai-native userRely on versioned APIs with a documented deprecation policy

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce~partialprobed4/10

   Evidence shows real API versioning (protocol version headers like x-shopify-ucp-mcp-api-version: 2026-08-25, dated UCP spec releases on ucp.dev, and profile negotiation based on 'the protocol version and capabilities the platform supports'), which supports the 'versioned APIs' half of the story. However, no evidence anywhere describes a documented deprecation policy, sunset timelines, or backward-compatibility guarantees for older versions. Missing for 10: explicit deprecation/sunset policy documentation, version-support lifecycle commitments, migration guidance between dated versions.

   • [probe] “PROBE runtime (recorded 2026-09-14): Shopify's Global Catalog MCP server is live — a keyless JSON-RPC initialize POST to https://catalog.sho…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the Universal Commerce Protocol spec is published in the open — https://ucp.dev/llms.txt serves the ver…”
   • [claimed-docs] “In UCP, "a platform profile is a JSON document that describes the protocol version and capabilities the platform supports"; the business sid…”

   proof ↗⚑ flag

   Crossmint—none0/10

   No evidence pack item documents API versioning conventions or a deprecation policy; the only version-related signal is an endpoint path containing 'unstable' (crossmint-probe-rt-1), which if anything suggests unversioned/experimental APIs rather than a documented deprecation policy.

   ⚑ flag

1. ai-native userPerform bulk operations across many items at once

   weight 2 · round drawn
   Shopify Agentic Commerce—none0/10

   The evidence describes single-item/cart-at-a-time flows (search, build a cart, checkout, track one order) and catalog pagination for browsing, but nothing documents a bulk operation primitive — e.g., adding many items to a cart in one call, batch checkout, or bulk order management — for an AI agent to act on many items at once.

   ⚑ flag

   Crossmint—none0/10

   The evidence pack covers single-item agent payment flows (cards, wallets, checkouts, x402/MPP) and mentions managing funds 'at scale' in passing, but there is no documented batch/bulk API, bulk wallet creation, or multi-item transaction endpoint that would let a user perform operations across many items at once.

   • [claimed-docs] “Secure, programmable wallets to manage and move company funds at scale.”
   • [claimed-docs] “Let your agent buy from any merchant with a single API.”
   • [claimed-docs] “Merchant coverage is URL-universal: "Let your agent buy from any merchant with a single API." — hand it "a product URL and a spending cap, a…”

   proof ↗⚑ flag

2. ai-native userDefine rules that trigger actions automatically on events

   weight 3 · round to Crossmint
   Shopify Agentic Commerce~partialclaimed3/10

   Shopify's UCP order webhooks push event notifications (fulfillment, refunds, cancellations) to a registered endpoint whenever a committed change occurs, giving a basic event-trigger backbone, but there is no evidence of an actual rules/automation engine where an AI-native user declares conditional logic ("if X then do Y") that Shopify executes on their behalf. Missing for 10: a rule-definition interface or automation engine, support for triggers beyond order state changes, and any evidence of user-authored conditional actions rather than raw webhook delivery.

   • [claimed-docs] “"Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (fu…”
   • [claimed-docs] “Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change”
   • [claimed-docs] “Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (ful…”

   proof ↗⚑ flag

   Crossmint~partialclaimed4/10

   Crossmint lets users define scoped rules (spend caps, counterparty allow-lists, time windows) that once set let an agent act autonomously without per-action prompts, and states 'Transaction rules enforced onchain' — a form of automatic rule-based action. However this is closer to pre-authorized permission bounds than true event-triggered automation, and the docs explicitly note agent checkouts have 'no webhooks in v1', meaning event-driven triggering isn't supported there. Missing for 10: an explicit rules/automation engine that fires actions on arbitrary external or on-chain events, webhook/event-subscription support, and independent confirmation of automated rule execution beyond spend-limit enforcement.

   • [claimed-docs] “Transaction rules enforced onchain”
   • [claimed-docs] “Agent wallets are user-owned with onchain-enforced delegation: "The user owns a non-custodial wallet and grants the agent scoped permissions…”
   • [claimed-docs] “Scoped card spending: "An order intent gives the agent a fixed allowance with an amount, description, and expiration, enforced through Visa …”
   • [claimed-docs] “Merchant coverage is URL-universal: "Let your agent buy from any merchant with a single API." — hand it "a product URL and a spending cap, a…”

   proof ↗⚑ flag

Fees transparency

1. merchantThe fees for agent-originated transactions are published — I can price agentic channels without asking sales

   weight 2 · round drawn
   Shopify Agentic Commerce—none0/10

   The evidence pack thoroughly documents UCP's technical architecture (catalog, cart, checkout, orders, trust tiers) but contains no mention of transaction fees, take rates, commission percentages, or pricing terms for agent-originated sales — nothing addresses what a merchant would pay for agentic-channel transactions.

   ⚑ flag

   Crossmint—none0/10

   Crossmint publishes general wallet MAU overage pricing and checkout fee tiers, but the evidence pack explicitly states 'No agent-card- or agent-checkout-specific price is published on the pricing page' (crossmint-supp-9), meaning a merchant cannot price the agent-specific channels (Agent Cards, Agent Checkouts) without contacting sales.

   • [claimed-docs] “Published pricing: wallets are "Free 1,000 Monthly Active Wallets" then "Overages start at $0.05 per MAU. Volume discounts available."; onra…”

   proof ↗⚑ flag

Payouts

1. merchantAgent-originated payments settle through documented payout and reporting flows, reconcilable like any other channel

   weight 1 · round to Crossmint
   Shopify Agentic Commerce—none0/10

   The evidence documents order creation, checkout/payment completion, order-state webhooks, and get_order reconciliation of order state, but nothing addresses payout, settlement, or financial reporting flows that let a merchant reconcile agent-originated revenue against other channels (no mention of payout reports, settlement schedules, or accounting/export integration). Since payout/reporting reconciliation is a normal, fair expectation for any commerce channel with real payments, this axis applies but is unaddressed in the pack.

   ⚑ flag

   Crossmint~partialclaimed3/10

   Evidence shows transaction-lifecycle tracking (order intents track total/reserved/spent/available amounts) and a documented authorization-hold/capture and dispute-management model for card checkout, which are reconciliation-adjacent, plus tiered per-transaction pricing. But there is no documented merchant payout schedule, settlement-to-bank-account flow, transaction reporting dashboard, or export/reconciliation tooling specific to agent-originated payments, and the agent-checkouts flow explicitly lacks webhooks ('no webhooks in v1' — poll until terminal state), undermining real-time reconciliation. Missing for 10: merchant payout/settlement documentation, reporting/dashboard or export tools, reconciliation-specific guidance for agent transactions, and webhook-based confirmation.

   • [claimed-docs] “Scoped card spending: "An order intent gives the agent a fixed allowance with an amount, description, and expiration, enforced through Visa …”
   • [claimed-docs] “Merchant coverage is URL-universal: "Let your agent buy from any merchant with a single API." — hand it "a product URL and a spending cap, a…”
   • [claimed-docs] “For card checkout, Crossmint absorbs dispute risk: "Crossmint will take on the risk and manage disputes directly with the bank.", using an a…”
   • [claimed-docs] “Published pricing: wallets are "Free 1,000 Monthly Active Wallets" then "Overages start at $0.05 per MAU. Volume discounts available."; onra…”

   proof ↗⚑ flag

Attribution analytics

1. merchantOrders are attributed to the originating agent and I can report on or filter transactions by agent

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce~partialclaimed5/10

   Cart/checkout objects carry explicit agent-attribution metadata (referring_domain, click_id_tag, activity_id, utm_* fields) and orders are tied to a specific agent's UCP profile via checkout creation, giving Shopify the raw data needed to attribute orders to an agent. However, there is no evidence of a merchant-facing report, analytics dashboard, or order-list filter that lets a merchant actually query or segment transactions by originating agent — only developer-facing MCP/webhook data plumbing is documented. Missing for 10: merchant admin UI or reporting API to filter/segment orders by agent, aggregate agent-performance analytics, independent confirmation that attribution data surfaces in Shopify's order admin.

   • [claimed-docs] “"Cart tools accept unauthenticated requests, which lets you estimate totals and share a cart with the buyer before collecting credentials" —…”
   • [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
   • [claimed-docs] “"Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (fu…”
   • [claimed-docs] “"The Order MCP server enables AI agents to fetch the current state of an order placed through their agent, including line items, fulfillment…”
   • [claimed-docs] “In UCP, "a platform profile is a JSON document that describes the protocol version and capabilities the platform supports"; the business sid…”

   proof ↗⚑ flag

   Crossmint—none0/10

   The evidence describes agent payment mechanisms (cards, wallets, checkouts, spending rules) but contains no mention of merchant-facing reporting, dashboards, or transaction filtering by originating agent — the core of this story. Order intents and delegated signers are documented for controlling agent spend, not for merchant attribution/reporting.

   ⚑ flag

Onboarding to agents

1. merchantI have a documented self-serve path to start accepting agent traffic — enable a setting, sign an agreement, or publish an endpoint

   weight 3 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce~partialprobed5/10

   Docs show every UCP-enabled storefront automatically exposes a /api/ucp/mcp endpoint and a merchant publishes a UCP profile at {shop}.myshopify.com/.well-known/ucp for capability negotiation — that's a documented, quasi-self-serve publishing path, and probes confirm live merchant endpoints exist. But the pack explicitly contradicts full self-serve: order webhook subscription is 'not self-serve... contact your Shopify partner manager,' and there is no merchant-facing admin setting or signed agreement flow described (all guidance is developer/CLI-facing, not merchant-console-facing). missing for 10: a merchant-admin toggle/setting in Shopify admin UI, an explicit merchant agreement/terms step, and self-serve webhook registration (currently manual via partner manager).

   • [claimed-docs] “In UCP, "a platform profile is a JSON document that describes the protocol version and capabilities the platform supports"; the business sid…”
   • [claimed-docs] “"Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (fu…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a Shopify-operated storefront's own UCP endpoint is live — a keyless JSON-RPC initialize POST to https:…”
   • [claimed-docs] “Negotiation is server-selects. The business computes the intersection of its capabilities with the platform's and chooses the active set”

   proof ↗⚑ flag

   Crossmint—none0/10

   Evidence covers agent-side integrations (agent wallets, agent cards, x402/MPP payment flows, agent checkouts) but nothing documents a merchant-facing onboarding step — no setting to enable, agreement to sign, or endpoint-publishing guide aimed at merchants who want to accept agent traffic. The 'buy from any merchant' framing implies merchants need no explicit action, but this is never documented as a self-serve merchant enablement path.

   ⚑ flag

Traffic controls

1. merchantRate-limit, allow, or deny specific agents and agent platforms accessing my catalog and checkout

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce~partialclaimed3/10

   Shopify's UCP documents a platform-wide trust-tier system (Token/Signed/Anonymous) where 'rate limits scale with identification' and certain tools (like complete_checkout or Order MCP) are gated to higher trust tiers, which provides some rate-limiting infrastructure. However, this is a Shopify-controlled protocol mechanism based on identification strength, not a merchant-facing dashboard/setting to specifically allow, deny, or rate-limit named agents or agent platforms (e.g. blocking 'Agent X' or 'Platform Y' by name). Missing for 10: merchant-configurable allow/deny lists for specific agents/platforms, merchant UI or API to set custom rate limits per agent, and any evidence of per-merchant policy enforcement beyond the global trust-tier scheme.

   • [claimed-docs] “"UCP traffic to Shopify's MCP servers is classified into three tiers based on how your agent identifies itself" — Token, Signed, Anonymous —…”
   • [claimed-docs] “In UCP, "a platform profile is a JSON document that describes the protocol version and capabilities the platform supports"; the business sid…”
   • [claimed-docs] “"The Order MCP server enables AI agents to fetch the current state of an order placed through their agent, including line items, fulfillment…”

   proof ↗⚑ flag

   Crossmint—none0/10

   The evidence details user-side and agent-side spending controls (spend caps, counterparties, time windows, order intents) but nothing about merchants controlling which agents/agent platforms may access their catalog or checkout, nor any rate-limiting/allow-deny mechanism exposed to merchants. Crossmint's agent-checkout flow treats the merchant as an arbitrary third-party target ('buy from any merchant'), not as a Crossmint customer configuring agent access policies.

   • [claimed-docs] “Merchant coverage is URL-universal: "Let your agent buy from any merchant with a single API." — hand it "a product URL and a spending cap, a…”
   • [claimed-docs] “Agent wallets are user-owned with onchain-enforced delegation: "The user owns a non-custodial wallet and grants the agent scoped permissions…”
   • [claimed-docs] “"An agent card is an order intent that gives an agent a bounded amount to spend before a fixed expiration." Merchant locking: "The merchant …”

   proof ↗⚑ flag

1. ai-native userDo everything through the API that I can do in the UI

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce~partialprobed7/10

   Shopify's UCP/MCP surface documents broad API parity for the core buyer journey — catalog search, cart building, checkout creation/completion, and order tracking/webhooks all mirror what a human can do in a Shopify storefront UI, with runtime probes confirming live handshakes and a real cart creation. However, the spec explicitly carves out cases where the API cannot fully replace the UI: checkouts can enter a `requires_escalation` state where 'Checkout requires buyer input or review not available via API,' forcing a handoff via `continue_url` to the merchant's own UI, and full autonomous `complete_checkout` is gated to Token-tier trusted agents only. Missing for 10: evidence of parity for non-purchase storefront actions (account management, returns UI, arbitrary merchant customizations) and confirmation that escalation-required flows are rare rather than common.

   • [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
   • [claimed-docs] “Buyer handoff is a first-class state: "Build for escalations regardless of how you authenticate." A checkout in requires_escalation means "C…”
   • [claimed-docs] “"UCP traffic to Shopify's MCP servers is classified into three tiers based on how your agent identifies itself" — Token, Signed, Anonymous —…”
   • [claimed-docs] “"Cart tools accept unauthenticated requests, which lets you estimate totals and share a cart with the buyer before collecting credentials" —…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”
   • [claimed-docs] “"The Order MCP server enables AI agents to fetch the current state of an order placed through their agent, including line items, fulfillment…”
   • [claimed-docs] “"Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (fu…”

   proof ↗⚑ flag

   Crossmint~partialprobed6/10

   Crossmint is built API-first — wallets, agent cards, agent checkouts, and headless checkout are all exposed as REST APIs, with headless checkout explicitly positioned as the API-only alternative to Crossmint's embedded iframe UI, giving 'full control of the user experience' (crossmint-docs-1, crossmint-docs-7, crossmint-docs-8, crossmint-supp-1). However, there's no explicit claim or evidence of full UI/API feature parity across the whole platform, and the probe found no discoverable OpenAPI spec (404s on all candidate paths), suggesting some API surface may be undocumented or incomplete relative to the dashboard. Missing for 10: an explicit parity statement or audit showing every dashboard/UI action (account/team management, dispute handling, analytics) has an API equivalent, and a published OpenAPI spec confirming full API surface.

   • [claimed-docs] “Crossmint offers secure, programmable smart wallet infrastructure through a single API that is configurable for any use case”
   • [claimed-docs] “Crossmint's headless checkout API is a set of REST APIs that allow you to integrate credit card and cross-chain crypto payments inside your …”
   • [claimed-docs] “Embedded iframe with customizable UI.”
   • [claimed-docs] “Crossmint's agent stack is three composable products, verbatim: Agent Cards — "a card for your agent to pay with, secured by Visa VIC and Ma…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.crossmint.com/openapi.json, https://docs.crossmint.com/swagger.json, https://docs.cross…”

   proof ↗⚑ flag

2. ai-native userExport all of my data in open formats and leave

   weight 3 · round drawn
   Shopify Agentic Commerce—none0/10

   None of the evidence addresses data export, portability, or the ability for a user/agent to extract their commerce data in an open format and leave the platform — the pack only covers catalog search, cart/checkout MCP tools, order webhooks, and profile negotiation. Since data portability is a plausible axis for any commerce platform, absence of evidence means 'none' rather than 'na'.

   ⚑ flag

   Crossmint—none0/10

   The evidence pack covers Crossmint's wallet, checkout, and agent-payment APIs in depth, but nothing addresses data export, open-format portability, or account/data takeout for users leaving the platform. Missing for 10: any documented data export feature, open-format (e.g., CSV/JSON) export tooling, or explicit portability/exit guarantees for user data.

   ⚑ flag

Order events

1. developerMy agent or backend can subscribe to order lifecycle events — created, updated, fulfilled, canceled — pushed programmatically

   weight 3 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce~partialclaimed5/10

   Shopify does push full, HMAC-signed UCP-shaped order webhooks (created/updated/fulfilled/canceled/refunded etc.) with retry logic, so lifecycle events are indeed pushed programmatically once configured. However the same documentation states subscription itself is not self-serve — 'There's no self-serve subscription API today: your delivery URL and topic scoping are registered server-side... contact your Shopify partner manager' — and the UCP profile's webhook_url field, meant to let agents declare their endpoint programmatically, 'Shopify doesn't honor that field today.' This is a first-party documented limitation (not an external dispute) directly undercutting the 'programmatically subscribe' part of the story. missing for 10: a self-serve/programmatic subscription or registration API, honoring of the webhook_url profile field, and independent/hands-on confirmation of webhook delivery in production.

   • [claimed-docs] “Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change”
   • [claimed-docs] “"Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (fu…”
   • [claimed-docs] “Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (ful…”

   proof ↗⚑ flag

   Crossmint—none0/10

   Crossmint's own docs explicitly state agent checkouts have 'no webhooks in v1' and require polling until a terminal state is reached, meaning there is no programmatic push-based subscription to order lifecycle events (created/updated/fulfilled/canceled). No other product area (wallets, cards) documents webhook/event subscription either.

   • [claimed-docs] “Merchant coverage is URL-universal: "Let your agent buy from any merchant with a single API." — hand it "a product URL and a spending cap, a…”

   proof ↗⚑ flag

Post purchase status

1. ai-native userMy agent can query the status and tracking of an order it placed, after the purchase

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce✓fullclaimed8/10

   Order MCP's get_order explicitly returns current order state (line items, fulfillment events, post-purchase adjustments) for orders placed via the agent, complemented by push order webhooks for tracking updates, and this is documented with concrete access/scope details (Token-tier, read_global_api_orders scope). The quickstart even walks through discovery-to-order-tracking as a first-party flow. Missing for 10: independent/third-party hands-on confirmation of get_order in production (only first-party docs/probes), and no evidence of consumer-facing tracking UI beyond the API/webhook mechanism.

   • [claimed-docs] “enables AI agents to fetch the current state of an order placed through their agent, including line items, fulfillment events, and post-purc…”
   • [claimed-docs] “"The Order MCP server enables AI agents to fetch the current state of an order placed through their agent, including line items, fulfillment…”
   • [claimed-docs] “"Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (fu…”
   • [claimed-docs] “This quickstart runs the full agentic commerce flow with the UCP CLI, from product discovery to order tracking, in about five minutes.”
   • [claimed-docs] “Help customers track orders, manage returns, and access their account information.”

   proof ↗⚑ flag

   Crossmint~partialclaimed6/10

   Docs explicitly describe agent checkouts as poll-driven — 'no webhooks in v1... you poll until it reaches a terminal state' — and order intents/rails each carry their own status, so an agent can query order status after purchase via polling. However, this is documented only for the Agent Checkouts flow (not agent cards or wallet payments), lacks any true package/shipment tracking detail, and has no independent or hands-on corroboration beyond first-party docs. Missing for 10: shipment/delivery tracking detail, webhook or push-based status updates, and third-party verification of the polling flow actually working in production.

   • [claimed-docs] “Merchant coverage is URL-universal: "Let your agent buy from any merchant with a single API." — hand it "a product URL and a spending cap, a…”
   • [claimed-docs] “An order intent can have multiple rails, each with its own status, credential formats, and verification.”
   • [claimed-docs] “Let your agent buy from any merchant with a single API.”

   proof ↗⚑ flag

Delegated credentials

1. ai-native userHand my agent a scoped, limited-use payment credential — amount limits, expiry, merchant restrictions — instead of a raw card number

   weight 3 · round to Crossmint
   Shopify Agentic Commerce~partialclaimed4/10

   UCP references AP2 payment mandates as "cryptographically signed payment authorizations that are mathematically tied to the specific state of the cart" and verifiable credentials, plus short-lived (60-minute) JWT checkout tokens and Token-tier gating for complete_checkout — gesturing at scoped, non-raw-card credentials, but this describes protocol/session tokens for API access, not a user-issued payment instrument with explicit amount limits, expiry, and merchant restrictions handed to the agent. Missing for 10: concrete documentation of a user-facing scoped payment credential (spending caps, expiry dates, merchant allow-lists) rather than just agent-identity/session auth tokens, and no independent/hands-on evidence of this credential-issuance flow in practice.

   • [claimed-docs] “allows Platforms to provide cryptographically signed payment authorizations that are mathematically tied to the specific state of the cart”
   • [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
   • [claimed-docs] “"UCP traffic to Shopify's MCP servers is classified into three tiers based on how your agent identifies itself" — Token, Signed, Anonymous —…”
   • [claimed-docs] “ucp.dev positions the protocol as industry-governed rather than single-vendor: "UCP is built by the industry, to enable seamless agentic exp…”

   proof ↗⚑ flag

   Crossmint✓fullprobed9/10

   Crossmint's Agent Cards give agents a one-time card number, expiration, and CVC scoped by an order intent with amount, description, merchant lock, and expiration — never exposing the real card number — enforced via Visa/Mastercard network rails (crossmint-supp-2, crossmint-supp-3, crossmint-supp-8). This is corroborated by a live runtime probe showing the agent-scoped checkout endpoint requiring agent-specific credentials (crossmint-probe-rt-1). Missing for 10: independent third-party (non-vendor) verification of the card-scoping behavior in production beyond the docs and single runtime probe.

   • [claimed-docs] “Scoped card spending: "An order intent gives the agent a fixed allowance with an amount, description, and expiration, enforced through Visa …”
   • [claimed-docs] “Credentials are one-time and network-verified: minting returns "the secure one-time card number, expiration, and CVC", and verification is a…”
   • [claimed-docs] “"An agent card is an order intent that gives an agent a bounded amount to spend before a fixed expiration." Merchant locking: "The merchant …”
   • [probe] “PROBE runtime (recorded 2026-09-14): the Agent Checkouts endpoint is live and agent-scoped — a keyless POST to https://www.crossmint.com/api…”
   • [claimed-docs] “Give agents permission to pay with a user's card using Crossmint's Agentic Payments API.”

   proof ↗⚑ flag

Settlement rails

1. developerSettle agent-initiated payments in stablecoins over documented rails

   weight 2 · round to Crossmint
   Shopify Agentic Commerce—none0/10

   Evidence documents payment_handlers like com.google.pay, credit-card style checkout, and AP2/payment mandate concepts, but nowhere mentions stablecoins, crypto rails, or any stablecoin settlement path for agent-initiated payments. This is a documented gap, not a category mismatch, since UCP explicitly discusses payment handler negotiation and could plausibly include stablecoin rails.

   • [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
   • [claimed-docs] “ucp.dev positions the protocol as industry-governed rather than single-vendor: "UCP is built by the industry, to enable seamless agentic exp…”
   • [claimed-docs] “allows Platforms to provide cryptographically signed payment authorizations that are mathematically tied to the specific state of the cart”

   proof ↗⚑ flag

   Crossmint✓fullprobed8/10

   Crossmint documents stablecoin settlement for agent payments via user-owned wallets with delegated signer permissions (USDXM/USDC), and explicit rails including x402 and MPP protocols with runtime-verified endpoint behavior, giving strong first-party and probe corroboration of documented stablecoin rails. missing for 10: independent (non-vendor) real-world case studies of production stablecoin settlement volume, and confirmation the x402/MPP flows work beyond testnet/Base Sepolia examples.

   • [claimed-docs] “Create a user-owned smart wallet, authorize an agent as a delegated signer, and send USDXM on Base Sepolia.”
   • [claimed-docs] “This guide shows how to pay x402-protected endpoints using a Crossmint wallet.”
   • [claimed-docs] “This guide shows how to pay MPP (Machine Payment Protocol) endpoints using a Crossmint wallet.”
   • [claimed-docs] “Agent wallets are user-owned with onchain-enforced delegation: "The user owns a non-custodial wallet and grants the agent scoped permissions…”
   • [claimed-docs] “MPP support is a first-class payment flow: "This guide shows how to pay MPP (Machine Payment Protocol) endpoints using a Crossmint wallet." …”
   • [claimed-docs] “Crossmint wallets pay x402 endpoints through the @x402/core client (prerequisite: "A funded Crossmint EVM wallet on Base with USDC."): on a …”
   • [probe] “PROBE runtime (recorded 2026-09-14): the Agent Checkouts endpoint is live and agent-scoped — a keyless POST to https://www.crossmint.com/api…”

   proof ↗⚑ flag

Wallets

1. ai-native userProvision a wallet my agent holds and spends from — funded and controlled by me, with balance visibility

   weight 3 · round to Crossmint
   Shopify Agentic Commerce—none0/10

   Shopify's UCP evidence covers checkout, payment-handler negotiation (e.g., com.google.pay), and AP2 payment mandates/verifiable credentials tied to cart state, but there is no documentation of a user-funded, agent-held wallet construct with balance visibility — payment credentials are collected per-checkout, not provisioned as a standing wallet.

   • [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
   • [claimed-docs] “allows Platforms to provide cryptographically signed payment authorizations that are mathematically tied to the specific state of the cart”
   • [claimed-docs] “"UCP traffic to Shopify's MCP servers is classified into three tiers based on how your agent identifies itself" — Token, Signed, Anonymous —…”

   proof ↗⚑ flag

   Crossmint~partialclaimed7/10

   Crossmint's Agent Wallets docs show a user-owned, non-custodial wallet that a user funds and controls, with the agent authorized as a scoped, revocable delegated signer (spend cap, counterparties, time window) enforced onchain, and a working stablecoin-wallet quickstart (crossmint-docs-3, crossmint-supp-4, crossmint-supp-5). However, the evidence never explicitly documents a balance-visibility feature (e.g., a balance/dashboard API for the funding user) — missing for 10: explicit balance-check/visibility API or UI evidence, independent/hands-on corroboration of the wallet flow.

   • [claimed-docs] “Create a user-owned smart wallet, authorize an agent as a delegated signer, and send USDXM on Base Sepolia.”
   • [claimed-docs] “Crossmint's agent stack is three composable products, verbatim: Agent Cards — "a card for your agent to pay with, secured by Visa VIC and Ma…”
   • [claimed-docs] “Agent wallets are user-owned with onchain-enforced delegation: "The user owns a non-custodial wallet and grants the agent scoped permissions…”
   • [claimed-docs] “MPP support is a first-class payment flow: "This guide shows how to pay MPP (Machine Payment Protocol) endpoints using a Crossmint wallet." …”
   • [claimed-docs] “Crossmint wallets pay x402 endpoints through the @x402/core client (prerequisite: "A funded Crossmint EVM wallet on Base with USDC."): on a …”

   proof ↗⚑ flag

Ecosystem adoption

1. developerAt least two independent parties beyond the vendor implement the protocol or platform — it is an ecosystem, not a private integration

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce✓fullprobed7/10

   UCP is documented as an industry-governed open standard rather than a Shopify-only integration: ucp.dev's co-developer wall names Google, Etsy, Wayfair, Target, Walmart, Amazon, Microsoft, Meta, Salesforce and Stripe as builders of the spec, with 'The complete technical specification, documentation, and reference implementations are hosted in our public GitHub repository' and versioned releases confirmed live via ucp.dev/llms.txt. Shopify itself ships a conformant implementation (catalog/cart/checkout/order MCP servers, verified live via runtime probes), demonstrating at least one non-founding-spec-author adopting the protocol. Missing for 10: independent, hands-on evidence that another named co-developer (e.g., Etsy, Walmart) has a live production UCP endpoint analogous to Shopify's, rather than just being listed as a spec co-author.

   • [claimed-docs] “ucp.dev positions the protocol as industry-governed rather than single-vendor: "UCP is built by the industry, to enable seamless agentic exp…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the Universal Commerce Protocol spec is published in the open — https://ucp.dev/llms.txt serves the ver…”
   • [probe] “PROBE runtime (recorded 2026-09-14): Shopify's Global Catalog MCP server is live — a keyless JSON-RPC initialize POST to https://catalog.sho…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a Shopify-operated storefront's own UCP endpoint is live — a keyless JSON-RPC initialize POST to https:…”

   proof ↗⚑ flag

   Crossmint—none0/10

   Evidence describes Crossmint as a single-vendor proprietary API/platform (wallets, checkout, agent cards) — even where it interoperates with external protocols like x402 or MPP, those are third-party specs Crossmint merely consumes, not evidence that independent parties implement Crossmint's own protocol/platform. No evidence pack item shows any other company or independent implementer building a competing or parallel implementation of Crossmint's infrastructure.

   ⚑ flag

Spec publication

1. developerThe commerce protocol this product speaks is published as an open, versioned specification I can read and implement without signing anything

   weight 3 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce✓fullprobed8/10

   UCP is documented as an open, industry-governed standard with versioned releases and a public GitHub repository hosting the full spec and reference implementations, and ucp.dev/llms.txt confirms a dated, versioned spec index with no signup gate. Shopify's own docs and runtime probes show keyless, unauthenticated access to core UCP endpoints (catalog search, cart creation) without any signature required to read or implement the protocol. missing for 10: no direct evidence of the actual spec text/license terms confirming implementation rights, and no independent third-party (non-Shopify, non-ucp.dev) confirmation of the openness claim.

   • [claimed-docs] “ucp.dev positions the protocol as industry-governed rather than single-vendor: "UCP is built by the industry, to enable seamless agentic exp…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the Universal Commerce Protocol spec is published in the open — https://ucp.dev/llms.txt serves the ver…”
   • [claimed-docs] “Allows autonomous AI agents to transact on behalf of users with pre-defined, verifiable boundaries.”
   • [probe] “PROBE runtime (recorded 2026-09-14): the documented agent-profile trust gate behaves as specified — a keyless raw tools/call search_catalog …”

   proof ↗⚑ flag

   Crossmint—none0/10

   Crossmint documents its own REST/agent APIs (cards, wallets, checkouts) but the evidence shows no open, versioned specification of its own commerce protocol — the OpenAPI/swagger probe returned 404 on all candidate paths, and no spec repository or versioning scheme is mentioned. While Crossmint implements external protocols like x402 and MPP, it does not publish its own commerce protocol as an open spec.

   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.crossmint.com/openapi.json, https://docs.crossmint.com/swagger.json, https://docs.cross…”

   proof ↗⚑ flag

Disputes

1. developerDisputes and chargebacks on agent transactions can be handled via API — evidence submission, status, outcomes

   weight 2 · round drawn
   Shopify Agentic Commerce—none0/10

   The evidence pack covers catalog, cart, checkout, order state, and order webhooks (which surface refunds/returns/cancellations), but nowhere mentions a dispute or chargeback API, evidence submission, dispute status tracking, or dispute outcome handling for agent transactions.

   ⚑ flag

   Crossmint—none0/10

   The only relevant evidence states that Crossmint itself absorbs dispute risk and manages chargebacks directly with the bank on the user's behalf (crossmint-supp-10), which is for the general Checkout product, not agent-specific. There is no documentation of any developer-facing API for submitting dispute evidence, checking dispute status, or retrieving outcomes. Missing for 10: any dispute-management API endpoints, evidence-submission workflow, or status/outcome reporting for agent transactions.

   • [claimed-docs] “For card checkout, Crossmint absorbs dispute risk: "Crossmint will take on the risk and manage disputes directly with the bank.", using an a…”

   proof ↗⚑ flag

Refunds

1. developerRefunds on agent-placed orders can be initiated and tracked programmatically

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce~partialclaimed4/10

   Refunds are only surfaced as read/notification events — order webhooks fire on committed changes including refunds, and get_order can be polled to see post-purchase adjustments — but there is no documented API/tool for a developer to programmatically initiate a refund on an agent-placed order; webhook subscription itself is not self-serve ('contact your Shopify partner manager'). missing for 10: an actual refund-initiation endpoint/tool (create_refund or equivalent), self-serve webhook subscription for refund events, and any tracking dashboard/status API dedicated to refund lifecycle beyond generic order state.

   • [claimed-docs] “"Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (fu…”
   • [claimed-docs] “"The Order MCP server enables AI agents to fetch the current state of an order placed through their agent, including line items, fulfillment…”
   • [claimed-docs] “Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (ful…”
   • [claimed-docs] “enables AI agents to fetch the current state of an order placed through their agent, including line items, fulfillment events, and post-purc…”

   proof ↗⚑ flag

   Crossmint—none0/10

   Evidence covers dispute/chargeback risk absorption for general card Checkout (crossmint-supp-10), but this describes Crossmint handling bank disputes, not a developer-facing refund API for initiating/tracking refunds on agent-placed orders. No refund endpoint, refund object, or tracking mechanism is documented anywhere for Agent Cards, Agent Wallets, or Agent Checkouts. Missing for 10: any refund API/endpoint, refund status tracking, and agent-order-specific refund workflow documentation.

   • [claimed-docs] “For card checkout, Crossmint absorbs dispute risk: "Crossmint will take on the risk and manage disputes directly with the bank.", using an a…”
   • [claimed-docs] “Merchant coverage is URL-universal: "Let your agent buy from any merchant with a single API." — hand it "a product URL and a spending cap, a…”
   • [claimed-docs] “Scoped card spending: "An order intent gives the agent a fixed allowance with an amount, description, and expiration, enforced through Visa …”

   proof ↗⚑ flag

Agent identity

1. merchantAgents identify themselves verifiably — registered profiles, signatures, or trust tiers — so I can tell trusted agent traffic from anonymous bots

   weight 3 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce✓fullprobed9/10

   Shopify's UCP documents a concrete three-tier trust model (Token, Signed, Anonymous) tied to agent identity, with Signed-tier requiring RFC 9421 ECDSA P-256 signature verification against a published public key in the agent's UCP profile, and access/rate-limits scaling with identification strength; a live probe confirms the trust gate actually enforces this (invalid_profile_url error when no hosted profile is presented). This gives merchants a verifiable way to distinguish anonymous vs. cryptographically-signed vs. token-authenticated agent traffic. missing for 10: no independent/third-party audit of the signature verification in production merchant traffic, and no merchant-facing dashboard/reporting evidence showing how tier data is surfaced to merchants themselves.

   • [claimed-docs] “"UCP traffic to Shopify's MCP servers is classified into three tiers based on how your agent identifies itself" — Token, Signed, Anonymous —…”
   • [claimed-docs] “In UCP, "a platform profile is a JSON document that describes the protocol version and capabilities the platform supports"; the business sid…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the documented agent-profile trust gate behaves as specified — a keyless raw tools/call search_catalog …”
   • [claimed-docs] “Shopify uses your profile to learn what your agent declares, intersect it with what the shop supports, and settle on a single negotiated set…”
   • [claimed-docs] “Negotiation is server-selects. The business computes the intersection of its capabilities with the platform's and chooses the active set”

   proof ↗⚑ flag

   Crossmint~partialprobed5/10

   Crossmint's agent stack does embed verifiable-identity mechanisms — onchain delegated signer keys with scoped, revocable permissions (crossmint-supp-4), card-network verified 'Agent Cards' secured by Visa VIC/Mastercard Agent Pay (crossmint-supp-1, -3), and a distinct 'ServerKeyAgent' credential type confirmed live at the Agent Checkouts endpoint (crossmint-probe-rt-1). These give merchants some cryptographic/network-level basis to distinguish agent-initiated, permissioned transactions from anonymous traffic. However, there is no documented merchant-facing registry, trust-tier system, or API for merchants to look up/verify an agent's identity or reputation directly — the verification lives inside Crossmint/card-network infrastructure rather than being exposed as a merchant-consumable signal. Missing for 10: an explicit merchant-facing agent identity/reputation lookup or trust-tier classification, and independent confirmation that merchants can actually distinguish trust levels using this data.

   • [claimed-docs] “Crossmint's agent stack is three composable products, verbatim: Agent Cards — "a card for your agent to pay with, secured by Visa VIC and Ma…”
   • [claimed-docs] “Credentials are one-time and network-verified: minting returns "the secure one-time card number, expiration, and CVC", and verification is a…”
   • [claimed-docs] “Agent wallets are user-owned with onchain-enforced delegation: "The user owns a non-custodial wallet and grants the agent scoped permissions…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the Agent Checkouts endpoint is live and agent-scoped — a keyless POST to https://www.crossmint.com/api…”

   proof ↗⚑ flag

Human oversight

1. ai-native userSensitive agent spending requires my documented approval — a confirmation step, signed mandate, or per-purchase consent — before money moves

   weight 3 · round drawn
   Shopify Agentic Commerce~partialclaimed6/10

   Shopify's UCP checkout flow documents explicit pre-purchase gates: complete_checkout must only be called once 'Checkout status is ready_for_complete', the 'Buyer has reviewed and confirmed the order', and the 'Payment credential has been collected', and unresolved cases force a hand-off to the buyer via continue_url (requires_escalation/requires_buyer_review). AP2 integration adds 'cryptographically signed payment authorizations that are mathematically tied to the specific state of the cart', which maps to a signed-mandate model, and trust tiers restrict complete_checkout to Token-tier agents with explicit purchase permission. However, the docs also note 'Trusted agents can complete checkouts directly,' implying some agents can skip buyer-facing confirmation, and enforcement of the 'buyer reviewed' precondition appears to rely on agent self-attestation rather than a Shopify-verified user signature captured at time of purchase. Missing for 10: independent/third-party confirmation that buyer consent is cryptographically captured (not just agent-declared) and clarity on exactly which agents qualify as 'trusted' to bypass buyer review.

   • [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
   • [claimed-docs] “Buyer handoff is a first-class state: "Build for escalations regardless of how you authenticate." A checkout in requires_escalation means "C…”
   • [claimed-docs] “"UCP traffic to Shopify's MCP servers is classified into three tiers based on how your agent identifies itself" — Token, Signed, Anonymous —…”
   • [claimed-docs] “allows Platforms to provide cryptographically signed payment authorizations that are mathematically tied to the specific state of the cart”
   • [claimed-docs] “ucp.dev positions the protocol as industry-governed rather than single-vendor: "UCP is built by the industry, to enable seamless agentic exp…”

   proof ↗⚑ flag

   Crossmint~partialclaimed6/10

   Crossmint documents strong pre-authorized consent mechanisms — user-signed onchain delegation with spend caps, counterparties, and time windows, plus order-intent 'agent cards' with fixed allowances and expiration — enforced without a per-purchase prompt, and revocable at any time. However, the story asks for documented approval INCLUDING per-purchase consent or signed mandate at time of spend, and Crossmint's model explicitly favors upfront scoped delegation with 'no user prompt per action' rather than a per-transaction confirmation step; this is a deliberate design tradeoff, not a failure, so it's partial rather than disputed. missing for 10: evidence of an optional per-purchase confirmation/step-up flow, independent/hands-on verification of the delegation and revocation actually working in production, and clarity on how disputes/approval work for agent checkouts specifically (dispute coverage is only confirmed for general checkout, not agent checkouts).

   • [claimed-docs] “Agent wallets are user-owned with onchain-enforced delegation: "The user owns a non-custodial wallet and grants the agent scoped permissions…”
   • [claimed-docs] “Scoped card spending: "An order intent gives the agent a fixed allowance with an amount, description, and expiration, enforced through Visa …”
   • [claimed-docs] “"An agent card is an order intent that gives an agent a bounded amount to spend before a fixed expiration." Merchant locking: "The merchant …”
   • [claimed-docs] “Crossmint's agent stack is three composable products, verbatim: Agent Cards — "a card for your agent to pay with, secured by Visa VIC and Ma…”
   • [claimed-docs] “For card checkout, Crossmint absorbs dispute risk: "Crossmint will take on the risk and manage disputes directly with the bank.", using an a…”

   proof ↗⚑ flag

Liability

1. merchantThe fraud, liability, and chargeback rules for agent-initiated transactions are documented so I know who bears the risk

   weight 2 · round to Crossmint
   Shopify Agentic Commerce—none0/10

   The evidence pack documents UCP's protocol mechanics (catalog, cart, checkout, order webhooks, trust tiers, profile negotiation) but nowhere specifies fraud liability, chargeback responsibility, or dispute-resolution rules for agent-initiated purchases. The only tangential mention is UCP's general 'Merchant of Record' framing on ucp.dev, which addresses customer-relationship ownership, not who bears fraud/chargeback risk in an agent transaction — no Shopify-specific policy, contract terms, or dispute process is documented.

   • [claimed-docs] “ucp.dev positions the protocol as industry-governed rather than single-vendor: "UCP is built by the industry, to enable seamless agentic exp…”

   proof ↗⚑ flag

   Crossmint~partialclaimed4/10

   Crossmint documents dispute handling for its general Checkout product (Crossmint absorbs card dispute risk via authorization holds, per crossmint-supp-10) and describes spend caps/order-intent controls for agent cards and wallets, but explicitly notes this chargeback/liability coverage is not specific to agent-initiated transactions. There is no dedicated documentation defining fraud/liability/chargeback allocation rules for agent checkouts or agent-card/agent-wallet flows. missing for 10: explicit agent-transaction-specific liability/chargeback policy, merchant-facing dispute-resolution terms for agent checkouts, and clarity on who bears risk when an agent-initiated purchase is fraudulent or disputed.

   • [claimed-docs] “For card checkout, Crossmint absorbs dispute risk: "Crossmint will take on the risk and manage disputes directly with the bank.", using an a…”
   • [claimed-docs] “Scoped card spending: "An order intent gives the agent a fixed allowance with an amount, description, and expiration, enforced through Visa …”
   • [claimed-docs] “Agent wallets are user-owned with onchain-enforced delegation: "The user owns a non-custodial wallet and grants the agent scoped permissions…”
   • [claimed-docs] “Merchant coverage is URL-universal: "Let your agent buy from any merchant with a single API." — hand it "a product URL and a spending cap, a…”

   proof ↗⚑ flag

Spend controls

1. ai-native userSet per-agent spend caps and usage limits and revoke an agent's payment authority instantly

   weight 2 · round to Crossmint
   Shopify Agentic Commerce—none0/10

   The evidence describes trust tiers, rate limiting, token TTLs, and JWT scopes, but nowhere documents per-agent spend caps, usage limits, or an instant revoke-payment-authority mechanism — tokens simply expire after 60 minutes rather than being explicitly revocable on demand, and no dollar-limit or usage-cap controls are mentioned anywhere in the pack.

   ⚑ flag

   Crossmint✓fullprobed8/10

   Crossmint documents onchain-enforced per-agent spend caps, allowed counterparties, and time windows for agent wallets, plus order-intent allowances with amount/expiration for agent cards, and explicitly states permissions are revocable at any time by the user. This is corroborated by detailed docs on delegation mechanics and a runtime probe confirming agent-scoped auth is live in production. Missing for 10: independent (non-vendor) confirmation that revocation is instantaneous in practice, and no evidence of a unified dashboard/UI for setting caps or revoking across all three agent products (cards, wallets, checkouts) in one place.

   • [claimed-docs] “Scoped card spending: "An order intent gives the agent a fixed allowance with an amount, description, and expiration, enforced through Visa …”
   • [claimed-docs] “Agent wallets are user-owned with onchain-enforced delegation: "The user owns a non-custodial wallet and grants the agent scoped permissions…”
   • [claimed-docs] “Crossmint's agent stack is three composable products, verbatim: Agent Cards — "a card for your agent to pay with, secured by Visa VIC and Ma…”
   • [claimed-docs] “"An agent card is an order intent that gives an agent a bounded amount to spend before a fixed expiration." Merchant locking: "The merchant …”
   • [probe] “PROBE runtime (recorded 2026-09-14): the Agent Checkouts endpoint is live and agent-scoped — a keyless POST to https://www.crossmint.com/api…”

   proof ↗⚑ flag