Shopify Agentic Commerce vs PayPal Agentic Commerce
Shopify Agentic Commerce
Shopify Inc.
Shopify Agentic Commerce wins · 24–10 (12 drawn)
Agent checkout — stories about agent checkout in this arenaAgent checkout
Stories about agent checkout in this arena
Cart
ai-native userMy agent can create and update a cart or order draft through a documented protocol call
weight 3 · round to Shopify Agentic CommerceCart MCP and Checkout MCP are documented UCP protocol calls (create_cart, update_cart, create_checkout, complete_checkout) with JSON-RPC schemas, and a runtime probe confirms a real cart was created keylessly against a live Shopify store via the CLI/protocol. missing for 10: no independent (non-Shopify) hands-on corroboration of a full end-to-end checkout completion.
- [claimed-docs] “"Cart tools accept unauthenticated requests, which lets you estimate totals and share a cart with the buyer before collecting credentials" —…”
- [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
- [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”
- [claimed-docs] “The Cart MCP server enables AI agents to build and iterate on a cart before the buyer commits to purchase. When the buyer is ready to buy, c…”
- [claimed-docs] “The Checkout MCP server enables AI agents to create and manage checkout sessions, convert carts into checkouts, and refer buyers to the merc…”
PayPal documents a concrete, callable cart protocol: POST /merchant-cart createcart to create a cart from a PayPalCart object and getcart to retrieve/update cart status, validation issues, and totals, explicitly invoked by AI agents/PayPal Shopping Cart during checkout; the agent toolkit also exposes create_order and related order-management tools callable by AI agents via MCP/LangChain/etc. Missing for 10: no independent hands-on developer report confirming a live end-to-end agent-driven cart creation/update flow beyond PayPal's own docs, and cart update (vs. only create/get) isn't explicitly documented as a separate call.
- [claimed-docs] “Creates a new cart with the provided PayPalCart object. This is called by PayPal Shopping Cart when an AI agent or customer initiates a chec…”
- [claimed-docs] “Retrieves the current state of a cart. Used by PayPal Shopping Cart to check cart status, validation issues, and current totals.”
- [claimed-docs] “Cart execution is a reverse API the merchant hosts: POST /merchant-cart "Creates a new cart with the provided PayPalCart object. This is cal…”
- [claimed-docs] “The companion read endpoint keeps agent-side cart state fresh: get cart "Retrieves the current state of a cart. Used by PayPal Shopping Cart…”
- [claimed-docs] “Post-purchase operations are first-class agent tools: refunds via create_refund / get_refund (a "refund for a captured payment", where "If n…”
- [claimed-docs] “"PayPal's agent toolkit supports the integration of PayPal APIs into AI agent workflows using" Amazon Bedrock, CrewAI, LangChain, MCP, OpenA…”
Checkout
ai-native userMy agent can complete a purchase end-to-end — checkout session, delegated payment credential, confirmed order
weight 3 · round to Shopify Agentic CommerceDocs describe a full documented path — create_checkout, payment_handlers (e.g. com.google.pay) negotiation, complete_checkout requiring a collected payment credential, and order confirmation via get_order/order webhooks — and even name complete_checkout as Token-tier gated 'when the token is granted permission to complete purchases.' However, the default flow explicitly hands off to the buyer's browser for payment ('Build carts, convert them to checkouts, and hand off to the merchant for payment') and the only hands-on runtime probe reached cart creation only, explicitly stopping 'no checkout, no payment.' Missing for 10: an independent/hands-on trace of an actual complete_checkout call with a delegated payment credential and a resulting confirmed order, and clarity on how broadly (vs. only select trusted agents) autonomous payment completion is actually granted.
- [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
- [claimed-docs] “Buyer handoff is a first-class state: "Build for escalations regardless of how you authenticate." A checkout in requires_escalation means "C…”
- [claimed-docs] “"UCP traffic to Shopify's MCP servers is classified into three tiers based on how your agent identifies itself" — Token, Signed, Anonymous —…”
- [claimed-docs] “"The Order MCP server enables AI agents to fetch the current state of an order placed through their agent, including line items, fulfillment…”
- [claimed-docs] “"Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (fu…”
- [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”
Docs describe a real end-to-end path: agent-initiated checkout session (ACP requestCheckout / UCP checkout-session), a delegated one-time-use payment credential (Braintree nonce / Google Pay token), and order confirmation flowing into the merchant's existing order system, backed by a cart API and agent toolkit tools (create_order, pay_order). However this is gated behind Braintree accounts, PayPal's form-based approval, Google's separate merchant enablement, and Store Sync's narrow scope (US, physical goods only) — all from first-party docs with no independent or hands-on confirmation of a completed purchase. Missing for 10: independent/hands-on evidence of an actual completed agent purchase, broader (non-gated) merchant eligibility, and real-world confirmation beyond sandbox/spec descriptions.
- [claimed-docs] “The ACP path is an in-ChatGPT checkout build: "Implement an MCP server with the `complete_checkout` tool to receive tokens", "Call `requestC…”
- [claimed-docs] “The UCP path targets Google surfaces: "This enables AI-powered checkout experiences through Google AI Mode (Gemini), where Google Pay return…”
- [claimed-docs] “Store Sync is the full-catalog path, "enabling AI agents to discover your products, create and manage shopping carts, and complete purchases…”
- [claimed-docs] “Cart execution is a reverse API the merchant hosts: POST /merchant-cart "Creates a new cart with the provided PayPalCart object. This is cal…”
- [claimed-docs] “Post-purchase operations are first-class agent tools: refunds via create_refund / get_refund (a "refund for a captured payment", where "If n…”
- [claimed-docs] “Access to PayPal's agentic commerce services is form-gated, not self-serve: merchants must complete a form "to contact the AI team at PayPal…”
- [probe] “PROBE runtime (recorded 2026-09-14): PayPal's remote MCP server is live — a keyless JSON-RPC initialize POST to https://mcp.paypal.com/mcp a…”
Embedded surfaces
merchantBuyers can complete purchases of my products inside chat and assistant surfaces (ChatGPT, Claude, Gemini, Copilot and peers)
weight 2 · round drawnShopify ships a real, live UCP checkout stack — Catalog, Cart, and Checkout MCP servers with a documented complete_checkout tool that can 'submit payment and place the order' for Token-tier trusted agents, backed by a runtime-verified cart creation and marketing claiming buyers 'check out right in the chat' — and UCP itself is co-developed with Google, Microsoft, OpenAI-adjacent ecosystem players. However, the docs make buyer handoff/escalation a first-class, common path ('hand off to the buyer via continue_url', 'Build for escalations regardless of how you authenticate'), meaning many purchases route the buyer out to the merchant's own checkout page rather than completing fully inside the chat UI, and named surfaces beyond Claude (only a Claude plugin is documented) — ChatGPT, Gemini, Copilot — have no confirmed live integration in the evidence. Missing for 10: confirmed named integrations with ChatGPT/Gemini/Copilot, evidence that in-chat completion (not handoff) is the norm rather than the exception, and independent buyer-side confirmation of an end-to-end in-chat purchase.
- [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
- [claimed-docs] “Buyer handoff is a first-class state: "Build for escalations regardless of how you authenticate." A checkout in requires_escalation means "C…”
- [claimed-docs] “"UCP traffic to Shopify's MCP servers is classified into three tiers based on how your agent identifies itself" — Token, Signed, Anonymous —…”
- [claimed-docs] “Get discovered across AI channels. Shoppers check out right in the chat.”
- [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”
- [claimed-docs] “ucp.dev positions the protocol as industry-governed rather than single-vendor: "UCP is built by the industry, to enable seamless agentic exp…”
PayPal offers real infrastructure for in-chat checkout: ACP for ChatGPT (via Braintree delegated tokens), UCP for Google AI Mode/Gemini (via Google Pay tokens), and Store Sync for broader catalog/agent discovery, plus an MCP server and agent toolkit. However, coverage is fragmented and gated — Store Sync is US-only, physical-goods-only, and access is form-gated with manual onboarding; ACP/UCP require an existing Braintree relationship or separate Google merchant registration; no evidence of Claude or Copilot checkout support is present. Missing for 10: broader platform coverage beyond ChatGPT/Google (Claude, Copilot), self-serve enablement without form gating, and independent/hands-on confirmation of live buyer transactions completing in-chat.
- [claimed-docs] “"Agent Ready helps Braintree merchants accept payments from AI shopping assistants across major platforms, including ChatGPT, Google AI Mode…”
- [claimed-docs] “The ACP path is an in-ChatGPT checkout build: "Implement an MCP server with the `complete_checkout` tool to receive tokens", "Call `requestC…”
- [claimed-docs] “The UCP path targets Google surfaces: "This enables AI-powered checkout experiences through Google AI Mode (Gemini), where Google Pay return…”
- [claimed-docs] “Store Sync is the full-catalog path, "enabling AI agents to discover your products, create and manage shopping carts, and complete purchases…”
- [claimed-docs] “Access to PayPal's agentic commerce services is form-gated, not self-serve: merchants must complete a form "to contact the AI team at PayPal…”
- [claimed-docs] “Catalog publishing is feed-file based: "PayPal supports 3 feed specifications", including the Google Product Feed ("you can reuse it to powe…”
- [probe] “PROBE runtime (recorded 2026-09-14): PayPal's remote MCP server is live — a keyless JSON-RPC initialize POST to https://mcp.paypal.com/mcp a…”
Protocol conformance
developerBuild against a versioned commerce protocol with a published schema and conformance or validation tooling
weight 2 · round to Shopify Agentic CommerceUCP is documented as a versioned protocol (dated releases like 2026-08-25, 2026-04-08) with a publicly hosted spec and reference implementations on GitHub, and Shopify's MCP servers enforce schema/profile validation at runtime (e.g. `--input-schema` to fetch a merchant's live input schema, and a probed `invalid_profile_url` error when an agent lacks a valid hosted profile), plus an AI Toolkit that validates GraphQL/Liquid/Extensions against Shopify schemas. Missing for 10: an explicit standalone conformance test suite or certification program for third-party UCP implementations, and independent (non-Shopify) corroboration of schema stability across versions.
- [claimed-docs] “In UCP, "a platform profile is a JSON document that describes the protocol version and capabilities the platform supports"; the business sid…”
- [claimed-docs] “"The Storefront Catalog MCP server enables AI agents to search and discover products from a single merchant's catalog, helping buyers find a…”
- [probe] “PROBE runtime (recorded 2026-09-14): the documented agent-profile trust gate behaves as specified — a keyless raw tools/call search_catalog …”
- [claimed-docs] “ucp.dev positions the protocol as industry-governed rather than single-vendor: "UCP is built by the industry, to enable seamless agentic exp…”
- [probe] “PROBE runtime (recorded 2026-09-14): the Universal Commerce Protocol spec is published in the open — https://ucp.dev/llms.txt serves the ver…”
- [claimed-docs] “validate GraphQL queries, Liquid templates, and Shopify Extensions against Shopify schemas to catch issues earlier”
PayPal does version its agentic-commerce cart API (v1 createcart/getcart) and provides catalog-feed validation tooling for Store Sync ('a validated product catalog file' against Google/OpenAI ACP feed specs), and it interoperates with external versioned protocols (ACP, UCP). But there's no evidence of a published, standalone schema (e.g., OpenAPI/JSON Schema) for PayPal's own agentic-commerce protocol nor a formal conformance/test suite for developers to validate protocol implementations beyond feed-file field checks. Missing for 10: published protocol schema/spec document, dedicated conformance or validation test suite for the cart/checkout API (not just catalog feed format), and independent evidence of developers using such tooling.
- [claimed-docs] “Creates a new cart with the provided PayPalCart object. This is called by PayPal Shopping Cart when an AI agent or customer initiates a chec…”
- [claimed-docs] “Retrieves the current state of a cart. Used by PayPal Shopping Cart to check cart status, validation issues, and current totals.”
- [claimed-docs] “Catalog publishing is feed-file based: "PayPal supports 3 feed specifications", including the Google Product Feed ("you can reuse it to powe…”
- [claimed-docs] “Cart execution is a reverse API the merchant hosts: POST /merchant-cart "Creates a new cart with the provided PayPalCart object. This is cal…”
- [claimed-docs] “The companion read endpoint keeps agent-side cart state fresh: get cart "Retrieves the current state of a cart. Used by PayPal Shopping Cart…”
Agent discovery — stories about agent discovery in this arenaAgent discovery
Stories about agent discovery in this arena
Agent search
ai-native userMy agent can programmatically search products or services across merchants — keylessly or with self-service credentials, no private partnership required
weight 3 · round to Shopify Agentic CommerceShopify's Global Catalog MCP server explicitly supports keyless, self-service cross-merchant product search ('search and discover products across the entire Shopify ecosystem... from multiple merchants'), requiring only a self-hosted UCP agent profile URL rather than a private partnership — confirmed by a live runtime probe showing a full keyless JSON-RPC handshake and catalog search against catalog.shopify.com/api/ucp/mcp, and another probe showing the profile-gate behaves as documented (self-service profile, not vendor approval). Storefront-level search is similarly self-service per-merchant. Missing for 10: independent (non-Shopify) developer corroboration of onboarding friction, and confirmation that profile creation itself has no gatekeeping/approval step.
- [claimed-docs] “"The Global Catalog MCP server enables AI agents to search and discover products across the entire Shopify ecosystem, helping buyers find pr…”
- [probe] “PROBE runtime (recorded 2026-09-14): Shopify's Global Catalog MCP server is live — a keyless JSON-RPC initialize POST to https://catalog.sho…”
- [probe] “PROBE runtime (recorded 2026-09-14): the documented agent-profile trust gate behaves as specified — a keyless raw tools/call search_catalog …”
- [claimed-docs] “In UCP, "a platform profile is a JSON document that describes the protocol version and capabilities the platform supports"; the business sid…”
- [claimed-docs] “"The Storefront Catalog MCP server enables AI agents to search and discover products from a single merchant's catalog, helping buyers find a…”
PayPal Agentic Commercedisputedcontradicted3/10PayPal frames agentic commerce as 'connect once to reach many platforms', but access to Store Sync/agentic commerce services is explicitly form-gated ('merchants must complete a form... to request access... PayPal AI team will follow up to guide onboarding'), Agent Ready requires an existing Braintree merchant relationship, and UCP requires separate Google merchant registration — none of this is keyless or self-service, and runtime probing confirms the live MCP server itself demands OAuth Bearer authentication (401 + www-authenticate) rather than allowing keyless discovery calls. This contradicts the story's requirement of keyless or self-service, no-partnership product search across merchants. Missing for 10: keyless/anonymous cross-merchant product search, a genuinely self-serve onboarding path without a sales/approval form, and evidence of catalog search working without a pre-existing Braintree/PayPal merchant relationship.
- [claimed-docs] “Access to PayPal's agentic commerce services is form-gated, not self-serve: merchants must complete a form "to contact the AI team at PayPal…”
- [claimed-docs] “Store Sync is the full-catalog path, "enabling AI agents to discover your products, create and manage shopping carts, and complete purchases…”
- [claimed-docs] “"Agent Ready helps Braintree merchants accept payments from AI shopping assistants across major platforms, including ChatGPT, Google AI Mode…”
- [probe] “PROBE runtime (recorded 2026-09-14): PayPal's remote MCP server is live — a keyless JSON-RPC initialize POST to https://mcp.paypal.com/mcp a…”
Machine readable offers
developerRead machine-readable offer data — price, availability, variants, checkout links — for any listed product or service
weight 2 · round to Shopify Agentic CommerceShopify's Catalog MCP servers (global and storefront) expose structured, machine-readable product data — price (minor units), availability, variants, media, checkout links (continue_url) — verified live via runtime probes (get_product, search_catalog, cart continue_url), and Cart/Checkout MCP further surface checkout links and negotiated payment handlers. Missing for 10: no independent third-party benchmark of data completeness/accuracy across many merchants beyond Shopify's own demo store.
- [claimed-docs] “"The Global Catalog MCP server enables AI agents to search and discover products across the entire Shopify ecosystem, helping buyers find pr…”
- [claimed-docs] “"The Storefront Catalog MCP server enables AI agents to search and discover products from a single merchant's catalog, helping buyers find a…”
- [claimed-docs] “"Cart tools accept unauthenticated requests, which lets you estimate totals and share a cart with the buyer before collecting credentials" —…”
- [probe] “PROBE runtime (recorded 2026-09-14): Shopify's Global Catalog MCP server is live — a keyless JSON-RPC initialize POST to https://catalog.sho…”
- [probe] “PROBE runtime (recorded 2026-09-14): a Shopify-operated storefront's own UCP endpoint is live — a keyless JSON-RPC initialize POST to https:…”
- [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”
PayPal's Store Sync catalog feed spec and agent-toolkit's list_product/show_product_details tools do define machine-readable offer fields (id, title, price, availability, description, image_link, link — with each row representing a product variant) and cart-read endpoints expose price/checkout totals, so the core data model the story asks for exists. But this is a gated, merchant-onboarding pathway (form approval required, US-only physical goods, Braintree/PayPal-account prerequisite) rather than an open read surface for 'any listed product,' and there's no evidence of a simple public GET-offer endpoint or checkout-link retrieval independent of the full agentic-commerce integration. Missing for 10: an open/self-serve read API (vs form-gated onboarding), broader product/geography scope, explicit example of returning a checkout link, independent/hands-on corroboration of reading catalog data.
- [claimed-docs] “Catalog publishing is feed-file based: "PayPal supports 3 feed specifications", including the Google Product Feed ("you can reuse it to powe…”
- [claimed-docs] “Store Sync is the full-catalog path, "enabling AI agents to discover your products, create and manage shopping carts, and complete purchases…”
- [claimed-docs] “Post-purchase operations are first-class agent tools: refunds via create_refund / get_refund (a "refund for a captured payment", where "If n…”
- [claimed-docs] “The companion read endpoint keeps agent-side cart state fresh: get cart "Retrieves the current state of a cart. Used by PayPal Shopping Cart…”
- [claimed-docs] “Access to PayPal's agentic commerce services is form-gated, not self-serve: merchants must complete a form "to contact the AI team at PayPal…”
Merchant feeds
merchantPublish my product or service catalog into agent surfaces through a documented feed or import API so AI agents can discover what I sell
weight 3 · round to Shopify Agentic CommerceShopify's Storefront Catalog MCP server exposes each merchant's product catalog at a documented, live endpoint ({shop}.myshopify.com/api/ucp/mcp), confirmed by both docs and a runtime probe (hardware.shopify.com handshake), and merchants are also discoverable via the cross-merchant Global Catalog MCP server, with a documented UCP profile mechanism for agent identification/negotiation. missing for 10: no separate static feed/file-based import format (e.g., XML/JSON feed upload) is documented beyond the live MCP query interface, and no independent third-party merchant case study confirms adoption.
- [claimed-docs] “"The Storefront Catalog MCP server enables AI agents to search and discover products from a single merchant's catalog, helping buyers find a…”
- [claimed-docs] “"The Global Catalog MCP server enables AI agents to search and discover products across the entire Shopify ecosystem, helping buyers find pr…”
- [probe] “PROBE runtime (recorded 2026-09-14): Shopify's Global Catalog MCP server is live — a keyless JSON-RPC initialize POST to https://catalog.sho…”
- [probe] “PROBE runtime (recorded 2026-09-14): a Shopify-operated storefront's own UCP endpoint is live — a keyless JSON-RPC initialize POST to https:…”
- [claimed-docs] “In UCP, "a platform profile is a JSON document that describes the protocol version and capabilities the platform supports"; the business sid…”
- [claimed-docs] “enables AI agents to search and discover products from a single merchant's catalog, helping buyers find and purchase products from that stor…”
PayPal documents a real catalog-publishing path (Store Sync with feed specs like Google Product Feed/OpenAI ACP Product Feed, CSV/TSV/PSV, field requirements) that explicitly targets AI-agent discovery, plus partner-based catalog connections (Wix, Cymbio, BigCommerce/Feedonomics, Shopware). However, access is form-gated (not self-serve), scope is narrow (US-only, physical goods, USD only), and eligibility requires an existing PayPal/Braintree merchant account with compatible setup. missing for 10: self-serve onboarding without a sales-gated form, broader product-type/geography coverage, independent merchant confirmation the feed import actually surfaces products in live agent surfaces (ChatGPT/Gemini) rather than only demo/spec documentation.
- [claimed-docs] “Easy setup: Connect your product listings to PayPal's partners like Wix, Cymbio, Commerce (BigCommerce & Feedonomics), and Shopware to make …”
- [claimed-docs] “It connects your product catalog and commerce API with PayPal's agentic commerce services, enabling AI agents to discover your products, cre…”
- [claimed-docs] “By the end of this page, you will have a validated product catalog file that is ready to connect to Store Sync.”
- [claimed-docs] “Access to PayPal's agentic commerce services is form-gated, not self-serve: merchants must complete a form "to contact the AI team at PayPal…”
- [claimed-docs] “Store Sync is the full-catalog path, "enabling AI agents to discover your products, create and manage shopping carts, and complete purchases…”
- [claimed-docs] “Catalog publishing is feed-file based: "PayPal supports 3 feed specifications", including the Google Product Feed ("you can reuse it to powe…”
Service discovery
ai-native userMy agent can discover payable services and APIs through a published directory or discovery index
weight 2 · round to Shopify Agentic CommerceShopify publishes UCP-compliant Global Catalog and Storefront Catalog MCP servers that agents can discover payable services/products through, with documented endpoints, tool schemas, and profile-based discovery negotiation, corroborated by live runtime probes showing real handshakes and search/cart flows against catalog.shopify.com and a merchant storefront. The broader UCP spec is also openly published (ucp.dev) as an industry discovery standard. Missing for 10: a single canonical top-level directory/index listing all payable services across merchants (discovery is per-server/per-merchant plus a global catalog, not one unified public index), and independent (non-Shopify) confirmation of third-party agent adoption discovering via this index.
- [claimed-docs] “enables AI agents to search and discover products across the entire Shopify ecosystem, helping buyers find products from multiple merchants”
- [claimed-docs] “enables AI agents to search and discover products from a single merchant's catalog, helping buyers find and purchase products from that stor…”
- [claimed-docs] “"The Global Catalog MCP server enables AI agents to search and discover products across the entire Shopify ecosystem, helping buyers find pr…”
- [claimed-docs] “"The Storefront Catalog MCP server enables AI agents to search and discover products from a single merchant's catalog, helping buyers find a…”
- [claimed-docs] “In UCP, "a platform profile is a JSON document that describes the protocol version and capabilities the platform supports"; the business sid…”
- [probe] “PROBE runtime (recorded 2026-09-14): Shopify's Global Catalog MCP server is live — a keyless JSON-RPC initialize POST to https://catalog.sho…”
- [probe] “PROBE runtime (recorded 2026-09-14): a Shopify-operated storefront's own UCP endpoint is live — a keyless JSON-RPC initialize POST to https:…”
- [probe] “PROBE runtime (recorded 2026-09-14): the documented agent-profile trust gate behaves as specified — a keyless raw tools/call search_catalog …”
- [claimed-docs] “ucp.dev positions the protocol as industry-governed rather than single-vendor: "UCP is built by the industry, to enable seamless agentic exp…”
- [probe] “PROBE runtime (recorded 2026-09-14): the Universal Commerce Protocol spec is published in the open — https://ucp.dev/llms.txt serves the ver…”
PayPal provides discovery mechanisms — Store Sync product-catalog feeds (Google Product Feed / OpenAI ACP Product Feed) that let AI agents 'discover your products' and a live MCP server discoverable via RFC 9728 well-known metadata — but there is no published cross-merchant directory or marketplace index of payable services/APIs; discovery is scoped to a single merchant's catalog after form-gated onboarding, and Store Sync itself is limited to US physical goods only. missing for 10: a cross-merchant/public discovery index of payable services or APIs, evidence of self-serve (non form-gated) discoverability, and support beyond US physical goods.
- [claimed-docs] “It connects your product catalog and commerce API with PayPal's agentic commerce services, enabling AI agents to discover your products, cre…”
- [claimed-docs] “Store Sync is the full-catalog path, "enabling AI agents to discover your products, create and manage shopping carts, and complete purchases…”
- [claimed-docs] “Catalog publishing is feed-file based: "PayPal supports 3 feed specifications", including the Google Product Feed ("you can reuse it to powe…”
- [claimed-docs] “Access to PayPal's agentic commerce services is form-gated, not self-serve: merchants must complete a form "to contact the AI team at PayPal…”
- [probe] “PROBE runtime (recorded 2026-09-14): PayPal's remote MCP server is live — a keyless JSON-RPC initialize POST to https://mcp.paypal.com/mcp a…”
- [probe] “official MCP server documented at https://developer.paypal.com/ai-tools/mcp-server”
Agenticness — how well agents can access and operate the productAgenticness
How well agents can access and operate the product
Agent access
ai-native userPoint an agent at llms.txt or agent-oriented docs
weight 2 · round to PayPal Agentic CommerceShopify does not host its own llms.txt (shopify.dev/llms.txt returns 404), but it provides extensive agent-oriented documentation reachable via .md suffixed URLs (e.g. shopify.dev/docs/agents.md returns 200 with structured content) covering catalog, cart, checkout, orders, and profiles — exactly the kind of agent-consumable docs the story asks for. The related UCP spec (ucp.dev/llms.txt) does serve a proper llms.txt index, showing the ecosystem partially satisfies this pattern even though Shopify's own domain doesn't. Missing for 10: a working llms.txt directly at shopify.dev, and independent (non-Shopify) confirmation that agents reliably parse these .md docs as intended.
- [probe] “PROBE llms.txt: HTTP 404 at https://shopify.dev/llms.txt”
- [probe] “PROBE docs-md: HTTP 200 at https://shopify.dev/docs/agents.md --- title: Agentic commerce description: >- Build AI agents that authenticat…”
- [probe] “PROBE runtime (recorded 2026-09-14): the Universal Commerce Protocol spec is published in the open — https://ucp.dev/llms.txt serves the ver…”
- [claimed-docs] “Initialize a local UCP profile.”
- [claimed-docs] “This quickstart runs the full agentic commerce flow with the UCP CLI, from product discovery to order tracking, in about five minutes.”
There's a confirmed live llms.txt at developer.paypal.com/llms.txt (HTTP 200) plus per-page .md agent-readable docs (e.g. agent-ready/overview.md), and the docs are explicitly agent-oriented (MCP server, agent toolkit, ACP/UCP guides) that an AI agent could consume directly. Missing for 10: no independent third-party report of an agent actually consuming llms.txt successfully in the wild, just first-party probes.
- [probe] “PROBE llms.txt: HTTP 200 at https://developer.paypal.com/llms.txt # PayPal Developer Documentation > PayPal's developer documentation for i…”
- [probe] “PROBE docs-md: HTTP 200 at https://developer.paypal.com/agent-ready/overview.md # Agent Ready overview (/agent-ready/overview) Agent Read…”
- [probe] “official MCP server documented at https://developer.paypal.com/ai-tools/mcp-server”
- [probe] “PROBE runtime (recorded 2026-09-14): PayPal's remote MCP server is live — a keyless JSON-RPC initialize POST to https://mcp.paypal.com/mcp a…”
ai-native userRun the product headlessly / in CI for automation
weight 2 · round to Shopify Agentic CommerceThe UCP CLI is explicitly designed as a scriptable, headless tool with structured commands (search, cart, checkout, order tracking) usable via npm install and local profile init, and probes confirm real keyless CLI runs against live endpoints (catalog search, cart creation) succeeding non-interactively — consistent with CI/automation use. missing for 10: no explicit CI pipeline example (e.g., GitHub Actions), no documented exit codes/machine-readable output format guarantees, and no independent third-party report of running it in a CI environment.
- [claimed-docs] “Initialize a local UCP profile.”
- [claimed-docs] “This quickstart runs the full agentic commerce flow with the UCP CLI, from product discovery to order tracking, in about five minutes.”
- [claimed-docs] “The CLI uses a local profile to identify your agent on every merchant-scoped request. Initialize it once and the CLI reuses it for every ope…”
- [claimed-docs] “Shopify's agent surface is UCP end to end via "Shopify's UCP-compliant MCP servers": the UCP CLI "provides structured commands to search the…”
- [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”
- [probe] “PROBE runtime (recorded 2026-09-14): the documented agent-profile trust gate behaves as specified — a keyless raw tools/call search_catalog …”
- [probe] “official CLI documented at https://shopify.dev/docs/agents/get-started/quickstart”
PayPal's agent toolkit (npm/PyPI packages) and REST APIs, plus the sandbox environment, can be scripted headlessly and invoked from CI pipelines via SDKs (LangChain, CrewAI, OpenAI Agents SDK, MCP) without a UI; webhooks and sandbox credentials support automated testing. However the remote MCP server requires interactive OAuth/PKCE authorization flow (dynamic client registration, bearer auth), which complicates pure headless/CI use, and there's no explicit CI/automation guide or example pipeline in the evidence. missing for 10: documented headless auth flow for CI (service-account/client-credentials for MCP), explicit CI/automation examples, and independent confirmation of unattended operation.
- [claimed-docs] “"PayPal's agent toolkit supports the integration of PayPal APIs into AI agent workflows using" Amazon Bedrock, CrewAI, LangChain, MCP, OpenA…”
- [probe] “PROBE runtime (recorded 2026-09-14): the PayPal Agent Toolkit resolves on the public npm registry (npm view @paypal/agent-toolkit → 1.11.0, …”
- [claimed-docs] “The PayPal sandbox "is a self-contained, virtual testing environment that simulates the live PayPal production environment" — "a shielded sp…”
- [probe] “PROBE runtime (recorded 2026-09-14): PayPal's remote MCP server is live — a keyless JSON-RPC initialize POST to https://mcp.paypal.com/mcp a…”
- [claimed-docs] “The developer portal's REST API getting-started page anchors the agent surface: "REST APIs, including orders, payments, subscriptions, invoi…”
ai-native userConnect an agent via an official MCP server
weight 3 · round to Shopify Agentic CommerceShopify ships multiple official UCP-compliant MCP servers (Global Catalog, Storefront Catalog, Cart, Checkout, Order) plus a Storefront MCP, all documented and independently probe-verified with live handshakes (catalog.shopify.com/api/ucp/mcp, per-merchant endpoints) and real cart creation via the CLI. Agent identification/authentication via hosted profiles and tiered trust is also verified in runtime probes. Missing for 10: independent third-party (non-Shopify) developer accounts of connecting an arbitrary agent end-to-end beyond Shopify's own probes.
- [claimed-docs] “Shopify's agent surface is UCP end to end via "Shopify's UCP-compliant MCP servers": the UCP CLI "provides structured commands to search the…”
- [claimed-docs] “"The Global Catalog MCP server enables AI agents to search and discover products across the entire Shopify ecosystem, helping buyers find pr…”
- [claimed-docs] “"The Storefront Catalog MCP server enables AI agents to search and discover products from a single merchant's catalog, helping buyers find a…”
- [claimed-docs] “"Cart tools accept unauthenticated requests, which lets you estimate totals and share a cart with the buyer before collecting credentials" —…”
- [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
- [claimed-docs] “"The Order MCP server enables AI agents to fetch the current state of an order placed through their agent, including line items, fulfillment…”
- [probe] “PROBE runtime (recorded 2026-09-14): Shopify's Global Catalog MCP server is live — a keyless JSON-RPC initialize POST to https://catalog.sho…”
- [probe] “PROBE runtime (recorded 2026-09-14): a Shopify-operated storefront's own UCP endpoint is live — a keyless JSON-RPC initialize POST to https:…”
- [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”
- [probe] “PROBE runtime (recorded 2026-09-14): the documented agent-profile trust gate behaves as specified — a keyless raw tools/call search_catalog …”
- [claimed-docs] “Connect any AI assistant to real-time commerce data from Shopify stores with Model Context Protocol (MCP) servers”
PayPal documents and runtime-probes an official MCP server (developer.paypal.com/ai-tools/mcp-server) plus a published agent-toolkit npm/PyPI package explicitly listing MCP as a supported integration, and a live probe confirms the remote MCP endpoint (mcp.paypal.com/mcp) responds with proper OAuth-protected-resource metadata. missing for 10: independent/community hands-on confirmation of a successful end-to-end MCP client connection (beyond PayPal's own docs and the auth-handshake probe), and clearer documentation of the full tool list exposed over MCP.
- [claimed-docs] “PayPal built an MCP server that lets merchants use natural language with their favorite MCP clients. This helps users complete business task…”
- [probe] “official MCP server documented at https://developer.paypal.com/ai-tools/mcp-server”
- [probe] “PROBE runtime (recorded 2026-09-14): PayPal's remote MCP server is live — a keyless JSON-RPC initialize POST to https://mcp.paypal.com/mcp a…”
- [probe] “PROBE runtime (recorded 2026-09-14): the PayPal Agent Toolkit resolves on the public npm registry (npm view @paypal/agent-toolkit → 1.11.0, …”
- [claimed-docs] “"PayPal's agent toolkit supports the integration of PayPal APIs into AI agent workflows using" Amazon Bedrock, CrewAI, LangChain, MCP, OpenA…”
ai-native userUse an official CLI
weight 2 · round to Shopify Agentic CommerceShopify documents and ships an official UCP CLI (`@shopify/ucp-cli`) with structured commands for catalog search, cart building, checkout, and order tracking, backed by a quickstart guide and runtime probes confirming live functionality (cart creation, catalog search) against real endpoints. missing for 10: independent third-party (non-Shopify) hands-on reviews of the CLI itself and broader adoption evidence beyond Shopify's own docs/probes.
- [claimed-docs] “Shopify's agent surface is UCP end to end via "Shopify's UCP-compliant MCP servers": the UCP CLI "provides structured commands to search the…”
- [claimed-docs] “Initialize a local UCP profile.”
- [claimed-docs] “This quickstart runs the full agentic commerce flow with the UCP CLI, from product discovery to order tracking, in about five minutes.”
- [claimed-docs] “The CLI uses a local profile to identify your agent on every merchant-scoped request. Initialize it once and the CLI reuses it for every ope…”
- [probe] “official CLI documented at https://shopify.dev/docs/agents/get-started/quickstart”
- [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”
- [claimed-docs] “Buyer handoff is a first-class state: "Build for escalations regardless of how you authenticate." A checkout in requires_escalation means "C…”
PayPal Agentic Commercenone0/10The evidence pack documents PayPal's Agent Toolkit, MCP server, REST APIs, and SDKs, but nowhere mentions an official command-line interface (CLI) tool for developers or AI-native users to interact with PayPal's agentic commerce services. Since PayPal is a developer-facing platform with APIs and SDKs, a CLI would be a plausible product offering, but none is evidenced here.
ai-native userDrive the product through a documented public API
weight 3 · round drawnShopify documents and exposes a full public, documented agent-facing API surface (UCP CLI + MCP servers for Catalog, Cart, Checkout, Order) with schemas, auth tiers, negotiation, webhooks, and runtime probes confirming live handshakes, keyless catalog search, and real cart creation — clearly enabling an AI-native user to drive the product programmatically. Missing for 10: no publicly documented OpenAPI/REST spec found (404s on openapi.json/llms.txt) and no independent third-party developer report beyond Shopify's own docs/probes.
- [claimed-docs] “the CLI provides structured commands to search the Catalog, build carts, create checkouts, hand off buyers, and track orders”
- [claimed-docs] “Shopify's agent surface is UCP end to end via "Shopify's UCP-compliant MCP servers": the UCP CLI "provides structured commands to search the…”
- [claimed-docs] “"The Global Catalog MCP server enables AI agents to search and discover products across the entire Shopify ecosystem, helping buyers find pr…”
- [claimed-docs] “"Cart tools accept unauthenticated requests, which lets you estimate totals and share a cart with the buyer before collecting credentials" —…”
- [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
- [claimed-docs] “"The Order MCP server enables AI agents to fetch the current state of an order placed through their agent, including line items, fulfillment…”
- [claimed-docs] “"Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (fu…”
- [claimed-docs] “In UCP, "a platform profile is a JSON document that describes the protocol version and capabilities the platform supports"; the business sid…”
- [probe] “PROBE runtime (recorded 2026-09-14): Shopify's Global Catalog MCP server is live — a keyless JSON-RPC initialize POST to https://catalog.sho…”
- [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”
- [probe] “PROBE runtime (recorded 2026-09-14): the documented agent-profile trust gate behaves as specified — a keyless raw tools/call search_catalog …”
PayPal publishes extensive, concrete developer documentation (REST API reference, Agent Toolkit, MCP server, agentic-commerce cart API, Store Sync, ACP/UCP guides) with runtime confirmation of a live MCP endpoint and published npm/PyPI SDK packages, giving AI-native developers a genuinely documented public API surface to build against. Missing for 10: some flows are form-gated/partner-gated (Braintree, Store Sync approval) rather than fully self-serve, slightly limiting pure API-driven access.
- [claimed-docs] “PayPal's agent toolkit supports the integration of PayPal APIs into AI agent workflows using Amazon Bedrock, CrewAI, LangChain, Model Contex…”
- [claimed-docs] “PayPal built an MCP server that lets merchants use natural language with their favorite MCP clients. This helps users complete business task…”
- [claimed-docs] “Creates a new cart with the provided PayPalCart object. This is called by PayPal Shopping Cart when an AI agent or customer initiates a chec…”
- [claimed-docs] “Retrieves the current state of a cart. Used by PayPal Shopping Cart to check cart status, validation issues, and current totals.”
- [claimed-docs] “"PayPal's agent toolkit supports the integration of PayPal APIs into AI agent workflows using" Amazon Bedrock, CrewAI, LangChain, MCP, OpenA…”
- [probe] “PROBE runtime (recorded 2026-09-14): PayPal's remote MCP server is live — a keyless JSON-RPC initialize POST to https://mcp.paypal.com/mcp a…”
- [probe] “PROBE runtime (recorded 2026-09-14): the PayPal Agent Toolkit resolves on the public npm registry (npm view @paypal/agent-toolkit → 1.11.0, …”
- [claimed-docs] “The developer portal's REST API getting-started page anchors the agent surface: "REST APIs, including orders, payments, subscriptions, invoi…”
- [claimed-docs] “The PayPal sandbox "is a self-contained, virtual testing environment that simulates the live PayPal production environment" — "a shielded sp…”
ai-native userIssue scoped/least-privilege API credentials for an agent
weight 2 · round to Shopify Agentic CommerceShopify's UCP documents concrete least-privilege mechanics: three trust tiers (Anonymous/Signed/Token) that gate which tools and rate limits an agent gets, a specific scope (read_global_api_orders) required for Order MCP, short-lived (60-minute TTL) JWTs minted from Dev Dashboard client credentials, and checkout completion gated on the token being 'granted permission to complete purchases.' A runtime probe confirms the profile/identity gate rejects unauthenticated calls (invalid_profile_url), corroborating the scoped-access model works as documented. Missing for 10: a full catalog of all available scopes/permissions beyond the few named, self-service credential/scope management UI, explicit revocation workflow, and independent third-party verification of least-privilege enforcement in production.
- [claimed-docs] “"UCP traffic to Shopify's MCP servers is classified into three tiers based on how your agent identifies itself" — Token, Signed, Anonymous —…”
- [claimed-docs] “"The Order MCP server enables AI agents to fetch the current state of an order placed through their agent, including line items, fulfillment…”
- [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
- [probe] “PROBE runtime (recorded 2026-09-14): the documented agent-profile trust gate behaves as specified — a keyless raw tools/call search_catalog …”
There's no explicit 'issue a scoped API key/token for an agent' feature for the general Agent Toolkit or REST API surface, but agent-specific payment tokens are documented as scoped/least-privilege by design — the ACP delegated token is 'bound to your merchant ID and includes amount and time restrictions that you can configure,' and the MCP server enforces OAuth with PKCE and dynamic client registration rather than static keys. This shows some least-privilege credentialing pattern for agent checkout flows but not a general-purpose scoped-credential system for arbitrary agent API access. Missing for 10: documented scope/permission tiers (e.g., read-only vs write) for the Agent Toolkit or REST OAuth tokens, and any self-serve UI/API to mint restricted credentials per agent.
- [claimed-docs] “The ACP path is an in-ChatGPT checkout build: "Implement an MCP server with the `complete_checkout` tool to receive tokens", "Call `requestC…”
- [probe] “PROBE runtime (recorded 2026-09-14): PayPal's remote MCP server is live — a keyless JSON-RPC initialize POST to https://mcp.paypal.com/mcp a…”
- [claimed-docs] “Cart execution is a reverse API the merchant hosts: POST /merchant-cart "Creates a new cart with the provided PayPalCart object. This is cal…”
ai-native userBuild against official SDKs
weight 2 · round to PayPal Agentic CommerceShopify provides official developer tooling for agentic commerce — the `@shopify/ucp-cli`, UCP-compliant MCP servers (Catalog, Cart, Checkout, Order), profile/negotiation docs, and an AI Toolkit that validates GraphQL/Liquid/Extensions — all documented with schemas and confirmed live via runtime probes. However, this is CLI/MCP/JSON-RPC tooling rather than a conventional language-specific SDK (e.g., a Python or JS client library) that an AI-native developer could import directly. Missing for 10: dedicated SDK packages/libraries beyond the CLI and MCP JSON-RPC interface, and independent third-party corroboration of SDK usability.
- [claimed-docs] “Shopify's agent surface is UCP end to end via "Shopify's UCP-compliant MCP servers": the UCP CLI "provides structured commands to search the…”
- [claimed-docs] “validate GraphQL queries, Liquid templates, and Shopify Extensions against Shopify schemas to catch issues earlier”
- [claimed-docs] “"The Global Catalog MCP server enables AI agents to search and discover products across the entire Shopify ecosystem, helping buyers find pr…”
- [claimed-docs] “"Cart tools accept unauthenticated requests, which lets you estimate totals and share a cart with the buyer before collecting credentials" —…”
- [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
- [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”
- [claimed-docs] “Initialize a local UCP profile.”
PayPal publishes an official Agent Toolkit SDK (npm/PyPI, versioned and actively published) integrating with MCP, OpenAI Agents SDK, LangChain, CrewAI, Vercel AI SDK, and Bedrock, plus documented pre-built functions for orders, invoices, subscriptions, refunds, disputes, and catalog management, backed by REST API docs, sandbox testing, and webhooks. This is corroborated by runtime probes confirming the toolkit is live on public registries and the MCP server is reachable. Missing for 10: independent third-party developer reviews/case studies of building against these SDKs beyond PayPal's own docs and registry probes.
- [claimed-docs] “PayPal's agent toolkit supports the integration of PayPal APIs into AI agent workflows using Amazon Bedrock, CrewAI, LangChain, Model Contex…”
- [claimed-docs] “PayPal built an MCP server that lets merchants use natural language with their favorite MCP clients. This helps users complete business task…”
- [claimed-docs] “Integrate with PayPal APIs to access orders, invoices, subscriptions, shipment tracking, transaction details, and dispute management through…”
- [claimed-docs] “"PayPal's agent toolkit supports the integration of PayPal APIs into AI agent workflows using" Amazon Bedrock, CrewAI, LangChain, MCP, OpenA…”
- [claimed-docs] “Post-purchase operations are first-class agent tools: refunds via create_refund / get_refund (a "refund for a captured payment", where "If n…”
- [probe] “PROBE runtime (recorded 2026-09-14): the PayPal Agent Toolkit resolves on the public npm registry (npm view @paypal/agent-toolkit → 1.11.0, …”
- [probe] “PROBE runtime (recorded 2026-09-14): PayPal's remote MCP server is live — a keyless JSON-RPC initialize POST to https://mcp.paypal.com/mcp a…”
- [claimed-docs] “The PayPal sandbox "is a self-contained, virtual testing environment that simulates the live PayPal production environment" — "a shielded sp…”
- [claimed-docs] “The developer portal's REST API getting-started page anchors the agent surface: "REST APIs, including orders, payments, subscriptions, invoi…”
- [github] “create_order: Create an order in PayPal system based on provided details”
ai-native userSubscribe to events via webhooks
weight 2 · round to PayPal Agentic CommerceShopify does deliver order webhooks — UCP-shaped payloads pushed to a registered endpoint on committed order changes, HMAC-signed and retried — but the subscription mechanism itself is not agent-native: 'There's no self-serve subscription API today... contact your Shopify partner manager,' and although the UCP profile spec allows agents to declare a webhook_url, 'Shopify doesn't honor that field today.' This means an AI-native user cannot programmatically subscribe/register for webhook events themselves — it requires a manual, human, out-of-band process, undercutting the 'agentic' self-serve subscription story. missing for 10: self-serve/programmatic webhook subscription API, honoring the agent-declared webhook_url in the UCP profile, and any evidence of agent-driven (not partner-manager-mediated) event subscription.
- [claimed-docs] “Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change”
- [claimed-docs] “"Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (fu…”
- [claimed-docs] “Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (ful…”
PayPal's webhook API is explicitly documented: merchants can subscribe up to 10 webhook URLs per app, scoped to specific event types, with durable retry (25 attempts over 3 days) and signature verification guidance — enabling event-driven, agentic integrations. Missing for 10: explicit agentic-commerce-specific event types (e.g., cart/order events tied to AI checkout flows) and independent/hands-on corroboration beyond first-party docs.
- [claimed-docs] “"Webhooks are HTTPS posts from PayPal to an endpoint on your server whenever the corresponding event type occurs" — "Up to 10 webhook URLs m…”
- [claimed-docs] “The developer portal's REST API getting-started page anchors the agent surface: "REST APIs, including orders, payments, subscriptions, invoi…”
Agentic features
ai-native userSet up automations that run autonomously in the background
weight 2 · round to PayPal Agentic CommerceUCP's trust-tier model lets Token-tier agents call complete_checkout autonomously once granted permission, and order webhooks push background state updates to a registered endpoint without polling — both hint at unattended, background-capable agent operation. But there is no documented feature for an AI-native user to configure a scheduled or trigger-based automation (e.g., recurring reorders, price-watch, monitor-and-act loops) that runs unsupervised over time; the evidence only covers per-session agent tool calls (search/cart/checkout/order) and merchant-side webhook delivery, not user-configurable autonomous background jobs. Missing for 10: explicit scheduling/trigger mechanism, evidence of a persistent background agent process, and independent confirmation of real autonomous (no-human-in-loop) purchase completion.
- [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
- [claimed-docs] “"UCP traffic to Shopify's MCP servers is classified into three tiers based on how your agent identifies itself" — Token, Signed, Anonymous —…”
- [claimed-docs] “"Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (fu…”
- [claimed-docs] “Buyer handoff is a first-class state: "Build for escalations regardless of how you authenticate." A checkout in requires_escalation means "C…”
PayPal provides the building blocks for background automation — an agent toolkit with pre-built functions (orders, refunds, disputes, subscriptions) usable in LangChain/CrewAI/Bedrock workflows, an MCP server for natural-language triggered actions, and webhooks that fire asynchronously with retry logic — enabling autonomous background agent workflows. However, PayPal's own docs explicitly recommend keeping 'human oversight in areas where personal judgment matters most,' and much of the deeper commerce automation (Store Sync, agentic commerce services) is gated behind manual application forms rather than self-serve autonomous setup. Missing for 10: evidence of a fully autonomous, unattended scheduling/orchestration layer, independent confirmation of agents running unattended in production, and self-serve (non-form-gated) enablement.
- [claimed-docs] “"PayPal's agent toolkit supports the integration of PayPal APIs into AI agent workflows using" Amazon Bedrock, CrewAI, LangChain, MCP, OpenA…”
- [claimed-docs] “"Webhooks are HTTPS posts from PayPal to an endpoint on your server whenever the corresponding event type occurs" — "Up to 10 webhook URLs m…”
- [probe] “PROBE runtime (recorded 2026-09-14): PayPal's remote MCP server is live — a keyless JSON-RPC initialize POST to https://mcp.paypal.com/mcp a…”
- [probe] “PROBE runtime (recorded 2026-09-14): the PayPal Agent Toolkit resolves on the public npm registry (npm view @paypal/agent-toolkit → 1.11.0, …”
- [claimed-docs] “Post-purchase operations are first-class agent tools: refunds via create_refund / get_refund (a "refund for a captured payment", where "If n…”
- [claimed-docs] “Access to PayPal's agentic commerce services is form-gated, not self-serve: merchants must complete a form "to contact the AI team at PayPal…”
ai-native userDelegate tasks to a built-in AI assistant inside the product
weight 3 · round drawnShopify Agentic Commercenone0/10The evidence describes Shopify's Universal Commerce Protocol (UCP) and MCP servers as the *backend* that external AI agents (ChatGPT, Claude, etc.) connect to in order to search, cart, and checkout on behalf of buyers — Shopify is the server/merchant side, not a built-in assistant that a user delegates tasks to within the product itself. Nothing in the pack describes an embedded assistant (e.g., a Shopify-hosted chat agent for store owners or shoppers) that a user interacts with directly and delegates tasks to inside Shopify's own UI. Missing for 10: any first-party built-in assistant UI/feature, evidence of a user directly delegating a task to an in-product assistant, and independent confirmation of such an assistant's existence.
- [claimed-docs] “the CLI provides structured commands to search the Catalog, build carts, create checkouts, hand off buyers, and track orders”
- [claimed-docs] “Connect any AI assistant to real-time commerce data from Shopify stores with Model Context Protocol (MCP) servers”
- [claimed-docs] “Shopify's agent surface is UCP end to end via "Shopify's UCP-compliant MCP servers": the UCP CLI "provides structured commands to search the…”
PayPal Agentic Commercenone0/10The evidence pack is entirely about PayPal enabling external AI agents (ChatGPT, Gemini, third-party MCP clients, or developer-built agents via the Agent Toolkit) to transact through PayPal/Braintree — it is infrastructure for other assistants to use PayPal, not a built-in AI assistant inside PayPal's own product that an end user delegates tasks to. No citation shows a first-party PayPal assistant a user converses with directly.
ai-native userOperate the product with natural-language commands
weight 2 · round to Shopify Agentic CommerceShopify's UCP stack is explicitly designed so a natural-language request to an AI assistant ('find me crewneck sweaters under $50') is mapped by a skill/plugin to the right structured UCP CLI/MCP command, and runtime probes confirm the underlying MCP catalog/cart tools actually work end-to-end (search, cart creation) via the CLI with a local profile. Missing for 10: independent third-party evidence of a user issuing free-form natural-language commands (only one first-party doc line makes this claim) and no evidence of NL support beyond the catalog-search example (checkout/order flows are shown as structured CLI/MCP calls, not demonstrated NL-driven).
- [claimed-docs] “Ask your assistant in natural language ("find me crewneck sweaters under $50") and the skill picks the right UCP CLI command”
- [claimed-docs] “the CLI provides structured commands to search the Catalog, build carts, create checkouts, hand off buyers, and track orders”
- [claimed-docs] “Shopify's agent surface is UCP end to end via "Shopify's UCP-compliant MCP servers": the UCP CLI "provides structured commands to search the…”
- [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”
- [probe] “PROBE runtime (recorded 2026-09-14): Shopify's Global Catalog MCP server is live — a keyless JSON-RPC initialize POST to https://catalog.sho…”
PayPal supports natural-language operation via its MCP server and agent toolkit (LangChain, OpenAI Agents SDK, CrewAI, etc.), letting AI agents issue commands for orders, refunds, disputes, and shopping carts in conversational form, and a runtime probe confirms the MCP endpoint is live. However, the 'user' operating this isn't typically an end consumer speaking to PayPal directly — most flows are merchant-hosted or gated behind Braintree/Google/form approval, and the natural-language surface is mediated through third-party chat assistants (ChatGPT, Gemini) or developer-built agents rather than a native PayPal NL interface. missing for 10: independent/hands-on evidence of an end user directly issuing free-form natural-language commands to PayPal itself (not via a third-party chat assistant or developer-built agent), and confirmation the MCP server/agent toolkit works smoothly without heavy setup/gating.
- [claimed-docs] “PayPal built an MCP server that lets merchants use natural language with their favorite MCP clients. This helps users complete business task…”
- [claimed-docs] “"PayPal's agent toolkit supports the integration of PayPal APIs into AI agent workflows using" Amazon Bedrock, CrewAI, LangChain, MCP, OpenA…”
- [claimed-docs] “Post-purchase operations are first-class agent tools: refunds via create_refund / get_refund (a "refund for a captured payment", where "If n…”
- [probe] “PROBE runtime (recorded 2026-09-14): PayPal's remote MCP server is live — a keyless JSON-RPC initialize POST to https://mcp.paypal.com/mcp a…”
- [probe] “PROBE runtime (recorded 2026-09-14): the PayPal Agent Toolkit resolves on the public npm registry (npm view @paypal/agent-toolkit → 1.11.0, …”
- [claimed-docs] “"Agent Ready helps Braintree merchants accept payments from AI shopping assistants across major platforms, including ChatGPT, Google AI Mode…”
- [claimed-docs] “Access to PayPal's agentic commerce services is form-gated, not self-serve: merchants must complete a form "to contact the AI team at PayPal…”
Api quality
ai-native userExplore an interactive API reference with runnable examples
weight 2 · round to Shopify Agentic CommerceShopify's UCP docs provide a step-by-step quickstart with real, copy-pasteable CLI commands that run the full discovery→cart→checkout→order flow, and MCP tools are self-describing (agents can fetch live input schemas via `--input-schema`), which gives AI-native users a way to explore and run real examples against live endpoints (confirmed by runtime probes actually executing search/cart calls). However, there is no dedicated interactive API-reference surface — probes explicitly found no OpenAPI/Swagger spec and no llms.txt at shopify.dev (404s), so there's no Postman/Swagger-style 'try it' reference page, only linear docs plus CLI/MCP introspection. Missing for 10: a dedicated interactive API-reference UI (OpenAPI/Swagger explorer or embedded try-it-now widgets), and independent hands-on confirmation that non-CLI docs pages let users run examples inline.
- [claimed-docs] “This quickstart runs the full agentic commerce flow with the UCP CLI, from product discovery to order tracking, in about five minutes.”
- [claimed-docs] “"The Storefront Catalog MCP server enables AI agents to search and discover products from a single merchant's catalog, helping buyers find a…”
- [probe] “PROBE runtime (recorded 2026-09-14): Shopify's Global Catalog MCP server is live — a keyless JSON-RPC initialize POST to https://catalog.sho…”
- [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”
- [probe] “PROBE llms.txt: HTTP 404 at https://shopify.dev/llms.txt”
- [probe] “PROBE openapi: all candidate paths 404 (https://shopify.dev/openapi.json, https://shopify.dev/swagger.json, https://shopify.dev/api/openapi.…”
PayPal Agentic Commercenone0/10Evidence shows static API reference pages (createcart, getcart) and REST API docs, plus a sandbox environment for testing, but nothing describing an interactive reference with embedded runnable/try-it-out examples (e.g., live code execution in docs, Swagger-style console). Missing for 10: any mention of an interactive API console, embedded runnable code snippets, or in-docs request execution.
- [claimed-docs] “Creates a new cart with the provided PayPalCart object. This is called by PayPal Shopping Cart when an AI agent or customer initiates a chec…”
- [claimed-docs] “Retrieves the current state of a cart. Used by PayPal Shopping Cart to check cart status, validation issues, and current totals.”
- [claimed-docs] “The developer portal's REST API getting-started page anchors the agent surface: "REST APIs, including orders, payments, subscriptions, invoi…”
- [claimed-docs] “The PayPal sandbox "is a self-contained, virtual testing environment that simulates the live PayPal production environment" — "a shielded sp…”
ai-native userDownload a machine-readable API spec (OpenAPI or equivalent)
weight 2 · round to Shopify Agentic CommerceThere's no downloadable OpenAPI/Swagger file — a direct probe found openapi.json, swagger.json, and similar candidate paths all 404 — but the underlying protocol is machine-readable in other ways: MCP servers expose live input schemas agents can introspect at runtime (--input-schema) and the UCP protocol itself has a published, versioned technical specification with reference implementations in a public GitHub repo (ucp.dev/llms.txt). missing for 10: an actual OpenAPI/JSON-Schema-equivalent document downloadable in one shot, and confirmation that the GitHub spec repo is machine-readable in OpenAPI-equivalent form rather than prose/markdown protocol docs.
- [probe] “PROBE openapi: all candidate paths 404 (https://shopify.dev/openapi.json, https://shopify.dev/swagger.json, https://shopify.dev/api/openapi.…”
- [claimed-docs] “"The Storefront Catalog MCP server enables AI agents to search and discover products from a single merchant's catalog, helping buyers find a…”
- [claimed-docs] “ucp.dev positions the protocol as industry-governed rather than single-vendor: "UCP is built by the industry, to enable seamless agentic exp…”
- [probe] “PROBE runtime (recorded 2026-09-14): the Universal Commerce Protocol spec is published in the open — https://ucp.dev/llms.txt serves the ver…”
PayPal Agentic Commercenone0/10The evidence pack documents REST API references, SDKs, webhooks, and endpoint descriptions (e.g., createcart/getcart docs), but nowhere mentions a downloadable OpenAPI/Swagger file or other machine-readable spec artifact for the agentic-commerce or general PayPal APIs. This axis is clearly applicable to an API-based commerce product, but no evidence shows PayPal exposing such a spec for download.
- [claimed-docs] “The developer portal's REST API getting-started page anchors the agent surface: "REST APIs, including orders, payments, subscriptions, invoi…”
- [claimed-docs] “Cart execution is a reverse API the merchant hosts: POST /merchant-cart "Creates a new cart with the provided PayPalCart object. This is cal…”
- [claimed-docs] “The companion read endpoint keeps agent-side cart state fresh: get cart "Retrieves the current state of a cart. Used by PayPal Shopping Cart…”
ai-native userTest against a sandbox environment without touching production data
weight 1 · round to PayPal Agentic CommerceShopify Agentic Commercenone0/10No evidence pack item describes a dedicated sandbox/test environment for UCP agent development; the only relevant runtime probe shows testing being done directly against a live production Shopify store ('a REAL cart was created keylessly on Shopify's own hardware store'), not a sandbox. No test-mode flag, dev store, or mock UCP endpoint is documented anywhere in the pack.
- [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”
- [probe] “PROBE runtime (recorded 2026-09-14): a Shopify-operated storefront's own UCP endpoint is live — a keyless JSON-RPC initialize POST to https:…”
PayPal documents a dedicated sandbox that mirrors production, allowing developers/agents to test agent-toolkit tools, cart API, and checkout flows without touching live accounts, and confirms the same REST rails (Orders, cart API) run against sandbox credentials. Missing for 10: no independent/hands-on verification of sandbox parity for agentic-commerce-specific flows (cart API, ACP/UCP checkout) and no explicit documentation of sandbox mode for the MCP server or agent toolkit specifically.
- [claimed-docs] “The PayPal sandbox "is a self-contained, virtual testing environment that simulates the live PayPal production environment" — "a shielded sp…”
- [claimed-docs] “The developer portal's REST API getting-started page anchors the agent surface: "REST APIs, including orders, payments, subscriptions, invoi…”
- [claimed-docs] “Cart execution is a reverse API the merchant hosts: POST /merchant-cart "Creates a new cart with the provided PayPalCart object. This is cal…”
- [claimed-docs] “"PayPal's agent toolkit supports the integration of PayPal APIs into AI agent workflows using" Amazon Bedrock, CrewAI, LangChain, MCP, OpenA…”
ai-native userRely on versioned APIs with a documented deprecation policy
weight 2 · round to Shopify Agentic CommerceEvidence shows real API versioning (protocol version headers like x-shopify-ucp-mcp-api-version: 2026-08-25, dated UCP spec releases on ucp.dev, and profile negotiation based on 'the protocol version and capabilities the platform supports'), which supports the 'versioned APIs' half of the story. However, no evidence anywhere describes a documented deprecation policy, sunset timelines, or backward-compatibility guarantees for older versions. Missing for 10: explicit deprecation/sunset policy documentation, version-support lifecycle commitments, migration guidance between dated versions.
- [probe] “PROBE runtime (recorded 2026-09-14): Shopify's Global Catalog MCP server is live — a keyless JSON-RPC initialize POST to https://catalog.sho…”
- [probe] “PROBE runtime (recorded 2026-09-14): the Universal Commerce Protocol spec is published in the open — https://ucp.dev/llms.txt serves the ver…”
- [claimed-docs] “In UCP, "a platform profile is a JSON document that describes the protocol version and capabilities the platform supports"; the business sid…”
PayPal Agentic Commercenone0/10The evidence pack documents PayPal's agentic-commerce APIs (createcart, getcart, agent toolkit, REST APIs) including a versioned path like /v1/createcart, but nowhere is there any documented deprecation policy, versioning strategy, or backward-compatibility commitment for AI agents to rely on. The axis is clearly applicable (PayPal is an API-first commerce platform) but no supporting evidence exists.
- [claimed-docs] “Creates a new cart with the provided PayPalCart object. This is called by PayPal Shopping Cart when an AI agent or customer initiates a chec…”
- [claimed-docs] “Retrieves the current state of a cart. Used by PayPal Shopping Cart to check cart status, validation issues, and current totals.”
- [claimed-docs] “The developer portal's REST API getting-started page anchors the agent surface: "REST APIs, including orders, payments, subscriptions, invoi…”
Automation depth — how much of the product can run unattendedAutomation depth
How much of the product can run unattended
ai-native userPerform bulk operations across many items at once
weight 2 · round drawnShopify Agentic Commercenone0/10The evidence describes single-item/cart-at-a-time flows (search, build a cart, checkout, track one order) and catalog pagination for browsing, but nothing documents a bulk operation primitive — e.g., adding many items to a cart in one call, batch checkout, or bulk order management — for an AI agent to act on many items at once.
PayPal Agentic Commercenone0/10The evidence shows only single-item agent tools (create_order, create_refund, get_dispute, etc.) and a one-time bulk catalog feed upload for merchant setup, but no documented bulk/batch operation capability (e.g., batch refunds, batch order processing, multi-item transaction endpoints) that an AI agent could invoke across many items at once.
- [claimed-docs] “Post-purchase operations are first-class agent tools: refunds via create_refund / get_refund (a "refund for a captured payment", where "If n…”
- [claimed-docs] “"PayPal's agent toolkit supports the integration of PayPal APIs into AI agent workflows using" Amazon Bedrock, CrewAI, LangChain, MCP, OpenA…”
- [claimed-docs] “Catalog publishing is feed-file based: "PayPal supports 3 feed specifications", including the Google Product Feed ("you can reuse it to powe…”
ai-native userDefine rules that trigger actions automatically on events
weight 3 · round to Shopify Agentic CommerceShopify's UCP order webhooks push event notifications (fulfillment, refunds, cancellations) to a registered endpoint whenever a committed change occurs, giving a basic event-trigger backbone, but there is no evidence of an actual rules/automation engine where an AI-native user declares conditional logic ("if X then do Y") that Shopify executes on their behalf. Missing for 10: a rule-definition interface or automation engine, support for triggers beyond order state changes, and any evidence of user-authored conditional actions rather than raw webhook delivery.
- [claimed-docs] “"Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (fu…”
- [claimed-docs] “Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change”
- [claimed-docs] “Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (ful…”
PayPal Agentic Commercenone0/10Evidence shows PayPal offers webhooks (event notifications) and an agent toolkit with individual API tools, but nothing resembling a rules engine where a user defines 'if event X then action Y' automation — webhooks merely deliver raw event notifications that require the merchant to write custom code to act on, not a rule-definition interface. Missing for 10: any rule-builder/automation-trigger UI or API, conditional logic definition, and evidence of automatic action execution tied to rules rather than manual webhook handling.
- [claimed-docs] “"Webhooks are HTTPS posts from PayPal to an endpoint on your server whenever the corresponding event type occurs" — "Up to 10 webhook URLs m…”
Fees economics — stories about fees economics in this arenaFees economics
Stories about fees economics in this arena
Fees transparency
merchantThe fees for agent-originated transactions are published — I can price agentic channels without asking sales
weight 2 · round to PayPal Agentic CommerceShopify Agentic Commercenone0/10The evidence pack thoroughly documents UCP's technical architecture (catalog, cart, checkout, orders, trust tiers) but contains no mention of transaction fees, take rates, commission percentages, or pricing terms for agent-originated sales — nothing addresses what a merchant would pay for agentic-channel transactions.
Evidence shows agent-originated transactions run through existing Braintree/PayPal Checkout rails and thus inherit the standard published US commercial fee schedule (2.99–4.99% + fixed fee), so merchants aren't quoted a hidden or sales-negotiated rate for the payment processing itself. However, the same evidence explicitly states 'No separate agentic/AI-channel fee schedule is published,' and access to Agent Ready/Store Sync/ACS is gated behind a sales-contact form, leaving open whether any additional platform or enablement fee applies to the agentic channel — so a merchant cannot fully price the agentic channel without engaging sales for onboarding. Missing for 10: an explicit agentic-channel fee page or fee line item, and self-serve (non-form-gated) enrollment that would let a merchant confirm total costs without sales contact.
- [claimed-docs] “The published US commercial rates that agent-initiated orders inherit: "PayPal Checkout" and "PayPal Guest Checkout" at "3.49% +" fixed fee,…”
- [claimed-docs] “Access to PayPal's agentic commerce services is form-gated, not self-serve: merchants must complete a form "to contact the AI team at PayPal…”
- [claimed-docs] “Store Sync is the full-catalog path, "enabling AI agents to discover your products, create and manage shopping carts, and complete purchases…”
Payouts
merchantAgent-originated payments settle through documented payout and reporting flows, reconcilable like any other channel
weight 1 · round to PayPal Agentic CommerceShopify Agentic Commercenone0/10The evidence documents order creation, checkout/payment completion, order-state webhooks, and get_order reconciliation of order state, but nothing addresses payout, settlement, or financial reporting flows that let a merchant reconcile agent-originated revenue against other channels (no mention of payout reports, settlement schedules, or accounting/export integration). Since payout/reporting reconciliation is a normal, fair expectation for any commerce channel with real payments, this axis applies but is unaddressed in the pack.
Agent-originated orders flow into the merchant's existing order management, payment, refund/dispute, and webhook systems (create_order, refund/dispute tools, webhooks with signature verification, existing Orders v2/Braintree rails), and docs explicitly state Store Sync orders arrive 'just as it would from any other channel,' suggesting standard reconciliation. However, there is no dedicated agentic-channel reporting/settlement documentation, no separate transaction tagging or reconciliation report distinguishing agent-originated payments, and fee schedules show no distinct line item for agent transactions, making channel-level reconciliation an inference rather than a documented flow. missing for 10: dedicated agent-channel reporting/settlement statements, explicit reconciliation tooling or transaction tags identifying agent-originated payments, independent merchant confirmation of clean reconciliation in production.
- [claimed-docs] “Store Sync is the full-catalog path, "enabling AI agents to discover your products, create and manage shopping carts, and complete purchases…”
- [claimed-docs] “Post-purchase operations are first-class agent tools: refunds via create_refund / get_refund (a "refund for a captured payment", where "If n…”
- [claimed-docs] “"Webhooks are HTTPS posts from PayPal to an endpoint on your server whenever the corresponding event type occurs" — "Up to 10 webhook URLs m…”
- [claimed-docs] “The published US commercial rates that agent-initiated orders inherit: "PayPal Checkout" and "PayPal Guest Checkout" at "3.49% +" fixed fee,…”
- [claimed-docs] “The developer portal's REST API getting-started page anchors the agent surface: "REST APIs, including orders, payments, subscriptions, invoi…”
- [claimed-docs] “Cart execution is a reverse API the merchant hosts: POST /merchant-cart "Creates a new cart with the provided PayPalCart object. This is cal…”
Merchant enablement — stories about merchant enablement in this arenaMerchant enablement
Stories about merchant enablement in this arena
Attribution analytics
merchantOrders are attributed to the originating agent and I can report on or filter transactions by agent
weight 2 · round to Shopify Agentic CommerceCart/checkout objects carry explicit agent-attribution metadata (referring_domain, click_id_tag, activity_id, utm_* fields) and orders are tied to a specific agent's UCP profile via checkout creation, giving Shopify the raw data needed to attribute orders to an agent. However, there is no evidence of a merchant-facing report, analytics dashboard, or order-list filter that lets a merchant actually query or segment transactions by originating agent — only developer-facing MCP/webhook data plumbing is documented. Missing for 10: merchant admin UI or reporting API to filter/segment orders by agent, aggregate agent-performance analytics, independent confirmation that attribution data surfaces in Shopify's order admin.
- [claimed-docs] “"Cart tools accept unauthenticated requests, which lets you estimate totals and share a cart with the buyer before collecting credentials" —…”
- [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
- [claimed-docs] “"Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (fu…”
- [claimed-docs] “"The Order MCP server enables AI agents to fetch the current state of an order placed through their agent, including line items, fulfillment…”
- [claimed-docs] “In UCP, "a platform profile is a JSON document that describes the protocol version and capabilities the platform supports"; the business sid…”
PayPal Agentic Commercenone0/10Evidence covers agent-initiated checkout flows (ACP/UCP/Store Sync/cart API/agent toolkit) but nowhere describes orders being tagged with an originating-agent identifier, nor any merchant dashboard/report/filter capability by agent; in fact Store Sync docs state orders arrive 'just as it would from any other channel,' suggesting no special agent attribution.
- [claimed-docs] “Store Sync is the full-catalog path, "enabling AI agents to discover your products, create and manage shopping carts, and complete purchases…”
- [claimed-docs] “Cart execution is a reverse API the merchant hosts: POST /merchant-cart "Creates a new cart with the provided PayPalCart object. This is cal…”
- [claimed-docs] “The companion read endpoint keeps agent-side cart state fresh: get cart "Retrieves the current state of a cart. Used by PayPal Shopping Cart…”
Onboarding to agents
merchantI have a documented self-serve path to start accepting agent traffic — enable a setting, sign an agreement, or publish an endpoint
weight 3 · round drawnDocs show every UCP-enabled storefront automatically exposes a /api/ucp/mcp endpoint and a merchant publishes a UCP profile at {shop}.myshopify.com/.well-known/ucp for capability negotiation — that's a documented, quasi-self-serve publishing path, and probes confirm live merchant endpoints exist. But the pack explicitly contradicts full self-serve: order webhook subscription is 'not self-serve... contact your Shopify partner manager,' and there is no merchant-facing admin setting or signed agreement flow described (all guidance is developer/CLI-facing, not merchant-console-facing). missing for 10: a merchant-admin toggle/setting in Shopify admin UI, an explicit merchant agreement/terms step, and self-serve webhook registration (currently manual via partner manager).
- [claimed-docs] “In UCP, "a platform profile is a JSON document that describes the protocol version and capabilities the platform supports"; the business sid…”
- [claimed-docs] “"Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (fu…”
- [probe] “PROBE runtime (recorded 2026-09-14): a Shopify-operated storefront's own UCP endpoint is live — a keyless JSON-RPC initialize POST to https:…”
- [claimed-docs] “Negotiation is server-selects. The business computes the intersection of its capabilities with the platform's and chooses the active set”
There is documented onboarding material (Agent Ready guides, Store Sync docs, catalog feed specs), but the path is explicitly gated rather than self-serve: PayPal's own docs state that agentic commerce services access is 'form-gated, not self-serve' requiring a form submission and manual follow-up from PayPal's AI team, Store Sync eligibility requires an existing Braintree/Orders v2 account plus the same approval gate, and the UCP/Google Pay path requires separate 'merchant registration with Google. Contact Google for enablement.' Agent Ready itself assumes an existing Braintree merchant relationship rather than a simple toggle or self-issued agreement. Missing for 10: a true no-approval self-serve enablement (setting flip, standard clickthrough agreement, or endpoint publish without a contact-form/manual review step), and confirmation of approval turnaround time.
- [claimed-docs] “Access to PayPal's agentic commerce services is form-gated, not self-serve: merchants must complete a form "to contact the AI team at PayPal…”
- [claimed-docs] “"Agent Ready helps Braintree merchants accept payments from AI shopping assistants across major platforms, including ChatGPT, Google AI Mode…”
- [claimed-docs] “The UCP path targets Google surfaces: "This enables AI-powered checkout experiences through Google AI Mode (Gemini), where Google Pay return…”
- [claimed-docs] “Store Sync is the full-catalog path, "enabling AI agents to discover your products, create and manage shopping carts, and complete purchases…”
- [claimed-docs] “Catalog publishing is feed-file based: "PayPal supports 3 feed specifications", including the Google Product Feed ("you can reuse it to powe…”
Traffic controls
merchantRate-limit, allow, or deny specific agents and agent platforms accessing my catalog and checkout
weight 2 · round to Shopify Agentic CommerceShopify's UCP documents a platform-wide trust-tier system (Token/Signed/Anonymous) where 'rate limits scale with identification' and certain tools (like complete_checkout or Order MCP) are gated to higher trust tiers, which provides some rate-limiting infrastructure. However, this is a Shopify-controlled protocol mechanism based on identification strength, not a merchant-facing dashboard/setting to specifically allow, deny, or rate-limit named agents or agent platforms (e.g. blocking 'Agent X' or 'Platform Y' by name). Missing for 10: merchant-configurable allow/deny lists for specific agents/platforms, merchant UI or API to set custom rate limits per agent, and any evidence of per-merchant policy enforcement beyond the global trust-tier scheme.
- [claimed-docs] “"UCP traffic to Shopify's MCP servers is classified into three tiers based on how your agent identifies itself" — Token, Signed, Anonymous —…”
- [claimed-docs] “In UCP, "a platform profile is a JSON document that describes the protocol version and capabilities the platform supports"; the business sid…”
- [claimed-docs] “"The Order MCP server enables AI agents to fetch the current state of an order placed through their agent, including line items, fulfillment…”
PayPal Agentic Commercenone0/10Evidence shows PayPal gates agentic-commerce access at the platform/onboarding level (Braintree account, Google UCP registration, PayPal AI-team approval form) and gives merchants brand/communication control, but nothing describes merchant-configurable rate limits or per-agent/per-platform allow/deny controls over catalog or checkout access.
- [claimed-docs] “"Agent Ready helps Braintree merchants accept payments from AI shopping assistants across major platforms, including ChatGPT, Google AI Mode…”
- [claimed-docs] “Access to PayPal's agentic commerce services is form-gated, not self-serve: merchants must complete a form "to contact the AI team at PayPal…”
- [claimed-docs] “Store Sync is the full-catalog path, "enabling AI agents to discover your products, create and manage shopping carts, and complete purchases…”
Openness — open source, data portability, and self-hosting storiesOpenness
Open source, data portability, and self-hosting stories
ai-native userDo everything through the API that I can do in the UI
weight 2 · round to Shopify Agentic CommerceShopify's UCP/MCP surface documents broad API parity for the core buyer journey — catalog search, cart building, checkout creation/completion, and order tracking/webhooks all mirror what a human can do in a Shopify storefront UI, with runtime probes confirming live handshakes and a real cart creation. However, the spec explicitly carves out cases where the API cannot fully replace the UI: checkouts can enter a `requires_escalation` state where 'Checkout requires buyer input or review not available via API,' forcing a handoff via `continue_url` to the merchant's own UI, and full autonomous `complete_checkout` is gated to Token-tier trusted agents only. Missing for 10: evidence of parity for non-purchase storefront actions (account management, returns UI, arbitrary merchant customizations) and confirmation that escalation-required flows are rare rather than common.
- [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
- [claimed-docs] “Buyer handoff is a first-class state: "Build for escalations regardless of how you authenticate." A checkout in requires_escalation means "C…”
- [claimed-docs] “"UCP traffic to Shopify's MCP servers is classified into three tiers based on how your agent identifies itself" — Token, Signed, Anonymous —…”
- [claimed-docs] “"Cart tools accept unauthenticated requests, which lets you estimate totals and share a cart with the buyer before collecting credentials" —…”
- [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”
- [claimed-docs] “"The Order MCP server enables AI agents to fetch the current state of an order placed through their agent, including line items, fulfillment…”
- [claimed-docs] “"Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (fu…”
PayPal's agent toolkit and REST APIs expose a broad set of merchant operations (orders, invoices, subscriptions, refunds, disputes, shipment tracking, catalog management) that mirror much of what's doable in the PayPal/Braintree dashboards, and there's a documented MCP server, SDKs, and sandbox for building against these. However, the flagship agentic-commerce paths are heavily gated rather than self-serve: Agent Ready requires a Braintree account, Store Sync and Agentic Commerce Services require a manual form-based approval process, UCP requires separate Google merchant registration, and Store Sync itself is scoped only to US physical goods in USD — none of which are pure API-driven equivalents of UI actions. Missing for 10: explicit UI-vs-API feature-parity mapping, self-serve (non-gated) access to the agentic commerce APIs, and confirmation that all dashboard-level configuration/reporting is API-accessible without approval gates.
- [claimed-docs] “"PayPal's agent toolkit supports the integration of PayPal APIs into AI agent workflows using" Amazon Bedrock, CrewAI, LangChain, MCP, OpenA…”
- [claimed-docs] “Post-purchase operations are first-class agent tools: refunds via create_refund / get_refund (a "refund for a captured payment", where "If n…”
- [claimed-docs] “Access to PayPal's agentic commerce services is form-gated, not self-serve: merchants must complete a form "to contact the AI team at PayPal…”
- [claimed-docs] “Store Sync is the full-catalog path, "enabling AI agents to discover your products, create and manage shopping carts, and complete purchases…”
- [claimed-docs] “The UCP path targets Google surfaces: "This enables AI-powered checkout experiences through Google AI Mode (Gemini), where Google Pay return…”
- [claimed-docs] “The developer portal's REST API getting-started page anchors the agent surface: "REST APIs, including orders, payments, subscriptions, invoi…”
- [claimed-docs] “The PayPal sandbox "is a self-contained, virtual testing environment that simulates the live PayPal production environment" — "a shielded sp…”
ai-native userRead the product's source under an open license
weight 2 · round drawnShopify Agentic Commercenone0/10Evidence shows the UCP protocol specification and reference implementations are published openly on GitHub, but this is the industry-wide protocol spec (ucp.dev), not Shopify's own Agentic Commerce product source code, servers, or CLI implementation. No citation shows Shopify's actual MCP server/checkout implementation, storefront code, or platform source is released under an open license.
PayPal Agentic Commercenone0/10PayPal's agentic commerce services (Store Sync, ACP/UCP integrations, agent toolkit) are proprietary hosted APIs and closed-source integrations; the agent-toolkit SDK is published on npm/PyPI but no evidence indicates an open-source license for its source, and core commerce services (Store Sync, cart API, MCP server backend) are entirely closed, gated behind forms and merchant accounts. No evidence pack item shows an open-license repository for the product's source.
Order lifecycle — stories about order lifecycle in this arenaOrder lifecycle
Stories about order lifecycle in this arena
Order events
developerMy agent or backend can subscribe to order lifecycle events — created, updated, fulfilled, canceled — pushed programmatically
weight 3 · round drawnShopify does push full, HMAC-signed UCP-shaped order webhooks (created/updated/fulfilled/canceled/refunded etc.) with retry logic, so lifecycle events are indeed pushed programmatically once configured. However the same documentation states subscription itself is not self-serve — 'There's no self-serve subscription API today: your delivery URL and topic scoping are registered server-side... contact your Shopify partner manager' — and the UCP profile's webhook_url field, meant to let agents declare their endpoint programmatically, 'Shopify doesn't honor that field today.' This is a first-party documented limitation (not an external dispute) directly undercutting the 'programmatically subscribe' part of the story. missing for 10: a self-serve/programmatic subscription or registration API, honoring of the webhook_url profile field, and independent/hands-on confirmation of webhook delivery in production.
- [claimed-docs] “Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change”
- [claimed-docs] “"Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (fu…”
- [claimed-docs] “Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (ful…”
PayPal's generic webhooks system (developer.paypal.com/api/webhooks/overview) lets a merchant subscribe up to 10 URLs to specific event types, with durable retry (up to 25 attempts/3 days) and signature verification — and the agent-toolkit/cart API run on the same REST/order rails, so this infrastructure would carry order events. However, no evidence pack item explicitly names order-lifecycle event types (ORDER.CREATED/UPDATED/CANCELLED/fulfilled) tied to the agentic-commerce cart or Store Sync flows — those docs describe merchant-hosted reverse endpoints (createcart/getcart) rather than push-based lifecycle events for agents. Missing for 10: explicit order-lifecycle event-type list for agentic commerce, confirmation that Store Sync/cart orders emit standard webhook events, and any hands-on/independent proof of an agent successfully subscribing to these events.
- [claimed-docs] “"Webhooks are HTTPS posts from PayPal to an endpoint on your server whenever the corresponding event type occurs" — "Up to 10 webhook URLs m…”
- [claimed-docs] “The developer portal's REST API getting-started page anchors the agent surface: "REST APIs, including orders, payments, subscriptions, invoi…”
- [claimed-docs] “Cart execution is a reverse API the merchant hosts: POST /merchant-cart "Creates a new cart with the provided PayPalCart object. This is cal…”
- [claimed-docs] “The companion read endpoint keeps agent-side cart state fresh: get cart "Retrieves the current state of a cart. Used by PayPal Shopping Cart…”
Post purchase status
ai-native userMy agent can query the status and tracking of an order it placed, after the purchase
weight 2 · round to Shopify Agentic CommerceOrder MCP's get_order explicitly returns current order state (line items, fulfillment events, post-purchase adjustments) for orders placed via the agent, complemented by push order webhooks for tracking updates, and this is documented with concrete access/scope details (Token-tier, read_global_api_orders scope). The quickstart even walks through discovery-to-order-tracking as a first-party flow. Missing for 10: independent/third-party hands-on confirmation of get_order in production (only first-party docs/probes), and no evidence of consumer-facing tracking UI beyond the API/webhook mechanism.
- [claimed-docs] “enables AI agents to fetch the current state of an order placed through their agent, including line items, fulfillment events, and post-purc…”
- [claimed-docs] “"The Order MCP server enables AI agents to fetch the current state of an order placed through their agent, including line items, fulfillment…”
- [claimed-docs] “"Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (fu…”
- [claimed-docs] “This quickstart runs the full agentic commerce flow with the UCP CLI, from product discovery to order tracking, in about five minutes.”
- [claimed-docs] “Help customers track orders, manage returns, and access their account information.”
PayPal's agent toolkit and REST surface explicitly advertise agent access to 'orders...shipment tracking, transaction details' for post-purchase queries, and the agent-tools page lists concrete order-related functions (create_order, pay_order, create_shipment) alongside webhooks for order events. However, no specific 'get_order_status' or 'track_shipment' tool call is named or demonstrated end-to-end, so the tracking-query capability is asserted at a high level rather than shown working. Missing for 10: an explicitly named order-status/tracking query tool/function, and independent or hands-on confirmation that an agent can actually retrieve tracking info post-purchase.
- [claimed-docs] “Integrate with PayPal APIs to access orders, invoices, subscriptions, shipment tracking, transaction details, and dispute management through…”
- [claimed-docs] “"PayPal's agent toolkit supports the integration of PayPal APIs into AI agent workflows using" Amazon Bedrock, CrewAI, LangChain, MCP, OpenA…”
- [claimed-docs] “Post-purchase operations are first-class agent tools: refunds via create_refund / get_refund (a "refund for a captured payment", where "If n…”
- [claimed-docs] “"Webhooks are HTTPS posts from PayPal to an endpoint on your server whenever the corresponding event type occurs" — "Up to 10 webhook URLs m…”
- [probe] “PROBE runtime (recorded 2026-09-14): the PayPal Agent Toolkit resolves on the public npm registry (npm view @paypal/agent-toolkit → 1.11.0, …”
Payment credentials — stories about payment credentials in this arenaPayment credentials
Stories about payment credentials in this arena
Delegated credentials
ai-native userHand my agent a scoped, limited-use payment credential — amount limits, expiry, merchant restrictions — instead of a raw card number
weight 3 · round to PayPal Agentic CommerceUCP references AP2 payment mandates as "cryptographically signed payment authorizations that are mathematically tied to the specific state of the cart" and verifiable credentials, plus short-lived (60-minute) JWT checkout tokens and Token-tier gating for complete_checkout — gesturing at scoped, non-raw-card credentials, but this describes protocol/session tokens for API access, not a user-issued payment instrument with explicit amount limits, expiry, and merchant restrictions handed to the agent. Missing for 10: concrete documentation of a user-facing scoped payment credential (spending caps, expiry dates, merchant allow-lists) rather than just agent-identity/session auth tokens, and no independent/hands-on evidence of this credential-issuance flow in practice.
- [claimed-docs] “allows Platforms to provide cryptographically signed payment authorizations that are mathematically tied to the specific state of the cart”
- [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
- [claimed-docs] “"UCP traffic to Shopify's MCP servers is classified into three tiers based on how your agent identifies itself" — Token, Signed, Anonymous —…”
- [claimed-docs] “ucp.dev positions the protocol as industry-governed rather than single-vendor: "UCP is built by the industry, to enable seamless agentic exp…”
PayPal's ACP/UCP flows use Braintree single-use payment tokens/nonces that are explicitly described as 'bound to your merchant ID and includes amount and time restrictions that you can configure' — a genuine scoped, limited-use credential rather than a raw card number, and Google's UCP path similarly returns a tokenized, single-use credential. However this is merchant-side infrastructure (tokens generated by the merchant's Braintree integration for a specific checkout), not a consumer/end-user-controlled credential that an AI-native user personally hands to their own agent with self-set amount/expiry/merchant limits; there's no evidence of a user-facing wallet-style scoped credential issuance flow. missing for 10: end-user-facing UI/API for a consumer to mint their own scoped credential (set their own amount cap, expiry, merchant allowlist) independent of a specific merchant checkout session, and independent/hands-on confirmation of these restriction configs working in practice.
- [claimed-docs] “The ACP path is an in-ChatGPT checkout build: "Implement an MCP server with the `complete_checkout` tool to receive tokens", "Call `requestC…”
- [claimed-docs] “The UCP path targets Google surfaces: "This enables AI-powered checkout experiences through Google AI Mode (Gemini), where Google Pay return…”
- [claimed-docs] “Cart execution is a reverse API the merchant hosts: POST /merchant-cart "Creates a new cart with the provided PayPalCart object. This is cal…”
Settlement rails
developerSettle agent-initiated payments in stablecoins over documented rails
weight 2 · round drawnShopify Agentic Commercenone0/10Evidence documents payment_handlers like com.google.pay, credit-card style checkout, and AP2/payment mandate concepts, but nowhere mentions stablecoins, crypto rails, or any stablecoin settlement path for agent-initiated payments. This is a documented gap, not a category mismatch, since UCP explicitly discusses payment handler negotiation and could plausibly include stablecoin rails.
- [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
- [claimed-docs] “ucp.dev positions the protocol as industry-governed rather than single-vendor: "UCP is built by the industry, to enable seamless agentic exp…”
- [claimed-docs] “allows Platforms to provide cryptographically signed payment authorizations that are mathematically tied to the specific state of the cart”
PayPal Agentic Commercenone0/10The evidence pack details PayPal's agentic commerce rails extensively (ACP/UCP via Braintree tokens, agent toolkit, cart APIs, webhooks, fees) but none of it mentions stablecoins, PYUSD, crypto, or blockchain-based settlement rails for agent-initiated payments — all documented settlement is via traditional card/Braintree processing and standard PayPal fee schedules.
- [claimed-docs] “"Agent Ready helps Braintree merchants accept payments from AI shopping assistants across major platforms, including ChatGPT, Google AI Mode…”
- [claimed-docs] “The ACP path is an in-ChatGPT checkout build: "Implement an MCP server with the `complete_checkout` tool to receive tokens", "Call `requestC…”
- [claimed-docs] “The UCP path targets Google surfaces: "This enables AI-powered checkout experiences through Google AI Mode (Gemini), where Google Pay return…”
- [claimed-docs] “The published US commercial rates that agent-initiated orders inherit: "PayPal Checkout" and "PayPal Guest Checkout" at "3.49% +" fixed fee,…”
Wallets
ai-native userProvision a wallet my agent holds and spends from — funded and controlled by me, with balance visibility
weight 3 · round drawnShopify Agentic Commercenone0/10Shopify's UCP evidence covers checkout, payment-handler negotiation (e.g., com.google.pay), and AP2 payment mandates/verifiable credentials tied to cart state, but there is no documentation of a user-funded, agent-held wallet construct with balance visibility — payment credentials are collected per-checkout, not provisioned as a standing wallet.
- [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
- [claimed-docs] “allows Platforms to provide cryptographically signed payment authorizations that are mathematically tied to the specific state of the cart”
- [claimed-docs] “"UCP traffic to Shopify's MCP servers is classified into three tiers based on how your agent identifies itself" — Token, Signed, Anonymous —…”
PayPal Agentic Commercenone0/10All evidence describes merchant-side infrastructure (Agent Ready, Store Sync, agent toolkit, cart APIs) that lets AI agents check out with merchants or lets merchants build agents for order/refund/dispute management — none of it describes a consumer-provisioned wallet that a user funds, an agent holds/spends from, with balance visibility. The delegated tokens in ACP/UCP are single-use, merchant-bound checkout credentials, not a persistent user wallet.
Privacy posture — data-handling and privacy storiesPrivacy posture
Data-handling and privacy stories
ai-native userControl data retention and deletion
weight 2 · round drawnShopify Agentic Commercenone0/10The evidence pack covers UCP agent profiles, catalog/cart/checkout/order MCP servers, webhooks, and trust tiers, but nowhere describes any mechanism for an AI-native user to control retention or deletion of their data (e.g., profile data, cart history, order records) — no privacy/data-deletion API, retention policy, or opt-out control is documented.
PayPal Agentic Commercenone0/10The evidence pack covers agentic commerce protocols, cart APIs, webhooks, fees, and toolkit integrations, but contains no mention of data retention policies, deletion controls, or privacy settings that an AI-native user could invoke to manage stored data. This axis plausibly applies to a payments platform handling AI agent transaction data, but no supporting evidence exists.
Protocol openness — stories about protocol openness in this arenaProtocol openness
Stories about protocol openness in this arena
Ecosystem adoption
developerAt least two independent parties beyond the vendor implement the protocol or platform — it is an ecosystem, not a private integration
weight 2 · round to Shopify Agentic CommerceUCP is documented as an industry-governed open standard rather than a Shopify-only integration: ucp.dev's co-developer wall names Google, Etsy, Wayfair, Target, Walmart, Amazon, Microsoft, Meta, Salesforce and Stripe as builders of the spec, with 'The complete technical specification, documentation, and reference implementations are hosted in our public GitHub repository' and versioned releases confirmed live via ucp.dev/llms.txt. Shopify itself ships a conformant implementation (catalog/cart/checkout/order MCP servers, verified live via runtime probes), demonstrating at least one non-founding-spec-author adopting the protocol. Missing for 10: independent, hands-on evidence that another named co-developer (e.g., Etsy, Walmart) has a live production UCP endpoint analogous to Shopify's, rather than just being listed as a spec co-author.
- [claimed-docs] “ucp.dev positions the protocol as industry-governed rather than single-vendor: "UCP is built by the industry, to enable seamless agentic exp…”
- [probe] “PROBE runtime (recorded 2026-09-14): the Universal Commerce Protocol spec is published in the open — https://ucp.dev/llms.txt serves the ver…”
- [probe] “PROBE runtime (recorded 2026-09-14): Shopify's Global Catalog MCP server is live — a keyless JSON-RPC initialize POST to https://catalog.sho…”
- [probe] “PROBE runtime (recorded 2026-09-14): a Shopify-operated storefront's own UCP endpoint is live — a keyless JSON-RPC initialize POST to https:…”
PayPal Agentic Commercenone0/10The evidence shows PayPal/Braintree acting as an implementer of protocols defined by other parties (OpenAI's ACP, Google's UCP, and the Anthropic-originated MCP), but nothing shows independent third parties implementing PayPal's own agentic-commerce platform (Cart API, Store Sync, agent toolkit) as an open ecosystem. Merchants and partners (Wix, Shopware, BigCommerce) are consumers/integrators of PayPal's platform, not independent implementers of its protocol.
- [claimed-docs] “The ACP path is an in-ChatGPT checkout build: "Implement an MCP server with the `complete_checkout` tool to receive tokens", "Call `requestC…”
- [claimed-docs] “The UCP path targets Google surfaces: "This enables AI-powered checkout experiences through Google AI Mode (Gemini), where Google Pay return…”
- [claimed-docs] “Store Sync is the full-catalog path, "enabling AI agents to discover your products, create and manage shopping carts, and complete purchases…”
- [claimed-docs] “Access to PayPal's agentic commerce services is form-gated, not self-serve: merchants must complete a form "to contact the AI team at PayPal…”
Spec publication
developerThe commerce protocol this product speaks is published as an open, versioned specification I can read and implement without signing anything
weight 3 · round to Shopify Agentic CommerceUCP is documented as an open, industry-governed standard with versioned releases and a public GitHub repository hosting the full spec and reference implementations, and ucp.dev/llms.txt confirms a dated, versioned spec index with no signup gate. Shopify's own docs and runtime probes show keyless, unauthenticated access to core UCP endpoints (catalog search, cart creation) without any signature required to read or implement the protocol. missing for 10: no direct evidence of the actual spec text/license terms confirming implementation rights, and no independent third-party (non-Shopify, non-ucp.dev) confirmation of the openness claim.
- [claimed-docs] “ucp.dev positions the protocol as industry-governed rather than single-vendor: "UCP is built by the industry, to enable seamless agentic exp…”
- [probe] “PROBE runtime (recorded 2026-09-14): the Universal Commerce Protocol spec is published in the open — https://ucp.dev/llms.txt serves the ver…”
- [claimed-docs] “Allows autonomous AI agents to transact on behalf of users with pre-defined, verifiable boundaries.”
- [probe] “PROBE runtime (recorded 2026-09-14): the documented agent-profile trust gate behaves as specified — a keyless raw tools/call search_catalog …”
PayPal Agentic Commercenone0/10The evidence pack shows PayPal implements OpenAI's ACP and Google's UCP protocols and tells developers to 'follow the ACP agentic checkout specification,' but never provides or links a version number, license, or spec document for ACP/UCP that a developer could read independently of PayPal. Instead, everything documented is gated: Braintree merchant account required, PayPal AI team form-approval required for agentic commerce services, and separate Google merchant registration required for UCP enablement — none of this evidences an open, versioned, sign-nothing spec.
- [claimed-docs] “The ACP path is an in-ChatGPT checkout build: "Implement an MCP server with the `complete_checkout` tool to receive tokens", "Call `requestC…”
- [claimed-docs] “The UCP path targets Google surfaces: "This enables AI-powered checkout experiences through Google AI Mode (Gemini), where Google Pay return…”
- [claimed-docs] “Access to PayPal's agentic commerce services is form-gated, not self-serve: merchants must complete a form "to contact the AI team at PayPal…”
- [claimed-docs] “"Agent Ready helps Braintree merchants accept payments from AI shopping assistants across major platforms, including ChatGPT, Google AI Mode…”
Refunds disputes — stories about refunds disputes in this arenaRefunds disputes
Stories about refunds disputes in this arena
Disputes
developerDisputes and chargebacks on agent transactions can be handled via API — evidence submission, status, outcomes
weight 2 · round to PayPal Agentic CommerceShopify Agentic Commercenone0/10The evidence pack covers catalog, cart, checkout, order state, and order webhooks (which surface refunds/returns/cancellations), but nowhere mentions a dispute or chargeback API, evidence submission, dispute status tracking, or dispute outcome handling for agent transactions.
The agent toolkit exposes dispute tools — list_disputes, get_dispute, and accept_dispute_claim — plus the general REST API surface explicitly lists 'disputes' alongside orders/payments, giving developers programmatic access to dispute status and resolution outcomes. However, no evidence-submission endpoint (e.g., uploading documents/evidence for a dispute) is documented anywhere in the pack, so the 'evidence submission' part of the story is unsupported. missing for 10: documented evidence-submission API/tool for disputes, and any hands-on/independent confirmation that these dispute tools work end-to-end in production.
- [claimed-docs] “Post-purchase operations are first-class agent tools: refunds via create_refund / get_refund (a "refund for a captured payment", where "If n…”
- [claimed-docs] “Integrate with PayPal APIs to access orders, invoices, subscriptions, shipment tracking, transaction details, and dispute management through…”
- [claimed-docs] “The developer portal's REST API getting-started page anchors the agent surface: "REST APIs, including orders, payments, subscriptions, invoi…”
- [claimed-docs] “"PayPal's agent toolkit supports the integration of PayPal APIs into AI agent workflows using" Amazon Bedrock, CrewAI, LangChain, MCP, OpenA…”
Refunds
developerRefunds on agent-placed orders can be initiated and tracked programmatically
weight 2 · round to PayPal Agentic CommerceRefunds are only surfaced as read/notification events — order webhooks fire on committed changes including refunds, and get_order can be polled to see post-purchase adjustments — but there is no documented API/tool for a developer to programmatically initiate a refund on an agent-placed order; webhook subscription itself is not self-serve ('contact your Shopify partner manager'). missing for 10: an actual refund-initiation endpoint/tool (create_refund or equivalent), self-serve webhook subscription for refund events, and any tracking dashboard/status API dedicated to refund lifecycle beyond generic order state.
- [claimed-docs] “"Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (fu…”
- [claimed-docs] “"The Order MCP server enables AI agents to fetch the current state of an order placed through their agent, including line items, fulfillment…”
- [claimed-docs] “Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (ful…”
- [claimed-docs] “enables AI agents to fetch the current state of an order placed through their agent, including line items, fulfillment events, and post-purc…”
The Agent Toolkit exposes create_refund/get_refund tools and dispute tools (list_disputes, get_dispute, accept_dispute_claim) so refunds on agent-placed orders can be initiated and tracked programmatically via MCP/LangChain/etc., backed by the underlying PayPal REST orders/disputes API and webhooks for status updates. However, the docs don't specifically address refund flows tied to the new agentic-commerce cart/checkout (ACP/UCP) orders, and there's no independent hands-on confirmation of refund success for agent-originated transactions. missing for 10: explicit documentation linking refund/dispute tools to agent-placed (ACP/UCP/Store Sync) orders specifically, and independent/hands-on verification of the refund tracking flow.
- [claimed-docs] “Post-purchase operations are first-class agent tools: refunds via create_refund / get_refund (a "refund for a captured payment", where "If n…”
- [claimed-docs] “"PayPal's agent toolkit supports the integration of PayPal APIs into AI agent workflows using" Amazon Bedrock, CrewAI, LangChain, MCP, OpenA…”
- [claimed-docs] “"Webhooks are HTTPS posts from PayPal to an endpoint on your server whenever the corresponding event type occurs" — "Up to 10 webhook URLs m…”
- [probe] “PROBE runtime (recorded 2026-09-14): the PayPal Agent Toolkit resolves on the public npm registry (npm view @paypal/agent-toolkit → 1.11.0, …”
- [claimed-docs] “The developer portal's REST API getting-started page anchors the agent surface: "REST APIs, including orders, payments, subscriptions, invoi…”
Trust safety — stories about trust safety in this arenaTrust safety
Stories about trust safety in this arena
Agent identity
merchantAgents identify themselves verifiably — registered profiles, signatures, or trust tiers — so I can tell trusted agent traffic from anonymous bots
weight 3 · round to Shopify Agentic CommerceShopify's UCP documents a concrete three-tier trust model (Token, Signed, Anonymous) tied to agent identity, with Signed-tier requiring RFC 9421 ECDSA P-256 signature verification against a published public key in the agent's UCP profile, and access/rate-limits scaling with identification strength; a live probe confirms the trust gate actually enforces this (invalid_profile_url error when no hosted profile is presented). This gives merchants a verifiable way to distinguish anonymous vs. cryptographically-signed vs. token-authenticated agent traffic. missing for 10: no independent/third-party audit of the signature verification in production merchant traffic, and no merchant-facing dashboard/reporting evidence showing how tier data is surfaced to merchants themselves.
- [claimed-docs] “"UCP traffic to Shopify's MCP servers is classified into three tiers based on how your agent identifies itself" — Token, Signed, Anonymous —…”
- [claimed-docs] “In UCP, "a platform profile is a JSON document that describes the protocol version and capabilities the platform supports"; the business sid…”
- [probe] “PROBE runtime (recorded 2026-09-14): the documented agent-profile trust gate behaves as specified — a keyless raw tools/call search_catalog …”
- [claimed-docs] “Shopify uses your profile to learn what your agent declares, intersect it with what the shop supports, and settle on a single negotiated set…”
- [claimed-docs] “Negotiation is server-selects. The business computes the intersection of its capabilities with the platform's and chooses the active set”
PayPal Agentic Commercenone0/10PayPal's docs describe payment-token authentication (Braintree single-use tokens bound to merchant ID), PayPal-issued JWTs for verifying that requests come from PayPal's own Shopping Cart service, and webhook signature verification — but none of this constitutes a verifiable agent identity system (no registered agent profiles, agent-level signatures, or trust tiers that would let a merchant distinguish which specific AI agent or bot is originating traffic). The authentication documented is merchant-to-PayPal or PayPal-to-merchant channel security, not agent-to-merchant identity/trust signaling.
- [claimed-docs] “Cart execution is a reverse API the merchant hosts: POST /merchant-cart "Creates a new cart with the provided PayPalCart object. This is cal…”
- [claimed-docs] “The ACP path is an in-ChatGPT checkout build: "Implement an MCP server with the `complete_checkout` tool to receive tokens", "Call `requestC…”
- [claimed-docs] “"Webhooks are HTTPS posts from PayPal to an endpoint on your server whenever the corresponding event type occurs" — "Up to 10 webhook URLs m…”
- [probe] “PROBE runtime (recorded 2026-09-14): PayPal's remote MCP server is live — a keyless JSON-RPC initialize POST to https://mcp.paypal.com/mcp a…”
Human oversight
ai-native userSensitive agent spending requires my documented approval — a confirmation step, signed mandate, or per-purchase consent — before money moves
weight 3 · round to Shopify Agentic CommerceShopify's UCP checkout flow documents explicit pre-purchase gates: complete_checkout must only be called once 'Checkout status is ready_for_complete', the 'Buyer has reviewed and confirmed the order', and the 'Payment credential has been collected', and unresolved cases force a hand-off to the buyer via continue_url (requires_escalation/requires_buyer_review). AP2 integration adds 'cryptographically signed payment authorizations that are mathematically tied to the specific state of the cart', which maps to a signed-mandate model, and trust tiers restrict complete_checkout to Token-tier agents with explicit purchase permission. However, the docs also note 'Trusted agents can complete checkouts directly,' implying some agents can skip buyer-facing confirmation, and enforcement of the 'buyer reviewed' precondition appears to rely on agent self-attestation rather than a Shopify-verified user signature captured at time of purchase. Missing for 10: independent/third-party confirmation that buyer consent is cryptographically captured (not just agent-declared) and clarity on exactly which agents qualify as 'trusted' to bypass buyer review.
- [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
- [claimed-docs] “Buyer handoff is a first-class state: "Build for escalations regardless of how you authenticate." A checkout in requires_escalation means "C…”
- [claimed-docs] “"UCP traffic to Shopify's MCP servers is classified into three tiers based on how your agent identifies itself" — Token, Signed, Anonymous —…”
- [claimed-docs] “allows Platforms to provide cryptographically signed payment authorizations that are mathematically tied to the specific state of the cart”
- [claimed-docs] “ucp.dev positions the protocol as industry-governed rather than single-vendor: "UCP is built by the industry, to enable seamless agentic exp…”
PayPal's ACP/UCP flows use single-use, time- and amount-bound delegated tokens tied to a specific merchant and transaction, and the toolkit docs explicitly recommend 'human oversight' for judgment-sensitive actions — both suggest transaction-level guardrails rather than fully autonomous spending. However, the evidence never documents an explicit user-facing confirmation screen, signed mandate artifact, or per-purchase consent UI shown to the end user before the token is used to move money; the checkout flow (requestCheckout/Instant Checkout) is described only at a technical/token level, not from the consent-UX perspective. Missing for 10: an explicit documented consent/confirmation step or mandate artifact shown to the payer, and any independent/hands-on confirmation that this consent step actually blocks unauthorized charges.
- [claimed-docs] “The ACP path is an in-ChatGPT checkout build: "Implement an MCP server with the `complete_checkout` tool to receive tokens", "Call `requestC…”
- [claimed-docs] “The UCP path targets Google surfaces: "This enables AI-powered checkout experiences through Google AI Mode (Gemini), where Google Pay return…”
- [claimed-docs] “"PayPal's agent toolkit supports the integration of PayPal APIs into AI agent workflows using" Amazon Bedrock, CrewAI, LangChain, MCP, OpenA…”
- [claimed-docs] “Cart execution is a reverse API the merchant hosts: POST /merchant-cart "Creates a new cart with the provided PayPalCart object. This is cal…”
Liability
merchantThe fraud, liability, and chargeback rules for agent-initiated transactions are documented so I know who bears the risk
weight 2 · round drawnShopify Agentic Commercenone0/10The evidence pack documents UCP's protocol mechanics (catalog, cart, checkout, order webhooks, trust tiers, profile negotiation) but nowhere specifies fraud liability, chargeback responsibility, or dispute-resolution rules for agent-initiated purchases. The only tangential mention is UCP's general 'Merchant of Record' framing on ucp.dev, which addresses customer-relationship ownership, not who bears fraud/chargeback risk in an agent transaction — no Shopify-specific policy, contract terms, or dispute process is documented.
- [claimed-docs] “ucp.dev positions the protocol as industry-governed rather than single-vendor: "UCP is built by the industry, to enable seamless agentic exp…”
PayPal Agentic Commercenone0/10Evidence shows general dispute-management and refund tools (list_disputes, accept_dispute_claim, create_refund) and standard PayPal fee/webhook docs, but nothing documents fraud, liability, or chargeback allocation specifically for agent-initiated transactions (e.g., who bears risk when a delegated token or AI agent purchase is disputed). The delegated-token docs mention tokens are 'bound to your merchant ID' but stop short of stating liability shift or chargeback rules for agent-driven checkouts.
- [claimed-docs] “Post-purchase operations are first-class agent tools: refunds via create_refund / get_refund (a "refund for a captured payment", where "If n…”
- [claimed-docs] “The ACP path is an in-ChatGPT checkout build: "Implement an MCP server with the `complete_checkout` tool to receive tokens", "Call `requestC…”
- [claimed-docs] “The published US commercial rates that agent-initiated orders inherit: "PayPal Checkout" and "PayPal Guest Checkout" at "3.49% +" fixed fee,…”
- [claimed-docs] “"Webhooks are HTTPS posts from PayPal to an endpoint on your server whenever the corresponding event type occurs" — "Up to 10 webhook URLs m…”
Spend controls
ai-native userSet per-agent spend caps and usage limits and revoke an agent's payment authority instantly
weight 2 · round drawnShopify Agentic Commercenone0/10The evidence describes trust tiers, rate limiting, token TTLs, and JWT scopes, but nowhere documents per-agent spend caps, usage limits, or an instant revoke-payment-authority mechanism — tokens simply expire after 60 minutes rather than being explicitly revocable on demand, and no dollar-limit or usage-cap controls are mentioned anywhere in the pack.
PayPal Agentic Commercenone0/10Evidence shows per-transaction delegated tokens with configurable amount/time restrictions bound to a merchant (paypal-ac-supp-acp-chatgpt), but nothing about a user or merchant setting persistent per-agent spend caps/usage limits across multiple transactions, or an instant revoke-authority mechanism for a given agent's payment access. No dashboard, API, or docs reference for agent-level authorization management or revocation is present.
- [claimed-docs] “The ACP path is an in-ChatGPT checkout build: "Implement an MCP server with the `complete_checkout` tool to receive tokens", "Call `requestC…”
- [claimed-docs] “The UCP path targets Google surfaces: "This enables AI-powered checkout experiences through Google AI Mode (Gemini), where Google Pay return…”
- [claimed-docs] “Cart execution is a reverse API the merchant hosts: POST /merchant-cart "Creates a new cart with the provided PayPalCart object. This is cal…”
Not comparable on these axes
ai-native userPlug MCP servers into this product so it can use their tools
weight 3 · not comparableShopify Agentic Commercen/aShopify Agentic Commerce's entire evidence pack describes it as an MCP *server* provider (Catalog, Cart, Checkout, Order MCP servers) that AI agents connect to and consume — it is the tool-provider side of the UCP protocol, not a host/client product into which a user would plug third-party MCP servers. This story's axis (acting as an MCP client that ingests external servers' tools) is a category mismatch for a commerce backend whose role is to be the target integration, not the integrator.
- [claimed-docs] “the CLI provides structured commands to search the Catalog, build carts, create checkouts, hand off buyers, and track orders”
- [claimed-docs] “Shopify's agent surface is UCP end to end via "Shopify's UCP-compliant MCP servers": the UCP CLI "provides structured commands to search the…”
- [claimed-docs] “"The Global Catalog MCP server enables AI agents to search and discover products across the entire Shopify ecosystem, helping buyers find pr…”
- [claimed-docs] “"Cart tools accept unauthenticated requests, which lets you estimate totals and share a cart with the buyer before collecting credentials" —…”
PayPal Agentic Commercen/aPayPal Agentic Commerce is a payments/commerce platform that exposes its own APIs as tools to AI agents (via its MCP server and agent toolkit) — it is not itself an agent or orchestrator that a user configures with external MCP servers to expand its own tool access. The story's premise (plugging MCP servers into the product so it can use their tools) is a category error for a commerce backend/tool-provider like this.
ai-native userGet AI-generated insights and suggestions from my data inside the product
weight 2 · not comparableShopify Agentic Commercen/aThe evidence pack for Shopify Agentic Commerce (UCP) is entirely about enabling third-party AI agents to search, cart, checkout, and track orders on behalf of buyers — a transactional commerce protocol, not a feature for surfacing AI-generated insights or suggestions from a user's own data. This story is a category error for this product's scope.
PayPal Agentic Commercenone0/10Evidence documents PayPal's agentic commerce stack (Agent Ready, Store Sync, cart APIs, agent toolkit, MCP server) purely as infrastructure enabling AI agents to browse catalogs, create carts, and complete transactions on a merchant's behalf — none of it shows PayPal analyzing a user's/merchant's own data to surface AI-generated insights or suggestions inside the product (e.g., analytics dashboards, business recommendations). The dispute/order/refund tools are action endpoints for agents to execute tasks, not insight-generation features.
- [claimed-docs] “"PayPal's agent toolkit supports the integration of PayPal APIs into AI agent workflows using" Amazon Bedrock, CrewAI, LangChain, MCP, OpenA…”
- [claimed-docs] “Post-purchase operations are first-class agent tools: refunds via create_refund / get_refund (a "refund for a captured payment", where "If n…”
- [claimed-docs] “PayPal built an MCP server that lets merchants use natural language with their favorite MCP clients. This helps users complete business task…”
ai-native userSchedule recurring jobs or workflows
weight 2 · not comparableShopify Agentic Commercen/aShopify Agentic Commerce is a commerce/MCP protocol for catalog search, cart, checkout, and order tracking by AI agents — not a workflow/job orchestration or scheduling platform. Recurring job/workflow scheduling is a different product category (task schedulers, automation platforms) and no evidence pack material addresses scheduling recurring commerce actions or workflows.
PayPal Agentic Commercenone0/10The evidence covers PayPal's agent toolkit for orders, invoices, subscriptions, refunds, disputes, and MCP/agent-framework integrations, but none of it describes any capability for an AI-native user to schedule recurring jobs or automated workflows (e.g., cron-like triggers, recurring agent task execution). 'Subscriptions' access is a payment-billing object type merchants can query, not a workflow-scheduling feature for AI agents themselves. missing for 10: any scheduling/cron mechanism, recurring workflow orchestration, or documented recurring-task automation for AI-native users.
- [claimed-docs] “"PayPal's agent toolkit supports the integration of PayPal APIs into AI agent workflows using" Amazon Bedrock, CrewAI, LangChain, MCP, OpenA…”
- [claimed-docs] “Post-purchase operations are first-class agent tools: refunds via create_refund / get_refund (a "refund for a captured payment", where "If n…”
- [claimed-docs] “Integrate with PayPal APIs to access orders, invoices, subscriptions, shipment tracking, transaction details, and dispute management through…”
ai-native userVersion, review, and roll back my automations
weight 1 · not comparableShopify Agentic Commercen/aThis story concerns versioning, review, and rollback of user-authored automations (e.g., workflow definitions), which is a wrong axis for Shopify's agentic commerce/UCP protocol tooling — the evidence pack is entirely about product discovery, cart/checkout, order state, and trust/negotiation protocols, none of which involve automation authoring, versioning, or rollback capabilities.
PayPal Agentic Commercenone0/10The evidence pack covers payment protocols, catalog sync, agent toolkit tools, and webhooks, but nothing addresses versioning, reviewing, or rolling back agent-configured automations themselves — no changelog, audit history, or rollback mechanism for automation workflows is documented.
ai-native userExport all of my data in open formats and leave
weight 3 · not comparableShopify Agentic Commercenone0/10None of the evidence addresses data export, portability, or the ability for a user/agent to extract their commerce data in an open format and leave the platform — the pack only covers catalog search, cart/checkout MCP tools, order webhooks, and profile negotiation. Since data portability is a plausible axis for any commerce platform, absence of evidence means 'none' rather than 'na'.
ai-native userSelf-host the core product
weight 3 · not comparableShopify Agentic Commercen/aShopify Agentic Commerce is a hosted SaaS/e-commerce platform with proprietary MCP servers and merchant infrastructure, not open-source software a user could self-host; the underlying UCP protocol spec is open but that is distinct from self-hosting Shopify's actual product. This is a category error — self-hosting is not a fair question for a hosted commerce platform.
PayPal Agentic Commercen/aPayPal Agentic Commerce is a hosted payments/commerce SaaS platform tied to PayPal's merchant accounts, processing infrastructure, and proprietary services (Braintree, Store Sync, hosted Agentic Commerce APIs) — self-hosting the core product is a category error since the core value is PayPal's regulated payment processing, which cannot be run independently by a customer.
developerMonetize an API or service with HTTP 402 machine payments that agents pay per call without a checkout UI
weight 3 · not comparableShopify Agentic Commercen/aShopify Agentic Commerce/UCP is a retail commerce protocol for AI agents to search catalogs, build carts, and complete merchant checkouts — it is not an API/service monetization mechanism using HTTP 402 per-call machine payments. Nothing in the evidence describes HTTP 402 status-code payment flows, API paywalls, or per-call agent billing; all payment/checkout flows described are tied to merchant cart/checkout sessions for buying goods, a different axis than developer API monetization.
PayPal Agentic Commercenone0/10All evidence describes PayPal's agentic commerce as checkout-flow based (carts, ACP/UCP delegated tokens, Store Sync, agent toolkit for orders/refunds/disputes) — none of it describes HTTP 402 status-code machine payments or per-call API monetization without a checkout UI, which is a distinct technical pattern. Since PayPal is a payments platform, this axis could plausibly apply, but there is no evidence it ships or supports the 402 pay-per-call mechanism described in the story.
ai-native userChoose where my data is stored (region/residency)
weight 2 · not comparableShopify Agentic Commercen/aThis story concerns data residency/region choice for storing an AI-native user's own data, which is a cloud/SaaS infrastructure axis. Shopify Agentic Commerce is a commerce protocol/MCP toolset for agent-driven shopping, not a data-hosting platform where a user selects storage regions — the evidence pack contains nothing about data residency and the axis is a category error for this product type.
PayPal Agentic Commercen/aPayPal Agentic Commerce is a payments/checkout API and agent-toolkit product, not a data storage/hosting platform; data residency/region selection is not a capability category this kind of product offers or that buyers would compare it on. No evidence pack item addresses residency at all, confirming it's outside scope rather than a gap.
ai-native userPrevent my data from being used to train AI models
weight 3 · not comparableShopify Agentic Commercen/aShopify Agentic Commerce is a commerce protocol/MCP platform for enabling AI agents to shop, not an AI model or assistant product; there is no concept here of user data being used to train an AI model, so an AI-training opt-out control is a category error for this product type.
ai-native userOpt out of telemetry and usage tracking
weight 2 · not comparableShopify Agentic Commercenone0/10The evidence pack covers UCP CLI, MCP servers, cart/checkout/order flows, trust tiers, and profile negotiation, but nowhere mentions telemetry collection, usage analytics, or any opt-out mechanism for the CLI or MCP servers. Since CLI/SDK tools commonly report usage telemetry, this axis is a fair question, but no evidence supports or denies it.
PayPal Agentic Commercen/aPayPal Agentic Commerce is a payments/commerce infrastructure product for merchants and AI agent developers, not a data-collecting SaaS tool with user-facing telemetry settings; the concept of an end-user 'opting out of telemetry/usage tracking' as a privacy control does not map onto this product's category. No evidence pack item addresses telemetry opt-out, so the axis is a category mismatch rather than an unmet capability.