Shopify Agentic Commerce vs Skyfire

Cart

1. ai-native userMy agent can create and update a cart or order draft through a documented protocol call

   weight 3 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce✓fullprobed9/10

   Cart MCP and Checkout MCP are documented UCP protocol calls (create_cart, update_cart, create_checkout, complete_checkout) with JSON-RPC schemas, and a runtime probe confirms a real cart was created keylessly against a live Shopify store via the CLI/protocol. missing for 10: no independent (non-Shopify) hands-on corroboration of a full end-to-end checkout completion.

   • [claimed-docs] “"Cart tools accept unauthenticated requests, which lets you estimate totals and share a cart with the buyer before collecting credentials" —…”
   • [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”
   • [claimed-docs] “The Cart MCP server enables AI agents to build and iterate on a cart before the buyer commits to purchase. When the buyer is ready to buy, c…”
   • [claimed-docs] “The Checkout MCP server enables AI agents to create and manage checkout sessions, convert carts into checkouts, and refer buyers to the merc…”

   proof ↗⚑ flag

   Skyfire—none0/10

   Skyfire's documented protocol (tokens, kya/pay/kya-pay, MCP tools like find-sellers/create-*-token) covers identity verification and payment authorization/settlement, but there is no documented call for creating or updating a cart or order draft — order/cart state is left to the seller's own system, not exposed via Skyfire's API or MCP server.

   • [claimed-docs] “Add the Skyfire MCP server ... Your agent is now ready to discover sellers, generate `kya` or `pay` tokens, and instantly execute agentic co…”
   • [claimed-docs] “Create an MCP Server Resource that explains which token types are required (`kya`, `pay`, and/or `kya-pay`), how tokens must be passed (the …”
   • [claimed-docs] “The Skyfire MCP server at https://mcp.skyfire.xyz/mcp lets agents "Discover sellers", create tokens, and "Orchestrate agent commerce workflo…”
   • [claimed-docs] “Skyfire gives agents verified identity and payment credentials — "No 403 errors, captchas or blocked checkouts. Authenticated access and pay…”

   proof ↗⚑ flag

Checkout

1. ai-native userMy agent can complete a purchase end-to-end — checkout session, delegated payment credential, confirmed order

   weight 3 · round to Skyfire
   Shopify Agentic Commerce~partialprobed7/10

   Docs describe a full documented path — create_checkout, payment_handlers (e.g. com.google.pay) negotiation, complete_checkout requiring a collected payment credential, and order confirmation via get_order/order webhooks — and even name complete_checkout as Token-tier gated 'when the token is granted permission to complete purchases.' However, the default flow explicitly hands off to the buyer's browser for payment ('Build carts, convert them to checkouts, and hand off to the merchant for payment') and the only hands-on runtime probe reached cart creation only, explicitly stopping 'no checkout, no payment.' Missing for 10: an independent/hands-on trace of an actual complete_checkout call with a delegated payment credential and a resulting confirmed order, and clarity on how broadly (vs. only select trusted agents) autonomous payment completion is actually granted.

   • [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
   • [claimed-docs] “Buyer handoff is a first-class state: "Build for escalations regardless of how you authenticate." A checkout in requires_escalation means "C…”
   • [claimed-docs] “"UCP traffic to Shopify's MCP servers is classified into three tiers based on how your agent identifies itself" — Token, Signed, Anonymous —…”
   • [claimed-docs] “"The Order MCP server enables AI agents to fetch the current state of an order placed through their agent, including line items, fulfillment…”
   • [claimed-docs] “"Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (fu…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”

   proof ↗⚑ flag

   Skyfire✓fullprobed8/10

   Skyfire documents the full agent-checkout loop: MCP tools let an agent discover sellers, create kya/pay/kya-pay tokens (delegated payment+identity credential), and sellers charge the token post-delivery with funds moved between wallets, completing a confirmed order/settlement. missing for 10: independent/hands-on end-to-end transaction proof (evidence is vendor docs plus a narrow auth-only runtime probe, not a full live purchase trace) and no example of an explicit 'confirmed order' object/receipt returned to the buyer.

   • [claimed-docs] “Charge a `pay` or `kya-pay` token as a seller agent or seller service. Use this API after delivering a service, tool, or resource to collect…”
   • [claimed-docs] “Add the Skyfire MCP server ... Your agent is now ready to discover sellers, generate `kya` or `pay` tokens, and instantly execute agentic co…”
   • [claimed-docs] “Sellers can use a `kya-pay` token to enable a guest checkout experience for buyer agents.”
   • [claimed-docs] “Skyfire gives agents verified identity and payment credentials — "No 403 errors, captchas or blocked checkouts. Authenticated access and pay…”
   • [claimed-docs] “Pay tokens carry committed amounts: "At creation, the token's amount is committed against the buyer's wallet (which is why token creation re…”
   • [claimed-docs] “Sellers collect via the Charge Token API: "Use this API after delivering a service, tool, or resource to collect payment from a buyer-issued…”
   • [claimed-docs] “The Skyfire MCP server at https://mcp.skyfire.xyz/mcp lets agents "Discover sellers", create tokens, and "Orchestrate agent commerce workflo…”
   • [probe] “PROBE runtime (recorded 2026-09-14): Skyfire's token API is live and key-gated as documented — a keyless POST to https://api.skyfire.xyz/api…”

   proof ↗⚑ flag

Embedded surfaces

1. merchantBuyers can complete purchases of my products inside chat and assistant surfaces (ChatGPT, Claude, Gemini, Copilot and peers)

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce~partialprobed6/10

   Shopify ships a real, live UCP checkout stack — Catalog, Cart, and Checkout MCP servers with a documented complete_checkout tool that can 'submit payment and place the order' for Token-tier trusted agents, backed by a runtime-verified cart creation and marketing claiming buyers 'check out right in the chat' — and UCP itself is co-developed with Google, Microsoft, OpenAI-adjacent ecosystem players. However, the docs make buyer handoff/escalation a first-class, common path ('hand off to the buyer via continue_url', 'Build for escalations regardless of how you authenticate'), meaning many purchases route the buyer out to the merchant's own checkout page rather than completing fully inside the chat UI, and named surfaces beyond Claude (only a Claude plugin is documented) — ChatGPT, Gemini, Copilot — have no confirmed live integration in the evidence. Missing for 10: confirmed named integrations with ChatGPT/Gemini/Copilot, evidence that in-chat completion (not handoff) is the norm rather than the exception, and independent buyer-side confirmation of an end-to-end in-chat purchase.

   • [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
   • [claimed-docs] “Buyer handoff is a first-class state: "Build for escalations regardless of how you authenticate." A checkout in requires_escalation means "C…”
   • [claimed-docs] “"UCP traffic to Shopify's MCP servers is classified into three tiers based on how your agent identifies itself" — Token, Signed, Anonymous —…”
   • [claimed-docs] “Get discovered across AI channels. Shoppers check out right in the chat.”
   • [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”
   • [claimed-docs] “ucp.dev positions the protocol as industry-governed rather than single-vendor: "UCP is built by the industry, to enable seamless agentic exp…”

   proof ↗⚑ flag

   Skyfire—none0/10

   Skyfire's evidence documents a generic agent-to-agent payment/identity protocol (tokens, MCP server for 'find-sellers' and token creation) but nowhere mentions ChatGPT, Claude, Gemini, Copilot or any named chat/assistant surface, nor any commerce-in-chat integration or app-store listing. The MCP server is a generic protocol endpoint, not documented evidence of embedding within these specific consumer assistant surfaces.

   • [claimed-docs] “Add the Skyfire MCP server ... Your agent is now ready to discover sellers, generate `kya` or `pay` tokens, and instantly execute agentic co…”
   • [claimed-docs] “The Skyfire MCP server at https://mcp.skyfire.xyz/mcp lets agents "Discover sellers", create tokens, and "Orchestrate agent commerce workflo…”
   • [claimed-docs] “Create an MCP Server Resource that explains which token types are required (`kya`, `pay`, and/or `kya-pay`), how tokens must be passed (the …”

   proof ↗⚑ flag

Protocol conformance

1. developerBuild against a versioned commerce protocol with a published schema and conformance or validation tooling

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce✓fullprobed7/10

   UCP is documented as a versioned protocol (dated releases like 2026-08-25, 2026-04-08) with a publicly hosted spec and reference implementations on GitHub, and Shopify's MCP servers enforce schema/profile validation at runtime (e.g. `--input-schema` to fetch a merchant's live input schema, and a probed `invalid_profile_url` error when an agent lacks a valid hosted profile), plus an AI Toolkit that validates GraphQL/Liquid/Extensions against Shopify schemas. Missing for 10: an explicit standalone conformance test suite or certification program for third-party UCP implementations, and independent (non-Shopify) corroboration of schema stability across versions.

   • [claimed-docs] “In UCP, "a platform profile is a JSON document that describes the protocol version and capabilities the platform supports"; the business sid…”
   • [claimed-docs] “"The Storefront Catalog MCP server enables AI agents to search and discover products from a single merchant's catalog, helping buyers find a…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the documented agent-profile trust gate behaves as specified — a keyless raw tools/call search_catalog …”
   • [claimed-docs] “ucp.dev positions the protocol as industry-governed rather than single-vendor: "UCP is built by the industry, to enable seamless agentic exp…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the Universal Commerce Protocol spec is published in the open — https://ucp.dev/llms.txt serves the ver…”
   • [claimed-docs] “validate GraphQL queries, Liquid templates, and Shopify Extensions against Shopify schemas to catch issues earlier”

   proof ↗⚑ flag

   Skyfire~partialprobed4/10

   Skyfire points to an external 'open' KYAPay protocol (KYAPay.org) with JWT-based tokens that all Skyfire tokens conform to, giving a nominal published spec, but the evidence pack shows no OpenAPI/schema file for Skyfire's own API (all standard OpenAPI paths 404) and no conformance/validation tooling (test suites, schema validators, certification) is documented anywhere. Missing for 10: a published machine-readable schema for the Skyfire API itself, explicit protocol versioning, and any conformance/validation tooling a developer could run against.

   • [claimed-docs] “"A KYAPay token is a signed, interoperable credential that packages agent identity and payment intent into a verifiable envelope." Tokens ar…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.skyfire.xyz/openapi.json, https://docs.skyfire.xyz/swagger.json, https://docs.skyfire.x…”
   • [claimed-docs] “Create an MCP Server Resource that explains which token types are required (`kya`, `pay`, and/or `kya-pay`), how tokens must be passed (the …”

   proof ↗⚑ flag

Agent search

1. ai-native userMy agent can programmatically search products or services across merchants — keylessly or with self-service credentials, no private partnership required

   weight 3 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce✓fullprobed8/10

   Shopify's Global Catalog MCP server explicitly supports keyless, self-service cross-merchant product search ('search and discover products across the entire Shopify ecosystem... from multiple merchants'), requiring only a self-hosted UCP agent profile URL rather than a private partnership — confirmed by a live runtime probe showing a full keyless JSON-RPC handshake and catalog search against catalog.shopify.com/api/ucp/mcp, and another probe showing the profile-gate behaves as documented (self-service profile, not vendor approval). Storefront-level search is similarly self-service per-merchant. Missing for 10: independent (non-Shopify) developer corroboration of onboarding friction, and confirmation that profile creation itself has no gatekeeping/approval step.

   • [claimed-docs] “"The Global Catalog MCP server enables AI agents to search and discover products across the entire Shopify ecosystem, helping buyers find pr…”
   • [probe] “PROBE runtime (recorded 2026-09-14): Shopify's Global Catalog MCP server is live — a keyless JSON-RPC initialize POST to https://catalog.sho…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the documented agent-profile trust gate behaves as specified — a keyless raw tools/call search_catalog …”
   • [claimed-docs] “In UCP, "a platform profile is a JSON document that describes the protocol version and capabilities the platform supports"; the business sid…”
   • [claimed-docs] “"The Storefront Catalog MCP server enables AI agents to search and discover products from a single merchant's catalog, helping buyers find a…”

   proof ↗⚑ flag

   Skyfire~partialprobed5/10

   Skyfire's MCP server exposes a 'find-sellers' tool for programmatic discovery, but access requires a self-service API key scoped to a registered agent (not fully keyless) and seller listings are approval-gated by Skyfire rather than an open, permissionless catalog; runtime probe confirms endpoints are key-gated. missing for 10: evidence of true keyless/anonymous discovery, breadth/independence of merchant catalog, and independent corroboration of discovery quality beyond Skyfire's own docs.

   • [claimed-docs] “Add the Skyfire MCP server ... Your agent is now ready to discover sellers, generate `kya` or `pay` tokens, and instantly execute agentic co…”
   • [claimed-docs] “The Skyfire MCP server at https://mcp.skyfire.xyz/mcp lets agents "Discover sellers", create tokens, and "Orchestrate agent commerce workflo…”
   • [claimed-docs] “API keys are created and managed in your Agent Dashboard, and each key is scoped to a single agent (Buyer or Seller).”
   • [claimed-docs] “Onboarding: signup auto-creates a Buyer Agent with a "pre-funded wallet"; API keys are managed per agent and "each key is scoped to a single…”
   • [probe] “PROBE runtime (recorded 2026-09-14): Skyfire's token API is live and key-gated as documented — a keyless POST to https://api.skyfire.xyz/api…”

   proof ↗⚑ flag

Machine readable offers

1. developerRead machine-readable offer data — price, availability, variants, checkout links — for any listed product or service

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce✓fullprobed9/10

   Shopify's Catalog MCP servers (global and storefront) expose structured, machine-readable product data — price (minor units), availability, variants, media, checkout links (continue_url) — verified live via runtime probes (get_product, search_catalog, cart continue_url), and Cart/Checkout MCP further surface checkout links and negotiated payment handlers. Missing for 10: no independent third-party benchmark of data completeness/accuracy across many merchants beyond Shopify's own demo store.

   • [claimed-docs] “"The Global Catalog MCP server enables AI agents to search and discover products across the entire Shopify ecosystem, helping buyers find pr…”
   • [claimed-docs] “"The Storefront Catalog MCP server enables AI agents to search and discover products from a single merchant's catalog, helping buyers find a…”
   • [claimed-docs] “"Cart tools accept unauthenticated requests, which lets you estimate totals and share a cart with the buyer before collecting credentials" —…”
   • [probe] “PROBE runtime (recorded 2026-09-14): Shopify's Global Catalog MCP server is live — a keyless JSON-RPC initialize POST to https://catalog.sho…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a Shopify-operated storefront's own UCP endpoint is live — a keyless JSON-RPC initialize POST to https:…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”

   proof ↗⚑ flag

   Skyfire~partialprobed3/10

   Skyfire's MCP server exposes a 'find-sellers' tool for service discovery, and seller service creation includes a 'pricing' field (skyfire-docs-3, skyfire-docs-6, skyfire-supp-9), suggesting some machine-readable service metadata exists. However, there is no documented schema showing availability, variants, or checkout links returned to a developer/agent, and no OpenAPI spec was found (skyfire-probe-2) to confirm structured offer data beyond pricing and identity requirements. Missing for 10: documented availability/variant fields, explicit checkout-link data, and a public API schema showing full offer payloads.

   • [claimed-docs] “Click Create Service and provide details like: name, type, pricing, identity requirements, etc. Submit for approval.”
   • [claimed-docs] “Add the Skyfire MCP server ... Your agent is now ready to discover sellers, generate `kya` or `pay` tokens, and instantly execute agentic co…”
   • [claimed-docs] “The Skyfire MCP server at https://mcp.skyfire.xyz/mcp lets agents "Discover sellers", create tokens, and "Orchestrate agent commerce workflo…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.skyfire.xyz/openapi.json, https://docs.skyfire.xyz/swagger.json, https://docs.skyfire.x…”

   proof ↗⚑ flag

Merchant feeds

1. merchantPublish my product or service catalog into agent surfaces through a documented feed or import API so AI agents can discover what I sell

   weight 3 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce✓fullprobed9/10

   Shopify's Storefront Catalog MCP server exposes each merchant's product catalog at a documented, live endpoint ({shop}.myshopify.com/api/ucp/mcp), confirmed by both docs and a runtime probe (hardware.shopify.com handshake), and merchants are also discoverable via the cross-merchant Global Catalog MCP server, with a documented UCP profile mechanism for agent identification/negotiation. missing for 10: no separate static feed/file-based import format (e.g., XML/JSON feed upload) is documented beyond the live MCP query interface, and no independent third-party merchant case study confirms adoption.

   • [claimed-docs] “"The Storefront Catalog MCP server enables AI agents to search and discover products from a single merchant's catalog, helping buyers find a…”
   • [claimed-docs] “"The Global Catalog MCP server enables AI agents to search and discover products across the entire Shopify ecosystem, helping buyers find pr…”
   • [probe] “PROBE runtime (recorded 2026-09-14): Shopify's Global Catalog MCP server is live — a keyless JSON-RPC initialize POST to https://catalog.sho…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a Shopify-operated storefront's own UCP endpoint is live — a keyless JSON-RPC initialize POST to https:…”
   • [claimed-docs] “In UCP, "a platform profile is a JSON document that describes the protocol version and capabilities the platform supports"; the business sid…”
   • [claimed-docs] “enables AI agents to search and discover products from a single merchant's catalog, helping buyers find and purchase products from that stor…”

   proof ↗⚑ flag

   Skyfire~partialclaimed5/10

   Skyfire lets a seller register services via 'Create Service' (name, type, pricing, identity requirements) and then makes them discoverable to agents through the MCP server's 'find-sellers' tool, which is a real agent-discovery surface. But this is a one-at-a-time, approval-gated dashboard/API flow rather than a documented bulk catalog feed or import API for a full product/service catalog. missing for 10: a bulk catalog feed/import API (e.g., CSV/JSON catalog upload), documentation on how multiple SKUs or listings map to discovery, and evidence of independent merchant usage confirming catalog visibility in agent surfaces.

   • [claimed-docs] “Click Create Service and provide details like: name, type, pricing, identity requirements, etc. Submit for approval.”
   • [claimed-docs] “Onboarding: signup auto-creates a Buyer Agent with a "pre-funded wallet"; API keys are managed per agent and "each key is scoped to a single…”
   • [claimed-docs] “Add the Skyfire MCP server ... Your agent is now ready to discover sellers, generate `kya` or `pay` tokens, and instantly execute agentic co…”
   • [claimed-docs] “The Skyfire MCP server at https://mcp.skyfire.xyz/mcp lets agents "Discover sellers", create tokens, and "Orchestrate agent commerce workflo…”

   proof ↗⚑ flag

Service discovery

1. ai-native userMy agent can discover payable services and APIs through a published directory or discovery index

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce✓fullprobed8/10

   Shopify publishes UCP-compliant Global Catalog and Storefront Catalog MCP servers that agents can discover payable services/products through, with documented endpoints, tool schemas, and profile-based discovery negotiation, corroborated by live runtime probes showing real handshakes and search/cart flows against catalog.shopify.com and a merchant storefront. The broader UCP spec is also openly published (ucp.dev) as an industry discovery standard. Missing for 10: a single canonical top-level directory/index listing all payable services across merchants (discovery is per-server/per-merchant plus a global catalog, not one unified public index), and independent (non-Shopify) confirmation of third-party agent adoption discovering via this index.

   • [claimed-docs] “enables AI agents to search and discover products across the entire Shopify ecosystem, helping buyers find products from multiple merchants”
   • [claimed-docs] “enables AI agents to search and discover products from a single merchant's catalog, helping buyers find and purchase products from that stor…”
   • [claimed-docs] “"The Global Catalog MCP server enables AI agents to search and discover products across the entire Shopify ecosystem, helping buyers find pr…”
   • [claimed-docs] “"The Storefront Catalog MCP server enables AI agents to search and discover products from a single merchant's catalog, helping buyers find a…”
   • [claimed-docs] “In UCP, "a platform profile is a JSON document that describes the protocol version and capabilities the platform supports"; the business sid…”
   • [probe] “PROBE runtime (recorded 2026-09-14): Shopify's Global Catalog MCP server is live — a keyless JSON-RPC initialize POST to https://catalog.sho…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a Shopify-operated storefront's own UCP endpoint is live — a keyless JSON-RPC initialize POST to https:…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the documented agent-profile trust gate behaves as specified — a keyless raw tools/call search_catalog …”
   • [claimed-docs] “ucp.dev positions the protocol as industry-governed rather than single-vendor: "UCP is built by the industry, to enable seamless agentic exp…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the Universal Commerce Protocol spec is published in the open — https://ucp.dev/llms.txt serves the ver…”

   proof ↗⚑ flag

   Skyfire~partialclaimed6/10

   Skyfire's MCP server exposes a 'find-sellers' tool that lets an agent query for payable services/sellers programmatically, and sellers register services through an approval-gated catalog, giving agents a discovery mechanism (skyfire-docs-6, skyfire-supp-9, skyfire-docs-3). However, there's no evidence of a publicly browsable directory/index outside the MCP tool call, nor documentation of how the directory is structured, filtered, or how comprehensive/curated it is. Missing for 10: a documented public directory/catalog UI or API endpoint separate from the MCP tool, details on search/filter capabilities, and independent confirmation of discovery breadth.

   • [claimed-docs] “Add the Skyfire MCP server ... Your agent is now ready to discover sellers, generate `kya` or `pay` tokens, and instantly execute agentic co…”
   • [claimed-docs] “The Skyfire MCP server at https://mcp.skyfire.xyz/mcp lets agents "Discover sellers", create tokens, and "Orchestrate agent commerce workflo…”
   • [claimed-docs] “Click Create Service and provide details like: name, type, pricing, identity requirements, etc. Submit for approval.”
   • [claimed-docs] “Create an MCP Server Resource that explains which token types are required (`kya`, `pay`, and/or `kya-pay`), how tokens must be passed (the …”

   proof ↗⚑ flag

Agent access

1. ai-native userPoint an agent at llms.txt or agent-oriented docs

   weight 2 · round to Skyfire
   Shopify Agentic Commerce~partialprobed7/10

   Shopify does not host its own llms.txt (shopify.dev/llms.txt returns 404), but it provides extensive agent-oriented documentation reachable via .md suffixed URLs (e.g. shopify.dev/docs/agents.md returns 200 with structured content) covering catalog, cart, checkout, orders, and profiles — exactly the kind of agent-consumable docs the story asks for. The related UCP spec (ucp.dev/llms.txt) does serve a proper llms.txt index, showing the ecosystem partially satisfies this pattern even though Shopify's own domain doesn't. Missing for 10: a working llms.txt directly at shopify.dev, and independent (non-Shopify) confirmation that agents reliably parse these .md docs as intended.

   • [probe] “PROBE llms.txt: HTTP 404 at https://shopify.dev/llms.txt”
   • [probe] “PROBE docs-md: HTTP 200 at https://shopify.dev/docs/agents.md --- title: Agentic commerce description: >- Build AI agents that authenticat…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the Universal Commerce Protocol spec is published in the open — https://ucp.dev/llms.txt serves the ver…”
   • [claimed-docs] “Initialize a local UCP profile.”
   • [claimed-docs] “This quickstart runs the full agentic commerce flow with the UCP CLI, from product discovery to order tracking, in about five minutes.”

   proof ↗⚑ flag

   Skyfire✓fullprobed8/10

   Skyfire's docs site serves a working llms.txt (HTTP 200, agent-oriented summary) confirmed by both a probe and a runtime check, and its full docs are structured as agent-consumable markdown (.md endpoints throughout). This directly satisfies pointing an agent at llms.txt/agent-oriented docs. Missing for 10: no independent third-party report of an agent successfully consuming llms.txt end-to-end, and no OpenAPI spec (all candidate paths 404) which would further strengthen machine-readability.

   • [probe] “PROBE llms.txt: HTTP 200 at https://docs.skyfire.xyz/llms.txt # Skyfire Developer Portal Documentation > Skyfire is the open identity and p…”
   • [probe] “PROBE runtime (recorded 2026-09-14): Skyfire's token API is live and key-gated as documented — a keyless POST to https://api.skyfire.xyz/api…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.skyfire.xyz/openapi.json, https://docs.skyfire.xyz/swagger.json, https://docs.skyfire.x…”

   proof ↗⚑ flag

2. ai-native userRun the product headlessly / in CI for automation

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce✓fullprobed8/10

   The UCP CLI is explicitly designed as a scriptable, headless tool with structured commands (search, cart, checkout, order tracking) usable via npm install and local profile init, and probes confirm real keyless CLI runs against live endpoints (catalog search, cart creation) succeeding non-interactively — consistent with CI/automation use. missing for 10: no explicit CI pipeline example (e.g., GitHub Actions), no documented exit codes/machine-readable output format guarantees, and no independent third-party report of running it in a CI environment.

   • [claimed-docs] “Initialize a local UCP profile.”
   • [claimed-docs] “This quickstart runs the full agentic commerce flow with the UCP CLI, from product discovery to order tracking, in about five minutes.”
   • [claimed-docs] “The CLI uses a local profile to identify your agent on every merchant-scoped request. Initialize it once and the CLI reuses it for every ope…”
   • [claimed-docs] “Shopify's agent surface is UCP end to end via "Shopify's UCP-compliant MCP servers": the UCP CLI "provides structured commands to search the…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the documented agent-profile trust gate behaves as specified — a keyless raw tools/call search_catalog …”
   • [probe] “official CLI documented at https://shopify.dev/docs/agents/get-started/quickstart”

   proof ↗⚑ flag

   Skyfire~partialprobed6/10

   Skyfire is API-first: agents authenticate via scoped API keys (no interactive login) and all core operations (token creation, introspection, charging) are REST endpoints, confirmed live and key-gated by a runtime probe, plus an MCP server for programmatic agent workflows. However, there's no explicit CI/CD example, headless setup guide, or CLI/SDK documentation showing automation-pipeline usage. missing for 10: explicit CI/headless usage guide, CLI or SDK tooling, and independent confirmation of non-interactive automation beyond API-key auth.

   • [claimed-docs] “API keys are created and managed in your Agent Dashboard, and each key is scoped to a single agent (Buyer or Seller).”
   • [claimed-docs] “Charge a `pay` or `kya-pay` token as a seller agent or seller service. Use this API after delivering a service, tool, or resource to collect…”
   • [claimed-docs] “Check whether a token is currently usable and get the remaining balance as a buyer or seller agent.”
   • [claimed-docs] “Add the Skyfire MCP server ... Your agent is now ready to discover sellers, generate `kya` or `pay` tokens, and instantly execute agentic co…”
   • [probe] “PROBE runtime (recorded 2026-09-14): Skyfire's token API is live and key-gated as documented — a keyless POST to https://api.skyfire.xyz/api…”
   • [claimed-docs] “Onboarding: signup auto-creates a Buyer Agent with a "pre-funded wallet"; API keys are managed per agent and "each key is scoped to a single…”
   • [claimed-docs] “The Skyfire MCP server at https://mcp.skyfire.xyz/mcp lets agents "Discover sellers", create tokens, and "Orchestrate agent commerce workflo…”

   proof ↗⚑ flag

3. ai-native userConnect an agent via an official MCP server

   weight 3 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce✓fullprobed9/10

   Shopify ships multiple official UCP-compliant MCP servers (Global Catalog, Storefront Catalog, Cart, Checkout, Order) plus a Storefront MCP, all documented and independently probe-verified with live handshakes (catalog.shopify.com/api/ucp/mcp, per-merchant endpoints) and real cart creation via the CLI. Agent identification/authentication via hosted profiles and tiered trust is also verified in runtime probes. Missing for 10: independent third-party (non-Shopify) developer accounts of connecting an arbitrary agent end-to-end beyond Shopify's own probes.

   • [claimed-docs] “Shopify's agent surface is UCP end to end via "Shopify's UCP-compliant MCP servers": the UCP CLI "provides structured commands to search the…”
   • [claimed-docs] “"The Global Catalog MCP server enables AI agents to search and discover products across the entire Shopify ecosystem, helping buyers find pr…”
   • [claimed-docs] “"The Storefront Catalog MCP server enables AI agents to search and discover products from a single merchant's catalog, helping buyers find a…”
   • [claimed-docs] “"Cart tools accept unauthenticated requests, which lets you estimate totals and share a cart with the buyer before collecting credentials" —…”
   • [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
   • [claimed-docs] “"The Order MCP server enables AI agents to fetch the current state of an order placed through their agent, including line items, fulfillment…”
   • [probe] “PROBE runtime (recorded 2026-09-14): Shopify's Global Catalog MCP server is live — a keyless JSON-RPC initialize POST to https://catalog.sho…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a Shopify-operated storefront's own UCP endpoint is live — a keyless JSON-RPC initialize POST to https:…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the documented agent-profile trust gate behaves as specified — a keyless raw tools/call search_catalog …”
   • [claimed-docs] “Connect any AI assistant to real-time commerce data from Shopify stores with Model Context Protocol (MCP) servers”

   proof ↗⚑ flag

   Skyfire✓fullclaimed8/10

   Skyfire documents an official hosted MCP server (https://mcp.skyfire.xyz/mcp, plus sandbox) with documented tools (find-sellers, create-kya-token, create-pay-token, create-kya-payment-token) and auth via API key header, letting agents connect and execute commerce workflows. missing for 10: independent/third-party corroboration of the MCP server working in practice, and no public OpenAPI/schema for deeper verification.

   • [claimed-docs] “Add the Skyfire MCP server ... Your agent is now ready to discover sellers, generate `kya` or `pay` tokens, and instantly execute agentic co…”
   • [claimed-docs] “Create an MCP Server Resource that explains which token types are required (`kya`, `pay`, and/or `kya-pay`), how tokens must be passed (the …”
   • [claimed-docs] “The Skyfire MCP server at https://mcp.skyfire.xyz/mcp lets agents "Discover sellers", create tokens, and "Orchestrate agent commerce workflo…”

   proof ↗⚑ flag

4. ai-native userUse an official CLI

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce✓fullprobed8/10

   Shopify documents and ships an official UCP CLI (`@shopify/ucp-cli`) with structured commands for catalog search, cart building, checkout, and order tracking, backed by a quickstart guide and runtime probes confirming live functionality (cart creation, catalog search) against real endpoints. missing for 10: independent third-party (non-Shopify) hands-on reviews of the CLI itself and broader adoption evidence beyond Shopify's own docs/probes.

   • [claimed-docs] “Shopify's agent surface is UCP end to end via "Shopify's UCP-compliant MCP servers": the UCP CLI "provides structured commands to search the…”
   • [claimed-docs] “Initialize a local UCP profile.”
   • [claimed-docs] “This quickstart runs the full agentic commerce flow with the UCP CLI, from product discovery to order tracking, in about five minutes.”
   • [claimed-docs] “The CLI uses a local profile to identify your agent on every merchant-scoped request. Initialize it once and the CLI reuses it for every ope…”
   • [probe] “official CLI documented at https://shopify.dev/docs/agents/get-started/quickstart”
   • [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”
   • [claimed-docs] “Buyer handoff is a first-class state: "Build for escalations regardless of how you authenticate." A checkout in requires_escalation means "C…”

   proof ↗⚑ flag

   Skyfire—none0/10

   Skyfire's docs describe REST APIs, MCP server integration, and a dashboard/Playground, but no evidence pack item mentions an official CLI tool for developers or agents. Missing for 10: any documented CLI binary, npm/pip package, or command-line reference.

   ⚑ flag

5. ai-native userDrive the product through a documented public API

   weight 3 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce✓fullprobed9/10

   Shopify documents and exposes a full public, documented agent-facing API surface (UCP CLI + MCP servers for Catalog, Cart, Checkout, Order) with schemas, auth tiers, negotiation, webhooks, and runtime probes confirming live handshakes, keyless catalog search, and real cart creation — clearly enabling an AI-native user to drive the product programmatically. Missing for 10: no publicly documented OpenAPI/REST spec found (404s on openapi.json/llms.txt) and no independent third-party developer report beyond Shopify's own docs/probes.

   • [claimed-docs] “the CLI provides structured commands to search the Catalog, build carts, create checkouts, hand off buyers, and track orders”
   • [claimed-docs] “Shopify's agent surface is UCP end to end via "Shopify's UCP-compliant MCP servers": the UCP CLI "provides structured commands to search the…”
   • [claimed-docs] “"The Global Catalog MCP server enables AI agents to search and discover products across the entire Shopify ecosystem, helping buyers find pr…”
   • [claimed-docs] “"Cart tools accept unauthenticated requests, which lets you estimate totals and share a cart with the buyer before collecting credentials" —…”
   • [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
   • [claimed-docs] “"The Order MCP server enables AI agents to fetch the current state of an order placed through their agent, including line items, fulfillment…”
   • [claimed-docs] “"Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (fu…”
   • [claimed-docs] “In UCP, "a platform profile is a JSON document that describes the protocol version and capabilities the platform supports"; the business sid…”
   • [probe] “PROBE runtime (recorded 2026-09-14): Shopify's Global Catalog MCP server is live — a keyless JSON-RPC initialize POST to https://catalog.sho…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the documented agent-profile trust gate behaves as specified — a keyless raw tools/call search_catalog …”

   proof ↗⚑ flag

   Skyfire✓fullprobed8/10

   Skyfire ships a documented public REST API (tokens, introspect, charge-token) gated by per-agent API keys, confirmed live via runtime probe returning a structured auth error rather than a 404, plus llms.txt-served docs. Missing for 10: a published OpenAPI/swagger spec (probe found all candidate spec URLs 404) and independent third-party corroboration beyond vendor docs/probes.

   • [claimed-docs] “API keys are created and managed in your Agent Dashboard, and each key is scoped to a single agent (Buyer or Seller).”
   • [claimed-docs] “Charge a `pay` or `kya-pay` token as a seller agent or seller service. Use this API after delivering a service, tool, or resource to collect…”
   • [claimed-docs] “Check whether a token is currently usable and get the remaining balance as a buyer or seller agent.”
   • [probe] “PROBE llms.txt: HTTP 200 at https://docs.skyfire.xyz/llms.txt # Skyfire Developer Portal Documentation > Skyfire is the open identity and p…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.skyfire.xyz/openapi.json, https://docs.skyfire.xyz/swagger.json, https://docs.skyfire.x…”
   • [probe] “PROBE runtime (recorded 2026-09-14): Skyfire's token API is live and key-gated as documented — a keyless POST to https://api.skyfire.xyz/api…”
   • [claimed-docs] “Sellers collect via the Charge Token API: "Use this API after delivering a service, tool, or resource to collect payment from a buyer-issued…”

   proof ↗⚑ flag

6. ai-native userIssue scoped/least-privilege API credentials for an agent

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce✓fullprobed7/10

   Shopify's UCP documents concrete least-privilege mechanics: three trust tiers (Anonymous/Signed/Token) that gate which tools and rate limits an agent gets, a specific scope (read_global_api_orders) required for Order MCP, short-lived (60-minute TTL) JWTs minted from Dev Dashboard client credentials, and checkout completion gated on the token being 'granted permission to complete purchases.' A runtime probe confirms the profile/identity gate rejects unauthenticated calls (invalid_profile_url), corroborating the scoped-access model works as documented. Missing for 10: a full catalog of all available scopes/permissions beyond the few named, self-service credential/scope management UI, explicit revocation workflow, and independent third-party verification of least-privilege enforcement in production.

   • [claimed-docs] “"UCP traffic to Shopify's MCP servers is classified into three tiers based on how your agent identifies itself" — Token, Signed, Anonymous —…”
   • [claimed-docs] “"The Order MCP server enables AI agents to fetch the current state of an order placed through their agent, including line items, fulfillment…”
   • [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the documented agent-profile trust gate behaves as specified — a keyless raw tools/call search_catalog …”

   proof ↗⚑ flag

   Skyfire~partialclaimed6/10

   Skyfire API keys are scoped per-agent (Buyer/Seller) and pay tokens carry committed amounts with hard balance ceilings, and KYA-gated tokens enforce identity requirements, which together give agent-level least-privilege credentials. However, this is scoped to payment/identity tokens rather than granular API permission scopes (e.g., no fine-grained action/resource-level scoping or role-based permission sets), and there is no documented per-token revocation API. missing for 10: fine-grained permission/action scoping beyond agent+amount+identity, documented revocation controls, independent/hands-on verification of scoping enforcement.

   • [claimed-docs] “API keys are created and managed in your Agent Dashboard, and each key is scoped to a single agent (Buyer or Seller).”
   • [claimed-docs] “Pay tokens carry committed amounts: "At creation, the token's amount is committed against the buyer's wallet (which is why token creation re…”
   • [claimed-docs] “"Skyfire supports identity verification through Know Your Agent (KYA), a single verification that applies to both your buyer and seller agen…”
   • [claimed-docs] “Revocation is bounded by design: deactivating an account does not void already-issued pay/kya-pay tokens — "New token creation stops at deac…”
   • [claimed-docs] “Onboarding: signup auto-creates a Buyer Agent with a "pre-funded wallet"; API keys are managed per agent and "each key is scoped to a single…”

   proof ↗⚑ flag

7. ai-native userBuild against official SDKs

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce~partialprobed6/10

   Shopify provides official developer tooling for agentic commerce — the `@shopify/ucp-cli`, UCP-compliant MCP servers (Catalog, Cart, Checkout, Order), profile/negotiation docs, and an AI Toolkit that validates GraphQL/Liquid/Extensions — all documented with schemas and confirmed live via runtime probes. However, this is CLI/MCP/JSON-RPC tooling rather than a conventional language-specific SDK (e.g., a Python or JS client library) that an AI-native developer could import directly. Missing for 10: dedicated SDK packages/libraries beyond the CLI and MCP JSON-RPC interface, and independent third-party corroboration of SDK usability.

   • [claimed-docs] “Shopify's agent surface is UCP end to end via "Shopify's UCP-compliant MCP servers": the UCP CLI "provides structured commands to search the…”
   • [claimed-docs] “validate GraphQL queries, Liquid templates, and Shopify Extensions against Shopify schemas to catch issues earlier”
   • [claimed-docs] “"The Global Catalog MCP server enables AI agents to search and discover products across the entire Shopify ecosystem, helping buyers find pr…”
   • [claimed-docs] “"Cart tools accept unauthenticated requests, which lets you estimate totals and share a cart with the buyer before collecting credentials" —…”
   • [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”
   • [claimed-docs] “Initialize a local UCP profile.”

   proof ↗⚑ flag

   Skyfire—none0/10

   Evidence shows Skyfire has REST API reference docs, a Playground, and an MCP server for agent integration, but nowhere does it mention or link to an official language SDK (e.g., Python/JS client library). The openapi.json probe even returned 404, undermining any inference of auto-generated SDK tooling.

   • [claimed-docs] “Add the Skyfire MCP server ... Your agent is now ready to discover sellers, generate `kya` or `pay` tokens, and instantly execute agentic co…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.skyfire.xyz/openapi.json, https://docs.skyfire.xyz/swagger.json, https://docs.skyfire.x…”
   • [claimed-docs] “The Skyfire MCP server at https://mcp.skyfire.xyz/mcp lets agents "Discover sellers", create tokens, and "Orchestrate agent commerce workflo…”

   proof ↗⚑ flag

8. ai-native userSubscribe to events via webhooks

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce~partialclaimed5/10

   Shopify does deliver order webhooks — UCP-shaped payloads pushed to a registered endpoint on committed order changes, HMAC-signed and retried — but the subscription mechanism itself is not agent-native: 'There's no self-serve subscription API today... contact your Shopify partner manager,' and although the UCP profile spec allows agents to declare a webhook_url, 'Shopify doesn't honor that field today.' This means an AI-native user cannot programmatically subscribe/register for webhook events themselves — it requires a manual, human, out-of-band process, undercutting the 'agentic' self-serve subscription story. missing for 10: self-serve/programmatic webhook subscription API, honoring the agent-declared webhook_url in the UCP profile, and any evidence of agent-driven (not partner-manager-mediated) event subscription.

   • [claimed-docs] “Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change”
   • [claimed-docs] “"Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (fu…”
   • [claimed-docs] “Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (ful…”

   proof ↗⚑ flag

   Skyfire—none0/10

   Evidence covers token issuance, charging, MCP tools, and identity verification, but nowhere mentions webhooks or any event subscription/callback mechanism for developers to receive notifications. Missing for 10: any webhook endpoint registration, event types, or push-notification documentation.

   ⚑ flag

Agentic features

1. ai-native userSet up automations that run autonomously in the background

   weight 2 · round to Skyfire
   Shopify Agentic Commerce~partialclaimed4/10

   UCP's trust-tier model lets Token-tier agents call complete_checkout autonomously once granted permission, and order webhooks push background state updates to a registered endpoint without polling — both hint at unattended, background-capable agent operation. But there is no documented feature for an AI-native user to configure a scheduled or trigger-based automation (e.g., recurring reorders, price-watch, monitor-and-act loops) that runs unsupervised over time; the evidence only covers per-session agent tool calls (search/cart/checkout/order) and merchant-side webhook delivery, not user-configurable autonomous background jobs. Missing for 10: explicit scheduling/trigger mechanism, evidence of a persistent background agent process, and independent confirmation of real autonomous (no-human-in-loop) purchase completion.

   • [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
   • [claimed-docs] “"UCP traffic to Shopify's MCP servers is classified into three tiers based on how your agent identifies itself" — Token, Signed, Anonymous —…”
   • [claimed-docs] “"Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (fu…”
   • [claimed-docs] “Buyer handoff is a first-class state: "Build for escalations regardless of how you authenticate." A checkout in requires_escalation means "C…”

   proof ↗⚑ flag

   Skyfire~partialclaimed5/10

   Skyfire's MCP server lets an agent autonomously discover sellers, mint kya/pay tokens, and execute commerce transactions without human-in-the-loop approval up to committed token limits (skyfire-docs-6, skyfire-supp-9, skyfire-supp-4), which supports autonomous background operation for agent commerce specifically. But Skyfire is a payment/identity layer, not a general automation/orchestration platform — there's no documented scheduler, trigger system, or persistent background-job mechanism for setting up broader autonomous workflows beyond commerce transactions. missing for 10: evidence of a scheduling/trigger system, persistent background job execution beyond per-call MCP invocations, and support for non-commerce automation tasks.

   • [claimed-docs] “Add the Skyfire MCP server ... Your agent is now ready to discover sellers, generate `kya` or `pay` tokens, and instantly execute agentic co…”
   • [claimed-docs] “The Skyfire MCP server at https://mcp.skyfire.xyz/mcp lets agents "Discover sellers", create tokens, and "Orchestrate agent commerce workflo…”
   • [claimed-docs] “Pay tokens carry committed amounts: "At creation, the token's amount is committed against the buyer's wallet (which is why token creation re…”
   • [claimed-docs] “Skyfire gives agents verified identity and payment credentials — "No 403 errors, captchas or blocked checkouts. Authenticated access and pay…”

   proof ↗⚑ flag

2. ai-native userOperate the product with natural-language commands

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce✓fullprobed7/10

   Shopify's UCP stack is explicitly designed so a natural-language request to an AI assistant ('find me crewneck sweaters under $50') is mapped by a skill/plugin to the right structured UCP CLI/MCP command, and runtime probes confirm the underlying MCP catalog/cart tools actually work end-to-end (search, cart creation) via the CLI with a local profile. Missing for 10: independent third-party evidence of a user issuing free-form natural-language commands (only one first-party doc line makes this claim) and no evidence of NL support beyond the catalog-search example (checkout/order flows are shown as structured CLI/MCP calls, not demonstrated NL-driven).

   • [claimed-docs] “Ask your assistant in natural language ("find me crewneck sweaters under $50") and the skill picks the right UCP CLI command”
   • [claimed-docs] “the CLI provides structured commands to search the Catalog, build carts, create checkouts, hand off buyers, and track orders”
   • [claimed-docs] “Shopify's agent surface is UCP end to end via "Shopify's UCP-compliant MCP servers": the UCP CLI "provides structured commands to search the…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”
   • [probe] “PROBE runtime (recorded 2026-09-14): Shopify's Global Catalog MCP server is live — a keyless JSON-RPC initialize POST to https://catalog.sho…”

   proof ↗⚑ flag

   Skyfire~partialclaimed6/10

   Skyfire ships an MCP server exposing tools (find-sellers, create-kya-token, create-pay-token, create-kya-payment-token) that let an LLM-driven agent translate natural-language requests into commerce actions like discovering sellers and issuing/charging tokens, which is the standard mechanism for natural-language operation in agentic products. Missing for 10: no evidence of a first-party conversational interface, no examples of actual natural-language prompts mapped to tool calls, and no independent/hands-on confirmation of NL-driven usage beyond the docs.

   • [claimed-docs] “Add the Skyfire MCP server ... Your agent is now ready to discover sellers, generate `kya` or `pay` tokens, and instantly execute agentic co…”
   • [claimed-docs] “Create an MCP Server Resource that explains which token types are required (`kya`, `pay`, and/or `kya-pay`), how tokens must be passed (the …”
   • [claimed-docs] “The Skyfire MCP server at https://mcp.skyfire.xyz/mcp lets agents "Discover sellers", create tokens, and "Orchestrate agent commerce workflo…”

   proof ↗⚑ flag

Api quality

1. ai-native userExplore an interactive API reference with runnable examples

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce~partialprobed4/10

   Shopify's UCP docs provide a step-by-step quickstart with real, copy-pasteable CLI commands that run the full discovery→cart→checkout→order flow, and MCP tools are self-describing (agents can fetch live input schemas via `--input-schema`), which gives AI-native users a way to explore and run real examples against live endpoints (confirmed by runtime probes actually executing search/cart calls). However, there is no dedicated interactive API-reference surface — probes explicitly found no OpenAPI/Swagger spec and no llms.txt at shopify.dev (404s), so there's no Postman/Swagger-style 'try it' reference page, only linear docs plus CLI/MCP introspection. Missing for 10: a dedicated interactive API-reference UI (OpenAPI/Swagger explorer or embedded try-it-now widgets), and independent hands-on confirmation that non-CLI docs pages let users run examples inline.

   • [claimed-docs] “This quickstart runs the full agentic commerce flow with the UCP CLI, from product discovery to order tracking, in about five minutes.”
   • [claimed-docs] “"The Storefront Catalog MCP server enables AI agents to search and discover products from a single merchant's catalog, helping buyers find a…”
   • [probe] “PROBE runtime (recorded 2026-09-14): Shopify's Global Catalog MCP server is live — a keyless JSON-RPC initialize POST to https://catalog.sho…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”
   • [probe] “PROBE llms.txt: HTTP 404 at https://shopify.dev/llms.txt”
   • [probe] “PROBE openapi: all candidate paths 404 (https://shopify.dev/openapi.json, https://shopify.dev/swagger.json, https://shopify.dev/api/openapi.…”

   proof ↗⚑ flag

   Skyfire—none0/10

   The evidence shows Skyfire has structured reference docs (charge-token, introspect-token, etc.) but the openapi probe found no machine-readable spec (404s on all candidate paths), and there is no mention of an interactive console, 'try it' feature, or runnable code examples anywhere in the pack — only static markdown-style API reference pages.

   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.skyfire.xyz/openapi.json, https://docs.skyfire.xyz/swagger.json, https://docs.skyfire.x…”
   • [claimed-docs] “Charge a `pay` or `kya-pay` token as a seller agent or seller service. Use this API after delivering a service, tool, or resource to collect…”
   • [claimed-docs] “Check whether a token is currently usable and get the remaining balance as a buyer or seller agent.”

   proof ↗⚑ flag

2. ai-native userDownload a machine-readable API spec (OpenAPI or equivalent)

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce~partialprobed4/10

   There's no downloadable OpenAPI/Swagger file — a direct probe found openapi.json, swagger.json, and similar candidate paths all 404 — but the underlying protocol is machine-readable in other ways: MCP servers expose live input schemas agents can introspect at runtime (--input-schema) and the UCP protocol itself has a published, versioned technical specification with reference implementations in a public GitHub repo (ucp.dev/llms.txt). missing for 10: an actual OpenAPI/JSON-Schema-equivalent document downloadable in one shot, and confirmation that the GitHub spec repo is machine-readable in OpenAPI-equivalent form rather than prose/markdown protocol docs.

   • [probe] “PROBE openapi: all candidate paths 404 (https://shopify.dev/openapi.json, https://shopify.dev/swagger.json, https://shopify.dev/api/openapi.…”
   • [claimed-docs] “"The Storefront Catalog MCP server enables AI agents to search and discover products from a single merchant's catalog, helping buyers find a…”
   • [claimed-docs] “ucp.dev positions the protocol as industry-governed rather than single-vendor: "UCP is built by the industry, to enable seamless agentic exp…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the Universal Commerce Protocol spec is published in the open — https://ucp.dev/llms.txt serves the ver…”

   proof ↗⚑ flag

   Skyfire—none0/10

   The docs contain structured API reference pages (e.g., charge-token, introspect-token) suggesting an underlying spec, but a direct probe for machine-readable OpenAPI/Swagger files at all standard locations returned 404 for every candidate path, and no evidence shows a downloadable spec file or link.

   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.skyfire.xyz/openapi.json, https://docs.skyfire.xyz/swagger.json, https://docs.skyfire.x…”
   • [claimed-docs] “Charge a `pay` or `kya-pay` token as a seller agent or seller service. Use this API after delivering a service, tool, or resource to collect…”
   • [claimed-docs] “Check whether a token is currently usable and get the remaining balance as a buyer or seller agent.”

   proof ↗⚑ flag

3. ai-native userTest against a sandbox environment without touching production data

   weight 1 · round to Skyfire
   Shopify Agentic Commerce—none0/10

   No evidence pack item describes a dedicated sandbox/test environment for UCP agent development; the only relevant runtime probe shows testing being done directly against a live production Shopify store ('a REAL cart was created keylessly on Shopify's own hardware store'), not a sandbox. No test-mode flag, dev store, or mock UCP endpoint is documented anywhere in the pack.

   • [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a Shopify-operated storefront's own UCP endpoint is live — a keyless JSON-RPC initialize POST to https:…”

   proof ↗⚑ flag

   Skyfire~partialclaimed5/10

   The MCP server docs explicitly reference a separate sandbox endpoint (mcp-sandbox.skyfire.xyz) distinct from the production mcp.skyfire.xyz, showing a dedicated test environment exists. However, there's no broader documentation of a sandbox for the core token/payment APIs, wallets, or KYA flows outside the MCP context, and no detail on how sandbox data is isolated from production. Missing for 10: dedicated sandbox docs for REST/token APIs beyond MCP, explicit guidance on test credentials/test wallets, independent confirmation the sandbox fully mirrors production without touching real funds.

   • [claimed-docs] “The Skyfire MCP server at https://mcp.skyfire.xyz/mcp lets agents "Discover sellers", create tokens, and "Orchestrate agent commerce workflo…”

   proof ↗⚑ flag

4. ai-native userRely on versioned APIs with a documented deprecation policy

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce~partialprobed4/10

   Evidence shows real API versioning (protocol version headers like x-shopify-ucp-mcp-api-version: 2026-08-25, dated UCP spec releases on ucp.dev, and profile negotiation based on 'the protocol version and capabilities the platform supports'), which supports the 'versioned APIs' half of the story. However, no evidence anywhere describes a documented deprecation policy, sunset timelines, or backward-compatibility guarantees for older versions. Missing for 10: explicit deprecation/sunset policy documentation, version-support lifecycle commitments, migration guidance between dated versions.

   • [probe] “PROBE runtime (recorded 2026-09-14): Shopify's Global Catalog MCP server is live — a keyless JSON-RPC initialize POST to https://catalog.sho…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the Universal Commerce Protocol spec is published in the open — https://ucp.dev/llms.txt serves the ver…”
   • [claimed-docs] “In UCP, "a platform profile is a JSON document that describes the protocol version and capabilities the platform supports"; the business sid…”

   proof ↗⚑ flag

   Skyfire—none0/10

   While the API path shows a v1 prefix (skyfire-probe-rt-1) and an OpenAPI spec probe returned 404s (skyfire-probe-2), there is no documentation of a versioning scheme, deprecation timeline, or migration policy anywhere in the evidence pack. Missing for 10: any deprecation policy page, versioning changelog, or migration guide.

   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.skyfire.xyz/openapi.json, https://docs.skyfire.xyz/swagger.json, https://docs.skyfire.x…”
   • [probe] “PROBE runtime (recorded 2026-09-14): Skyfire's token API is live and key-gated as documented — a keyless POST to https://api.skyfire.xyz/api…”

   proof ↗⚑ flag

1. ai-native userPerform bulk operations across many items at once

   weight 2 · round drawn
   Shopify Agentic Commerce—none0/10

   The evidence describes single-item/cart-at-a-time flows (search, build a cart, checkout, track one order) and catalog pagination for browsing, but nothing documents a bulk operation primitive — e.g., adding many items to a cart in one call, batch checkout, or bulk order management — for an AI agent to act on many items at once.

   ⚑ flag

   Skyfire—none0/10

   Skyfire's documented API is single-item/token-centric (create one token, charge one token, introspect one token) with no documented batch or bulk endpoints for processing many items in one call. No evidence of any bulk-operation capability across tokens, sellers, or charges.

   • [claimed-docs] “Charge a `pay` or `kya-pay` token as a seller agent or seller service. Use this API after delivering a service, tool, or resource to collect…”
   • [claimed-docs] “Check whether a token is currently usable and get the remaining balance as a buyer or seller agent.”
   • [claimed-docs] “Sellers collect via the Charge Token API: "Use this API after delivering a service, tool, or resource to collect payment from a buyer-issued…”

   proof ↗⚑ flag

Fees transparency

1. merchantThe fees for agent-originated transactions are published — I can price agentic channels without asking sales

   weight 2 · round drawn
   Shopify Agentic Commerce—none0/10

   The evidence pack thoroughly documents UCP's technical architecture (catalog, cart, checkout, orders, trust tiers) but contains no mention of transaction fees, take rates, commission percentages, or pricing terms for agent-originated sales — nothing addresses what a merchant would pay for agentic-channel transactions.

   ⚑ flag

   Skyfire—none0/10

   Evidence shows sellers set their own service pricing when configuring a service, but there is no published fee schedule for Skyfire's own transaction/take-rate fees on agent-originated payments — nothing lets a merchant price agentic channels without contacting sales.

   • [claimed-docs] “Click Create Service and provide details like: name, type, pricing, identity requirements, etc. Submit for approval.”
   • [claimed-docs] “Onboarding: signup auto-creates a Buyer Agent with a "pre-funded wallet"; API keys are managed per agent and "each key is scoped to a single…”

   proof ↗⚑ flag

Payouts

1. merchantAgent-originated payments settle through documented payout and reporting flows, reconcilable like any other channel

   weight 1 · round to Skyfire
   Shopify Agentic Commerce—none0/10

   The evidence documents order creation, checkout/payment completion, order-state webhooks, and get_order reconciliation of order state, but nothing addresses payout, settlement, or financial reporting flows that let a merchant reconcile agent-originated revenue against other channels (no mention of payout reports, settlement schedules, or accounting/export integration). Since payout/reporting reconciliation is a normal, fair expectation for any commerce channel with real payments, this axis applies but is unaddressed in the pack.

   ⚑ flag

   Skyfire~partialclaimed5/10

   Skyfire documents the settlement mechanics merchants need — charge-token API, committed/ceiling amounts, multi-charge until balance exhausted, defined settlement windows (up to 51 hours), and overcharge rejection (402) — which supports reconciliation of individual transactions. However, there is no documented merchant-facing payout flow (e.g., withdrawal to bank/external accounts), no statement/reporting/export API, and no mention of standard accounting artifacts (invoices, ledgers, CSV/webhook reporting) that would let a merchant reconcile against other channels. missing for 10: documented payout/withdrawal mechanism to real-world funds, merchant reporting/statement or export API, reconciliation tooling or ledger export, independent confirmation of reporting flows.

   • [claimed-docs] “Pay tokens carry committed amounts: "At creation, the token's amount is committed against the buyer's wallet (which is why token creation re…”
   • [claimed-docs] “Sellers collect via the Charge Token API: "Use this API after delivering a service, tool, or resource to collect payment from a buyer-issued…”
   • [claimed-docs] “Revocation is bounded by design: deactivating an account does not void already-issued pay/kya-pay tokens — "New token creation stops at deac…”
   • [claimed-docs] “Charge a `pay` or `kya-pay` token as a seller agent or seller service. Use this API after delivering a service, tool, or resource to collect…”
   • [claimed-docs] “Skyfire gives agents verified identity and payment credentials — "No 403 errors, captchas or blocked checkouts. Authenticated access and pay…”

   proof ↗⚑ flag

Attribution analytics

1. merchantOrders are attributed to the originating agent and I can report on or filter transactions by agent

   weight 2 · round drawn
   Shopify Agentic Commerce~partialclaimed5/10

   Cart/checkout objects carry explicit agent-attribution metadata (referring_domain, click_id_tag, activity_id, utm_* fields) and orders are tied to a specific agent's UCP profile via checkout creation, giving Shopify the raw data needed to attribute orders to an agent. However, there is no evidence of a merchant-facing report, analytics dashboard, or order-list filter that lets a merchant actually query or segment transactions by originating agent — only developer-facing MCP/webhook data plumbing is documented. Missing for 10: merchant admin UI or reporting API to filter/segment orders by agent, aggregate agent-performance analytics, independent confirmation that attribution data surfaces in Shopify's order admin.

   • [claimed-docs] “"Cart tools accept unauthenticated requests, which lets you estimate totals and share a cart with the buyer before collecting credentials" —…”
   • [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
   • [claimed-docs] “"Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (fu…”
   • [claimed-docs] “"The Order MCP server enables AI agents to fetch the current state of an order placed through their agent, including line items, fulfillment…”
   • [claimed-docs] “In UCP, "a platform profile is a JSON document that describes the protocol version and capabilities the platform supports"; the business sid…”

   proof ↗⚑ flag

   Skyfire~partialclaimed5/10

   Skyfire ties every transaction to a specific Buyer Agent via KYA identity tokens and per-agent API keys, so orders are technically attributable to the originating agent (skyfire-docs-1, skyfire-supp-2, skyfire-supp-7), and introspect/charge-token APIs let a seller programmatically check token/agent status (skyfire-docs-4, skyfire-docs-5). However, there is no evidence of a merchant-facing report or dashboard view that lets a merchant filter/aggregate transactions by agent — only a general 'Agent Dashboard' for key management is mentioned. Missing for 10: documented merchant reporting/analytics UI or API for filtering transactions by agent, evidence of aggregate order-to-agent attribution reporting.

   • [claimed-docs] “API keys are created and managed in your Agent Dashboard, and each key is scoped to a single agent (Buyer or Seller).”
   • [claimed-docs] “"Skyfire supports identity verification through Know Your Agent (KYA), a single verification that applies to both your buyer and seller agen…”
   • [claimed-docs] “Cardholder consent bounds card spending: "The agent/agent platform can never spend more than the cardholder approved." — an authorization co…”
   • [claimed-docs] “Charge a `pay` or `kya-pay` token as a seller agent or seller service. Use this API after delivering a service, tool, or resource to collect…”
   • [claimed-docs] “Check whether a token is currently usable and get the remaining balance as a buyer or seller agent.”

   proof ↗⚑ flag

Onboarding to agents

1. merchantI have a documented self-serve path to start accepting agent traffic — enable a setting, sign an agreement, or publish an endpoint

   weight 3 · round to Skyfire
   Shopify Agentic Commerce~partialprobed5/10

   Docs show every UCP-enabled storefront automatically exposes a /api/ucp/mcp endpoint and a merchant publishes a UCP profile at {shop}.myshopify.com/.well-known/ucp for capability negotiation — that's a documented, quasi-self-serve publishing path, and probes confirm live merchant endpoints exist. But the pack explicitly contradicts full self-serve: order webhook subscription is 'not self-serve... contact your Shopify partner manager,' and there is no merchant-facing admin setting or signed agreement flow described (all guidance is developer/CLI-facing, not merchant-console-facing). missing for 10: a merchant-admin toggle/setting in Shopify admin UI, an explicit merchant agreement/terms step, and self-serve webhook registration (currently manual via partner manager).

   • [claimed-docs] “In UCP, "a platform profile is a JSON document that describes the protocol version and capabilities the platform supports"; the business sid…”
   • [claimed-docs] “"Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (fu…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a Shopify-operated storefront's own UCP endpoint is live — a keyless JSON-RPC initialize POST to https:…”
   • [claimed-docs] “Negotiation is server-selects. The business computes the intersection of its capabilities with the platform's and chooses the active set”

   proof ↗⚑ flag

   Skyfire~partialclaimed7/10

   Skyfire documents a concrete merchant-facing path: create a Seller Agent, generate a scoped API key, click 'Create Service' with pricing/identity requirements, and use the Charge Token API to collect payment — all via the Agent Dashboard (skyfire-docs-3, skyfire-supp-8, skyfire-docs-4). However, service creation is explicitly 'Submit for approval,' meaning it's gated rather than a pure self-serve flip-a-switch flow. Missing for 10: confirmation of approval turnaround/criteria, an explicit merchant agreement/ToS signing step, and independent verification that the approval process is lightweight rather than a manual sales gate.

   • [claimed-docs] “Click Create Service and provide details like: name, type, pricing, identity requirements, etc. Submit for approval.”
   • [claimed-docs] “Onboarding: signup auto-creates a Buyer Agent with a "pre-funded wallet"; API keys are managed per agent and "each key is scoped to a single…”
   • [claimed-docs] “Charge a `pay` or `kya-pay` token as a seller agent or seller service. Use this API after delivering a service, tool, or resource to collect…”
   • [claimed-docs] “API keys are created and managed in your Agent Dashboard, and each key is scoped to a single agent (Buyer or Seller).”

   proof ↗⚑ flag

Traffic controls

1. merchantRate-limit, allow, or deny specific agents and agent platforms accessing my catalog and checkout

   weight 2 · round to Skyfire
   Shopify Agentic Commerce~partialclaimed3/10

   Shopify's UCP documents a platform-wide trust-tier system (Token/Signed/Anonymous) where 'rate limits scale with identification' and certain tools (like complete_checkout or Order MCP) are gated to higher trust tiers, which provides some rate-limiting infrastructure. However, this is a Shopify-controlled protocol mechanism based on identification strength, not a merchant-facing dashboard/setting to specifically allow, deny, or rate-limit named agents or agent platforms (e.g. blocking 'Agent X' or 'Platform Y' by name). Missing for 10: merchant-configurable allow/deny lists for specific agents/platforms, merchant UI or API to set custom rate limits per agent, and any evidence of per-merchant policy enforcement beyond the global trust-tier scheme.

   • [claimed-docs] “"UCP traffic to Shopify's MCP servers is classified into three tiers based on how your agent identifies itself" — Token, Signed, Anonymous —…”
   • [claimed-docs] “In UCP, "a platform profile is a JSON document that describes the protocol version and capabilities the platform supports"; the business sid…”
   • [claimed-docs] “"The Order MCP server enables AI agents to fetch the current state of an order placed through their agent, including line items, fulfillment…”

   proof ↗⚑ flag

   Skyfire~partialclaimed4/10

   Skyfire lets sellers set per-service identity requirements (KYA verification levels) that gate token creation and thus checkout access, and its payment-card flow lets a merchant's bot manager identify and allow known agents rather than block them — giving coarse allow/deny-by-identity control. However there is no documented rate-limiting feature, no explicit deny-list or per-agent/platform blocking mechanism, and no console for merchants to enumerate specific agents/platforms to throttle or reject. Missing for 10: rate-limiting controls, explicit allow/deny list management UI/API, granular per-agent-platform policy enforcement beyond identity-level gating.

   • [claimed-docs] “"Skyfire supports identity verification through Know Your Agent (KYA), a single verification that applies to both your buyer and seller agen…”
   • [claimed-docs] “The site, or the bot manager in front of it, can then identify the agent/agent platform and allow it through rather than block it.”
   • [claimed-docs] “Onboarding: signup auto-creates a Buyer Agent with a "pre-funded wallet"; API keys are managed per agent and "each key is scoped to a single…”

   proof ↗⚑ flag

1. ai-native userDo everything through the API that I can do in the UI

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce~partialprobed7/10

   Shopify's UCP/MCP surface documents broad API parity for the core buyer journey — catalog search, cart building, checkout creation/completion, and order tracking/webhooks all mirror what a human can do in a Shopify storefront UI, with runtime probes confirming live handshakes and a real cart creation. However, the spec explicitly carves out cases where the API cannot fully replace the UI: checkouts can enter a `requires_escalation` state where 'Checkout requires buyer input or review not available via API,' forcing a handoff via `continue_url` to the merchant's own UI, and full autonomous `complete_checkout` is gated to Token-tier trusted agents only. Missing for 10: evidence of parity for non-purchase storefront actions (account management, returns UI, arbitrary merchant customizations) and confirmation that escalation-required flows are rare rather than common.

   • [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
   • [claimed-docs] “Buyer handoff is a first-class state: "Build for escalations regardless of how you authenticate." A checkout in requires_escalation means "C…”
   • [claimed-docs] “"UCP traffic to Shopify's MCP servers is classified into three tiers based on how your agent identifies itself" — Token, Signed, Anonymous —…”
   • [claimed-docs] “"Cart tools accept unauthenticated requests, which lets you estimate totals and share a cart with the buyer before collecting credentials" —…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”
   • [claimed-docs] “"The Order MCP server enables AI agents to fetch the current state of an order placed through their agent, including line items, fulfillment…”
   • [claimed-docs] “"Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (fu…”

   proof ↗⚑ flag

   Skyfire~partialprobed6/10

   Core operations (token creation/charge/introspect, service creation, KYA verification) are all documented as REST API endpoints, and an MCP server exposes agentic workflows, showing strong API-first parity with the UI dashboard/playground. However, no OpenAPI/swagger spec was found (404s on all candidate paths), and some UI-only flows like account approval, dashboard-based key management, and paid KYA subscription setup aren't confirmed as fully API-driven. missing for 10: published OpenAPI/swagger spec, confirmation that account/service approval and subscription management can be done purely via API without dashboard interaction, independent third-party confirmation of full API/UI parity.

   • [claimed-docs] “Click Create Service and provide details like: name, type, pricing, identity requirements, etc. Submit for approval.”
   • [claimed-docs] “Charge a `pay` or `kya-pay` token as a seller agent or seller service. Use this API after delivering a service, tool, or resource to collect…”
   • [claimed-docs] “Check whether a token is currently usable and get the remaining balance as a buyer or seller agent.”
   • [claimed-docs] “Add the Skyfire MCP server ... Your agent is now ready to discover sellers, generate `kya` or `pay` tokens, and instantly execute agentic co…”
   • [claimed-docs] “Skyfire supports identity verification through Know Your Agent (KYA), a single verification that applies to both your buyer and seller agent…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.skyfire.xyz/openapi.json, https://docs.skyfire.xyz/swagger.json, https://docs.skyfire.x…”
   • [claimed-docs] “Onboarding: signup auto-creates a Buyer Agent with a "pre-funded wallet"; API keys are managed per agent and "each key is scoped to a single…”
   • [claimed-docs] “The Skyfire MCP server at https://mcp.skyfire.xyz/mcp lets agents "Discover sellers", create tokens, and "Orchestrate agent commerce workflo…”

   proof ↗⚑ flag

2. ai-native userExport all of my data in open formats and leave

   weight 3 · round drawn
   Shopify Agentic Commerce—none0/10

   None of the evidence addresses data export, portability, or the ability for a user/agent to extract their commerce data in an open format and leave the platform — the pack only covers catalog search, cart/checkout MCP tools, order webhooks, and profile negotiation. Since data portability is a plausible axis for any commerce platform, absence of evidence means 'none' rather than 'na'.

   ⚑ flag

   Skyfire—none0/10

   Evidence covers token issuance, KYA identity verification, MCP commerce workflows, and payment settlement, but nothing describes a data export feature or open-format data portability for a user's account, transaction history, or identity data. missing for 10: any documented export/download capability, open-format (CSV/JSON) data dump, or account-closure data portability guarantee.

   ⚑ flag

3. ai-native userRead the product's source under an open license

   weight 2 · round drawn
   Shopify Agentic Commerce—none0/10

   Evidence shows the UCP protocol specification and reference implementations are published openly on GitHub, but this is the industry-wide protocol spec (ucp.dev), not Shopify's own Agentic Commerce product source code, servers, or CLI implementation. No citation shows Shopify's actual MCP server/checkout implementation, storefront code, or platform source is released under an open license.

   ⚑ flag

   Skyfire—none0/10

   Evidence shows Skyfire is a closed, key-gated commercial API/platform (identity+payments infrastructure) with only a published token spec (KYAPay) being open, not the product's own source code; no repo, license, or open-source claim appears anywhere in the pack.

   • [probe] “PROBE runtime (recorded 2026-09-14): Skyfire's token API is live and key-gated as documented — a keyless POST to https://api.skyfire.xyz/api…”
   • [claimed-docs] “"A KYAPay token is a signed, interoperable credential that packages agent identity and payment intent into a verifiable envelope." Tokens ar…”

   proof ↗⚑ flag

Order events

1. developerMy agent or backend can subscribe to order lifecycle events — created, updated, fulfilled, canceled — pushed programmatically

   weight 3 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce~partialclaimed5/10

   Shopify does push full, HMAC-signed UCP-shaped order webhooks (created/updated/fulfilled/canceled/refunded etc.) with retry logic, so lifecycle events are indeed pushed programmatically once configured. However the same documentation states subscription itself is not self-serve — 'There's no self-serve subscription API today: your delivery URL and topic scoping are registered server-side... contact your Shopify partner manager' — and the UCP profile's webhook_url field, meant to let agents declare their endpoint programmatically, 'Shopify doesn't honor that field today.' This is a first-party documented limitation (not an external dispute) directly undercutting the 'programmatically subscribe' part of the story. missing for 10: a self-serve/programmatic subscription or registration API, honoring of the webhook_url profile field, and independent/hands-on confirmation of webhook delivery in production.

   • [claimed-docs] “Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change”
   • [claimed-docs] “"Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (fu…”
   • [claimed-docs] “Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (ful…”

   proof ↗⚑ flag

   Skyfire—none0/10

   Skyfire's docs cover token creation, charging, and introspection (pull-based checks), but there is no evidence of any webhook, event subscription, or push notification mechanism for order lifecycle events (created/updated/fulfilled/canceled). Developers must poll introspect-token rather than subscribe to pushed events.

   • [claimed-docs] “Check whether a token is currently usable and get the remaining balance as a buyer or seller agent.”
   • [claimed-docs] “Sellers collect via the Charge Token API: "Use this API after delivering a service, tool, or resource to collect payment from a buyer-issued…”
   • [claimed-docs] “Pay tokens carry committed amounts: "At creation, the token's amount is committed against the buyer's wallet (which is why token creation re…”

   proof ↗⚑ flag

Delegated credentials

1. ai-native userHand my agent a scoped, limited-use payment credential — amount limits, expiry, merchant restrictions — instead of a raw card number

   weight 3 · round to Skyfire
   Shopify Agentic Commerce~partialclaimed4/10

   UCP references AP2 payment mandates as "cryptographically signed payment authorizations that are mathematically tied to the specific state of the cart" and verifiable credentials, plus short-lived (60-minute) JWT checkout tokens and Token-tier gating for complete_checkout — gesturing at scoped, non-raw-card credentials, but this describes protocol/session tokens for API access, not a user-issued payment instrument with explicit amount limits, expiry, and merchant restrictions handed to the agent. Missing for 10: concrete documentation of a user-facing scoped payment credential (spending caps, expiry dates, merchant allow-lists) rather than just agent-identity/session auth tokens, and no independent/hands-on evidence of this credential-issuance flow in practice.

   • [claimed-docs] “allows Platforms to provide cryptographically signed payment authorizations that are mathematically tied to the specific state of the cart”
   • [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
   • [claimed-docs] “"UCP traffic to Shopify's MCP servers is classified into three tiers based on how your agent identifies itself" — Token, Signed, Anonymous —…”
   • [claimed-docs] “ucp.dev positions the protocol as industry-governed rather than single-vendor: "UCP is built by the industry, to enable seamless agentic exp…”

   proof ↗⚑ flag

   Skyfire✓fullclaimed8/10

   Skyfire issues scoped pay/kya-pay tokens with committed amount ceilings, expiry windows (10s-24h plus grace period), and merchant/identity-requirement gating rather than raw card numbers, all documented via API and MCP server tooling. Missing for 10: independent third-party/hands-on corroboration beyond vendor docs, and explicit merchant-restriction scoping details (evidence shows identity/amount/time limits clearly but merchant-lock-in specifics are thinner).

   • [claimed-docs] “Pay tokens carry committed amounts: "At creation, the token's amount is committed against the buyer's wallet (which is why token creation re…”
   • [claimed-docs] “Sellers collect via the Charge Token API: "Use this API after delivering a service, tool, or resource to collect payment from a buyer-issued…”
   • [claimed-docs] “Revocation is bounded by design: deactivating an account does not void already-issued pay/kya-pay tokens — "New token creation stops at deac…”
   • [claimed-docs] “"Skyfire supports identity verification through Know Your Agent (KYA), a single verification that applies to both your buyer and seller agen…”
   • [claimed-docs] “On signup, your Buyer Agent is created automatically, along with a pre-funded wallet so you can start using paid services right away.”
   • [claimed-docs] “The Skyfire MCP server at https://mcp.skyfire.xyz/mcp lets agents "Discover sellers", create tokens, and "Orchestrate agent commerce workflo…”

   proof ↗⚑ flag

Settlement rails

1. developerSettle agent-initiated payments in stablecoins over documented rails

   weight 2 · round to Skyfire
   Shopify Agentic Commerce—none0/10

   Evidence documents payment_handlers like com.google.pay, credit-card style checkout, and AP2/payment mandate concepts, but nowhere mentions stablecoins, crypto rails, or any stablecoin settlement path for agent-initiated payments. This is a documented gap, not a category mismatch, since UCP explicitly discusses payment handler negotiation and could plausibly include stablecoin rails.

   • [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
   • [claimed-docs] “ucp.dev positions the protocol as industry-governed rather than single-vendor: "UCP is built by the industry, to enable seamless agentic exp…”
   • [claimed-docs] “allows Platforms to provide cryptographically signed payment authorizations that are mathematically tied to the specific state of the cart”

   proof ↗⚑ flag

   Skyfire~partialclaimed3/10

   Skyfire documents thorough payment settlement rails — wallets, pay/kya-pay tokens, committed amounts, charge-token API, settlement timing windows, and open KYAPay token spec — but none of the evidence explicitly states that settlement occurs in stablecoins or names any specific blockchain/stablecoin rail. Missing for 10: explicit stablecoin currency mention, underlying blockchain/rail specification, and confirmation that wallet balances/settlement are denominated in a stablecoin rather than fiat/credit abstraction.

   • [claimed-docs] “Skyfire gives agents verified identity and payment credentials — "No 403 errors, captchas or blocked checkouts. Authenticated access and pay…”
   • [claimed-docs] “Pay tokens carry committed amounts: "At creation, the token's amount is committed against the buyer's wallet (which is why token creation re…”
   • [claimed-docs] “Sellers collect via the Charge Token API: "Use this API after delivering a service, tool, or resource to collect payment from a buyer-issued…”
   • [claimed-docs] “On signup, your Buyer Agent is created automatically, along with a pre-funded wallet so you can start using paid services right away.”
   • [claimed-docs] “"A KYAPay token is a signed, interoperable credential that packages agent identity and payment intent into a verifiable envelope." Tokens ar…”

   proof ↗⚑ flag

Wallets

1. ai-native userProvision a wallet my agent holds and spends from — funded and controlled by me, with balance visibility

   weight 3 · round to Skyfire
   Shopify Agentic Commerce—none0/10

   Shopify's UCP evidence covers checkout, payment-handler negotiation (e.g., com.google.pay), and AP2 payment mandates/verifiable credentials tied to cart state, but there is no documentation of a user-funded, agent-held wallet construct with balance visibility — payment credentials are collected per-checkout, not provisioned as a standing wallet.

   • [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
   • [claimed-docs] “allows Platforms to provide cryptographically signed payment authorizations that are mathematically tied to the specific state of the cart”
   • [claimed-docs] “"UCP traffic to Shopify's MCP servers is classified into three tiers based on how your agent identifies itself" — Token, Signed, Anonymous —…”

   proof ↗⚑ flag

   Skyfire✓fullclaimed7/10

   Docs describe a Buyer Agent wallet auto-created and pre-funded on signup, scoped per-agent via API keys that the user controls, with committed-amount enforcement against the wallet balance and an introspect-token API to check remaining balance. This covers user-provisioned/funded/controlled wallet plus balance visibility, but missing for 10: dashboard UI screenshots showing balance, explicit mechanism for manually topping up/funding beyond initial pre-fund, and independent/hands-on corroboration.

   • [claimed-docs] “On signup, your Buyer Agent is created automatically, along with a pre-funded wallet so you can start using paid services right away.”
   • [claimed-docs] “Onboarding: signup auto-creates a Buyer Agent with a "pre-funded wallet"; API keys are managed per agent and "each key is scoped to a single…”
   • [claimed-docs] “Check whether a token is currently usable and get the remaining balance as a buyer or seller agent.”
   • [claimed-docs] “Pay tokens carry committed amounts: "At creation, the token's amount is committed against the buyer's wallet (which is why token creation re…”
   • [claimed-docs] “API keys are created and managed in your Agent Dashboard, and each key is scoped to a single agent (Buyer or Seller).”

   proof ↗⚑ flag

1. ai-native userControl data retention and deletion

   weight 2 · round drawn
   Shopify Agentic Commerce—none0/10

   The evidence pack covers UCP agent profiles, catalog/cart/checkout/order MCP servers, webhooks, and trust tiers, but nowhere describes any mechanism for an AI-native user to control retention or deletion of their data (e.g., profile data, cart history, order records) — no privacy/data-deletion API, retention policy, or opt-out control is documented.

   ⚑ flag

   Skyfire—none0/10

   Skyfire's docs describe identity verification (KYA), token issuance/expiry, and payment settlement, but nothing in the evidence pack addresses user-controlled data retention policies or deletion of stored identity/verification/payment data. Given Skyfire handles real-world identity data via KYA, this is a fair privacy axis to expect, but no retention or deletion controls are documented.

   ⚑ flag

Ecosystem adoption

1. developerAt least two independent parties beyond the vendor implement the protocol or platform — it is an ecosystem, not a private integration

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce✓fullprobed7/10

   UCP is documented as an industry-governed open standard rather than a Shopify-only integration: ucp.dev's co-developer wall names Google, Etsy, Wayfair, Target, Walmart, Amazon, Microsoft, Meta, Salesforce and Stripe as builders of the spec, with 'The complete technical specification, documentation, and reference implementations are hosted in our public GitHub repository' and versioned releases confirmed live via ucp.dev/llms.txt. Shopify itself ships a conformant implementation (catalog/cart/checkout/order MCP servers, verified live via runtime probes), demonstrating at least one non-founding-spec-author adopting the protocol. Missing for 10: independent, hands-on evidence that another named co-developer (e.g., Etsy, Walmart) has a live production UCP endpoint analogous to Shopify's, rather than just being listed as a spec co-author.

   • [claimed-docs] “ucp.dev positions the protocol as industry-governed rather than single-vendor: "UCP is built by the industry, to enable seamless agentic exp…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the Universal Commerce Protocol spec is published in the open — https://ucp.dev/llms.txt serves the ver…”
   • [probe] “PROBE runtime (recorded 2026-09-14): Shopify's Global Catalog MCP server is live — a keyless JSON-RPC initialize POST to https://catalog.sho…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a Shopify-operated storefront's own UCP endpoint is live — a keyless JSON-RPC initialize POST to https:…”

   proof ↗⚑ flag

   Skyfire—none0/10

   Skyfire claims tokens conform to an 'open KYAPay protocol' hosted at KYAPay.org, but every operational piece — charging, wallets, settlement, MCP server, verification — runs exclusively through Skyfire's own APIs and infrastructure per the evidence pack. There is no mention of any independent vendor, competitor, or third party implementing the protocol or running their own compatible service/settlement layer.

   • [claimed-docs] “"A KYAPay token is a signed, interoperable credential that packages agent identity and payment intent into a verifiable envelope." Tokens ar…”
   • [claimed-docs] “Sellers collect via the Charge Token API: "Use this API after delivering a service, tool, or resource to collect payment from a buyer-issued…”
   • [claimed-docs] “The Skyfire MCP server at https://mcp.skyfire.xyz/mcp lets agents "Discover sellers", create tokens, and "Orchestrate agent commerce workflo…”

   proof ↗⚑ flag

Spec publication

1. developerThe commerce protocol this product speaks is published as an open, versioned specification I can read and implement without signing anything

   weight 3 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce✓fullprobed8/10

   UCP is documented as an open, industry-governed standard with versioned releases and a public GitHub repository hosting the full spec and reference implementations, and ucp.dev/llms.txt confirms a dated, versioned spec index with no signup gate. Shopify's own docs and runtime probes show keyless, unauthenticated access to core UCP endpoints (catalog search, cart creation) without any signature required to read or implement the protocol. missing for 10: no direct evidence of the actual spec text/license terms confirming implementation rights, and no independent third-party (non-Shopify, non-ucp.dev) confirmation of the openness claim.

   • [claimed-docs] “ucp.dev positions the protocol as industry-governed rather than single-vendor: "UCP is built by the industry, to enable seamless agentic exp…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the Universal Commerce Protocol spec is published in the open — https://ucp.dev/llms.txt serves the ver…”
   • [claimed-docs] “Allows autonomous AI agents to transact on behalf of users with pre-defined, verifiable boundaries.”
   • [probe] “PROBE runtime (recorded 2026-09-14): the documented agent-profile trust gate behaves as specified — a keyless raw tools/call search_catalog …”

   proof ↗⚑ flag

   Skyfire~partialprobed4/10

   Skyfire claims tokens conform to "the open KYAPay protocol, an industry specification for identity-linked payment credentials" (referencing KYAPay.org), suggesting a published spec exists, but the evidence pack itself notes that charging, wallets, and settlement all run through Skyfire's own gated APIs, and every other capability (creating tokens, MCP server, seller services) requires an API key and account signup — no evidence of a version number, a standalone spec document, or an implementation path that doesn't require signing up with Skyfire. missing for 10: a link to a versioned KYAPay spec document, confirmation it can be implemented independently of Skyfire's account/API-key system, and independent corroboration of the spec's openness.

   • [claimed-docs] “"A KYAPay token is a signed, interoperable credential that packages agent identity and payment intent into a verifiable envelope." Tokens ar…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.skyfire.xyz/openapi.json, https://docs.skyfire.xyz/swagger.json, https://docs.skyfire.x…”
   • [probe] “PROBE runtime (recorded 2026-09-14): Skyfire's token API is live and key-gated as documented — a keyless POST to https://api.skyfire.xyz/api…”
   • [claimed-docs] “Onboarding: signup auto-creates a Buyer Agent with a "pre-funded wallet"; API keys are managed per agent and "each key is scoped to a single…”

   proof ↗⚑ flag

Disputes

1. developerDisputes and chargebacks on agent transactions can be handled via API — evidence submission, status, outcomes

   weight 2 · round drawn
   Shopify Agentic Commerce—none0/10

   The evidence pack covers catalog, cart, checkout, order state, and order webhooks (which surface refunds/returns/cancellations), but nowhere mentions a dispute or chargeback API, evidence submission, dispute status tracking, or dispute outcome handling for agent transactions.

   ⚑ flag

   Skyfire—none0/10

   The evidence pack documents token creation, charging, introspection, settlement timing, and revocation limits, but nowhere describes a dispute or chargeback mechanism — no evidence-submission endpoint, dispute status API, or outcome reporting is mentioned. Payment guarantees are described as ceiling-bound token commitments rather than a dispute-resolution workflow, so this applicable axis has no supporting evidence.

   • [claimed-docs] “Pay tokens carry committed amounts: "At creation, the token's amount is committed against the buyer's wallet (which is why token creation re…”
   • [claimed-docs] “Sellers collect via the Charge Token API: "Use this API after delivering a service, tool, or resource to collect payment from a buyer-issued…”
   • [claimed-docs] “Revocation is bounded by design: deactivating an account does not void already-issued pay/kya-pay tokens — "New token creation stops at deac…”

   proof ↗⚑ flag

Refunds

1. developerRefunds on agent-placed orders can be initiated and tracked programmatically

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce~partialclaimed4/10

   Refunds are only surfaced as read/notification events — order webhooks fire on committed changes including refunds, and get_order can be polled to see post-purchase adjustments — but there is no documented API/tool for a developer to programmatically initiate a refund on an agent-placed order; webhook subscription itself is not self-serve ('contact your Shopify partner manager'). missing for 10: an actual refund-initiation endpoint/tool (create_refund or equivalent), self-serve webhook subscription for refund events, and any tracking dashboard/status API dedicated to refund lifecycle beyond generic order state.

   • [claimed-docs] “"Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (fu…”
   • [claimed-docs] “"The Order MCP server enables AI agents to fetch the current state of an order placed through their agent, including line items, fulfillment…”
   • [claimed-docs] “Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (ful…”
   • [claimed-docs] “enables AI agents to fetch the current state of an order placed through their agent, including line items, fulfillment events, and post-purc…”

   proof ↗⚑ flag

   Skyfire—none0/10

   The evidence pack covers token creation, charging, settlement, and revocation bounds in detail, but nowhere documents a refund API, refund initiation flow, or refund status/tracking endpoint. Since Skyfire is a payments platform, refunds are a plausible feature, but no evidence of programmatic refund support exists — missing for 10: any refund/dispute API reference, refund status tracking, or documented refund workflow.

   • [claimed-docs] “Sellers collect via the Charge Token API: "Use this API after delivering a service, tool, or resource to collect payment from a buyer-issued…”
   • [claimed-docs] “Revocation is bounded by design: deactivating an account does not void already-issued pay/kya-pay tokens — "New token creation stops at deac…”
   • [claimed-docs] “Pay tokens carry committed amounts: "At creation, the token's amount is committed against the buyer's wallet (which is why token creation re…”

   proof ↗⚑ flag

Agent identity

1. merchantAgents identify themselves verifiably — registered profiles, signatures, or trust tiers — so I can tell trusted agent traffic from anonymous bots

   weight 3 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce✓fullprobed9/10

   Shopify's UCP documents a concrete three-tier trust model (Token, Signed, Anonymous) tied to agent identity, with Signed-tier requiring RFC 9421 ECDSA P-256 signature verification against a published public key in the agent's UCP profile, and access/rate-limits scaling with identification strength; a live probe confirms the trust gate actually enforces this (invalid_profile_url error when no hosted profile is presented). This gives merchants a verifiable way to distinguish anonymous vs. cryptographically-signed vs. token-authenticated agent traffic. missing for 10: no independent/third-party audit of the signature verification in production merchant traffic, and no merchant-facing dashboard/reporting evidence showing how tier data is surfaced to merchants themselves.

   • [claimed-docs] “"UCP traffic to Shopify's MCP servers is classified into three tiers based on how your agent identifies itself" — Token, Signed, Anonymous —…”
   • [claimed-docs] “In UCP, "a platform profile is a JSON document that describes the protocol version and capabilities the platform supports"; the business sid…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the documented agent-profile trust gate behaves as specified — a keyless raw tools/call search_catalog …”
   • [claimed-docs] “Shopify uses your profile to learn what your agent declares, intersect it with what the shop supports, and settle on a single negotiated set…”
   • [claimed-docs] “Negotiation is server-selects. The business computes the intersection of its capabilities with the platform's and chooses the active set”

   proof ↗⚑ flag

   Skyfire✓fullclaimed8/10

   Skyfire's KYA/KYA-Pay tokens give merchants a verifiable, signed identity credential (JWT) per agent, with optional real-world identity attachment and hard gating ('token creation fails and the transaction does not proceed' if verification level is insufficient), plus per-agent scoped API keys and a documented merchant/bot-manager flow to identify and admit agent traffic instead of blocking it. This directly addresses distinguishing trusted, verified agent traffic from anonymous bots via a signature-based, tiered identity system. Missing for 10: independent/third-party corroboration of real-world merchant adoption or trust-tier enforcement outside Skyfire's own docs, and no public API schema (openapi probes 404) to verify signature/verification details externally.

   • [claimed-docs] “Skyfire supports identity verification through Know Your Agent (KYA), a single verification that applies to both your buyer and seller agent…”
   • [claimed-docs] “"Skyfire supports identity verification through Know Your Agent (KYA), a single verification that applies to both your buyer and seller agen…”
   • [claimed-docs] “"A KYAPay token is a signed, interoperable credential that packages agent identity and payment intent into a verifiable envelope." Tokens ar…”
   • [claimed-docs] “Cardholder consent bounds card spending: "The agent/agent platform can never spend more than the cardholder approved." — an authorization co…”
   • [claimed-docs] “The site, or the bot manager in front of it, can then identify the agent/agent platform and allow it through rather than block it.”
   • [claimed-docs] “API keys are created and managed in your Agent Dashboard, and each key is scoped to a single agent (Buyer or Seller).”

   proof ↗⚑ flag

Human oversight

1. ai-native userSensitive agent spending requires my documented approval — a confirmation step, signed mandate, or per-purchase consent — before money moves

   weight 3 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce~partialclaimed6/10

   Shopify's UCP checkout flow documents explicit pre-purchase gates: complete_checkout must only be called once 'Checkout status is ready_for_complete', the 'Buyer has reviewed and confirmed the order', and the 'Payment credential has been collected', and unresolved cases force a hand-off to the buyer via continue_url (requires_escalation/requires_buyer_review). AP2 integration adds 'cryptographically signed payment authorizations that are mathematically tied to the specific state of the cart', which maps to a signed-mandate model, and trust tiers restrict complete_checkout to Token-tier agents with explicit purchase permission. However, the docs also note 'Trusted agents can complete checkouts directly,' implying some agents can skip buyer-facing confirmation, and enforcement of the 'buyer reviewed' precondition appears to rely on agent self-attestation rather than a Shopify-verified user signature captured at time of purchase. Missing for 10: independent/third-party confirmation that buyer consent is cryptographically captured (not just agent-declared) and clarity on exactly which agents qualify as 'trusted' to bypass buyer review.

   • [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
   • [claimed-docs] “Buyer handoff is a first-class state: "Build for escalations regardless of how you authenticate." A checkout in requires_escalation means "C…”
   • [claimed-docs] “"UCP traffic to Shopify's MCP servers is classified into three tiers based on how your agent identifies itself" — Token, Signed, Anonymous —…”
   • [claimed-docs] “allows Platforms to provide cryptographically signed payment authorizations that are mathematically tied to the specific state of the cart”
   • [claimed-docs] “ucp.dev positions the protocol as industry-governed rather than single-vendor: "UCP is built by the industry, to enable seamless agentic exp…”

   proof ↗⚑ flag

   Skyfire~partialclaimed5/10

   Skyfire's pay/kya-pay tokens are signed JWT 'mandates' that commit a specific spending ceiling at creation time, and that ceiling is a hard cap enforced by the buyer's wallet balance and cardholder consent ('agent can never spend more than the cardholder approved'), giving a documented, auditable authorization trail per token. However, the evidence shows token creation is an agent/API-driven action, not a human-facing confirmation prompt or explicit per-purchase human sign-off — there's no documented UI step where a person approves each individual transaction before it fires, only the pre-set balance/identity gating. Missing for 10: an explicit human-in-the-loop confirmation/approval UI or workflow per purchase, and documentation of configurable spend policies beyond wallet pre-funding and KYA identity requirements.

   • [claimed-docs] “"A KYAPay token is a signed, interoperable credential that packages agent identity and payment intent into a verifiable envelope." Tokens ar…”
   • [claimed-docs] “Pay tokens carry committed amounts: "At creation, the token's amount is committed against the buyer's wallet (which is why token creation re…”
   • [claimed-docs] “Cardholder consent bounds card spending: "The agent/agent platform can never spend more than the cardholder approved." — an authorization co…”
   • [claimed-docs] “"Skyfire supports identity verification through Know Your Agent (KYA), a single verification that applies to both your buyer and seller agen…”
   • [claimed-docs] “On signup, your Buyer Agent is created automatically, along with a pre-funded wallet so you can start using paid services right away.”

   proof ↗⚑ flag

Liability

1. merchantThe fraud, liability, and chargeback rules for agent-initiated transactions are documented so I know who bears the risk

   weight 2 · round to Skyfire
   Shopify Agentic Commerce—none0/10

   The evidence pack documents UCP's protocol mechanics (catalog, cart, checkout, order webhooks, trust tiers, profile negotiation) but nowhere specifies fraud liability, chargeback responsibility, or dispute-resolution rules for agent-initiated purchases. The only tangential mention is UCP's general 'Merchant of Record' framing on ucp.dev, which addresses customer-relationship ownership, not who bears fraud/chargeback risk in an agent transaction — no Shopify-specific policy, contract terms, or dispute process is documented.

   • [claimed-docs] “ucp.dev positions the protocol as industry-governed rather than single-vendor: "UCP is built by the industry, to enable seamless agentic exp…”

   proof ↗⚑ flag

   Skyfire~partialclaimed6/10

   Skyfire's docs explicitly allocate payment risk: sellers are guaranteed payment up to a token's committed amount and 'do not carry buyer non-payment risk' (skyfire-supp-4), overcharges are rejected, and even after account deactivation in-flight tokens are still honored so sellers get paid (skyfire-supp-6). Card-based flows also state the agent can never exceed cardholder-approved amounts and purchases are never anonymous to the merchant (skyfire-supp-7). However, there is no dedicated chargeback/dispute-resolution policy, no explicit statement of who bears fraud losses when credentials are stolen or a buyer disputes via their bank, and no formal merchant-facing liability/ToS document. Missing for 10: explicit chargeback/dispute process, stolen-credential fraud liability terms, formal merchant liability agreement or ToS reference.

   • [claimed-docs] “Pay tokens carry committed amounts: "At creation, the token's amount is committed against the buyer's wallet (which is why token creation re…”
   • [claimed-docs] “Revocation is bounded by design: deactivating an account does not void already-issued pay/kya-pay tokens — "New token creation stops at deac…”
   • [claimed-docs] “Cardholder consent bounds card spending: "The agent/agent platform can never spend more than the cardholder approved." — an authorization co…”
   • [claimed-docs] “Sellers collect via the Charge Token API: "Use this API after delivering a service, tool, or resource to collect payment from a buyer-issued…”

   proof ↗⚑ flag

Spend controls

1. ai-native userSet per-agent spend caps and usage limits and revoke an agent's payment authority instantly

   weight 2 · round to Skyfire
   Shopify Agentic Commerce—none0/10

   The evidence describes trust tiers, rate limiting, token TTLs, and JWT scopes, but nowhere documents per-agent spend caps, usage limits, or an instant revoke-payment-authority mechanism — tokens simply expire after 60 minutes rather than being explicitly revocable on demand, and no dollar-limit or usage-cap controls are mentioned anywhere in the pack.

   ⚑ flag

   Skyfire~partialclaimed4/10

   Skyfire supports per-agent scoping and spend caps: keys are scoped to a single agent, and pay tokens carry a committed amount ceiling that bounds spend and rejects overcharges. However, the docs explicitly state there is no per-token revocation API and that deactivating an account does not void already-issued tokens — in-flight tokens remain chargeable until expiry plus a 24-hour grace window — directly contradicting 'instant' revocation of payment authority. missing for 10: a documented instant per-agent/per-token revocation mechanism, independent or hands-on confirmation of revocation behavior, and granular usage-limit controls beyond token amount/expiry.

   • [claimed-docs] “Pay tokens carry committed amounts: "At creation, the token's amount is committed against the buyer's wallet (which is why token creation re…”
   • [claimed-docs] “Sellers collect via the Charge Token API: "Use this API after delivering a service, tool, or resource to collect payment from a buyer-issued…”
   • [claimed-docs] “Revocation is bounded by design: deactivating an account does not void already-issued pay/kya-pay tokens — "New token creation stops at deac…”
   • [claimed-docs] “API keys are created and managed in your Agent Dashboard, and each key is scoped to a single agent (Buyer or Seller).”

   proof ↗⚑ flag