Shopify Agentic Commerce vs Visa Intelligent Commerce

Cart

1. ai-native userMy agent can create and update a cart or order draft through a documented protocol call

   weight 3 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce✓fullprobed9/10

   Cart MCP and Checkout MCP are documented UCP protocol calls (create_cart, update_cart, create_checkout, complete_checkout) with JSON-RPC schemas, and a runtime probe confirms a real cart was created keylessly against a live Shopify store via the CLI/protocol. missing for 10: no independent (non-Shopify) hands-on corroboration of a full end-to-end checkout completion.

   • [claimed-docs] “"Cart tools accept unauthenticated requests, which lets you estimate totals and share a cart with the buyer before collecting credentials" —…”
   • [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”
   • [claimed-docs] “The Cart MCP server enables AI agents to build and iterate on a cart before the buyer commits to purchase. When the buyer is ready to buy, c…”
   • [claimed-docs] “The Checkout MCP server enables AI agents to create and manage checkout sessions, convert carts into checkouts, and refer buyers to the merc…”

   proof ↗⚑ flag

   Visa Intelligent Commerce~partialclaimed6/10

   Visa's REST APIs document creating a purchase-intent (POST /acp/v1/instructions) with mandate fields (amount, merchant, description) that functions like an order/cart draft, and revocation of that intent is documented as a follow-on call — but there is no explicit 'update/modify draft' endpoint, only initiate and cancel actions on the instruction/mandate object. Missing for 10: a documented update/modify-in-place endpoint for an existing cart/order object, and clearer mapping of Visa's 'instruction' concept to a literal cart/order draft rather than a payment-intent mandate.

   • [claimed-docs] “Spend caps live in the purchase-intent mandate: Initiate a Purchase Intent (POST /acp/v1/instructions) exists "to verify that your agent is …”
   • [claimed-docs] “Credentials are scoped to an authenticated instruction: retrieval is POST /acp/v1/instructions/{instructionID}/credentials, and the request …”
   • [claimed-docs] “Capture consumer consent, set spending limits, and manage mandates for agent-initiated payments.”

   proof ↗⚑ flag

Checkout

1. ai-native userMy agent can complete a purchase end-to-end — checkout session, delegated payment credential, confirmed order

   weight 3 · round to Visa Intelligent Commerce
   Shopify Agentic Commerce~partialprobed7/10

   Docs describe a full documented path — create_checkout, payment_handlers (e.g. com.google.pay) negotiation, complete_checkout requiring a collected payment credential, and order confirmation via get_order/order webhooks — and even name complete_checkout as Token-tier gated 'when the token is granted permission to complete purchases.' However, the default flow explicitly hands off to the buyer's browser for payment ('Build carts, convert them to checkouts, and hand off to the merchant for payment') and the only hands-on runtime probe reached cart creation only, explicitly stopping 'no checkout, no payment.' Missing for 10: an independent/hands-on trace of an actual complete_checkout call with a delegated payment credential and a resulting confirmed order, and clarity on how broadly (vs. only select trusted agents) autonomous payment completion is actually granted.

   • [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
   • [claimed-docs] “Buyer handoff is a first-class state: "Build for escalations regardless of how you authenticate." A checkout in requires_escalation means "C…”
   • [claimed-docs] “"UCP traffic to Shopify's MCP servers is classified into three tiers based on how your agent identifies itself" — Token, Signed, Anonymous —…”
   • [claimed-docs] “"The Order MCP server enables AI agents to fetch the current state of an order placed through their agent, including line items, fulfillment…”
   • [claimed-docs] “"Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (fu…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”

   proof ↗⚑ flag

   Visa Intelligent Commerce✓fullclaimed8/10

   Visa's docs describe the full agent-checkout pipeline with concrete REST endpoints: card enrollment/tokenization (POST /acp/v1/tokens), a purchase-intent mandate with spend caps and expiry (POST /acp/v1/instructions), scoped delegated credential retrieval tied to merchant/amount (POST /acp/v1/instructions/{id}/credentials), passkey-based instruction authentication, and authorization-time enforcement plus payment outcome confirmation — covering checkout session, delegated credential, and confirmed order end-to-end. Missing for 10: independent/hands-on evidence of a completed real-world transaction (all evidence is first-party docs) and the product page's own maturity caveat that it is 'in the process of development and deployment'.

   • [claimed-docs] “Agent-scoped credentials are the core primitive: "Provisioning and life cycle management of agent-specific payment tokens that can be used b…”
   • [claimed-docs] “Human approval is passkey-anchored end to end: provisioning includes "step up verification of the cardholder as well as setting up a Passkey…”
   • [claimed-docs] “Spend caps live in the purchase-intent mandate: Initiate a Purchase Intent (POST /acp/v1/instructions) exists "to verify that your agent is …”
   • [claimed-docs] “"Your agents can enroll a customer's card for tokenization during the customer's account registration or when the customer begins a new purc…”
   • [claimed-docs] “Credentials are scoped to an authenticated instruction: retrieval is POST /acp/v1/instructions/{instructionID}/credentials, and the request …”
   • [claimed-docs] “Confirm payment outcomes and trigger post-purchase actions in real-time.”
   • [claimed-docs] “Controls to ensure that the agent’s purchasing actions and the related authorizations align with the user’s authenticated instruction”

   proof ↗⚑ flag

Embedded surfaces

1. merchantBuyers can complete purchases of my products inside chat and assistant surfaces (ChatGPT, Claude, Gemini, Copilot and peers)

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce~partialprobed6/10

   Shopify ships a real, live UCP checkout stack — Catalog, Cart, and Checkout MCP servers with a documented complete_checkout tool that can 'submit payment and place the order' for Token-tier trusted agents, backed by a runtime-verified cart creation and marketing claiming buyers 'check out right in the chat' — and UCP itself is co-developed with Google, Microsoft, OpenAI-adjacent ecosystem players. However, the docs make buyer handoff/escalation a first-class, common path ('hand off to the buyer via continue_url', 'Build for escalations regardless of how you authenticate'), meaning many purchases route the buyer out to the merchant's own checkout page rather than completing fully inside the chat UI, and named surfaces beyond Claude (only a Claude plugin is documented) — ChatGPT, Gemini, Copilot — have no confirmed live integration in the evidence. Missing for 10: confirmed named integrations with ChatGPT/Gemini/Copilot, evidence that in-chat completion (not handoff) is the norm rather than the exception, and independent buyer-side confirmation of an end-to-end in-chat purchase.

   • [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
   • [claimed-docs] “Buyer handoff is a first-class state: "Build for escalations regardless of how you authenticate." A checkout in requires_escalation means "C…”
   • [claimed-docs] “"UCP traffic to Shopify's MCP servers is classified into three tiers based on how your agent identifies itself" — Token, Signed, Anonymous —…”
   • [claimed-docs] “Get discovered across AI channels. Shoppers check out right in the chat.”
   • [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”
   • [claimed-docs] “ucp.dev positions the protocol as industry-governed rather than single-vendor: "UCP is built by the industry, to enable seamless agentic exp…”

   proof ↗⚑ flag

   Visa Intelligent Commerce~partialprobed5/10

   Visa Intelligent Commerce provides the underlying payment rails for agent-initiated purchases (tokenization, mandate/consent controls, passkey step-up auth, Trusted Agent Protocol, and an MCP server for developers to plug into agentic experiences), which is the necessary plumbing for buyers to check out via AI agents. However, the evidence never names or demonstrates live integration with specific chat/assistant surfaces like ChatGPT, Claude, Gemini, or Copilot — it's generic 'agent' infrastructure plus a community-noted MCP server, with the core product itself flagged as still 'in the process of development and deployment.' Missing for 10: explicit evidence of shipped integrations or launch partnerships with ChatGPT/Claude/Gemini/Copilot, and independent confirmation that merchants can actually complete checkout flows inside those named surfaces today.

   • [claimed-docs] “Developers can now connect to Visa Intelligent Commerce APIs through the MCP Server, making it faster and easier for builders to bring intel…”
   • [claimed-docs] “the toolkit helps developers and non-technical users to work with AI agents using plain language — no coding required.”
   • [claimed-docs] “Agent-scoped credentials are the core primitive: "Provisioning and life cycle management of agent-specific payment tokens that can be used b…”
   • [claimed-docs] “Spend caps live in the purchase-intent mandate: Initiate a Purchase Intent (POST /acp/v1/instructions) exists "to verify that your agent is …”
   • [claimed-docs] “"Your agents can enroll a customer's card for tokenization during the customer's account registration or when the customer begins a new purc…”
   • [claimed-docs] “Credentials are scoped to an authenticated instruction: retrieval is POST /acp/v1/instructions/{instructionID}/credentials, and the request …”
   • [probe] “PROBE runtime (recorded 2026-09-14): Visa's developer gateway is live and credential-gated exactly as documented — a keyless GET to https://…”

   proof ↗⚑ flag

Protocol conformance

1. developerBuild against a versioned commerce protocol with a published schema and conformance or validation tooling

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce✓fullprobed7/10

   UCP is documented as a versioned protocol (dated releases like 2026-08-25, 2026-04-08) with a publicly hosted spec and reference implementations on GitHub, and Shopify's MCP servers enforce schema/profile validation at runtime (e.g. `--input-schema` to fetch a merchant's live input schema, and a probed `invalid_profile_url` error when an agent lacks a valid hosted profile), plus an AI Toolkit that validates GraphQL/Liquid/Extensions against Shopify schemas. Missing for 10: an explicit standalone conformance test suite or certification program for third-party UCP implementations, and independent (non-Shopify) corroboration of schema stability across versions.

   • [claimed-docs] “In UCP, "a platform profile is a JSON document that describes the protocol version and capabilities the platform supports"; the business sid…”
   • [claimed-docs] “"The Storefront Catalog MCP server enables AI agents to search and discover products from a single merchant's catalog, helping buyers find a…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the documented agent-profile trust gate behaves as specified — a keyless raw tools/call search_catalog …”
   • [claimed-docs] “ucp.dev positions the protocol as industry-governed rather than single-vendor: "UCP is built by the industry, to enable seamless agentic exp…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the Universal Commerce Protocol spec is published in the open — https://ucp.dev/llms.txt serves the ver…”
   • [claimed-docs] “validate GraphQL queries, Liquid templates, and Shopify Extensions against Shopify schemas to catch issues earlier”

   proof ↗⚑ flag

   Visa Intelligent Commerce~partialclaimed5/10

   Visa publishes detailed REST API docs (endpoints, required fields, sample payloads) for Intelligent Commerce and a public spec with reference implementation for the Trusted Agent Protocol (RFC 9421 signatures, JWKS verification), plus a sandbox for testing. However, there's no evidence of a single unified 'commerce protocol' with an explicit version number, a published machine-readable schema (e.g. OpenAPI/JSON Schema spec file), or dedicated conformance/validation tooling beyond the sandbox and a reference implementation repo. missing for 10: explicit protocol versioning scheme, downloadable/published schema (OpenAPI or similar), dedicated conformance-test suite or validator tool, independent developer corroboration of building against the spec.

   • [claimed-docs] “Spend caps live in the purchase-intent mandate: Initiate a Purchase Intent (POST /acp/v1/instructions) exists "to verify that your agent is …”
   • [claimed-docs] “"Your agents can enroll a customer's card for tokenization during the customer's account registration or when the customer begins a new purc…”
   • [claimed-docs] “Credentials are scoped to an authenticated instruction: retrieval is POST /acp/v1/instructions/{instructionID}/credentials, and the request …”
   • [claimed-docs] “The Trusted Agent Protocol's agent recognition signature is HTTP Message Signatures "defined by RCF 9421" (typo in original), "aligned with …”
   • [claimed-docs] “The TAP spec is public with a runnable reference implementation: "Establishing a universal standard of trust between AI agents and merchants…”
   • [claimed-docs] “Merchant-side onboarding starts with a self-serve "Intelligent Commerce Sandbox Sign up" form (Organization ID, company, contact details, te…”
   • [claimed-docs] “including the cryptographic standards (RFC9421), required message signature fields, and the process for validating an agent's intent.”

   proof ↗⚑ flag

Service discovery

1. ai-native userMy agent can discover payable services and APIs through a published directory or discovery index

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce✓fullprobed8/10

   Shopify publishes UCP-compliant Global Catalog and Storefront Catalog MCP servers that agents can discover payable services/products through, with documented endpoints, tool schemas, and profile-based discovery negotiation, corroborated by live runtime probes showing real handshakes and search/cart flows against catalog.shopify.com and a merchant storefront. The broader UCP spec is also openly published (ucp.dev) as an industry discovery standard. Missing for 10: a single canonical top-level directory/index listing all payable services across merchants (discovery is per-server/per-merchant plus a global catalog, not one unified public index), and independent (non-Shopify) confirmation of third-party agent adoption discovering via this index.

   • [claimed-docs] “enables AI agents to search and discover products across the entire Shopify ecosystem, helping buyers find products from multiple merchants”
   • [claimed-docs] “enables AI agents to search and discover products from a single merchant's catalog, helping buyers find and purchase products from that stor…”
   • [claimed-docs] “"The Global Catalog MCP server enables AI agents to search and discover products across the entire Shopify ecosystem, helping buyers find pr…”
   • [claimed-docs] “"The Storefront Catalog MCP server enables AI agents to search and discover products from a single merchant's catalog, helping buyers find a…”
   • [claimed-docs] “In UCP, "a platform profile is a JSON document that describes the protocol version and capabilities the platform supports"; the business sid…”
   • [probe] “PROBE runtime (recorded 2026-09-14): Shopify's Global Catalog MCP server is live — a keyless JSON-RPC initialize POST to https://catalog.sho…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a Shopify-operated storefront's own UCP endpoint is live — a keyless JSON-RPC initialize POST to https:…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the documented agent-profile trust gate behaves as specified — a keyless raw tools/call search_catalog …”
   • [claimed-docs] “ucp.dev positions the protocol as industry-governed rather than single-vendor: "UCP is built by the industry, to enable seamless agentic exp…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the Universal Commerce Protocol spec is published in the open — https://ucp.dev/llms.txt serves the ver…”

   proof ↗⚑ flag

   Visa Intelligent Commerce~partialprobed5/10

   Visa provides discovery surfaces for its own developer APIs — an official MCP server (visa-intelligent-commerce-docs-8, probe-2), a public npm package (visa-ic-probe-rt-2), and a machine-readable llms.txt index (visa-intelligent-commerce-probe-1) — which let an agent discover and call its payment/commerce endpoints. However this is discovery of Visa's own API surface, not a broader directory/index of third-party payable services or merchants that an agent could browse; the TAP agent-registry is for verifying agent identity, not for service discovery. Missing for 10: a published directory/marketplace of payable third-party services, evidence of cross-vendor service discovery, independent confirmation the MCP/llms.txt are used for live service discovery rather than just docs.

   • [claimed-docs] “Developers can now connect to Visa Intelligent Commerce APIs through the MCP Server, making it faster and easier for builders to bring intel…”
   • [probe] “PROBE llms.txt: HTTP 200 at https://developer.visaacceptance.com/llms.txt # VisaAcceptance Developer Center > This developer documentation …”
   • [probe] “official MCP server documented at https://github.com/visaacceptance/agent-toolkit”
   • [probe] “PROBE runtime (recorded 2026-09-14): Visa's developer gateway is live and credential-gated exactly as documented — a keyless GET to https://…”

   proof ↗⚑ flag

Agent access

1. ai-native userPoint an agent at llms.txt or agent-oriented docs

   weight 2 · round to Visa Intelligent Commerce
   Shopify Agentic Commerce~partialprobed7/10

   Shopify does not host its own llms.txt (shopify.dev/llms.txt returns 404), but it provides extensive agent-oriented documentation reachable via .md suffixed URLs (e.g. shopify.dev/docs/agents.md returns 200 with structured content) covering catalog, cart, checkout, orders, and profiles — exactly the kind of agent-consumable docs the story asks for. The related UCP spec (ucp.dev/llms.txt) does serve a proper llms.txt index, showing the ecosystem partially satisfies this pattern even though Shopify's own domain doesn't. Missing for 10: a working llms.txt directly at shopify.dev, and independent (non-Shopify) confirmation that agents reliably parse these .md docs as intended.

   • [probe] “PROBE llms.txt: HTTP 404 at https://shopify.dev/llms.txt”
   • [probe] “PROBE docs-md: HTTP 200 at https://shopify.dev/docs/agents.md --- title: Agentic commerce description: >- Build AI agents that authenticat…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the Universal Commerce Protocol spec is published in the open — https://ucp.dev/llms.txt serves the ver…”
   • [claimed-docs] “Initialize a local UCP profile.”
   • [claimed-docs] “This quickstart runs the full agentic commerce flow with the UCP CLI, from product discovery to order tracking, in about five minutes.”

   proof ↗⚑ flag

   Visa Intelligent Commerce✓fullprobed9/10

   A probe confirms llms.txt returns HTTP 200 with structured content at developer.visaacceptance.com/llms.txt, and Visa also publishes an official MCP server (agent-toolkit) confirmed live on npm, giving agents both a machine-readable docs entry point and a programmatic tool interface. Missing for 10: independent third-party confirmation that agents actually consume llms.txt successfully in practice beyond the HTTP probe.

   • [probe] “PROBE llms.txt: HTTP 200 at https://developer.visaacceptance.com/llms.txt # VisaAcceptance Developer Center > This developer documentation …”
   • [probe] “official MCP server documented at https://github.com/visaacceptance/agent-toolkit”
   • [probe] “PROBE runtime (recorded 2026-09-14): Visa's developer gateway is live and credential-gated exactly as documented — a keyless GET to https://…”
   • [claimed-docs] “Developers can now connect to Visa Intelligent Commerce APIs through the MCP Server, making it faster and easier for builders to bring intel…”
   • [claimed-docs] “It offers a specialized set of tools designed to help you manage invoices, create payment links, and perform other Visa Acceptance-related o…”

   proof ↗⚑ flag

2. ai-native userRun the product headlessly / in CI for automation

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce✓fullprobed8/10

   The UCP CLI is explicitly designed as a scriptable, headless tool with structured commands (search, cart, checkout, order tracking) usable via npm install and local profile init, and probes confirm real keyless CLI runs against live endpoints (catalog search, cart creation) succeeding non-interactively — consistent with CI/automation use. missing for 10: no explicit CI pipeline example (e.g., GitHub Actions), no documented exit codes/machine-readable output format guarantees, and no independent third-party report of running it in a CI environment.

   • [claimed-docs] “Initialize a local UCP profile.”
   • [claimed-docs] “This quickstart runs the full agentic commerce flow with the UCP CLI, from product discovery to order tracking, in about five minutes.”
   • [claimed-docs] “The CLI uses a local profile to identify your agent on every merchant-scoped request. Initialize it once and the CLI reuses it for every ope…”
   • [claimed-docs] “Shopify's agent surface is UCP end to end via "Shopify's UCP-compliant MCP servers": the UCP CLI "provides structured commands to search the…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the documented agent-profile trust gate behaves as specified — a keyless raw tools/call search_catalog …”
   • [probe] “official CLI documented at https://shopify.dev/docs/agents/get-started/quickstart”

   proof ↗⚑ flag

   Visa Intelligent Commerce~partialprobed6/10

   The product is fundamentally API/protocol-driven (REST endpoints for tokens, instructions, credentials) with a published MCP server and npm-distributed agent-toolkit, plus a self-serve sandbox for test transactions — all of which are inherently headless and scriptable without a UI. However, there is no explicit documentation or example of CI/CD pipeline integration, automated test harnesses, or non-interactive credential/authentication flows (since the design requires passkey/step-up human authentication at key points), which limits true unattended automation. Missing for 10: explicit CI/CD pipeline examples, documentation on running fully unattended (given passkey step-up requirements), automated test suite integration guidance.

   • [claimed-docs] “Spend caps live in the purchase-intent mandate: Initiate a Purchase Intent (POST /acp/v1/instructions) exists "to verify that your agent is …”
   • [claimed-docs] “"Your agents can enroll a customer's card for tokenization during the customer's account registration or when the customer begins a new purc…”
   • [claimed-docs] “Credentials are scoped to an authenticated instruction: retrieval is POST /acp/v1/instructions/{instructionID}/credentials, and the request …”
   • [claimed-docs] “Developers can now connect to Visa Intelligent Commerce APIs through the MCP Server, making it faster and easier for builders to bring intel…”
   • [probe] “official MCP server documented at https://github.com/visaacceptance/agent-toolkit”
   • [probe] “PROBE runtime (recorded 2026-09-14): Visa's developer gateway is live and credential-gated exactly as documented — a keyless GET to https://…”
   • [claimed-docs] “Merchant-side onboarding starts with a self-serve "Intelligent Commerce Sandbox Sign up" form (Organization ID, company, contact details, te…”

   proof ↗⚑ flag

3. ai-native userConnect an agent via an official MCP server

   weight 3 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce✓fullprobed9/10

   Shopify ships multiple official UCP-compliant MCP servers (Global Catalog, Storefront Catalog, Cart, Checkout, Order) plus a Storefront MCP, all documented and independently probe-verified with live handshakes (catalog.shopify.com/api/ucp/mcp, per-merchant endpoints) and real cart creation via the CLI. Agent identification/authentication via hosted profiles and tiered trust is also verified in runtime probes. Missing for 10: independent third-party (non-Shopify) developer accounts of connecting an arbitrary agent end-to-end beyond Shopify's own probes.

   • [claimed-docs] “Shopify's agent surface is UCP end to end via "Shopify's UCP-compliant MCP servers": the UCP CLI "provides structured commands to search the…”
   • [claimed-docs] “"The Global Catalog MCP server enables AI agents to search and discover products across the entire Shopify ecosystem, helping buyers find pr…”
   • [claimed-docs] “"The Storefront Catalog MCP server enables AI agents to search and discover products from a single merchant's catalog, helping buyers find a…”
   • [claimed-docs] “"Cart tools accept unauthenticated requests, which lets you estimate totals and share a cart with the buyer before collecting credentials" —…”
   • [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
   • [claimed-docs] “"The Order MCP server enables AI agents to fetch the current state of an order placed through their agent, including line items, fulfillment…”
   • [probe] “PROBE runtime (recorded 2026-09-14): Shopify's Global Catalog MCP server is live — a keyless JSON-RPC initialize POST to https://catalog.sho…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a Shopify-operated storefront's own UCP endpoint is live — a keyless JSON-RPC initialize POST to https:…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the documented agent-profile trust gate behaves as specified — a keyless raw tools/call search_catalog …”
   • [claimed-docs] “Connect any AI assistant to real-time commerce data from Shopify stores with Model Context Protocol (MCP) servers”

   proof ↗⚑ flag

   Visa Intelligent Commerce✓fullprobed7/10

   Visa explicitly ships an official MCP server (visaacceptance/agent-toolkit, published on npm as @visaacceptance/mcp) that lets developers/agents connect to Visa Intelligent Commerce APIs for payment-enabled operations like invoices and payment links, corroborated by a runtime probe confirming the npm package exists with Visa-staff maintainers. Missing for 10: independent hands-on usage reports/reviews of the MCP server beyond Visa's own announcement and npm registry check, and more detail on the full tool surface exposed via MCP.

   • [claimed-docs] “Developers can now connect to Visa Intelligent Commerce APIs through the MCP Server, making it faster and easier for builders to bring intel…”
   • [claimed-docs] “the toolkit helps developers and non-technical users to work with AI agents using plain language — no coding required.”
   • [claimed-docs] “It offers a specialized set of tools designed to help you manage invoices, create payment links, and perform other Visa Acceptance-related o…”
   • [probe] “official MCP server documented at https://github.com/visaacceptance/agent-toolkit”
   • [probe] “PROBE runtime (recorded 2026-09-14): Visa's developer gateway is live and credential-gated exactly as documented — a keyless GET to https://…”

   proof ↗⚑ flag

4. ai-native userUse an official CLI

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce✓fullprobed8/10

   Shopify documents and ships an official UCP CLI (`@shopify/ucp-cli`) with structured commands for catalog search, cart building, checkout, and order tracking, backed by a quickstart guide and runtime probes confirming live functionality (cart creation, catalog search) against real endpoints. missing for 10: independent third-party (non-Shopify) hands-on reviews of the CLI itself and broader adoption evidence beyond Shopify's own docs/probes.

   • [claimed-docs] “Shopify's agent surface is UCP end to end via "Shopify's UCP-compliant MCP servers": the UCP CLI "provides structured commands to search the…”
   • [claimed-docs] “Initialize a local UCP profile.”
   • [claimed-docs] “This quickstart runs the full agentic commerce flow with the UCP CLI, from product discovery to order tracking, in about five minutes.”
   • [claimed-docs] “The CLI uses a local profile to identify your agent on every merchant-scoped request. Initialize it once and the CLI reuses it for every ope…”
   • [probe] “official CLI documented at https://shopify.dev/docs/agents/get-started/quickstart”
   • [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”
   • [claimed-docs] “Buyer handoff is a first-class state: "Build for escalations regardless of how you authenticate." A checkout in requires_escalation means "C…”

   proof ↗⚑ flag

   Visa Intelligent Commerce—none0/10

   Evidence shows an MCP server and an npm-published 'agent-toolkit' with tool bindings, but nothing describes an official CLI binary or command-line interface for AI-native users to interact with Visa Intelligent Commerce.

   • [claimed-docs] “Developers can now connect to Visa Intelligent Commerce APIs through the MCP Server, making it faster and easier for builders to bring intel…”
   • [claimed-docs] “It offers a specialized set of tools designed to help you manage invoices, create payment links, and perform other Visa Acceptance-related o…”
   • [probe] “official MCP server documented at https://github.com/visaacceptance/agent-toolkit”
   • [probe] “PROBE runtime (recorded 2026-09-14): Visa's developer gateway is live and credential-gated exactly as documented — a keyless GET to https://…”

   proof ↗⚑ flag

5. ai-native userDrive the product through a documented public API

   weight 3 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce✓fullprobed9/10

   Shopify documents and exposes a full public, documented agent-facing API surface (UCP CLI + MCP servers for Catalog, Cart, Checkout, Order) with schemas, auth tiers, negotiation, webhooks, and runtime probes confirming live handshakes, keyless catalog search, and real cart creation — clearly enabling an AI-native user to drive the product programmatically. Missing for 10: no publicly documented OpenAPI/REST spec found (404s on openapi.json/llms.txt) and no independent third-party developer report beyond Shopify's own docs/probes.

   • [claimed-docs] “the CLI provides structured commands to search the Catalog, build carts, create checkouts, hand off buyers, and track orders”
   • [claimed-docs] “Shopify's agent surface is UCP end to end via "Shopify's UCP-compliant MCP servers": the UCP CLI "provides structured commands to search the…”
   • [claimed-docs] “"The Global Catalog MCP server enables AI agents to search and discover products across the entire Shopify ecosystem, helping buyers find pr…”
   • [claimed-docs] “"Cart tools accept unauthenticated requests, which lets you estimate totals and share a cart with the buyer before collecting credentials" —…”
   • [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
   • [claimed-docs] “"The Order MCP server enables AI agents to fetch the current state of an order placed through their agent, including line items, fulfillment…”
   • [claimed-docs] “"Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (fu…”
   • [claimed-docs] “In UCP, "a platform profile is a JSON document that describes the protocol version and capabilities the platform supports"; the business sid…”
   • [probe] “PROBE runtime (recorded 2026-09-14): Shopify's Global Catalog MCP server is live — a keyless JSON-RPC initialize POST to https://catalog.sho…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the documented agent-profile trust gate behaves as specified — a keyless raw tools/call search_catalog …”

   proof ↗⚑ flag

   Visa Intelligent Commerce✓fullprobed8/10

   Visa publishes a documented REST API (POST /acp/v1/instructions, /acp/v1/tokens, /acp/v1/instructions/{id}/credentials) with field-level specs, sandbox sign-up, and an official MCP server/agent-toolkit for AI-native access, corroborated by npm registry presence and a live gateway probe. missing for 10: independent third-party developer confirmation of building against the API and broader SDK/language coverage beyond the documented endpoints.

   • [claimed-docs] “Spend caps live in the purchase-intent mandate: Initiate a Purchase Intent (POST /acp/v1/instructions) exists "to verify that your agent is …”
   • [claimed-docs] “"Your agents can enroll a customer's card for tokenization during the customer's account registration or when the customer begins a new purc…”
   • [claimed-docs] “Credentials are scoped to an authenticated instruction: retrieval is POST /acp/v1/instructions/{instructionID}/credentials, and the request …”
   • [claimed-docs] “Developers can now connect to Visa Intelligent Commerce APIs through the MCP Server, making it faster and easier for builders to bring intel…”
   • [probe] “official MCP server documented at https://github.com/visaacceptance/agent-toolkit”
   • [probe] “PROBE runtime (recorded 2026-09-14): Visa's developer gateway is live and credential-gated exactly as documented — a keyless GET to https://…”
   • [claimed-docs] “Merchant-side onboarding starts with a self-serve "Intelligent Commerce Sandbox Sign up" form (Organization ID, company, contact details, te…”

   proof ↗⚑ flag

6. ai-native userIssue scoped/least-privilege API credentials for an agent

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce✓fullprobed7/10

   Shopify's UCP documents concrete least-privilege mechanics: three trust tiers (Anonymous/Signed/Token) that gate which tools and rate limits an agent gets, a specific scope (read_global_api_orders) required for Order MCP, short-lived (60-minute TTL) JWTs minted from Dev Dashboard client credentials, and checkout completion gated on the token being 'granted permission to complete purchases.' A runtime probe confirms the profile/identity gate rejects unauthenticated calls (invalid_profile_url), corroborating the scoped-access model works as documented. Missing for 10: a full catalog of all available scopes/permissions beyond the few named, self-service credential/scope management UI, explicit revocation workflow, and independent third-party verification of least-privilege enforcement in production.

   • [claimed-docs] “"UCP traffic to Shopify's MCP servers is classified into three tiers based on how your agent identifies itself" — Token, Signed, Anonymous —…”
   • [claimed-docs] “"The Order MCP server enables AI agents to fetch the current state of an order placed through their agent, including line items, fulfillment…”
   • [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the documented agent-profile trust gate behaves as specified — a keyless raw tools/call search_catalog …”

   proof ↗⚑ flag

   Visa Intelligent Commerce~partialcommunity7/10

   Visa Intelligent Commerce issues agent-specific payment tokens/credentials scoped by merchant name, amount, and decline thresholds via mandates, gated behind passkey-authenticated user instructions (visa-ic-supp-1, visa-ic-supp-3, visa-ic-supp-5, visa-ic-supp-2). This is a concrete least-privilege credential model for payments, but it is payment-specific rather than a general API-credential scoping mechanism, and the platform page itself carries a maturity caveat ('in the process of development and deployment') plus community skepticism that standardized agent identity/permission scoping is still immature (visa-intelligent-commerce-comm-1). Missing for 10: evidence of granular scoping beyond amount/merchant (e.g., category-level or time-window least privilege), independent/production validation of the scoping enforcement, and confirmation the maturity caveat has been resolved.

   • [claimed-docs] “Agent-scoped credentials are the core primitive: "Provisioning and life cycle management of agent-specific payment tokens that can be used b…”
   • [claimed-docs] “Human approval is passkey-anchored end to end: provisioning includes "step up verification of the cardholder as well as setting up a Passkey…”
   • [claimed-docs] “Spend caps live in the purchase-intent mandate: Initiate a Purchase Intent (POST /acp/v1/instructions) exists "to verify that your agent is …”
   • [claimed-docs] “Credentials are scoped to an authenticated instruction: retrieval is POST /acp/v1/instructions/{instructionID}/credentials, and the request …”
   • [community] “The Visa/Mastercard announcements are interesting but feel premature. The missing piece is standardized agent identity and capability declar…”

   proof ↗⚑ flag

7. ai-native userBuild against official SDKs

   weight 2 · round to Visa Intelligent Commerce
   Shopify Agentic Commerce~partialprobed6/10

   Shopify provides official developer tooling for agentic commerce — the `@shopify/ucp-cli`, UCP-compliant MCP servers (Catalog, Cart, Checkout, Order), profile/negotiation docs, and an AI Toolkit that validates GraphQL/Liquid/Extensions — all documented with schemas and confirmed live via runtime probes. However, this is CLI/MCP/JSON-RPC tooling rather than a conventional language-specific SDK (e.g., a Python or JS client library) that an AI-native developer could import directly. Missing for 10: dedicated SDK packages/libraries beyond the CLI and MCP JSON-RPC interface, and independent third-party corroboration of SDK usability.

   • [claimed-docs] “Shopify's agent surface is UCP end to end via "Shopify's UCP-compliant MCP servers": the UCP CLI "provides structured commands to search the…”
   • [claimed-docs] “validate GraphQL queries, Liquid templates, and Shopify Extensions against Shopify schemas to catch issues earlier”
   • [claimed-docs] “"The Global Catalog MCP server enables AI agents to search and discover products across the entire Shopify ecosystem, helping buyers find pr…”
   • [claimed-docs] “"Cart tools accept unauthenticated requests, which lets you estimate totals and share a cart with the buyer before collecting credentials" —…”
   • [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”
   • [claimed-docs] “Initialize a local UCP profile.”

   proof ↗⚑ flag

   Visa Intelligent Commerce✓fullprobed8/10

   Visa documents official REST APIs (with concrete endpoints for enrollment, credential retrieval, purchase-intent mandates), an official MCP server (published on npm as @visaacceptance/mcp with a GitHub repo), and an open-source Trusted Agent Protocol reference implementation, giving AI-native developers multiple official SDK/tooling surfaces to build against. Missing for 10: dedicated language-specific SDKs (Python/Node/Java client libraries) beyond the MCP/toolkit and REST docs, and independent third-party corroboration of SDK developer experience.

   • [claimed-docs] “Developers can now connect to Visa Intelligent Commerce APIs through the MCP Server, making it faster and easier for builders to bring intel…”
   • [claimed-docs] “It offers a specialized set of tools designed to help you manage invoices, create payment links, and perform other Visa Acceptance-related o…”
   • [probe] “official MCP server documented at https://github.com/visaacceptance/agent-toolkit”
   • [probe] “PROBE runtime (recorded 2026-09-14): Visa's developer gateway is live and credential-gated exactly as documented — a keyless GET to https://…”
   • [claimed-docs] “Spend caps live in the purchase-intent mandate: Initiate a Purchase Intent (POST /acp/v1/instructions) exists "to verify that your agent is …”
   • [claimed-docs] “Credentials are scoped to an authenticated instruction: retrieval is POST /acp/v1/instructions/{instructionID}/credentials, and the request …”
   • [claimed-docs] “The TAP spec is public with a runnable reference implementation: "Establishing a universal standard of trust between AI agents and merchants…”

   proof ↗⚑ flag

8. ai-native userSubscribe to events via webhooks

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce~partialclaimed5/10

   Shopify does deliver order webhooks — UCP-shaped payloads pushed to a registered endpoint on committed order changes, HMAC-signed and retried — but the subscription mechanism itself is not agent-native: 'There's no self-serve subscription API today... contact your Shopify partner manager,' and although the UCP profile spec allows agents to declare a webhook_url, 'Shopify doesn't honor that field today.' This means an AI-native user cannot programmatically subscribe/register for webhook events themselves — it requires a manual, human, out-of-band process, undercutting the 'agentic' self-serve subscription story. missing for 10: self-serve/programmatic webhook subscription API, honoring the agent-declared webhook_url in the UCP profile, and any evidence of agent-driven (not partner-manager-mediated) event subscription.

   • [claimed-docs] “Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change”
   • [claimed-docs] “"Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (fu…”
   • [claimed-docs] “Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (ful…”

   proof ↗⚑ flag

   Visa Intelligent Commerce—none0/10

   The evidence pack describes payment instructions, tokenization, mandates, and the Trusted Agent Protocol, but nowhere documents a webhook subscription mechanism for AI agents to receive event notifications. The closest mention, 'Confirm payment outcomes and trigger post-purchase actions in real-time' (visa-intelligent-commerce-docs-5), does not specify webhooks or any pub/sub API.

   ⚑ flag

Agentic features

1. ai-native userSet up automations that run autonomously in the background

   weight 2 · round to Visa Intelligent Commerce
   Shopify Agentic Commerce~partialclaimed4/10

   UCP's trust-tier model lets Token-tier agents call complete_checkout autonomously once granted permission, and order webhooks push background state updates to a registered endpoint without polling — both hint at unattended, background-capable agent operation. But there is no documented feature for an AI-native user to configure a scheduled or trigger-based automation (e.g., recurring reorders, price-watch, monitor-and-act loops) that runs unsupervised over time; the evidence only covers per-session agent tool calls (search/cart/checkout/order) and merchant-side webhook delivery, not user-configurable autonomous background jobs. Missing for 10: explicit scheduling/trigger mechanism, evidence of a persistent background agent process, and independent confirmation of real autonomous (no-human-in-loop) purchase completion.

   • [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
   • [claimed-docs] “"UCP traffic to Shopify's MCP servers is classified into three tiers based on how your agent identifies itself" — Token, Signed, Anonymous —…”
   • [claimed-docs] “"Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (fu…”
   • [claimed-docs] “Buyer handoff is a first-class state: "Build for escalations regardless of how you authenticate." A checkout in requires_escalation means "C…”

   proof ↗⚑ flag

   Visa Intelligent Commerce~partialclaimed5/10

   Visa Intelligent Commerce provides the payment-authorization infrastructure (mandates, spend caps, tokens, passkey-anchored consent) that enables agents to transact autonomously within user-set limits, and the purchase-intent mandate mechanism (decline thresholds, effectiveUntilTime) supports background/recurring authorization without per-transaction human sign-off. However, this is a payments-rail product, not an automation/scheduling platform — there's no evidence of the product itself offering a UI or API for users to configure recurring/background 'automations' (e.g., scheduled tasks, triggers, workflows) beyond the payment-instruction mandate; that capability lives in whatever agent/orchestrator integrates with Visa's APIs. missing for 10: first-party evidence of an automation/scheduling interface for background-running tasks, independent hands-on confirmation of autonomous mandate execution in production, and clarity on how recurring (not just one-off) purchase intents are managed.

   • [claimed-docs] “Spend caps live in the purchase-intent mandate: Initiate a Purchase Intent (POST /acp/v1/instructions) exists "to verify that your agent is …”
   • [claimed-docs] “Human approval is passkey-anchored end to end: provisioning includes "step up verification of the cardholder as well as setting up a Passkey…”
   • [claimed-docs] “Capture consumer consent, set spending limits, and manage mandates for agent-initiated payments.”
   • [claimed-docs] “Agent-scoped credentials are the core primitive: "Provisioning and life cycle management of agent-specific payment tokens that can be used b…”

   proof ↗⚑ flag

2. ai-native userOperate the product with natural-language commands

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce✓fullprobed7/10

   Shopify's UCP stack is explicitly designed so a natural-language request to an AI assistant ('find me crewneck sweaters under $50') is mapped by a skill/plugin to the right structured UCP CLI/MCP command, and runtime probes confirm the underlying MCP catalog/cart tools actually work end-to-end (search, cart creation) via the CLI with a local profile. Missing for 10: independent third-party evidence of a user issuing free-form natural-language commands (only one first-party doc line makes this claim) and no evidence of NL support beyond the catalog-search example (checkout/order flows are shown as structured CLI/MCP calls, not demonstrated NL-driven).

   • [claimed-docs] “Ask your assistant in natural language ("find me crewneck sweaters under $50") and the skill picks the right UCP CLI command”
   • [claimed-docs] “the CLI provides structured commands to search the Catalog, build carts, create checkouts, hand off buyers, and track orders”
   • [claimed-docs] “Shopify's agent surface is UCP end to end via "Shopify's UCP-compliant MCP servers": the UCP CLI "provides structured commands to search the…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”
   • [probe] “PROBE runtime (recorded 2026-09-14): Shopify's Global Catalog MCP server is live — a keyless JSON-RPC initialize POST to https://catalog.sho…”

   proof ↗⚑ flag

   Visa Intelligent Commerce~partialprobed6/10

   The Visa Acceptance Agent Toolkit (MCP server) is documented as letting 'developers and non-technical users work with AI agents using plain language — no coding required,' and probes confirm the toolkit is a real, published npm package with an MCP server rather than just a marketing claim. However, natural-language operation is really mediated through AI agents (e.g., Claude/ChatGPT) calling the toolkit's tools, not a native NL interface Visa itself ships, and there's no independent hands-on report of a user issuing plain-language commands successfully. Missing for 10: independent/hands-on demonstration of NL command usage, and clarity on how much of the NL experience is Visa-built vs. reliant on third-party agent UIs.

   • [claimed-docs] “the toolkit helps developers and non-technical users to work with AI agents using plain language — no coding required.”
   • [claimed-docs] “It offers a specialized set of tools designed to help you manage invoices, create payment links, and perform other Visa Acceptance-related o…”
   • [claimed-docs] “Developers can now connect to Visa Intelligent Commerce APIs through the MCP Server, making it faster and easier for builders to bring intel…”
   • [probe] “official MCP server documented at https://github.com/visaacceptance/agent-toolkit”
   • [probe] “PROBE runtime (recorded 2026-09-14): Visa's developer gateway is live and credential-gated exactly as documented — a keyless GET to https://…”

   proof ↗⚑ flag

Api quality

1. ai-native userExplore an interactive API reference with runnable examples

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce~partialprobed4/10

   Shopify's UCP docs provide a step-by-step quickstart with real, copy-pasteable CLI commands that run the full discovery→cart→checkout→order flow, and MCP tools are self-describing (agents can fetch live input schemas via `--input-schema`), which gives AI-native users a way to explore and run real examples against live endpoints (confirmed by runtime probes actually executing search/cart calls). However, there is no dedicated interactive API-reference surface — probes explicitly found no OpenAPI/Swagger spec and no llms.txt at shopify.dev (404s), so there's no Postman/Swagger-style 'try it' reference page, only linear docs plus CLI/MCP introspection. Missing for 10: a dedicated interactive API-reference UI (OpenAPI/Swagger explorer or embedded try-it-now widgets), and independent hands-on confirmation that non-CLI docs pages let users run examples inline.

   • [claimed-docs] “This quickstart runs the full agentic commerce flow with the UCP CLI, from product discovery to order tracking, in about five minutes.”
   • [claimed-docs] “"The Storefront Catalog MCP server enables AI agents to search and discover products from a single merchant's catalog, helping buyers find a…”
   • [probe] “PROBE runtime (recorded 2026-09-14): Shopify's Global Catalog MCP server is live — a keyless JSON-RPC initialize POST to https://catalog.sho…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”
   • [probe] “PROBE llms.txt: HTTP 404 at https://shopify.dev/llms.txt”
   • [probe] “PROBE openapi: all candidate paths 404 (https://shopify.dev/openapi.json, https://shopify.dev/swagger.json, https://shopify.dev/api/openapi.…”

   proof ↗⚑ flag

   Visa Intelligent Commerce—none0/10

   Evidence shows detailed REST endpoint documentation with sample JSON payloads (mandates, enroll-card, retrieve-credentials) and a separate sandbox signup form for sending test transactions, but nothing describes an interactive API reference (e.g., a Swagger/Postman-style 'try it' console) where examples can be run directly from the docs page. missing for 10: an interactive/try-it-now console embedded in API docs, evidence of one-click runnable code samples, any UI screenshot or independent report of in-docs execution.

   • [claimed-docs] “Spend caps live in the purchase-intent mandate: Initiate a Purchase Intent (POST /acp/v1/instructions) exists "to verify that your agent is …”
   • [claimed-docs] “"Your agents can enroll a customer's card for tokenization during the customer's account registration or when the customer begins a new purc…”
   • [claimed-docs] “Credentials are scoped to an authenticated instruction: retrieval is POST /acp/v1/instructions/{instructionID}/credentials, and the request …”
   • [claimed-docs] “Merchant-side onboarding starts with a self-serve "Intelligent Commerce Sandbox Sign up" form (Organization ID, company, contact details, te…”
   • [probe] “PROBE llms.txt: HTTP 200 at https://developer.visaacceptance.com/llms.txt # VisaAcceptance Developer Center > This developer documentation …”

   proof ↗⚑ flag

2. ai-native userDownload a machine-readable API spec (OpenAPI or equivalent)

   weight 2 · round to Visa Intelligent Commerce
   Shopify Agentic Commerce~partialprobed4/10

   There's no downloadable OpenAPI/Swagger file — a direct probe found openapi.json, swagger.json, and similar candidate paths all 404 — but the underlying protocol is machine-readable in other ways: MCP servers expose live input schemas agents can introspect at runtime (--input-schema) and the UCP protocol itself has a published, versioned technical specification with reference implementations in a public GitHub repo (ucp.dev/llms.txt). missing for 10: an actual OpenAPI/JSON-Schema-equivalent document downloadable in one shot, and confirmation that the GitHub spec repo is machine-readable in OpenAPI-equivalent form rather than prose/markdown protocol docs.

   • [probe] “PROBE openapi: all candidate paths 404 (https://shopify.dev/openapi.json, https://shopify.dev/swagger.json, https://shopify.dev/api/openapi.…”
   • [claimed-docs] “"The Storefront Catalog MCP server enables AI agents to search and discover products from a single merchant's catalog, helping buyers find a…”
   • [claimed-docs] “ucp.dev positions the protocol as industry-governed rather than single-vendor: "UCP is built by the industry, to enable seamless agentic exp…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the Universal Commerce Protocol spec is published in the open — https://ucp.dev/llms.txt serves the ver…”

   proof ↗⚑ flag

   Visa Intelligent Commerce~partialprobed6/10

   Visa documents concrete REST endpoints (e.g., POST /acp/v1/instructions, /acp/v1/tokens, /acp/v1/instructions/{id}/credentials) with detailed field-level specs, an MCP server, and an llms.txt-served developer portal, indicating machine-readable interfaces exist, but no evidence explicitly confirms a downloadable OpenAPI/Swagger spec file. missing for 10: an explicit OpenAPI/Swagger JSON or YAML artifact, a documented download link or spec generation endpoint, independent confirmation the spec is machine-parseable rather than just REST prose docs.

   • [claimed-docs] “Spend caps live in the purchase-intent mandate: Initiate a Purchase Intent (POST /acp/v1/instructions) exists "to verify that your agent is …”
   • [claimed-docs] “"Your agents can enroll a customer's card for tokenization during the customer's account registration or when the customer begins a new purc…”
   • [claimed-docs] “Credentials are scoped to an authenticated instruction: retrieval is POST /acp/v1/instructions/{instructionID}/credentials, and the request …”
   • [probe] “PROBE llms.txt: HTTP 200 at https://developer.visaacceptance.com/llms.txt # VisaAcceptance Developer Center > This developer documentation …”
   • [claimed-docs] “Developers can now connect to Visa Intelligent Commerce APIs through the MCP Server, making it faster and easier for builders to bring intel…”

   proof ↗⚑ flag

3. ai-native userTest against a sandbox environment without touching production data

   weight 1 · round to Visa Intelligent Commerce
   Shopify Agentic Commerce—none0/10

   No evidence pack item describes a dedicated sandbox/test environment for UCP agent development; the only relevant runtime probe shows testing being done directly against a live production Shopify store ('a REAL cart was created keylessly on Shopify's own hardware store'), not a sandbox. No test-mode flag, dev store, or mock UCP endpoint is documented anywhere in the pack.

   • [probe] “PROBE runtime (recorded 2026-09-14): a REAL cart was created keylessly on Shopify's own hardware store through the UCP protocol — @shopify/u…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a Shopify-operated storefront's own UCP endpoint is live — a keyless JSON-RPC initialize POST to https:…”

   proof ↗⚑ flag

   Visa Intelligent Commerce✓fullclaimed8/10

   Visa documents a dedicated sandbox: a self-serve 'Intelligent Commerce Sandbox Sign up' form that lets developers 'send test transactions,' separate test endpoints (https://apitest.visaacceptance.com vs production https://api.visaacceptance.com), and explicit fee terms stating 'Free to use in Sandbox. Contact Visa for fees in Production.' This directly satisfies testing without touching production data or paying production fees. Missing for 10: independent/hands-on confirmation that the sandbox behaves as documented (no third-party report of actually using it), and no detail on sandbox data reset/isolation guarantees.

   • [claimed-docs] “Merchant-side onboarding starts with a self-serve "Intelligent Commerce Sandbox Sign up" form (Organization ID, company, contact details, te…”
   • [claimed-docs] “Fees, verbatim from FEES & TERMS: "Free to use in Sandbox. Contact Visa for fees in Production." On refunds/disputes the docs stop at eviden…”
   • [claimed-docs] “"Your agents can enroll a customer's card for tokenization during the customer's account registration or when the customer begins a new purc…”

   proof ↗⚑ flag

4. ai-native userRely on versioned APIs with a documented deprecation policy

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce~partialprobed4/10

   Evidence shows real API versioning (protocol version headers like x-shopify-ucp-mcp-api-version: 2026-08-25, dated UCP spec releases on ucp.dev, and profile negotiation based on 'the protocol version and capabilities the platform supports'), which supports the 'versioned APIs' half of the story. However, no evidence anywhere describes a documented deprecation policy, sunset timelines, or backward-compatibility guarantees for older versions. Missing for 10: explicit deprecation/sunset policy documentation, version-support lifecycle commitments, migration guidance between dated versions.

   • [probe] “PROBE runtime (recorded 2026-09-14): Shopify's Global Catalog MCP server is live — a keyless JSON-RPC initialize POST to https://catalog.sho…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the Universal Commerce Protocol spec is published in the open — https://ucp.dev/llms.txt serves the ver…”
   • [claimed-docs] “In UCP, "a platform profile is a JSON document that describes the protocol version and capabilities the platform supports"; the business sid…”

   proof ↗⚑ flag

   Visa Intelligent Commerce~partialclaimed3/10

   API endpoints show explicit versioning (e.g., POST /acp/v1/instructions, /acp/v1/tokens) indicating a versioning scheme, but no evidence anywhere in the pack documents a deprecation policy, sunset timeline, or version-lifecycle commitment for these APIs. missing for 10: documented deprecation/versioning policy, migration guidance between versions, changelog or version-lifecycle commitments.

   • [claimed-docs] “Spend caps live in the purchase-intent mandate: Initiate a Purchase Intent (POST /acp/v1/instructions) exists "to verify that your agent is …”
   • [claimed-docs] “"Your agents can enroll a customer's card for tokenization during the customer's account registration or when the customer begins a new purc…”
   • [claimed-docs] “Credentials are scoped to an authenticated instruction: retrieval is POST /acp/v1/instructions/{instructionID}/credentials, and the request …”

   proof ↗⚑ flag

1. ai-native userPerform bulk operations across many items at once

   weight 2 · round drawn
   Shopify Agentic Commerce—none0/10

   The evidence describes single-item/cart-at-a-time flows (search, build a cart, checkout, track one order) and catalog pagination for browsing, but nothing documents a bulk operation primitive — e.g., adding many items to a cart in one call, batch checkout, or bulk order management — for an AI agent to act on many items at once.

   ⚑ flag

   Visa Intelligent Commerce—none0/10

   The evidence describes per-transaction flows (single card enrollment, single purchase-intent mandate, single credential retrieval, single invoice/payment link creation) with no mention of batch or bulk APIs for processing many items/transactions at once. While bulk operations are a plausible axis for a commerce/payments platform, there is no documentation of batch enrollment, bulk credential issuance, or multi-item transaction processing.

   • [claimed-docs] “It offers a specialized set of tools designed to help you manage invoices, create payment links, and perform other Visa Acceptance-related o…”
   • [claimed-docs] “Spend caps live in the purchase-intent mandate: Initiate a Purchase Intent (POST /acp/v1/instructions) exists "to verify that your agent is …”
   • [claimed-docs] “"Your agents can enroll a customer's card for tokenization during the customer's account registration or when the customer begins a new purc…”
   • [claimed-docs] “Credentials are scoped to an authenticated instruction: retrieval is POST /acp/v1/instructions/{instructionID}/credentials, and the request …”

   proof ↗⚑ flag

2. ai-native userDefine rules that trigger actions automatically on events

   weight 3 · round to Visa Intelligent Commerce
   Shopify Agentic Commerce~partialclaimed3/10

   Shopify's UCP order webhooks push event notifications (fulfillment, refunds, cancellations) to a registered endpoint whenever a committed change occurs, giving a basic event-trigger backbone, but there is no evidence of an actual rules/automation engine where an AI-native user declares conditional logic ("if X then do Y") that Shopify executes on their behalf. Missing for 10: a rule-definition interface or automation engine, support for triggers beyond order state changes, and any evidence of user-authored conditional actions rather than raw webhook delivery.

   • [claimed-docs] “"Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (fu…”
   • [claimed-docs] “Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change”
   • [claimed-docs] “Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (ful…”

   proof ↗⚑ flag

   Visa Intelligent Commerce~partialclaimed5/10

   Visa Intelligent Commerce lets users set mandate-based rules such as decline thresholds, expiry times, and consumer prompts that constrain agent-initiated purchases, and documents automatic post-purchase actions triggered on payment confirmation events. This is rule-based automation but scoped narrowly to payment authorization and consent, not a general event-trigger-action framework a user can freely define. missing for 10: broader event types beyond payment confirmation, arbitrary custom action definitions beyond spend caps and expiry, independent evidence of the rule engine executing complex conditional logic

   • [claimed-docs] “Confirm payment outcomes and trigger post-purchase actions in real-time.”
   • [claimed-docs] “Human approval is passkey-anchored end to end: provisioning includes "step up verification of the cardholder as well as setting up a Passkey…”
   • [claimed-docs] “Spend caps live in the purchase-intent mandate: Initiate a Purchase Intent (POST /acp/v1/instructions) exists "to verify that your agent is …”

   proof ↗⚑ flag

Fees transparency

1. merchantThe fees for agent-originated transactions are published — I can price agentic channels without asking sales

   weight 2 · round drawn
   Shopify Agentic Commerce—none0/10

   The evidence pack thoroughly documents UCP's technical architecture (catalog, cart, checkout, orders, trust tiers) but contains no mention of transaction fees, take rates, commission percentages, or pricing terms for agent-originated sales — nothing addresses what a merchant would pay for agentic-channel transactions.

   ⚑ flag

   Visa Intelligent Commerce—none0/10

   Visa's own documentation states fees are 'Free to use in Sandbox. Contact Visa for fees in Production' — meaning production pricing is explicitly not published and requires contacting Visa directly, the opposite of the story's ask for a self-serve published rate card.

   • [claimed-docs] “Fees, verbatim from FEES & TERMS: "Free to use in Sandbox. Contact Visa for fees in Production." On refunds/disputes the docs stop at eviden…”

   proof ↗⚑ flag

Payouts

1. merchantAgent-originated payments settle through documented payout and reporting flows, reconcilable like any other channel

   weight 1 · round to Visa Intelligent Commerce
   Shopify Agentic Commerce—none0/10

   The evidence documents order creation, checkout/payment completion, order-state webhooks, and get_order reconciliation of order state, but nothing addresses payout, settlement, or financial reporting flows that let a merchant reconcile agent-originated revenue against other channels (no mention of payout reports, settlement schedules, or accounting/export integration). Since payout/reporting reconciliation is a normal, fair expectation for any commerce channel with real payments, this axis applies but is unaddressed in the pack.

   ⚑ flag

   Visa Intelligent Commerce~partialclaimed4/10

   Visa Intelligent Commerce documents authorization, tokenization, mandates, and dispute-relevant 'commerce signals' capture, and notes settlement/IOU concepts in TAP, but there is no documented merchant payout/settlement schedule, reconciliation file/report format, or statement-level breakdown distinguishing agent-originated transactions from other channels — it's treated as a standard card-rail authorization with evidence signals for disputes, not a distinct reconciliable payout flow. missing for 10: documented payout/settlement cadence, merchant reconciliation reports or statement descriptors specific to agent transactions, dispute/chargeback API (vs. just evidence capture), independent merchant confirmation of reconciling agent payments like other channels.

   • [claimed-docs] “Spend caps live in the purchase-intent mandate: Initiate a Purchase Intent (POST /acp/v1/instructions) exists "to verify that your agent is …”
   • [claimed-docs] “Credentials are scoped to an authenticated instruction: retrieval is POST /acp/v1/instructions/{instructionID}/credentials, and the request …”
   • [claimed-docs] “TAP's signed Agentic Payment Container adapts to the merchant's rail: for guest-checkout key entry it carries a credential hash — "If the ha…”
   • [claimed-docs] “Fees, verbatim from FEES & TERMS: "Free to use in Sandbox. Contact Visa for fees in Production." On refunds/disputes the docs stop at eviden…”

   proof ↗⚑ flag

Attribution analytics

1. merchantOrders are attributed to the originating agent and I can report on or filter transactions by agent

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce~partialclaimed5/10

   Cart/checkout objects carry explicit agent-attribution metadata (referring_domain, click_id_tag, activity_id, utm_* fields) and orders are tied to a specific agent's UCP profile via checkout creation, giving Shopify the raw data needed to attribute orders to an agent. However, there is no evidence of a merchant-facing report, analytics dashboard, or order-list filter that lets a merchant actually query or segment transactions by originating agent — only developer-facing MCP/webhook data plumbing is documented. Missing for 10: merchant admin UI or reporting API to filter/segment orders by agent, aggregate agent-performance analytics, independent confirmation that attribution data surfaces in Shopify's order admin.

   • [claimed-docs] “"Cart tools accept unauthenticated requests, which lets you estimate totals and share a cart with the buyer before collecting credentials" —…”
   • [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
   • [claimed-docs] “"Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (fu…”
   • [claimed-docs] “"The Order MCP server enables AI agents to fetch the current state of an order placed through their agent, including line items, fulfillment…”
   • [claimed-docs] “In UCP, "a platform profile is a JSON document that describes the protocol version and capabilities the platform supports"; the business sid…”

   proof ↗⚑ flag

   Visa Intelligent Commerce~partialclaimed4/10

   Visa Intelligent Commerce provides agent-scoped tokens, TAP signatures identifying an agent per interaction, and commerce-signal capture for dispute resolution, which implies some technical basis for attributing a transaction to an agent, but there is no documented merchant-facing reporting/dashboard feature or API to filter or report transactions specifically by agent identity. missing for 10: a merchant reporting/analytics dashboard or API endpoint that lets merchants filter/query transactions by agent identifier, explicit documentation of agent-ID fields surfaced in settlement/reporting data, and independent evidence merchants actually use this for reporting.

   • [claimed-docs] “The Trusted Agent Protocol's agent recognition signature is HTTP Message Signatures "defined by RCF 9421" (typo in original), "aligned with …”
   • [claimed-docs] “The TAP spec is public with a runnable reference implementation: "Establishing a universal standard of trust between AI agents and merchants…”
   • [claimed-docs] “Fees, verbatim from FEES & TERMS: "Free to use in Sandbox. Contact Visa for fees in Production." On refunds/disputes the docs stop at eviden…”
   • [claimed-docs] “Agent-scoped credentials are the core primitive: "Provisioning and life cycle management of agent-specific payment tokens that can be used b…”

   proof ↗⚑ flag

Onboarding to agents

1. merchantI have a documented self-serve path to start accepting agent traffic — enable a setting, sign an agreement, or publish an endpoint

   weight 3 · round to Visa Intelligent Commerce
   Shopify Agentic Commerce~partialprobed5/10

   Docs show every UCP-enabled storefront automatically exposes a /api/ucp/mcp endpoint and a merchant publishes a UCP profile at {shop}.myshopify.com/.well-known/ucp for capability negotiation — that's a documented, quasi-self-serve publishing path, and probes confirm live merchant endpoints exist. But the pack explicitly contradicts full self-serve: order webhook subscription is 'not self-serve... contact your Shopify partner manager,' and there is no merchant-facing admin setting or signed agreement flow described (all guidance is developer/CLI-facing, not merchant-console-facing). missing for 10: a merchant-admin toggle/setting in Shopify admin UI, an explicit merchant agreement/terms step, and self-serve webhook registration (currently manual via partner manager).

   • [claimed-docs] “In UCP, "a platform profile is a JSON document that describes the protocol version and capabilities the platform supports"; the business sid…”
   • [claimed-docs] “"Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (fu…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a Shopify-operated storefront's own UCP endpoint is live — a keyless JSON-RPC initialize POST to https:…”
   • [claimed-docs] “Negotiation is server-selects. The business computes the intersection of its capabilities with the platform's and chooses the active set”

   proof ↗⚑ flag

   Visa Intelligent Commerce~partialclaimed7/10

   Visa documents a genuine self-serve onboarding flow: a public 'Intelligent Commerce Sandbox Sign up' form with terms acceptance that immediately unlocks test transactions (visa-ic-supp-10), plus an open, publishable Trusted Agent Protocol reference implementation merchants can deploy to declare/verify agent traffic (visa-ic-supp-9, visa-intelligent-commerce-gh-1/2). However, production enablement is explicitly gated — 'Contact Visa for fees in Production' (visa-ic-supp-8) — meaning the fully self-serve path only covers sandbox/dev, not live acceptance. Missing for 10: a documented self-serve production activation step (no sales contact), and independent merchant confirmation that the sandbox-to-production path works without manual Visa involvement.

   • [claimed-docs] “Merchant-side onboarding starts with a self-serve "Intelligent Commerce Sandbox Sign up" form (Organization ID, company, contact details, te…”
   • [claimed-docs] “The TAP spec is public with a runnable reference implementation: "Establishing a universal standard of trust between AI agents and merchants…”
   • [github] “By presenting a secure digital signature with every interaction, a merchant can verify that an agent is legitimate and has the user's permis…”
   • [github] “This allows you to confidently welcome agent-driven commerce while protecting your site from harmful bots.”
   • [claimed-docs] “Fees, verbatim from FEES & TERMS: "Free to use in Sandbox. Contact Visa for fees in Production." On refunds/disputes the docs stop at eviden…”

   proof ↗⚑ flag

Traffic controls

1. merchantRate-limit, allow, or deny specific agents and agent platforms accessing my catalog and checkout

   weight 2 · round to Visa Intelligent Commerce
   Shopify Agentic Commerce~partialclaimed3/10

   Shopify's UCP documents a platform-wide trust-tier system (Token/Signed/Anonymous) where 'rate limits scale with identification' and certain tools (like complete_checkout or Order MCP) are gated to higher trust tiers, which provides some rate-limiting infrastructure. However, this is a Shopify-controlled protocol mechanism based on identification strength, not a merchant-facing dashboard/setting to specifically allow, deny, or rate-limit named agents or agent platforms (e.g. blocking 'Agent X' or 'Platform Y' by name). Missing for 10: merchant-configurable allow/deny lists for specific agents/platforms, merchant UI or API to set custom rate limits per agent, and any evidence of per-merchant policy enforcement beyond the global trust-tier scheme.

   • [claimed-docs] “"UCP traffic to Shopify's MCP servers is classified into three tiers based on how your agent identifies itself" — Token, Signed, Anonymous —…”
   • [claimed-docs] “In UCP, "a platform profile is a JSON document that describes the protocol version and capabilities the platform supports"; the business sid…”
   • [claimed-docs] “"The Order MCP server enables AI agents to fetch the current state of an order placed through their agent, including line items, fulfillment…”

   proof ↗⚑ flag

   Visa Intelligent Commerce~partialclaimed5/10

   Trusted Agent Protocol gives merchants a way to cryptographically verify agent legitimacy, distinguish credentialed agents from anonymous bots via an agent-registry, and reject stale/replayed signed requests, which supports an allow/deny posture at checkout. However there is no documented merchant-facing control for rate-limiting specific agents or blocking by agent platform/brand — the evidence is about identity verification and anti-bot protection, not policy-based throttling or platform-level allow/deny lists. missing for 10: explicit rate-limiting mechanism, per-platform allow/deny configuration UI or API, documented throttling/quota controls.

   • [github] “By presenting a secure digital signature with every interaction, a merchant can verify that an agent is legitimate and has the user's permis…”
   • [github] “This allows you to confidently welcome agent-driven commerce while protecting your site from harmful bots.”
   • [claimed-docs] “The Trusted Agent Protocol's agent recognition signature is HTTP Message Signatures "defined by RCF 9421" (typo in original), "aligned with …”
   • [claimed-docs] “The TAP spec is public with a runnable reference implementation: "Establishing a universal standard of trust between AI agents and merchants…”

   proof ↗⚑ flag

1. ai-native userRead the product's source under an open license

   weight 2 · round to Visa Intelligent Commerce
   Shopify Agentic Commerce—none0/10

   Evidence shows the UCP protocol specification and reference implementations are published openly on GitHub, but this is the industry-wide protocol spec (ucp.dev), not Shopify's own Agentic Commerce product source code, servers, or CLI implementation. No citation shows Shopify's actual MCP server/checkout implementation, storefront code, or platform source is released under an open license.

   ⚑ flag

   Visa Intelligent Commerce~partialprobed4/10

   Visa Intelligent Commerce itself (the core enrollment/token/mandate platform) is a closed, proprietary financial service with no source release, but the related Trusted Agent Protocol spec and reference implementation, plus the agent-toolkit, are published openly on GitHub with a runnable sample ecosystem (agent-registry, cdn-proxy, merchant-backend, tap-agent). This only covers peripheral protocol/toolkit components, not the core Intelligent Commerce platform's own source. Missing for 10: an explicit open-source license grant for the core Intelligent Commerce platform itself, not just the TAP spec/toolkit sidecars.

   • [probe] “PROBE runtime (recorded 2026-09-14): the Trusted Agent Protocol is published in the open — https://raw.githubusercontent.com/visa/trusted-ag…”
   • [claimed-docs] “The TAP spec is public with a runnable reference implementation: "Establishing a universal standard of trust between AI agents and merchants…”
   • [github] “By presenting a secure digital signature with every interaction, a merchant can verify that an agent is legitimate and has the user's permis…”
   • [claimed-docs] “It offers a specialized set of tools designed to help you manage invoices, create payment links, and perform other Visa Acceptance-related o…”

   proof ↗⚑ flag

Order events

1. developerMy agent or backend can subscribe to order lifecycle events — created, updated, fulfilled, canceled — pushed programmatically

   weight 3 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce~partialclaimed5/10

   Shopify does push full, HMAC-signed UCP-shaped order webhooks (created/updated/fulfilled/canceled/refunded etc.) with retry logic, so lifecycle events are indeed pushed programmatically once configured. However the same documentation states subscription itself is not self-serve — 'There's no self-serve subscription API today: your delivery URL and topic scoping are registered server-side... contact your Shopify partner manager' — and the UCP profile's webhook_url field, meant to let agents declare their endpoint programmatically, 'Shopify doesn't honor that field today.' This is a first-party documented limitation (not an external dispute) directly undercutting the 'programmatically subscribe' part of the story. missing for 10: a self-serve/programmatic subscription or registration API, honoring of the webhook_url profile field, and independent/hands-on confirmation of webhook delivery in production.

   • [claimed-docs] “Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change”
   • [claimed-docs] “"Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (fu…”
   • [claimed-docs] “Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (ful…”

   proof ↗⚑ flag

   Visa Intelligent Commerce—none0/10

   Evidence covers card enrollment, credential/token retrieval, purchase-intent mandates, and Trusted Agent Protocol signing, but no documentation of a webhook or event-subscription API for order lifecycle states (created/updated/fulfilled/canceled) pushed to developer systems — only a vague mention of confirming payment outcomes and triggering post-purchase actions, without any subscription mechanism.

   • [claimed-docs] “Confirm payment outcomes and trigger post-purchase actions in real-time.”
   • [claimed-docs] “Spend caps live in the purchase-intent mandate: Initiate a Purchase Intent (POST /acp/v1/instructions) exists "to verify that your agent is …”
   • [claimed-docs] “Fees, verbatim from FEES & TERMS: "Free to use in Sandbox. Contact Visa for fees in Production." On refunds/disputes the docs stop at eviden…”

   proof ↗⚑ flag

Post purchase status

1. ai-native userMy agent can query the status and tracking of an order it placed, after the purchase

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce✓fullclaimed8/10

   Order MCP's get_order explicitly returns current order state (line items, fulfillment events, post-purchase adjustments) for orders placed via the agent, complemented by push order webhooks for tracking updates, and this is documented with concrete access/scope details (Token-tier, read_global_api_orders scope). The quickstart even walks through discovery-to-order-tracking as a first-party flow. Missing for 10: independent/third-party hands-on confirmation of get_order in production (only first-party docs/probes), and no evidence of consumer-facing tracking UI beyond the API/webhook mechanism.

   • [claimed-docs] “enables AI agents to fetch the current state of an order placed through their agent, including line items, fulfillment events, and post-purc…”
   • [claimed-docs] “"The Order MCP server enables AI agents to fetch the current state of an order placed through their agent, including line items, fulfillment…”
   • [claimed-docs] “"Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (fu…”
   • [claimed-docs] “This quickstart runs the full agentic commerce flow with the UCP CLI, from product discovery to order tracking, in about five minutes.”
   • [claimed-docs] “Help customers track orders, manage returns, and access their account information.”

   proof ↗⚑ flag

   Visa Intelligent Commerce—none0/10

   Visa Intelligent Commerce's documented post-purchase capabilities cover confirming payment outcomes, triggering post-purchase actions, and collecting signals for dispute resolution, but there is no evidence of an API or capability letting an agent query order status or shipment/tracking information after a purchase — that is fulfillment/logistics data outside Visa's payment-rail scope as documented. missing for 10: any order-status/tracking query endpoint, evidence of integration with merchant fulfillment/tracking data, or documentation describing post-purchase order lifecycle visibility for agents.

   • [claimed-docs] “Confirm payment outcomes and trigger post-purchase actions in real-time.”
   • [claimed-docs] “Fees, verbatim from FEES & TERMS: "Free to use in Sandbox. Contact Visa for fees in Production." On refunds/disputes the docs stop at eviden…”

   proof ↗⚑ flag

Delegated credentials

1. ai-native userHand my agent a scoped, limited-use payment credential — amount limits, expiry, merchant restrictions — instead of a raw card number

   weight 3 · round to Visa Intelligent Commerce
   Shopify Agentic Commerce~partialclaimed4/10

   UCP references AP2 payment mandates as "cryptographically signed payment authorizations that are mathematically tied to the specific state of the cart" and verifiable credentials, plus short-lived (60-minute) JWT checkout tokens and Token-tier gating for complete_checkout — gesturing at scoped, non-raw-card credentials, but this describes protocol/session tokens for API access, not a user-issued payment instrument with explicit amount limits, expiry, and merchant restrictions handed to the agent. Missing for 10: concrete documentation of a user-facing scoped payment credential (spending caps, expiry dates, merchant allow-lists) rather than just agent-identity/session auth tokens, and no independent/hands-on evidence of this credential-issuance flow in practice.

   • [claimed-docs] “allows Platforms to provide cryptographically signed payment authorizations that are mathematically tied to the specific state of the cart”
   • [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
   • [claimed-docs] “"UCP traffic to Shopify's MCP servers is classified into three tiers based on how your agent identifies itself" — Token, Signed, Anonymous —…”
   • [claimed-docs] “ucp.dev positions the protocol as industry-governed rather than single-vendor: "UCP is built by the industry, to enable seamless agentic exp…”

   proof ↗⚑ flag

   Visa Intelligent Commerce✓fullclaimed9/10

   Extensive first-party docs describe exactly this: agent-specific pass-through payment tokens, purchase-intent mandates with declineThreshold amount/currency and effectiveUntilTime expiry, and credential retrieval requests scoped to a specific merchantName/merchant descriptor and amount — all gated behind passkey-authenticated user instructions. This directly matches 'scoped, limited-use credential with amount limits, expiry, merchant restrictions instead of raw card number.' missing for 10: independent third-party (non-Visa) hands-on confirmation that these scoped credentials work end-to-end in production rather than sandbox, since the product itself carries a documented maturity caveat.

   • [claimed-docs] “Agent-scoped credentials are the core primitive: "Provisioning and life cycle management of agent-specific payment tokens that can be used b…”
   • [claimed-docs] “Human approval is passkey-anchored end to end: provisioning includes "step up verification of the cardholder as well as setting up a Passkey…”
   • [claimed-docs] “Spend caps live in the purchase-intent mandate: Initiate a Purchase Intent (POST /acp/v1/instructions) exists "to verify that your agent is …”
   • [claimed-docs] “Credentials are scoped to an authenticated instruction: retrieval is POST /acp/v1/instructions/{instructionID}/credentials, and the request …”
   • [claimed-docs] “"Your agents can enroll a customer's card for tokenization during the customer's account registration or when the customer begins a new purc…”

   proof ↗⚑ flag

Settlement rails

1. developerSettle agent-initiated payments in stablecoins over documented rails

   weight 2 · round drawn
   Shopify Agentic Commerce—none0/10

   Evidence documents payment_handlers like com.google.pay, credit-card style checkout, and AP2/payment mandate concepts, but nowhere mentions stablecoins, crypto rails, or any stablecoin settlement path for agent-initiated payments. This is a documented gap, not a category mismatch, since UCP explicitly discusses payment handler negotiation and could plausibly include stablecoin rails.

   • [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
   • [claimed-docs] “ucp.dev positions the protocol as industry-governed rather than single-vendor: "UCP is built by the industry, to enable seamless agentic exp…”
   • [claimed-docs] “allows Platforms to provide cryptographically signed payment authorizations that are mathematically tied to the specific state of the cart”

   proof ↗⚑ flag

   Visa Intelligent Commerce—none0/10

   All evidence describes Visa Intelligent Commerce's card-network rails (tokenized cards, network tokens, VisaNet authorization, passkey-anchored mandates) — there is no mention anywhere of stablecoin settlement, crypto rails, or any non-card settlement currency. The axis applies to a payments product but no evidence supports stablecoin settlement specifically.

   • [claimed-docs] “Secure retrieval and management of network tokens, supporting seamless agentic commerce across multiple payment networks.”
   • [claimed-docs] “Agent-scoped credentials are the core primitive: "Provisioning and life cycle management of agent-specific payment tokens that can be used b…”
   • [claimed-docs] “Spend caps live in the purchase-intent mandate: Initiate a Purchase Intent (POST /acp/v1/instructions) exists "to verify that your agent is …”
   • [claimed-docs] “"Your agents can enroll a customer's card for tokenization during the customer's account registration or when the customer begins a new purc…”

   proof ↗⚑ flag

Wallets

1. ai-native userProvision a wallet my agent holds and spends from — funded and controlled by me, with balance visibility

   weight 3 · round to Visa Intelligent Commerce
   Shopify Agentic Commerce—none0/10

   Shopify's UCP evidence covers checkout, payment-handler negotiation (e.g., com.google.pay), and AP2 payment mandates/verifiable credentials tied to cart state, but there is no documentation of a user-funded, agent-held wallet construct with balance visibility — payment credentials are collected per-checkout, not provisioned as a standing wallet.

   • [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
   • [claimed-docs] “allows Platforms to provide cryptographically signed payment authorizations that are mathematically tied to the specific state of the cart”
   • [claimed-docs] “"UCP traffic to Shopify's MCP servers is classified into three tiers based on how your agent identifies itself" — Token, Signed, Anonymous —…”

   proof ↗⚑ flag

   Visa Intelligent Commerce~partialclaimed5/10

   Visa IC lets a consumer enroll/tokenize their card for agent use, set decline-threshold spend limits via mandates, and authenticate/control every agent payment instruction via Passkey — covering 'funded and controlled by me' reasonably well (visa-ic-supp-1, visa-ic-supp-2, visa-ic-supp-3, visa-ic-supp-4). But this is card-linkage/tokenization infrastructure, not a stored-value 'wallet' with its own balance, and there is no evidence of a balance-visibility feature for the end user or agent. Missing for 10: an actual funded wallet construct (vs. tokenized card-on-file), explicit balance-visibility UI/API, and independent confirmation beyond Visa's own docs.

   • [claimed-docs] “Agent-scoped credentials are the core primitive: "Provisioning and life cycle management of agent-specific payment tokens that can be used b…”
   • [claimed-docs] “Human approval is passkey-anchored end to end: provisioning includes "step up verification of the cardholder as well as setting up a Passkey…”
   • [claimed-docs] “Spend caps live in the purchase-intent mandate: Initiate a Purchase Intent (POST /acp/v1/instructions) exists "to verify that your agent is …”
   • [claimed-docs] “"Your agents can enroll a customer's card for tokenization during the customer's account registration or when the customer begins a new purc…”
   • [claimed-docs] “Capture consumer consent, set spending limits, and manage mandates for agent-initiated payments.”

   proof ↗⚑ flag

1. ai-native userControl data retention and deletion

   weight 2 · round drawn
   Shopify Agentic Commerce—none0/10

   The evidence pack covers UCP agent profiles, catalog/cart/checkout/order MCP servers, webhooks, and trust tiers, but nowhere describes any mechanism for an AI-native user to control retention or deletion of their data (e.g., profile data, cart history, order records) — no privacy/data-deletion API, retention policy, or opt-out control is documented.

   ⚑ flag

   Visa Intelligent Commerce—none0/10

   Visa Intelligent Commerce documents consent capture, mandates, spend caps, and even cancellation of a purchase intent, but none of the evidence addresses a user's ability to control data retention periods or request deletion of stored consumer data, tokens, or consent records. Revocation of a 'purchase intent' (visa-ic-supp-3) is a transactional control, not a data-retention/deletion mechanism, so the specific privacy-posture story is unaddressed.

   • [claimed-docs] “Spend caps live in the purchase-intent mandate: Initiate a Purchase Intent (POST /acp/v1/instructions) exists "to verify that your agent is …”
   • [claimed-docs] “Capture consumer consent, set spending limits, and manage mandates for agent-initiated payments.”
   • [claimed-docs] “Human approval is passkey-anchored end to end: provisioning includes "step up verification of the cardholder as well as setting up a Passkey…”

   proof ↗⚑ flag

Ecosystem adoption

1. developerAt least two independent parties beyond the vendor implement the protocol or platform — it is an ecosystem, not a private integration

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce✓fullprobed7/10

   UCP is documented as an industry-governed open standard rather than a Shopify-only integration: ucp.dev's co-developer wall names Google, Etsy, Wayfair, Target, Walmart, Amazon, Microsoft, Meta, Salesforce and Stripe as builders of the spec, with 'The complete technical specification, documentation, and reference implementations are hosted in our public GitHub repository' and versioned releases confirmed live via ucp.dev/llms.txt. Shopify itself ships a conformant implementation (catalog/cart/checkout/order MCP servers, verified live via runtime probes), demonstrating at least one non-founding-spec-author adopting the protocol. Missing for 10: independent, hands-on evidence that another named co-developer (e.g., Etsy, Walmart) has a live production UCP endpoint analogous to Shopify's, rather than just being listed as a spec co-author.

   • [claimed-docs] “ucp.dev positions the protocol as industry-governed rather than single-vendor: "UCP is built by the industry, to enable seamless agentic exp…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the Universal Commerce Protocol spec is published in the open — https://ucp.dev/llms.txt serves the ver…”
   • [probe] “PROBE runtime (recorded 2026-09-14): Shopify's Global Catalog MCP server is live — a keyless JSON-RPC initialize POST to https://catalog.sho…”
   • [probe] “PROBE runtime (recorded 2026-09-14): a Shopify-operated storefront's own UCP endpoint is live — a keyless JSON-RPC initialize POST to https:…”

   proof ↗⚑ flag

   Visa Intelligent Commerce—none0/10

   All evidence is first-party Visa documentation, GitHub repos owned by Visa, and Visa's own MCP/agent-toolkit; none names a second independent implementer (merchant platform, other network, AI vendor, etc.) building on the protocol. Community commentary even frames the initiative as still 'premature' with no adoption signals cited, so there's no evidence of an ecosystem beyond the vendor.

   • [community] “The Visa/Mastercard announcements are interesting but feel premature. The missing piece is standardized agent identity and capability declar…”
   • [community] “The Visa/Mastercard moves are interesting but I'd bet the real unlock is when businesses start issuing agent-specific cards with embedded po…”
   • [claimed-docs] “The TAP spec is public with a runnable reference implementation: "Establishing a universal standard of trust between AI agents and merchants…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the Trusted Agent Protocol is published in the open — https://raw.githubusercontent.com/visa/trusted-ag…”

   proof ↗⚑ flag

Spec publication

1. developerThe commerce protocol this product speaks is published as an open, versioned specification I can read and implement without signing anything

   weight 3 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce✓fullprobed8/10

   UCP is documented as an open, industry-governed standard with versioned releases and a public GitHub repository hosting the full spec and reference implementations, and ucp.dev/llms.txt confirms a dated, versioned spec index with no signup gate. Shopify's own docs and runtime probes show keyless, unauthenticated access to core UCP endpoints (catalog search, cart creation) without any signature required to read or implement the protocol. missing for 10: no direct evidence of the actual spec text/license terms confirming implementation rights, and no independent third-party (non-Shopify, non-ucp.dev) confirmation of the openness claim.

   • [claimed-docs] “ucp.dev positions the protocol as industry-governed rather than single-vendor: "UCP is built by the industry, to enable seamless agentic exp…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the Universal Commerce Protocol spec is published in the open — https://ucp.dev/llms.txt serves the ver…”
   • [claimed-docs] “Allows autonomous AI agents to transact on behalf of users with pre-defined, verifiable boundaries.”
   • [probe] “PROBE runtime (recorded 2026-09-14): the documented agent-profile trust gate behaves as specified — a keyless raw tools/call search_catalog …”

   proof ↗⚑ flag

   Visa Intelligent Commerce~partialprobed5/10

   Visa's Trusted Agent Protocol (TAP) is published openly on GitHub with a runnable reference implementation and keyless README access, satisfying 'read without signing' for that layer (visa-ic-probe-rt-1, visa-ic-supp-9, visa-ic-supp-6). However, the core Intelligent Commerce payment protocol (ACP instructions, tokens, credentials) requires a sandbox sign-up form with terms acceptance and 'Contact Visa for fees in Production' for real use, meaning the actual commerce protocol is gated behind registration/agreements, not a freely implementable open spec (visa-ic-supp-10, visa-ic-supp-8). Missing for 10: a single unified, explicitly versioned spec document covering the full commerce protocol (not just TAP) that can be implemented end-to-end without any sandbox registration or production agreement.

   • [probe] “PROBE runtime (recorded 2026-09-14): the Trusted Agent Protocol is published in the open — https://raw.githubusercontent.com/visa/trusted-ag…”
   • [claimed-docs] “The TAP spec is public with a runnable reference implementation: "Establishing a universal standard of trust between AI agents and merchants…”
   • [claimed-docs] “The Trusted Agent Protocol's agent recognition signature is HTTP Message Signatures "defined by RCF 9421" (typo in original), "aligned with …”
   • [claimed-docs] “Merchant-side onboarding starts with a self-serve "Intelligent Commerce Sandbox Sign up" form (Organization ID, company, contact details, te…”
   • [claimed-docs] “Fees, verbatim from FEES & TERMS: "Free to use in Sandbox. Contact Visa for fees in Production." On refunds/disputes the docs stop at eviden…”

   proof ↗⚑ flag

Disputes

1. developerDisputes and chargebacks on agent transactions can be handled via API — evidence submission, status, outcomes

   weight 2 · round drawn
   Shopify Agentic Commerce—none0/10

   The evidence pack covers catalog, cart, checkout, order state, and order webhooks (which surface refunds/returns/cancellations), but nowhere mentions a dispute or chargeback API, evidence submission, dispute status tracking, or dispute outcome handling for agent transactions.

   ⚑ flag

   Visa Intelligent Commerce—none0/10

   Evidence explicitly states Visa's docs stop at collecting 'commerce signals' to aid dispute resolution, not a dedicated dispute/chargeback API with evidence submission, status, or outcome endpoints (visa-ic-supp-8). No other citation shows any dispute-specific API surface.

   • [claimed-docs] “Fees, verbatim from FEES & TERMS: "Free to use in Sandbox. Contact Visa for fees in Production." On refunds/disputes the docs stop at eviden…”

   proof ↗⚑ flag

Refunds

1. developerRefunds on agent-placed orders can be initiated and tracked programmatically

   weight 2 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce~partialclaimed4/10

   Refunds are only surfaced as read/notification events — order webhooks fire on committed changes including refunds, and get_order can be polled to see post-purchase adjustments — but there is no documented API/tool for a developer to programmatically initiate a refund on an agent-placed order; webhook subscription itself is not self-serve ('contact your Shopify partner manager'). missing for 10: an actual refund-initiation endpoint/tool (create_refund or equivalent), self-serve webhook subscription for refund events, and any tracking dashboard/status API dedicated to refund lifecycle beyond generic order state.

   • [claimed-docs] “"Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (fu…”
   • [claimed-docs] “"The Order MCP server enables AI agents to fetch the current state of an order placed through their agent, including line items, fulfillment…”
   • [claimed-docs] “Shopify pushes UCP-shaped order webhooks to your registered endpoint whenever an order placed through your agent has a committed change (ful…”
   • [claimed-docs] “enables AI agents to fetch the current state of an order placed through their agent, including line items, fulfillment events, and post-purc…”

   proof ↗⚑ flag

   Visa Intelligent Commerce—none0/10

   Evidence explicitly states Visa Intelligent Commerce docs 'stop at evidence capture, not a dispute API' — there's only an optional 'policies.refundPolicy' metadata field attached to a credential request and generic 'commerce signals' for dispute resolution, not a programmatic refund initiation/tracking endpoint or status API for agent-placed orders.

   • [claimed-docs] “Fees, verbatim from FEES & TERMS: "Free to use in Sandbox. Contact Visa for fees in Production." On refunds/disputes the docs stop at eviden…”
   • [claimed-docs] “Credentials are scoped to an authenticated instruction: retrieval is POST /acp/v1/instructions/{instructionID}/credentials, and the request …”

   proof ↗⚑ flag

Agent identity

1. merchantAgents identify themselves verifiably — registered profiles, signatures, or trust tiers — so I can tell trusted agent traffic from anonymous bots

   weight 3 · round to Shopify Agentic Commerce
   Shopify Agentic Commerce✓fullprobed9/10

   Shopify's UCP documents a concrete three-tier trust model (Token, Signed, Anonymous) tied to agent identity, with Signed-tier requiring RFC 9421 ECDSA P-256 signature verification against a published public key in the agent's UCP profile, and access/rate-limits scaling with identification strength; a live probe confirms the trust gate actually enforces this (invalid_profile_url error when no hosted profile is presented). This gives merchants a verifiable way to distinguish anonymous vs. cryptographically-signed vs. token-authenticated agent traffic. missing for 10: no independent/third-party audit of the signature verification in production merchant traffic, and no merchant-facing dashboard/reporting evidence showing how tier data is surfaced to merchants themselves.

   • [claimed-docs] “"UCP traffic to Shopify's MCP servers is classified into three tiers based on how your agent identifies itself" — Token, Signed, Anonymous —…”
   • [claimed-docs] “In UCP, "a platform profile is a JSON document that describes the protocol version and capabilities the platform supports"; the business sid…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the documented agent-profile trust gate behaves as specified — a keyless raw tools/call search_catalog …”
   • [claimed-docs] “Shopify uses your profile to learn what your agent declares, intersect it with what the shop supports, and settle on a single negotiated set…”
   • [claimed-docs] “Negotiation is server-selects. The business computes the intersection of its capabilities with the platform's and chooses the active set”

   proof ↗⚑ flag

   Visa Intelligent Commerce✓fullprobed8/10

   Visa's Trusted Agent Protocol gives merchants a concrete verifiable-identity mechanism: RFC9421 HTTP message signatures tagged 'agent-browser-auth'/'agent-payer-auth', anti-replay nonces/timestamps, verification against Visa's public JWKS, and an open reference implementation that includes an 'agent-registry' component explicitly described as letting merchants 'instantly distinguish a legitimate, credentialed agent from an anonymous bot' and confirm it acts on behalf of an authenticated user. This is corroborated by a runtime probe showing the spec and reference repo are live and publicly accessible, going beyond marketing copy. Missing for 10: independent/production adoption evidence beyond Visa's own repo and probes, and clearer merchant-facing tooling for classifying agents into explicit 'trust tiers' rather than a binary signed/unsigned check.

   • [github] “By presenting a secure digital signature with every interaction, a merchant can verify that an agent is legitimate and has the user's permis…”
   • [github] “This allows you to confidently welcome agent-driven commerce while protecting your site from harmful bots.”
   • [claimed-docs] “including the cryptographic standards (RFC9421), required message signature fields, and the process for validating an agent's intent.”
   • [claimed-docs] “The Trusted Agent Protocol's agent recognition signature is HTTP Message Signatures "defined by RCF 9421" (typo in original), "aligned with …”
   • [claimed-docs] “TAP's signed Agentic Payment Container adapts to the merchant's rail: for guest-checkout key entry it carries a credential hash — "If the ha…”
   • [claimed-docs] “The TAP spec is public with a runnable reference implementation: "Establishing a universal standard of trust between AI agents and merchants…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the Trusted Agent Protocol is published in the open — https://raw.githubusercontent.com/visa/trusted-ag…”

   proof ↗⚑ flag

Human oversight

1. ai-native userSensitive agent spending requires my documented approval — a confirmation step, signed mandate, or per-purchase consent — before money moves

   weight 3 · round to Visa Intelligent Commerce
   Shopify Agentic Commerce~partialclaimed6/10

   Shopify's UCP checkout flow documents explicit pre-purchase gates: complete_checkout must only be called once 'Checkout status is ready_for_complete', the 'Buyer has reviewed and confirmed the order', and the 'Payment credential has been collected', and unresolved cases force a hand-off to the buyer via continue_url (requires_escalation/requires_buyer_review). AP2 integration adds 'cryptographically signed payment authorizations that are mathematically tied to the specific state of the cart', which maps to a signed-mandate model, and trust tiers restrict complete_checkout to Token-tier agents with explicit purchase permission. However, the docs also note 'Trusted agents can complete checkouts directly,' implying some agents can skip buyer-facing confirmation, and enforcement of the 'buyer reviewed' precondition appears to rely on agent self-attestation rather than a Shopify-verified user signature captured at time of purchase. Missing for 10: independent/third-party confirmation that buyer consent is cryptographically captured (not just agent-declared) and clarity on exactly which agents qualify as 'trusted' to bypass buyer review.

   • [claimed-docs] “"Checkout tools manage a purchase session once the buyer is ready to buy. All requests require authentication or a signed request." Tokens a…”
   • [claimed-docs] “Buyer handoff is a first-class state: "Build for escalations regardless of how you authenticate." A checkout in requires_escalation means "C…”
   • [claimed-docs] “"UCP traffic to Shopify's MCP servers is classified into three tiers based on how your agent identifies itself" — Token, Signed, Anonymous —…”
   • [claimed-docs] “allows Platforms to provide cryptographically signed payment authorizations that are mathematically tied to the specific state of the cart”
   • [claimed-docs] “ucp.dev positions the protocol as industry-governed rather than single-vendor: "UCP is built by the industry, to enable seamless agentic exp…”

   proof ↗⚑ flag

   Visa Intelligent Commerce✓fullclaimed8/10

   Visa Intelligent Commerce documents passkey-anchored authentication of payment instructions, per-purchase mandates with declineThreshold caps and consumerPrompt confirmation text, credential requests scoped to specific merchant/amount, and a Trusted Agent Protocol signature scheme validating agent intent before authorization — collectively a documented consent/mandate flow gating money movement. missing for 10: independent hands-on verification that the consent/mandate flow works end-to-end in production (product still carries a 'in process of development and deployment' caveat) and no third-party audit of the passkey step-up UX.

   • [claimed-docs] “Human approval is passkey-anchored end to end: provisioning includes "step up verification of the cardholder as well as setting up a Passkey…”
   • [claimed-docs] “Spend caps live in the purchase-intent mandate: Initiate a Purchase Intent (POST /acp/v1/instructions) exists "to verify that your agent is …”
   • [claimed-docs] “"Your agents can enroll a customer's card for tokenization during the customer's account registration or when the customer begins a new purc…”
   • [claimed-docs] “Credentials are scoped to an authenticated instruction: retrieval is POST /acp/v1/instructions/{instructionID}/credentials, and the request …”
   • [claimed-docs] “The Trusted Agent Protocol's agent recognition signature is HTTP Message Signatures "defined by RCF 9421" (typo in original), "aligned with …”
   • [claimed-docs] “Controls to ensure that the agent’s purchasing actions and the related authorizations align with the user’s authenticated instruction”
   • [claimed-docs] “Agent-scoped credentials are the core primitive: "Provisioning and life cycle management of agent-specific payment tokens that can be used b…”

   proof ↗⚑ flag

Liability

1. merchantThe fraud, liability, and chargeback rules for agent-initiated transactions are documented so I know who bears the risk

   weight 2 · round to Visa Intelligent Commerce
   Shopify Agentic Commerce—none0/10

   The evidence pack documents UCP's protocol mechanics (catalog, cart, checkout, order webhooks, trust tiers, profile negotiation) but nowhere specifies fraud liability, chargeback responsibility, or dispute-resolution rules for agent-initiated purchases. The only tangential mention is UCP's general 'Merchant of Record' framing on ucp.dev, which addresses customer-relationship ownership, not who bears fraud/chargeback risk in an agent transaction — no Shopify-specific policy, contract terms, or dispute process is documented.

   • [claimed-docs] “ucp.dev positions the protocol as industry-governed rather than single-vendor: "UCP is built by the industry, to enable seamless agentic exp…”

   proof ↗⚑ flag

   Visa Intelligent Commerce~partialclaimed3/10

   Docs describe extensive fraud-prevention plumbing (passkey authentication, mandates, TAP signatures) but the only mention of chargebacks/disputes explicitly stops at 'commerce signals... allow for quick resolution of most disputes' rather than a documented liability-shift or chargeback-allocation policy, and explicitly notes there is no dispute API. Missing for 10: explicit statement of who bears fraud/chargeback liability (merchant vs. issuer vs. cardholder) for agent-initiated transactions, documented dispute resolution process/API, and any liability-shift terms analogous to EMV rules.

   • [claimed-docs] “Fees, verbatim from FEES & TERMS: "Free to use in Sandbox. Contact Visa for fees in Production." On refunds/disputes the docs stop at eviden…”
   • [claimed-docs] “Human approval is passkey-anchored end to end: provisioning includes "step up verification of the cardholder as well as setting up a Passkey…”
   • [claimed-docs] “The Trusted Agent Protocol's agent recognition signature is HTTP Message Signatures "defined by RCF 9421" (typo in original), "aligned with …”

   proof ↗⚑ flag

Spend controls

1. ai-native userSet per-agent spend caps and usage limits and revoke an agent's payment authority instantly

   weight 2 · round to Visa Intelligent Commerce
   Shopify Agentic Commerce—none0/10

   The evidence describes trust tiers, rate limiting, token TTLs, and JWT scopes, but nowhere documents per-agent spend caps, usage limits, or an instant revoke-payment-authority mechanism — tokens simply expire after 60 minutes rather than being explicitly revocable on demand, and no dollar-limit or usage-cap controls are mentioned anywhere in the pack.

   ⚑ flag

   Visa Intelligent Commerce~partialclaimed7/10

   Docs show concrete mandate mechanics — declineThreshold spend caps, effectiveUntilTime, and a documented 'cancel a purchase intent' revocation path — plus passkey-gated instruction authentication and per-request credential scoping to merchant/amount, which together implement caps and a revocation-like control. However, evidence covers per-purchase-intent caps/cancellation rather than a persistent 'agent-wide spend cap + instant kill-switch' dashboard, and the product itself is flagged as still 'in the process of development and deployment.' Missing for 10: consumer-facing UI/API for setting ongoing per-agent usage limits (not just per-transaction mandates), explicit 'revoke all future authority instantly' mechanism beyond canceling a single intent, and independent/hands-on confirmation of revocation latency.

   • [claimed-docs] “Spend caps live in the purchase-intent mandate: Initiate a Purchase Intent (POST /acp/v1/instructions) exists "to verify that your agent is …”
   • [claimed-docs] “Human approval is passkey-anchored end to end: provisioning includes "step up verification of the cardholder as well as setting up a Passkey…”
   • [claimed-docs] “Agent-scoped credentials are the core primitive: "Provisioning and life cycle management of agent-specific payment tokens that can be used b…”
   • [claimed-docs] “Credentials are scoped to an authenticated instruction: retrieval is POST /acp/v1/instructions/{instructionID}/credentials, and the request …”
   • [claimed-docs] “Capture consumer consent, set spending limits, and manage mandates for agent-initiated payments.”

   proof ↗⚑ flag