How to test your UCP server for conformance

A practical 2026 guide to verifying a Universal Commerce Protocol (UCP) implementation — what to check, and how to check it in the browser, pip, or CI.

Check your server now →

Independent, unofficial. Not affiliated with or endorsed by the UCP project.

What "conformance" actually means for UCP

The Universal Commerce Protocol (UCP) is the open standard — co-developed by Google and Shopify — that lets AI agents discover products, run checkouts, and place orders with any merchant. A conformant UCP server is one whose behavior matches the spec's normative requirements: the discovery profile has the right shape, checkout follows the lifecycle, errors are structured, totals add up, and so on.

Getting this right matters because agents integrate against the spec, not against your specific server. A profile that's subtly off — capabilities as an array instead of a keyed object, a missing required field — can make your store invisible or broken to shopping agents.

The fastest check: your discovery profile

Every UCP interaction starts at /.well-known/ucp. Fetch yours and confirm:

• version is present and dated (e.g. 2026-04-08).
• capabilities is an object keyed by reverse-domain names ({ "dev.ucp.shopping.checkout": [ … ] }) — not an array.
• services values are arrays of { transport, endpoint } entries (REST, MCP, or embedded).
• It's served over HTTPS, without redirects.

The quickest way to verify all of this is to paste your store URL into the free checker — it fetches the profile server-side (no CORS headaches) and validates it against the official schema:

Run an instant profile check →

Going deeper: the full suite (CLI)

The profile is just the front door. To verify checkout, order, discount, catalog, cart, and the totals invariants, run the open-source CLI:

pip install spck-conformance

# scaffold a config tailored to your server's capabilities
spck-conformance --server https://your-store.example.com --init merchant.json

# run the full suite
spck-conformance --server https://your-store.example.com --config merchant.json

On any deviation it shows the requirement vs your actual response, so you can fix it directly. It's capability-adaptive: it only runs checks for what your server declares, and reports anything it can't test as not-tested rather than a silent pass.

Keep it conformant: check on every deploy (CI)

Add the GitHub Action so conformance is verified on every push — it fails the build on any MUST deviation and writes a JUnit report:

- uses: vishkaty/ucp-conformance@main
  with:
    server: https://your-store.example.com
    config: merchant.json   # optional

What makes a conformance result trustworthy

A checker that can silently pass a broken server is worse than none. Look for a tool where each check is proven to catch the defect it's for (kill-rate testing), is anchored to the official ucp-schema validator, and cites the specific spec clause it enforces — so a "pass" is earned, not assumed. (That's the principle spck.dev is built on.)

Check your UCP server →