The most-endorsed protocol in commerce — how much is actually deployed? A live tracker, refreshed every couple of months, with the history charted below.
Launch edition: The v2026-08-25 release — the eight migration hazards, published 2026-08-27.
We were curious how much of UCP is genuinely deployed versus endorsed, so we set out to measure it layer by layer — and we keep measuring, every couple of months, in the open. This is the fifth edition — the first ran 2026-07-17 — an independent, unofficial, data-backed read (not affiliated with or endorsed by the UCP maintainers). The registry, download and star figures are as of 2026-10-11. The endpoint probe behind the named-brand counts is a separate pass: the population scan is the one run on 2026-08-13, and the 8 named launch partners were re-probed on 2026-10-13, which is the pass section 3 reports. Each number links to its exact source — the spec line it was counted from, the primary announcement, or the raw data we measured (published alongside this page) — and where the honest answer is "announced, not verifiably live," we say so. We are certainly missing things and would rather be corrected than confident: if you build on UCP and see it differently, please tell us. No merchant from the population scan is named or graded; the 8 publicly announced launch partners are the stated exception, and only their discovery-document status is recorded.
A note on honesty. This is a best-effort, independent read, and we would rather be corrected than confident. We measured what we could and linked each figure to a source — but measurements have limits, methods can miss things, and even primary sources can be wrong or change over time. If anything here looks off — a number, a link, a claim — please tell us and we will check it and fix it, and note the correction. Getting it right matters more to us than looking right — help us keep it honest.
Two kinds of series, deliberately kept apart. Weekly series are rebuilt every edition from each registry's own daily-download history API (npm, PyPI, crates.io), so every point is a primary-source measurement — never interpolated from our snapshots. Per-edition series are the things only we measure (our full endpoint probes, and counts we verify by hand each edition); each point is one real measurement on the date shown. Where a past edition kept a stale value after a failed fetch, that point is excluded rather than plotted — the raw series, including those annotations, are published at trends.json and weekly-series.json. GitHub star history is per-edition only: the stargazer-timestamp API is not accessible for this org, so we chart only the counts we verified ourselves.
The trend charts could not load in this browser — the underlying data is at trends.json and weekly-series.json.
The Universal Commerce Protocol — Google and Shopify's standard for agent-driven shopping — arrived in January 2026 with co-developers Shopify, Etsy, Wayfair, Target and Walmart, and twenty-plus endorsers including Adyen, American Express, Best Buy, Flipkart, Macy's, Mastercard, Stripe, The Home Depot, Visa and Zalando (Google's launch post, Shopify Engineering). Its payments companion AP2 launched with Mastercard, Amex, JCB, UnionPay, Adyen, PayPal, Coinbase and more (Google Cloud, Sept 2025).
The spec has moved as fast as the endorsements. Across three tagged releases, the count of MUST-level requirements in our register went from 178 to 188 to 385 — nearly doubling in the latest release. Every requirement is individually traceable at spck.dev/checks, each linking to the exact spec line it comes from.
Precision note: the artifact tagged v2026-04-08 was finalized in a commit dated
2026-05-22 after post-date cherry-picks, and the tag was re-pointed again, to a25a4a24 on
2026-09-09 — "three releases in three months" describes the tagged artifacts, not a
clean calendar cut.
| Area | Jan 11 | Jan 23 | Apr 08 | What it is |
|---|---|---|---|---|
| identity-linking | 11 | 11 | 57 | OAuth account linking for agents |
| signatures | 0 | 0 | 34 | RFC 9421 request/response signing |
| catalog | 0 | 0 | 32 | Product search & lookup |
| error model | 8 | 8 | 25 | In-band structured errors |
| cart | 0 | 0 | 14 | Pre-checkout cart management |
| totals | 0 | 0 | 14 | Money-math reconciliation rules |
| payment | 35 | 37 | 44 | incl. the AP2 mandate extension |
Identity, cryptographic signatures and agent payments all arrived essentially at once: UCP stopped being a
checkout API and became a security-and-identity protocol. One hazard for anyone maintaining an implementation
across versions: requirement IDs are renumbered between eras, so pinning by ID can silently change meaning. Areas are renamed too: the
identity-linking and error-model obligations existed at Jan 11 and Jan 23 under the area names discount-consent-identity and errors-validation-security, which is why an earlier edition of this table counted them as zero. Counts are MUST, MUST NOT, REQUIRED and SHALL rows of each requirement family (IDL-, SIG-, ERR- and so on) in our register at each pinned tag, not of the area file, whose membership changed with the renames.
That is the ambition. The rest of this page measures what has actually been deployed underneath it — layer by layer, because endorsement is not adoption.
Update (late July 2026): the pace has not slowed. The spec's main branch has already moved
well beyond
the 2026-04-08 tag, with a substantial next release taking shape — buyer consent, split payments,
a loyalty extension, delegated identity providers, fulfillment methods on the catalog, and new permalink, policies
and Actions primitives have merged to main. In the same window the open-source reference server caught up to the
2026-04-08 release (its /.well-known/ucp now advertises that version, where earlier it
served 2026-01-23) — a reminder that even the canonical implementation trails the written spec by a
release. The gap this page is about is not closing; the spec keeps opening new frontier ahead of the deployment
underneath it.
An agent protocol needs agents that buy. Google's own surfaces came first: AI Mode in Search, the Gemini app, and Business Agent (Google). That same announcement frames the shopping side as still arriving: UCP "will soon power a new checkout feature" in AI Mode and the Gemini app, rather than generally available at launch. Microsoft is the second, on its own primary sources: its advertising pages state that "UCP enables transactions (checkout and post-purchase actions within AI experiences like Copilot)", and its 2026-04-21 post describes "UCP-enabled checkout in chat for eligible sellers". Microsoft hedges too, in the same places: the generally-available piece is UCP-ready feeds in Merchant Center, which its own FAQ assigns to discovery rather than transactions, and the same page says Merchant Center "will support" UCP, in the future tense. We have measured no UCP transaction on either surface, so both are vendor claims rather than verified behaviour. Claims that other assistants such as Perplexity or ChatGPT consume UCP still appear only in secondary marketing blogs, with no primary source, so we do not report those as fact.
We probed the /.well-known/ucp endpoint of
8 named launch partners directly.
On 2026-08-13 none served a UCP profile to our probe: every one returned a 404, a redirect, or a bot wall. A
re-probe on 2026-10-13 found 1
of them, at www.chewy.com, publishing a discovery profile: version 2026-01-23, a REST service
endpoint, and one signing key on curve P-256. The document validates against the pinned 2026-01-23 profile schema;
that schema neither requires a key nor checks the curve, so the curve was confirmed separately by verifying the
point lies on P-256. Our own population frame had already recorded that profile in April 2026, and our July and
August probes could not read it there: the July scan recorded a non-JSON response for that domain and the
August pass recorded a 403, so what changed is what our probe could see rather than what the
merchant serves. The endpoint the profile declares was not exercised, because our probe policy is discovery only:
a published discovery document is not a live endpoint, which is the distinction section 6 draws. The other seven
are unchanged. Mostly these brands participate through Google's managed agent surfaces rather than hosting their
own endpoints, so the marquee names cannot be counted as live UCP endpoints on the strength of an announcement,
which many public tallies still do.
The endpoints that do exist are overwhelmingly one platform's automatic provisioning. Population frame: the UCPChecker/ucp-merchants dataset (CC-BY-4.0); measurement: our own read-only probe on 2026-08-13, aggregates published in scan-summary.json.
Two independent registries agree with the hosting picture: the ucpregistry.com API lists 47 verified merchants — all on the same platform — and the community awesomeucp directory resolves the same way. This is one platform switching on UCP across its storefront base: infrastructure readiness at scale, on the platform's timeline, not thousands of independent adoption decisions. And it says nothing about live agent transactions — no primary source anywhere quantifies those, so neither do we.
Strip the platform default away and genuine, self-directed adoption is tiny — roughly a handful of real self-hosted merchants, a few ecosystem tools, and a few demos, including one booking-and-scheduling vendor extending UCP beyond retail with custom capabilities. Here is the striking part: the advanced, per-merchant features of the spec live almost exclusively in that tiny deliberate tail.
| The spec's frontier | Endpoints advertising it |
|---|---|
| RFC 9421 signing keys published | 11 (0.4%) |
| identity-linking capability | 4 |
| buyer-consent capability | 4 |
| AP2 payment mandates | 2 |
Signing keys: a withdrawn figure. The 2026-08-13 and 2026-08-01 scans both reported 0
for this row, from the same defect. Those runs
tested keys[] against a population that publishes signing_keys[], the field having been
renamed in ucp#566 (merged 2026-07-12, first released in the v2026-08-25 tag), so it could not see them. Both
figures are withdrawn and the row now shows the 2026-07-17 scan, which tested the right field. Under our probe
policy, at 50 stores a day, re-measuring the full frame takes about 61 days and will replace this row when it
completes. Every other row in this table is from the 2026-08-13 scan.
The 99.5% of endpoints on the platform default carry none of the frontier; the handful who deliberately adopted carry essentially all of it — one self-hosted retailer implements the entire stack, AP2 payment mandates included, by itself. The spec's January ambition is running years ahead of any real, differentiated deployment.
The gap shows up a third time in the code. The UCP spec repository has 3413 stars — remarkable for a six-month-old protocol. The repositories you'd actually build on are far smaller: samples 240, python-sdk 89, js-sdk 48, conformance 29 stars (captured 2026-10-11). Downstream use is smaller still — the Python SDK shows roughly 7 dependent repositories, and a code search for the AP2 mandate token returns single digits across all of GitHub.
SDK downloads are modest but real, consistent with a young protocol: the official @ucp-js/sdk sees about 52953 downloads/month, the official Python ucp-sdk about 8621/month, and the Rust ucp-schema about 4963 lifetime. The npm SDK has grown sharply since mid-July; the Python SDK rose through August and has since flattened, and the Rust schema crate keeps climbing steadily. The weekly series in the trend charts above show each curve from the history API of its registry. Beyond the official org, roughly three dozen third-party repositories genuinely implement UCP — platform connectors, a community Java SDK, vendor demos: a real implementer base, but an early one.
AP2's card-network cohort is the deepest endorsement list of all, and the least deployed. No card network has announced a live transaction on AP2 itself; AP2's launch framed itself as a call for collaboration. Card networks do announce live agentic payments on their own separate frameworks, which are not AP2 and are outside what this page measures. The only production claim in the AP2 world is the x402 crypto extension (Google Cloud) — crypto rails, not cards. That matches what we measured in the wild: 2 live endpoints advertise AP2 mandates, and the mandate token barely appears in public code at all.
2026-04-08, discount amounts in totals[] are
negative (schema-enforced) — the opposite of the earlier convention, and the most common money-math bug.messages[] entry of type error), not HTTP-4xx-only — implementations still disagree here.minProperties, quietly produce non-conformant payloads.Several of these are already converging in the reference implementations as the ecosystem matures — so check against the current release, not an older snapshot.
Where the published artifacts around the spec — the SDKs, the samples, the official conformance suite,
our own golden server — deviate from the pinned text, we keep a reproduction, a status per released cut and a
ledger anchor for each one, re-verified within thirty days. 10
issues are tracked at spec pin cd78fb38;
10 are still open on a published cut,
7 have a fix on some cut but not yet in a
release, and 3 have no fix anywhere yet. Latest
re-verification: 2026-10-16. The full
table, with the command to reproduce each row, is at spck.dev/known-issues.
The through-line is a protocol whose ambition and endorsement are running well ahead of its deployment. What would close the gap: a measured UCP transaction on any buyer agent, Google's and Microsoft's included; a card network going live on AP2; non-platform merchants adopting the frontier features at any scale; and agent-side conformance becoming table stakes the moment real money moves through autonomous agents. The distance between "passes conformance" and "behaves safely" — and between "endorsed" and "deployed" — is where the next year of this ecosystem gets decided. We will keep tracking it here edition by edition, and we would genuinely welcome the help: if you are building on UCP and seeing something different from what we measured, tell us what we missed.
Spec counts: spck.dev's public register (coverage.json), pinned
to release-tag commits (2026-04-08 → a25a4a24…, the tag position after the 2026-09-09 re-point, which is where our 2026-04-08 counts come from); every requirement links to its spec
line; method at spck.dev/docs.
Where this page leans on our own conformance register, its evidence-class split is published too: of 277 checked requirements at v2026-04-08, 67 are kill-tested against independent reference servers and 138 so far rest only on our own fixtures — the full split, drift-gated in CI, is at spck.dev/coverage.
Live-endpoint data: population frame from the CC-BY-4.0
UCPChecker/ucp-merchants dataset (attribution: UCPChecker on Hugging Face); measurements are our own read-only
/.well-known/ucp probe of 2026-08-13; aggregates at
scan-summary.json and
adoption-facts.json. Ecosystem signals: GitHub, npm, PyPI,
crates.io and ucpregistry.com public APIs plus the primary vendor announcements linked inline, captured
2026-10-11. Where a claim is announced but not verifiably live, it is labeled as such. No merchant from the
population scan is named or graded; aggregates only, with the 8 publicly announced launch partners as the stated
exception, recorded in site_claims.json and limited to whether each publishes a discovery document. Each edition is point-in-time and reproducible against the same public sources;
we refresh it every couple of months, chart the history above, and note what changed. Corrections and additions are
genuinely welcome
— open an issue on GitHub.