Introducing UCP — A Universal Commerce Protocol for AI Agents

AI agents can read the web. They can call APIs. They can write code. But they can't buy anything — because there is no standard way for an AI agent to discover what a merchant sells, get a price, complete a payment, and trigger fulfillment. Today we are publishing the spec for the **Universal Commerce Protocol (UCP)** and shipping a working implementation in 0nCore. ## The Problem in One Sentence Every e-commerce integration today assumes a human is at a browser. Every checkout flow assumes a human reads the page, fills the form, clicks "Pay." For AI agents to actually transact on the web, there has to be a machine-readable surface that exposes what a merchant sells, what its capabilities are, and how to fulfill an order — without scraping HTML or reverse-engineering Stripe checkout. UCP is that surface. ## The Discovery Endpoint UCP merchants expose `/.well-known/ucp` — a single JSON document that describes everything an agent needs to do business with you: ```json { "name": "0nCore", "description": "AI orchestration + AI app marketplace", "version": "1.0", "capabilities": ["catalog", "checkout", "identity", "orders", "fulfillment"], "payment_handlers": ["stripe", "stripe_connect"], "categories": ["website-compliance", "seo-optimization", "ai-content-generation", "crm-setup", "wordpress-management", "business-automation"], "endpoints": { "catalog": "/api/ucp/catalog", "checkout": "/api/ucp/checkout", "fulfillment": "/api/ucp/fulfillment", "orders": "/api/ucp/orders" } } ``` An AI agent crawls this endpoint, gets the merchant's capability matrix, and can decide whether this merchant has what its user needs — in one HTTP GET. ## The Catalog Products are returned as structured JSON: ```json { "id": "...", "name": "HIPAA Compliance Scan", "slug": "hipaa-scan", "description": "Full 63-point HIPAA compliance audit. Instant report.", "category": "website-compliance", "price_cents": 14700, "currency": "USD", "fulfillment_type": "hipaa_scan" } ``` The `fulfillment_type` is the key. Every merchant declares what handler runs when an order is paid. The agent doesn't need to know HOW the scan happens — just that it WILL happen, and the deliverable will land in the order record. ## Checkout ``` POST /api/ucp/checkout { "action": "create_session", "product_id": "...", "buyer_email": "agent-acting-on-behalf-of@user.com", "buyer_name": "John Smith" } → Returns Stripe checkout URL. Agent hands URL to user OR completes via Stripe Connect Payment Element. ``` After payment, Stripe webhook fires. Fulfillment auto-runs based on `fulfillment_type`. The deliverable populates the order record. ## Fulfillment UCP defines a contract: when an order is paid, the merchant runs the fulfillment handler tied to that product's `fulfillment_type`. The handler can be: - **Synchronous** (returns deliverable immediately — e.g. AI blog post written in under 60 seconds) - **Async** (returns 202, deliverable populated later — e.g. WordPress monthly management) - **Manual** (vendor or admin marks as fulfilled — e.g. custom AI automation work) The agent polls `/api/ucp/orders/{id}` until status is `fulfilled` or subscribes to a webhook. ## Why Open Standard, Not Proprietary This only works if multiple merchants adopt it. We're publishing UCP as an open spec for three reasons: 1. **AI agents need scale.** A single merchant exposing UCP is a curiosity. Ten merchants is interesting. Hundreds is a network effect. 2. **The standard is the moat, not the implementation.** First merchant to land in agent search results wins. We'd rather have a standard with competitors than a proprietary lock that no agent indexes. 3. **It mirrors `robots.txt` + `sitemap.xml`.** Those work because they're open. UCP works the same way — a `.well-known` URL that anyone can adopt. ## What's in the 0nCore Implementation - 9 fulfillment handlers (HIPAA scan, CRO9 audit, AI blog post, CRM setup, WordPress management, custom automation, .0n app install, marketplace app, manual) - 6 first-party products at launch - Stripe Connect for marketplace vendor payouts (third-party builders) - 70% revenue share to vendors, automatic payouts after fulfillment - Order tracking + reconciliation for both first-party and third-party flows ## Reference Implementation Live at [0ncore.com/.well-known/ucp](https://0ncore.com/.well-known/ucp) (publishing alongside the May 1, 2026 launch). The full open spec lives in the `lib/ucp/` directory of the [onork-app repository](https://github.com/Crypto-Goatz/onork-app). If you're building an AI agent that needs to transact, point it at any UCP merchant. If you're building a merchant, drop in the 4 endpoints (`/.well-known/ucp`, `/api/ucp/catalog`, `/api/ucp/checkout`, `/api/ucp/fulfillment`) and you're indexable. ## What Comes Next - Multi-merchant agent search index ("Find me a HIPAA scanner under $200" → returns ranked merchants) - Cross-merchant order federation (one agent assembling deliverables from multiple sellers) - Vendor reputation + dispute resolution layer The `/.well-known/ucp` endpoint is the AI commerce equivalent of `robots.txt`. It's small. It's open. It works. Spec, examples, and reference implementation: [0nmcp.com](https://www.0nmcp.com). The marketplace it powers: [0ncore.com/dashboard/marketplace](https://0ncore.com/dashboard/marketplace).