Introducing UCP — A Universal Commerce Protocol for AI Agents

AI agents can read the web. They can call APIs. They can write code. But they can't buy anything — because there is no standard way for an AI agent to discover what a merchant sells, get a price, complete a payment, and trigger fulfillment. Today we are publishing the spec for the Universal Commerce Protocol (UCP) and shipping a working implementation in 0nCore.

The Problem in One Sentence

Every e-commerce integration today assumes a human is at a browser. Every checkout flow assumes a human reads the page, fills the form, clicks "Pay." For AI agents to actually transact on the web, there has to be a machine-readable surface that exposes what a merchant sells, what its capabilities are, and how to fulfill an order — without scraping HTML or reverse-engineering Stripe checkout.

UCP is that surface.

The Discovery Endpoint

UCP merchants expose /.well-known/ucp — a single JSON document that describes everything an agent needs to do business with you:

{
"name": "0nCore", "description": "AI orchestration + AI app marketplace", "version": "1.0", "capabilities": ["catalog", "checkout", "identity", "orders", "fulfillment"], "payment_handlers": ["stripe", "stripe_connect"], "categories": ["website-compliance", "seo-optimization", "ai-content-generation", "crm-setup", "wordpress-management", "business-automation"], "endpoints": { "catalog": "/api/ucp/catalog", "checkout": "/api/ucp/checkout", "fulfillment": "/api/ucp/fulfillment", "orders": "/api/ucp/orders" } } 

An AI agent crawls this endpoint, gets the merchant's capability matrix, and can decide whether this merchant has what its user needs — in one HTTP GET.

The Catalog

Products are returned as structured JSON:

{
"id": "...", "name": "HIPAA Compliance Scan", "slug": "hipaa-scan", "description": "Full 63-point HIPAA compliance audit. Instant report.", "category": "website-compliance", "price_cents": 14700, "currency": "USD", "fulfillment_type": "hipaa_scan" } 

The fulfillment_type is the key. Every merchant declares what handler runs when an order is paid. The agent doesn't need to know HOW the scan happens — just that it WILL happen, and the deliverable will land in the order record.

Checkout

POST /api/ucp/checkout
{ "action": "create_session", "product_id": "...", "buyer_email": "agent-acting-on-behalf-of@user.com", "buyer_name": "John Smith" }

→ Returns Stripe checkout URL. Agent hands URL to user OR completes via Stripe Connect Payment Element. 

After payment, Stripe webhook fires. Fulfillment auto-runs based on fulfillment_type. The deliverable populates the order record.

Fulfillment

UCP defines a contract: when an order is paid, the merchant runs the fulfillment handler tied to that product's fulfillment_type. The handler can be:

• Synchronous (returns deliverable immediately — e.g. AI blog post written in under 60 seconds)
• Async (returns 202, deliverable populated later — e.g. WordPress monthly management)
• Manual (vendor or admin marks as fulfilled — e.g. custom AI automation work)

The agent polls /api/ucp/orders/{id} until status is fulfilled or subscribes to a webhook.

Why Open Standard, Not Proprietary

This only works if multiple merchants adopt it. We're publishing UCP as an open spec for three reasons:

1. AI agents need scale. A single merchant exposing UCP is a curiosity. Ten merchants is interesting. Hundreds is a network effect.
2. The standard is the moat, not the implementation. First merchant to land in agent search results wins. We'd rather have a standard with competitors than a proprietary lock that no agent indexes.
3. It mirrors robots.txt + sitemap.xml. Those work because they're open. UCP works the same way — a .well-known URL that anyone can adopt.

What's in the 0nCore Implementation

• 9 fulfillment handlers (HIPAA scan, CRO9 audit, AI blog post, CRM setup, WordPress management, custom automation, .0n app install, marketplace app, manual)
• 6 first-party products at launch
• Stripe Connect for marketplace vendor payouts (third-party builders)
• 70% revenue share to vendors, automatic payouts after fulfillment
• Order tracking + reconciliation for both first-party and third-party flows

Reference Implementation

Live at 0ncore.com/.well-known/ucp (publishing alongside the May 1, 2026 launch). The full open spec lives in the lib/ucp/ directory of the onork-app repository.

If you're building an AI agent that needs to transact, point it at any UCP merchant. If you're building a merchant, drop in the 4 endpoints (/.well-known/ucp, /api/ucp/catalog, /api/ucp/checkout, /api/ucp/fulfillment) and you're indexable.

What Comes Next

• Multi-merchant agent search index ("Find me a HIPAA scanner under $200" → returns ranked merchants)
• Cross-merchant order federation (one agent assembling deliverables from multiple sellers)
• Vendor reputation + dispute resolution layer

The /.well-known/ucp endpoint is the AI commerce equivalent of robots.txt. It's small. It's open. It works.

Spec, examples, and reference implementation: 0nmcp.com. The marketplace it powers: 0ncore.com/dashboard/marketplace.