UCP Technical Architecture: Capabilities, Extensions & Transport Bindings

UCP in One Paragraph (Specification Language)

The Universal Commerce Protocol is an open standard providing functional primitives and a standardized language that enables platforms, businesses, payment service providers, and credential providers to interoperate securely across the commerce journey.

Rather than forcing every actor to build custom integrations with every other actor (the "N×N problem"), UCP defines a common vocabulary and interface standard that any compliant system can implement.

Composable Building Blocks (Core Design Philosophy)

UCP is explicitly designed as a modular, composable system built on two primary concepts:

1. Capabilities

Capabilities are the functional primitives that define what a merchant's system can do. Think of them as standardized API contracts for specific commerce functions.

Initial v1 capabilities (from UCP GitHub):

• Checkout: Cart management, tax calculation, payment processing
• Order: Order lifecycle management and webhook-based status updates
• Identity Linking: OAuth 2.0-based authorization for agents to act on user behalf
• Payment Token Exchange: Secure tokenization for PCI-compliant payment handling

Each capability defines required endpoints and methods, expected request/response schemas, error handling contracts, and security requirements.

Example: Checkout Capability

{
  "capability": "checkout",
  "version": "1.0",
  "endpoints": {
    "create_session": "/ucp/checkout/create",
    "update_cart": "/ucp/checkout/cart",
    "calculate_tax": "/ucp/checkout/tax",
    "process_payment": "/ucp/checkout/payment"
  },
  "supported_features": [
    "single_item",
    "tax_calculation",
    "shipping_options"
  ]
}

2. Extensions

Extensions allow for richer flows without bloating the core protocol. This is critical for keeping UCP lean and adoptable while still supporting advanced merchant requirements.

Why extensions matter:

• Core stays minimal: Not every merchant needs every feature on day one
• Backward compatibility: New extensions don't break existing implementations
• Ecosystem innovation: Third parties can propose extensions without waiting for spec changes

Example extension scenarios: Gift message handling, delivery date scheduling, product customization flows, subscription management, and B2B purchase order workflows.

Extensions are optional and discoverable—agents query a merchant's capabilities profile to understand which extensions are supported.

Dynamic Discovery (How Agents Find Your Capabilities)

One of UCP's most powerful design choices is standardized capability discovery.

How it works:

• Merchant hosts a JSON manifest at /.well-known/ucp
• Agent (or platform crawler) fetches this manifest
• Manifest declares supported capabilities, endpoints, and extensions
• Agent dynamically configures its interaction model based on merchant's declared features

Example discovery manifest:

{
  "merchant_id": "merchant.example.com",
  "ucp_version": "1.0",
  "capabilities": {
    "checkout": {
      "version": "1.0",
      "endpoint": "https://api.example.com/ucp/checkout",
      "features": ["multi_item_cart", "tax_calculation", "express_shipping"]
    },
    "order": {
      "version": "1.0",
      "endpoint": "https://api.example.com/ucp/order",
      "webhooks": {
        "status_update": "https://platform.example.com/webhooks/order"
      }
    },
    "identity_linking": {
      "version": "1.0",
      "oauth_endpoint": "https://auth.example.com/oauth/authorize",
      "scopes": ["purchase", "order_history", "loyalty"]
    }
  },
  "extensions": {
    "gift_options": {
      "enabled": true,
      "endpoint": "https://api.example.com/ucp/ext/gifts"
    }
  },
  "metadata": {
    "business_name": "Example Retail Co",
    "support_url": "https://example.com/support",
    "terms_url": "https://example.com/terms"
  }
}

Why this matters:

• No pre-registration required: Merchants declare capabilities; agents discover them autonomously
• Versioning support: Agents can handle multiple capability versions gracefully
• Graceful degradation: If an agent doesn't support an extension, it falls back to core capabilities

Transport-Agnostic Bindings (Protocol Flexibility)

UCP is designed to work across multiple transport layers, making it future-proof as communication protocols evolve.

Supported transports (v1):

1. REST APIs (HTTP/HTTPS)

The default and most widely supported transport. Familiar to any engineering team with web API experience.

Characteristics: Synchronous request/response, standard HTTP methods (GET, POST, PUT, DELETE), JSON payloads, and OAuth 2.0 for authentication.

Best for: Traditional e-commerce platforms with existing REST infrastructure

2. MCP (Model Context Protocol)

MCP is Anthropic's standard for how AI models connect to external systems. UCP provides MCP bindings so agents can discover and interact with merchant capabilities through a unified MCP server.

Characteristics: Designed specifically for AI agent interactions, supports both tools (function calls) and resources (data retrieval), built-in schema validation, and optimized for LLM context windows.

Best for: Merchants building "AI-first" commerce experiences or integrating with platforms like Claude, ChatGPT, or Gemini

3. A2A (Agent-to-Agent)

A2A protocols enable direct agent-to-agent negotiation without human mediation. This is critical for B2B scenarios and autonomous procurement.

Characteristics: Bidirectional communication, support for multi-step negotiation (pricing, terms, delivery), cryptographic proof of authorization, and audit trail for autonomous transactions.

Best for: B2B merchants, wholesale platforms, or high-volume procurement scenarios

Transport comparison:

Transport	Latency	Complexity	Best Use Case
REST	Low	Low	Standard e-commerce, high compatibility
MCP	Medium	Medium	AI-native experiences, LLM optimization
A2A	Variable	High	B2B negotiation, autonomous procurement

The key insight: You implement UCP capabilities once, then expose them via multiple transports. The protocol logic stays the same; only the communication layer changes.

Initial Key Capabilities (v1 Baseline)

The UCP repository lists four foundational capabilities for the initial release:

1. Checkout

Purpose: Enable agents to create shopping sessions, manage cart state, calculate costs, and process payments.

Key sub-functions: Cart creation and item management, tax and shipping calculation, discount/promotion application, payment authorization, and order confirmation.

Implementation note: Start with single-item checkout; expand to multi-item carts as the roadmap unlocks this feature.

2. Identity Linking

Purpose: Allow platforms to obtain user authorization via OAuth 2.0, enabling agents to act on behalf of authenticated users.

Why it matters: Loyalty program integration, personalized pricing, order history access, saved payment methods, and subscription management.

Security requirement: Must use OAuth 2.1 with PKCE (Proof Key for Code Exchange) for mobile/web flows.

3. Order

Purpose: Provide webhook-based updates for order lifecycle events.

Supported events: Order created, payment confirmed, order shipped, delivery completed, and return initiated.

Implementation pattern: Merchant sends webhook to platform when status changes. Platform updates agent's knowledge of order state. User can query agent for "Where's my order?" and get real-time status.

4. Payment Token Exchange

Purpose: Enable secure payment processing without exposing sensitive card data.

How it works: User authorizes payment method with credential provider (e.g., Google Pay, Apple Pay). Credential provider generates a time-limited, single-use token. Token is passed to merchant via UCP. Merchant processes payment using token. Token is immediately invalidated.

PCI DSS impact: Drastically reduces scope of compliance requirements since merchant never handles raw card numbers (PANs).

How Asva AI Accelerates UCP Implementation

Most engineering teams can read the UCP specification and understand what to build. The challenge is knowing how to map existing systems to UCP's capability model efficiently.



Asva AI's value:

1. System mapping workshops

We analyze your current checkout, order management, and payment flows, then map them to UCP capability boundaries. This identifies what you can reuse vs rebuild, where custom extensions are needed, and optimal transport layer choices (REST vs MCP vs A2A).

2. Minimal viable capability design

We help you define the smallest set of capabilities needed to launch, then create a roadmap for expanding features based on actual usage data.

Example: Instead of building multi-item cart, gift messaging, delivery scheduling, and subscription support on day one, we help you launch with single-item checkout, standard shipping, basic tax calculation, and primary payment method. Then we instrument performance and add capabilities based on demand signals.

3. UCP/ACP compatibility validation

Google's UCP and OpenAI's ACP have overlapping goals but different architectural choices. We help you build implementations that work across both protocols without duplicating effort.

Example: Identity linking in UCP uses OAuth 2.0. ACP also uses OAuth 2.0 but with slightly different scope requirements. We map your OAuth implementation to both specs simultaneously.

4. Transport layer optimization

Choosing the right transport layer matters for performance and developer experience.

We help you decide: REST for maximum compatibility and existing infrastructure, MCP for AI-native experiences and LLM optimization, or A2A for B2B and agent-to-agent negotiation.

Most merchants will implement REST first (broadest compatibility) then add MCP bindings as AI platforms prioritize MCP-native integrations.

The Engineering Reality: Capabilities Are Easy, Data Is Hard

Here's what most technical teams discover: The protocol itself is straightforward. UCP's spec is well-documented, reference implementations exist, and the API contracts are clear.

The hard part is data quality:

• Inconsistent product identifiers (GTINs missing or incorrect)
• Inventory sync delays between systems
• Tax calculation logic that assumes human review
• Payment flows with hard-coded UI dependencies
• Order status updates that require manual intervention

Asva AI solves this by treating UCP implementation as a data engineering problem, not just an API problem.

We build: Data quality pipelines to ensure feed accuracy, real-time inventory sync layers, headless checkout logic (API-first, no UI dependencies), and webhook orchestration for order lifecycle events.

---

Ready to implement UCP without the trial-and-error phase?

Asva AI accelerates implementation with proven frameworks for capability mapping, minimal viable launches, and multi-protocol compatibility.

Schedule Engineering Consultation

References

• UCP GitHub Specification
• Google Developers: UCP Under the Hood
• Model Context Protocol Documentation

Related reading

• what the Universal Commerce Protocol is
• ACP vs MCP compared
• check your GPT Shopping readiness