The Highway Google Paved for Agentic Commerce

Shopping is sprouting a new "user": not a human, but an Agent. It compares prices, adds to cart, places orders, and handles returns for you. The problem is—every Agent connecting to every merchant requires writing a custom integration.

Google calls this the "N×N integration bottleneck": Gemini needs to connect to 10,000 stores, ChatGPT also needs to connect to 10,000 stores, and each store has to adapt separately for each Agent—the number of connections explodes multiplicatively with the number of parties on both sides. This is a replay of the 2010s "every app has to write an interface for every bank."

Shopify's engineering team put it more bluntly in their retrospective post: the complexity of commerce is real—payment methods, discount rules, fulfillment combinations change constantly with cart contents, buyer region, and market conditions. "Monolithic protocols eventually collapse under complexity: too rigid to adapt, too slow to evolve."

UCP's answer is to standardize but not lock down this highway: define a universal language and functional primitives, collapsing integration from N×N to N+N—merchants implement once, and all compliant Agents can drive on. At the NRF conference on January 11, 2026, Sundar Pichai announced it as an open-source standard, with co-developers Shopify, Etsy, Wayfair, Target, and Walmart.

UCP breaks commerce capabilities into three layers, each with clear responsibilities and the ability to evolve independently—this is its most fundamental difference from a "monolithic shopping API."

This layering is no accident. Shopify's retrospective explicitly benchmarks against TCP/IP's success: a stable lower layer with a pluggable upper layer allows new verticals to grow without breaking existing ones. This is also why UCP dares to claim it can scale to hotels and food delivery.

Discovery = Pull Manifest + Find Intersection

Merchants publish a JSON manifest at /.well-known/ucp: declaring which services, capabilities, payment handlers, REST endpoints, and OpenAPI schemas they support. Agents also bring their own capability profiles.

Then find the intersection: only capabilities both sides support are enabled; only extensions both understand take effect. When encountering a capability gap, the checkout state machine performs graceful degradation—incomplete → requires_escalation → ready_for_complete. For the escalation step, Shopify contributed the Embedded Checkout Protocol (ECP) (based on JSON-RPC 2.0), distilled from their own Checkout Kit, to securely hand state and credentials back to a human or the merchant's own checkout page.

Transport Layer: Pick One of Four

UCP deliberately does not bind to a single transport. The same capability manifest can declare multiple invocation methods; Agents can choose any one to initiate a tool call:

So the correct mental model is:
Use UCP to discover the store and negotiate capabilities; use MCP (or A2A) to execute those tool calls.

When an Agent spends money on your behalf, the most dangerous link is authorization. UCP splits this into two halves.

The first half is inside UCP: payment is modeled as bidirectional dynamic negotiation. The merchant manifest declares which payment handlers it accepts (Shop Pay, Google Pay, and other payment services); the Agent manifest declares which payment instruments it holds (cards, wallets). Available handlers change per transaction—change the cart, change the buyer's region, change any variable, and the available payment methods can shift. The key point: the Agent never touches raw payment or identity data; credentials are tokenized by the credential provider.

The second half is handed to AP2 (Agent Payments Protocol)—UCP's trust and authorization layer. The official documentation puts the division of labor succinctly: UCP handles "what you're buying and from whom"; AP2 handles "who approved this purchase" and provides an audit trail. AP2 plugs into UCP's checkout flow as an extension.

The subtext of this design is: autonomous Agents can spend money on behalf of users within preset, verifiable boundaries—boundaries, authorization, and audit are all pinned down with verifiable credentials, rather than relying on "trusting that this Agent is well-behaved."

Many people treat UCP, MCP, A2A, and AP2 as competing standards—this is the biggest misreading. Google's developer guide on March 18 lays them out as complementary layers, each solving a different problem:

A complete B2B procurement chain is strung together exactly like this: MCP connects to the supplier database to fetch inventory → A2A delegates the quoting task to another Agent → UCP manages the entire ordering flow → AP2 authorizes payment. Google's recommendation is also measured: "Add protocols as needed; for most Agents, starting with MCP is enough."

The data confirms this: among 3,643+ verified merchants as of April 13, 2026, almost 100% declare MCP as the transport layer. UCP handles "discovering the store"; MCP handles "executing tool calls"—the two are partners, not rivals.

The battle over agentic commerce standards is essentially a clash between two governance philosophies. On the other side is OpenAI + Stripe's ACP (Agentic Commerce Protocol).

Industry observers offer a pragmatic conclusion: don't pick just one—integrate both, just as retailers list on both Google Shopping and Amazon. Interestingly, the two protocols are converging: ACP's January 30 update introduced "capability negotiation" and a "payment handler framework," almost directly copying UCP's design patterns.

UCP's Expansion Pace Over the Last Six Months

The protocol launch was just the starting line. By May 20, Google had already pushed UCP's capabilities and monetization forward together:

• →Universal Cart: Save items across retailers, check out uniformly with Google Pay or merchant checkout.
• →Buy Now, Pay Later: Affirm and Klarna embedded directly into Google Pay.
• →YouTube Shoppable Ads + Demand Gen product feeds, converting content traffic directly into checkouts.
• →Vertical expansion: Hotel bookings, food delivery—validating the promise that "the three-layer architecture can grow new verticals."
• →New brand onboarding: Nike, Sephora, Target, Walmart, Wayfair, plus Shopify merchants like Fenty and Steve Madden. US first, then Canada, Australia, UK.

The endorsement list itself is the landscape: beyond the co-developers, Adyen, American Express, Best Buy, Flipkart, Macy's, Mastercard, Stripe, The Home Depot, Visa, and Zalando are all on board—payment networks, card networks, and major retailers are all represented.

UCP's appeal to merchants is real: eliminate the N×N integration cost. But there are no free highways—what merchants surrender is channel control.

eMarketer's Jeremy Goldman puts it directly: "When transactions happen in Google's environment, brands lose control over UX, product presentation, and post-sale interaction"—products degrade from a "brand experience" into "sorted commodities."

The specific costs come in three layers:

• 01The last touchpoint vanishes: Checkout jumps into Gemini, and merchants lose the "add one more item" cross-sell window—which often accounts for 33%–76% of upsells.
• 02Google dependency: Commentators directly analogize this to publishers' reliance on Google Search—once Google changes the algorithm, retailers bear the consequences with no power to push back.
• 03Data and relationship drain: Impression's Aaron Dicks points out that brands have reason to resist technology that "lets customers complete transactions outside their own turf"—transaction data, recommendations, and customer interactions are all intercepted by the intermediary platform.

This is precisely where UCP's "open source + free" strategy is most brilliant and most dangerous: the protocol is free so the standard becomes impossible to refuse; the real toll booth is set at the traffic gateway above the standard. This is the Android playbook, not Linux's.