Home / Blog / ACP, AP2 and MCP explained

UCP, ACP, AP2 and MCP, explained simply

7 min read · Protocols · Updated 2026

Agentic commerce runs on plumbing, and that plumbing has names. Four open standards, UCP, ACP, AP2 and MCP, describe how an AI agent connects to a store, proves it is allowed to pay, completes a purchase, and learns what your store can do in the first place. If you build or run e-commerce stores, these are the interfaces your storefront will be judged against. Here is what each one does, in plain English, and what it asks of your store.

The names look like alphabet soup, but the ideas are simple. An agent shopping on a person's behalf has to do a few separable jobs: discover what your store supports, reach and read your data, prove it has permission to spend money, and drive a checkout to completion. The industry did not want a different bespoke integration per agent and per merchant, so it is converging on shared, open protocols for each job. They are still moving, but they are the direction the market is walking in, and a store built to speak them is a store an agent can actually buy from.

MCP: how an agent connects to your data and tools

The Model Context Protocol (MCP), from Anthropic, is the open standard for how an AI agent connects to and reads external data and tools. People call it "the USB-C for AI" for a reason: before MCP, every model-to-system connection was a custom cable. MCP defines one socket. A store, a catalogue, an inventory service or an internal tool can expose itself through an MCP server, and any agent that speaks MCP can plug in, discover what is available, and read or call it without a bespoke integration.

For a store, MCP is about being reachable and legible on the agent's terms. It is the difference between an agent scraping a rendered page and hoping, versus an agent asking a well-described interface "what products match, what is in stock, what does this cost" and getting structured answers. If your product data, availability and pricing are exposed through a clean, well-described surface, an MCP-speaking agent can comprehend your catalogue instead of guessing at it. This is the access and comprehension side of readiness: can the agent get in, and can it understand what it found.

AP2: how an agent proves it is allowed to pay

The Agent Payments Protocol (AP2), led by Google with more than 60 payment networks including Mastercard, PayPal and American Express, solves the trust problem underneath machine-initiated payments. When software, not a human, presses buy, the merchant has a fair question: who authorised this, and for how much? AP2 answers it with signed "mandates", verifiable credentials that carry cryptographic proof the shopper granted this agent permission to make this purchase within set limits.

Think of a mandate as a tamper-evident permission slip. The shopper says, in effect, "this agent may spend up to this amount on this kind of thing," and that intent is signed so a merchant can verify it was not forged or altered. That is what lets a store accept a payment from a machine without treating every agent as a fraud risk. For your store, AP2 lands on the identity and trust layer: can you confirm who is on the other end, and can you trust that a machine-initiated payment is genuinely authorised. A store aligned with AP2 can say yes to a buyer it has never seen click a button.

ACP: how an agent completes the purchase

The Agentic Commerce Protocol (ACP), from OpenAI and Stripe, is the open standard for how an AI agent gets from a product to a completed purchase: feed to cart to checkout. It began as the protocol behind in-chat buying in ChatGPT, and it is worth knowing how that turned out. OpenAI launched Instant Checkout in September 2025 and withdrew it in March 2026, after very few merchants completed an integration and conversion in the chat window came in far below the same merchants' own storefronts. ACP did not go away; its role shifted. Today it standardises how an agent retrieves a live product feed with accurate photos, price and stock variants, and then hands the shopper into the merchant's own checkout.

That correction is the most useful thing in this article. The market tried moving the transaction onto the AI platform, and it did not hold. Discovery and reasoning belong to the agent; the cart, the checkout and the customer relationship stay on infrastructure you own. Which means readiness is your job, and it is not something a platform will do for you.

For a store, ACP is the transactability layer made concrete. It is not enough that an agent can find you and trust you; it has to be able to buy without a human tabbing through modals and address forms. A store built to speak ACP exposes a clean product feed, a cart an agent can construct, and a checkout an agent can complete. This is where "mentioned by AI" turns into "bought through AI," and it is the layer most stores have never tested, because a human checkout that works fine says nothing about whether a machine can drive the same flow.

UCP: how your store declares what it can do

The fourth standard is the one that ties the others together. UCP, the Universal Commerce Protocol, was co-developed by Google and Shopify and launched at NRF in January 2026. Where ACP standardises the checkout and AP2 standardises the payment authorisation, UCP covers the whole commerce journey, from discovery through cart to post-purchase support.

Its central idea is decentralised discovery. Instead of every AI platform negotiating a private integration with every retailer, your store publishes a JSON manifest at /.well-known/ucp declaring the capabilities it supports (for example dev.ucp.shopping.checkout), the schema versions it speaks, its payment handlers, and the public signing keys an agent can verify requests against. Any compliant agent reads that manifest and knows how to work with you.

UCP is also transport-agnostic. It rides over plain REST, over MCP, or over Google's Agent-to-Agent standard, which means a UCP capability exposed as an MCP tool is instantly callable by any MCP-compatible agent. Its adopter list already includes Etsy, Wayfair, Walmart, Target and Home Depot, and its technical council has grown to include Amazon, Meta, Microsoft, Salesforce and Stripe. Importantly for merchants, UCP keeps you as the Merchant of Record: you retain the customer relationship and the first-party transaction data. There is a full guide to UCP here.

How UCP, ACP, AP2 and MCP map to the five readiness layers

Goofre™ scores a store across five layers, and each protocol lands on specific ones. The layers gate each other in order, so an agent that cannot get past an early layer never reaches the later ones. UCP spans the whole journey, which is why it shows up at more than one level.

• Access. Can the agent reach your content and interfaces at all? This is where MCP starts: a described, connectable surface an agent can plug into rather than scrape.
• Comprehension. Can it understand what it reached? Structured products, offers, price and availability, exposed cleanly. MCP carries this too, turning a page into an answerable interface.
• Identity and trust. Can the agent, and the payment behind it, be trusted? AP2 lives here, with signed mandates that prove a machine-initiated payment was authorised.
• Transactability. Can it actually buy? ACP owns this layer: feed, cart and a checkout an agent can drive to completion.
• Reliability. Does it all stay true over time? No single protocol guarantees this. It is the discipline of keeping stock, price and terms accurate so an agent that bought once is not embarrassed the next time.
• Across all five: UCP. The manifest declares what your store supports, the capability schemas describe how each operation behaves, and the signing keys let an agent verify it is talking to the real you. UCP is the standard Goofre™ scores conformance against most directly.

Read top to bottom, they line up almost cleanly: MCP gets the agent in and reading, AP2 lets it be trusted to pay, ACP lets it complete the sale, and UCP is how your store announces that all of this is on offer. Reliability is the layer you own by operating well, not by adopting a spec.

Mentioned is not the same as buyable

It is worth being blunt about the gap these protocols expose. Search engine optimisation, and its newer cousin answer engine optimisation, work hard to get your store mentioned by AI. That is real, and it matters, but it covers roughly the access and comprehension layers and stops there. Being talked about by an assistant is not the same as being buyable by one.

UCP, ACP, AP2 and MCP are what make a store buyable rather than merely mentioned. A store can rank beautifully in an AI answer and still be a dead end at checkout because it cannot prove a payment is authorised or cannot let a machine complete an order. The mention is marketing. The protocols are revenue. Measuring one tells you nothing about the other, which is exactly why readiness needs its own score.