What we found scanning real e-commerce sites for Universal Commerce Protocol readiness, and how to fix each one
AI shopping agents are arriving. Google and Shopify introduced the Universal Commerce Protocol (UCP) at Google I/O. Zalando, DoorDash, and Walmart have announced agent-driven checkout. But when you drop to the technical layer, most stores are invisible to these agents.
I built Karuma (https://karuma.dev/en) to measure exactly that. It is a free, no-registration scanner that streams a live NDJSON audit of any public storefront against the UCP specification. It checks three layers:
/.well-known/ucp manifest)YYYY-MM-DD, HTTPS, and working transport ( REST, MCP, A2A, Embedded). Product + Offer in JSON-LD)490.00, not "490,00 € Todo incluido"), priceCurrency in ISO 4217 (EUR, USD), availability as a canonical Schema.org URI (https://schema.org/InStock), and global identifiers ( gtin13/ sku/ mpn + brand). robots.txt without accidental blocks on AI shopping crawlers, accessible sitemap.xml, and parity between visible HTML and structured JSON.
Karuma also renders a side-by-side view (what a human sees vs. what the agent reads in JSON) and emits a shareable report with exact evidence and concrete fix steps.
After scanning dozens of production stores across Shopify, WooCommerce, PrestaShop, and custom stacks, five failures repeat constantly. Here they are with real snippets.
200 OK
The UCP manifest is the front door. If it is absent, the agent assumes no agentic commerce support. Worse: some stacks return a custom 404 page as HTML with status 200. The parser chokes on <!DOCTYPE html> instead of JSON.
What the agent receives:
GET /.well-known/ucp
HTTP/1.1 200 OK
Content-Type: text/html
<!DOCTYPE html>
<html><body>Page not found</body></html>
What it should return:
{
"version": "2026-08-25",
"capabilities": ["catalog.read", "checkout.initiate", "orders.read"],
"transports": [
{ "type": "REST", "endpoint": "https://api.store.com/ucp" },
{ "type": "MCP", "endpoint": "https://mcp.store.com" }
],
"policies": {
"shipping": ["ES", "PT", "FR"],
"returns": "https://store.com/returns"
}
}
Fix: Add a static file or lightweight endpoint at /.well-known/ucp returning valid JSON with Content-Type: application/json. Ensure your CDN/WAF does not rewrite 404s to HTML pages.
Agents parse Offer.price as a number. They fail on "49,99 €" or "From 49.99" or "490,00 € Todo incluido". They also require priceCurrency as a three-letter ISO 4217 code.
Broken JSON-LD:
{
"@type": "Offer",
"price": "49,99 €",
"priceCurrency": "EUR"
}
Correct JSON-LD:
{
"@type": "Offer",
"price": "49.99",
"priceCurrency": "EUR",
"availability": "https://schema.org/InStock"
}
Fix: Emit price as a plain number with a dot decimal separator. Keep priceCurrency strictly ISO 4217. Strip all formatting, currency symbols, and marketing text from the structured data layer.
schema.org URI
Schema.org defines enumerated values for availability. Agents expect the full URI. Custom strings like "In Stock", "Available", "Disponible", or "✓ En stock" are not machine-readable.
Broken:
"availability": "In Stock"
Correct:
"availability": "https://schema.org/InStock"
Other valid values: https://schema.org/OutOfStock, https://schema.org/PreOrder, https://schema.org/LimitedAvailability.
Fix: Map your internal stock states to the exact Schema.org URIs. Do not localise or abbreviate.
An agent needs to distinguish variants. Product without sku, gtin13, mpn, and brand is ambiguous. The agent cannot match the item to a catalog entry or verify identity across feeds.
Minimal viable identity:
{
"@type": "Product",
"name": "Organic Cotton T-Shirt",
"sku": "TSH-ORG-M-BLU",
"gtin13": "8412345678901",
"brand": {
"@type": "Brand",
"name": "EcoWear"
}
}
Fix: Populate at least one of gtin13, sku, or mpn plus brand.name on every Product. For variants, each SKU needs its own Product node with distinct identifiers.
A manifest that advertises transports with endpoints returning 404, 500, or timing out is worse than no manifest. It wastes the agent's budget and signals unreliability.
Manifest declares:
"transports": [
{ "type": "MCP", "endpoint": "https://mcp.store.com" },
{ "type": "REST", "endpoint": "https://api.store.com/ucp" }
]
Reality:
https://mcp.store.com -> DNS resolves, TCP connects, TLS handshake, then HTTP 502https://api.store.com/ucp -> 404 Not Found
Fix: Treat the manifest as a contract. Only declare transports that are live, authenticated correctly, and respond within the UCP latency budget. Remove or disable entries for deprecated endpoints.
Karuma's scanner is free, open, and requires no registration. Paste any storefront URL at https://karuma.dev/en and get a streaming audit in seconds. The report shows exact evidence (HTTP status, headers, JSON snippets) and a prioritized technical backlog.
For store teams that want the missing files generated and verified without writing them from scratch, we also launched the Karuma GEO & Fix Pack (https://karuma.dev/en/geo-pack):
.zip with llms.txt, llms-full.txt, schema-patches.html with Organization/ FAQPage JSON-LD @graph, robots-ai-patch.txt + ucp.json, and rag-landing-rewrites.md), installable in 45–90 minutes.[COMPLETAR_DATO_REAL] rather than invented.
Try the live scanner at karuma.dev/en or check the GEO & Fix Pack at karuma.dev/en/geo-pack (also in Spanish at karuma.dev/es and karuma.dev/es/geo-pack).