# Shopify Just Shipped a UCP CLI. It Buys Anywhere — But Only Finds Shopify. > Source: > Published: 2026-05-21 17:09:41+00:00 On **May 18, 2026**, Shopify published [ @shopify/ucp-cli](https://www.npmjs.com/package/@shopify/ucp-cli) to npm — a command-line tool and MCP server it describes as "a shopping skill for AI agents, powered by the [Universal Commerce Protocol](https://ucpchecker.com/protocol)." Within days it's at v0.5.0, MIT-licensed, [open on GitHub](https://github.com/Shopify/ucp-cli). The pitch, from Ilya Grigorik's launch post: millions of Shopify merchants natively speak UCP, billions of products are discoverable through a global catalog, and now any agent can learn to shop them with two commands: ``` npm install -g @shopify/ucp-cli ucp skills add ``` The CLI shipping is not the interesting part. A reference client for a maturing protocol was always coming. **The interesting part is that @shopify/ucp-cli is really two tools wearing one binary — and only one of them leaves Shopify.** One layer is pure, platform-neutral UCP that will transact against any conformant merchant on any stack. The other is a discovery engine hardwired to Shopify's own catalog. Pull them apart and you get a clear read on where the protocol is genuinely open today, and where the gravity still pulls toward the platform with the biggest index. ## What shipped `@shopify/ucp-cli` is agent-first by design. Every command takes and returns structured JSON, so a model can compose payloads and parse results without scraping human-readable output. `ucp skills add` installs a bundled [ SKILL.md](https://agentskills.io) — the operating manual that teaches an agent *when*to search versus discover, how to render totals, how to surface required disclosures, and when to hand off to a human. The full command surface mirrors the UCP shopping service: - `ucp catalog search` /`catalog lookup` /`catalog get_product` — find products - `ucp cart create | update | get | cancel` — build a cart with confirmed pricing - `ucp checkout create | update | complete | cancel` — convert and pay - `ucp order get` — post-purchase status - `ucp discover --business ` — ask a store what it actually supports Two design choices stand out. First, **live introspection**: `ucp discover` and `--input-schema` make real network calls to the merchant, not static doc lookups. The agent composes against whatever the merchant advertises *right now* — including extensions added since it last shopped there. Second, **every response carries a cta** — the CLI tracks where you are in the flow and returns the next-best commands as structured recommendations, so the agent doesn't have to memorize the operating model. There's also a configurable escalation hook ( `UCP_ON_ESCALATION` ) for the moments a merchant needs the human back in the loop.It's a genuinely well-built piece of agent tooling. Which is exactly why the boundary inside it is worth tracing. ## Two layers, two answers The question that matters for everyone who isn't Shopify: **does it work outside Shopify?** The honest answer is that the CLI has two layers, and they answer differently. ### The transaction layer is pure UCP Cart, checkout, order, and per-merchant catalog operations route through the generic `dev.ucp.shopping` service. There is no Shopify branching in the dispatch path. When you pass `--business https://store.example.com` , the CLI fetches that store's `/.well-known/ucp` profile, negotiates a compatible protocol version and transport, and dispatches against the endpoint the merchant advertises — exactly as the spec describes. The capabilities it negotiates against are the neutral ones on `ucp.dev` : ``` dev.ucp.shopping.checkout → ucp.dev/2026-04-08/schemas/shopping/checkout.json dev.ucp.shopping.cart → ucp.dev/2026-04-08/schemas/shopping/cart.json dev.ucp.shopping.catalog.* → ucp.dev/2026-04-08/schemas/shopping/catalog_*.json dev.ucp.shopping.order → ucp.dev/2026-04-08/schemas/shopping/order.json ``` That means a WooCommerce, Magento, BigCommerce, or fully custom store that publishes a valid UCP profile can be carted and checked out by this CLI today. The README says as much in plain language: build carts and complete checkouts "against any UCP-supporting merchant." The transaction layer is real, standards-based, and platform-neutral. ### The discovery layer is Shopify Now run `ucp catalog search` with no `--business` . Where does it go? Straight to a hardcoded default: ``` // package.json "ucp": { "default_catalog_url": "https://catalog.shopify.com" } ``` The "search across millions of merchants" headline resolves against [ catalog.shopify.com](https://shopify.dev/docs/agents/catalog/global-catalog-extension). And the catalog tools aren't even part of core UCP — they're surfaced through two **Shopify-namespaced extensions**, `dev.shopify.catalog` and `dev.shopify.catalog.global` , with schemas served from `shopify.dev` , not `ucp.dev` . The results name their sellers as `*.myshopify.com` domains. (The bundled skill even warns agents to check `variants[*].seller.domain` rather than trust the brand in a product title — a Keychron keyboard in the global catalog might be sold by a third-party Shopify reseller, not Keychron itself.)So the asymmetry, stated plainly: | Layer | Scope | Backed by | |---|---|---| Discovery (`catalog search` , no `--business` ) | Shopify merchants only | `catalog.shopify.com` , `dev.shopify.catalog.global` | Transaction (`--business ` ) | Any UCP merchant, any platform | generic `dev.ucp.shopping` , `ucp.dev` schemas | **It can buy anywhere. It can only find Shopify.** To transact with a non-Shopify store, an agent has to already know that store's URL — the CLI will happily check out there, but it will never surface the store in a search. One smaller detail for implementers: the CLI negotiates a protocol range of `2026-01-23` to `2026-04-08` — the same dated releases — and it doesn't speak the working-draft `"draft"` version. Reference tooling is tracking published spec versions, not `main` . ## Why discovery is the layer that's hard to open This isn't a knock on Shopify, and it isn't an oversight. It's structural. **A transaction is a one-to-one conversation; discovery is an index.** Standardizing a checkout means agreeing on a message shape between two parties who already found each other. UCP does that well, and the CLI proves it — point it at any conformant endpoint and it works. But standardizing *discovery* means someone has to build and host the index of who sells what, keep it fresh, and serve it at query time. That is expensive, and it accrues to whoever already has the catalog. Shopify has millions of merchants and their product data in one place, so a Shopify-backed global catalog is the path of least resistance — for Shopify. The consequence is that as agent commerce matures, the transaction layer commoditizes while discovery concentrates. The protocol gives every merchant an equal ability to *be transacted with*. It does not, on its own, give every merchant an equal ability to *be found*. That gap isn't in the spec — it's in who builds the index on top of it. ## What it means in practice For **Shopify merchants**: you're discoverable by default. Your products sit in the global catalog an agent searches before it knows which store to visit, with no work on your part. That's a real distribution advantage, and it's the clearest argument in the launch. For **non-Shopify merchants** ([WooCommerce](https://ucpchecker.com/platforms/woocommerce), [Magento](https://ucpchecker.com/platforms/magento), [BigCommerce](https://ucpchecker.com/platforms/bigcommerce), and custom stacks): your UCP endpoint works fine with this CLI — an agent that has your URL can cart and check out against you today. But you will not appear in the default `catalog search` . Conformance buys you transactability; it does not buy you discoverability inside a Shopify-owned index. If agent-driven discovery matters to your channel, you need to live in a catalog or directory that spans platforms — and you need your manifest to actually be valid, because an agent that can't parse your profile can't transact with you no matter how it arrived. ([Run a check](https://ucpchecker.com/check).) For **agent builders**: treat the global catalog as a Shopify discovery surface, not a universal one. It's an excellent default for "find me X" with no merchant named. For cross-platform coverage you'll need to bring merchant URLs from elsewhere and lean on `discover --business` . The transaction primitives are solid and genuinely portable; the discovery primitive is platform-scoped. Plan your retrieval layer accordingly. For **evaluators** (us): this sharpens why we run an independent, cross-platform [directory](https://ucpchecker.com/directory). We index UCP merchants by *verification* — does this domain serve a valid, working manifest — not by membership in any one platform's catalog. The WooCommerce and Magento long tail that a Shopify global catalog structurally can't surface is exactly the part of the ecosystem we track. We measured the platform split in our [readiness data](https://ucpchecker.com/blog/agentic-commerce-optimization-ucp-readiness-data) and revisit it every month in the [State of Agentic Commerce](https://ucpchecker.com/blog/state-of-agentic-commerce-may-2026) census; a Shopify-only discovery default is a meaningful shift in how that long tail gets found. ## Where to read more - The package: `@shopify/ucp-cli` on npm - The source: [github.com/Shopify/ucp-cli](https://github.com/Shopify/ucp-cli) - The bundled agent skill: `skills/ucp/SKILL.md` - Shopify's global catalog extension: [global-catalog-extension](https://shopify.dev/docs/agents/catalog/global-catalog-extension) - How the three protocol layers fit together: [MCP vs UCP vs AP2](https://ucpchecker.com/blog/mcp-vs-ucp-vs-ap2-whats-the-difference) ## About UCP Checker UCP Checker is the independent validation and monitoring layer for the [Universal Commerce Protocol](https://ucpchecker.com/protocol). We crawl, validate, and grade every public UCP manifest we can find — across [Shopify](https://ucpchecker.com/platforms/shopify), [WooCommerce](https://ucpchecker.com/platforms/woocommerce), [BigCommerce](https://ucpchecker.com/platforms/bigcommerce), [Magento](https://ucpchecker.com/platforms/magento) and beyond — and run the cross-platform [merchant directory](https://ucpchecker.com/directory), the [UCP Score](https://ucpchecker.com/score), and the [adoption stats](https://ucpchecker.com/stats). If you want to know whether agents can actually transact with your store, on any platform: [run a check](https://ucpchecker.com/check). If you want to catch the moment your store's UCP support changes — a platform update, a spec bump, an endpoint breaking silently — [set up UCP Alerts](https://ucpchecker.com/alerts).