Shopify Just Shipped a UCP CLI. It Buys Anywhere — But Only Finds Shopify.

On May 18, 2026, Shopify released @shopify/ucp-cli, an open-source command-line tool and MCP server that functions as an AI shopping agent powered by the Universal Commerce Protocol (UCP). The CLI contains two distinct layers: a platform-neutral transaction layer that can process carts, checkouts, and orders against any UCP-supporting merchant (including WooCommerce, Magento, or custom stores), and a discovery engine hardwired to Shopify's own product catalog. While the tool is designed for AI agents with structured JSON inputs and live merchant introspection, its search functionality defaults to Shopify's catalog when no specific merchant is provided, revealing where the protocol remains genuinely open versus tied to Shopify's platform.

On May 18, 2026 , Shopify published @shopify/ucp-cli https://www.npmjs.com/package/@shopify/ucp-cli to npm — a command-line tool and MCP server it describes as "a shopping skill for AI agents, powered by the Universal Commerce Protocol https://ucpchecker.com/protocol ." Within days it's at v0.5.0, MIT-licensed, open on GitHub https://github.com/Shopify/ucp-cli . The pitch, from Ilya Grigorik's launch post: millions of Shopify merchants natively speak UCP, billions of products are discoverable through a global catalog, and now any agent can learn to shop them with two commands: npm install -g @shopify/ucp-cli ucp skills add The CLI shipping is not the interesting part. A reference client for a maturing protocol was always coming. The interesting part is that @shopify/ucp-cli is really two tools wearing one binary — and only one of them leaves Shopify. One layer is pure, platform-neutral UCP that will transact against any conformant merchant on any stack. The other is a discovery engine hardwired to Shopify's own catalog. Pull them apart and you get a clear read on where the protocol is genuinely open today, and where the gravity still pulls toward the platform with the biggest index. What shipped @shopify/ucp-cli is agent-first by design. Every command takes and returns structured JSON, so a model can compose payloads and parse results without scraping human-readable output. ucp skills add installs a bundled SKILL.md https://agentskills.io — the operating manual that teaches an agent when to search versus discover, how to render totals, how to surface required disclosures, and when to hand off to a human. The full command surface mirrors the UCP shopping service: - ucp catalog search / catalog lookup / catalog get product — find products - ucp cart create | update | get | cancel — build a cart with confirmed pricing - ucp checkout create | update | complete | cancel — convert and pay - ucp order get — post-purchase status - ucp discover --business <url — ask a store what it actually supports Two design choices stand out. First, live introspection : ucp discover and --input-schema make real network calls to the merchant, not static doc lookups. The agent composes against whatever the merchant advertises right now — including extensions added since it last shopped there. Second, every response carries a cta — the CLI tracks where you are in the flow and returns the next-best commands as structured recommendations, so the agent doesn't have to memorize the operating model. There's also a configurable escalation hook UCP ON ESCALATION for the moments a merchant needs the human back in the loop.It's a genuinely well-built piece of agent tooling. Which is exactly why the boundary inside it is worth tracing. Two layers, two answers The question that matters for everyone who isn't Shopify: does it work outside Shopify? The honest answer is that the CLI has two layers, and they answer differently. The transaction layer is pure UCP Cart, checkout, order, and per-merchant catalog operations route through the generic dev.ucp.shopping service. There is no Shopify branching in the dispatch path. When you pass --business https://store.example.com , the CLI fetches that store's /.well-known/ucp profile, negotiates a compatible protocol version and transport, and dispatches against the endpoint the merchant advertises — exactly as the spec describes. The capabilities it negotiates against are the neutral ones on ucp.dev : dev.ucp.shopping.checkout → ucp.dev/2026-04-08/schemas/shopping/checkout.json dev.ucp.shopping.cart → ucp.dev/2026-04-08/schemas/shopping/cart.json dev.ucp.shopping.catalog. → ucp.dev/2026-04-08/schemas/shopping/catalog .json dev.ucp.shopping.order → ucp.dev/2026-04-08/schemas/shopping/order.json That means a WooCommerce, Magento, BigCommerce, or fully custom store that publishes a valid UCP profile can be carted and checked out by this CLI today. The README says as much in plain language: build carts and complete checkouts "against any UCP-supporting merchant." The transaction layer is real, standards-based, and platform-neutral. The discovery layer is Shopify Now run ucp catalog search with no --business . Where does it go? Straight to a hardcoded default: // package.json "ucp": { "default catalog url": "https://catalog.shopify.com" } The "search across millions of merchants" headline resolves against catalog.shopify.com https://shopify.dev/docs/agents/catalog/global-catalog-extension . And the catalog tools aren't even part of core UCP — they're surfaced through two Shopify-namespaced extensions , dev.shopify.catalog and dev.shopify.catalog.global , with schemas served from shopify.dev , not ucp.dev . The results name their sellers as .myshopify.com domains. The bundled skill even warns agents to check variants .seller.domain rather than trust the brand in a product title — a Keychron keyboard in the global catalog might be sold by a third-party Shopify reseller, not Keychron itself. So the asymmetry, stated plainly: | Layer | Scope | Backed by | |---|---|---| Discovery catalog search , no --business | Shopify merchants only | catalog.shopify.com , dev.shopify.catalog.global | Transaction --business <url | Any UCP merchant, any platform | generic dev.ucp.shopping , ucp.dev schemas | It can buy anywhere. It can only find Shopify. To transact with a non-Shopify store, an agent has to already know that store's URL — the CLI will happily check out there, but it will never surface the store in a search. One smaller detail for implementers: the CLI negotiates a protocol range of 2026-01-23 to 2026-04-08 — the same dated releases — and it doesn't speak the working-draft "draft" version. Reference tooling is tracking published spec versions, not main . Why discovery is the layer that's hard to open This isn't a knock on Shopify, and it isn't an oversight. It's structural. A transaction is a one-to-one conversation; discovery is an index. Standardizing a checkout means agreeing on a message shape between two parties who already found each other. UCP does that well, and the CLI proves it — point it at any conformant endpoint and it works. But standardizing discovery means someone has to build and host the index of who sells what, keep it fresh, and serve it at query time. That is expensive, and it accrues to whoever already has the catalog. Shopify has millions of merchants and their product data in one place, so a Shopify-backed global catalog is the path of least resistance — for Shopify. The consequence is that as agent commerce matures, the transaction layer commoditizes while discovery concentrates. The protocol gives every merchant an equal ability to be transacted with . It does not, on its own, give every merchant an equal ability to be found . That gap isn't in the spec — it's in who builds the index on top of it. What it means in practice For Shopify merchants : you're discoverable by default. Your products sit in the global catalog an agent searches before it knows which store to visit, with no work on your part. That's a real distribution advantage, and it's the clearest argument in the launch. For non-Shopify merchants WooCommerce https://ucpchecker.com/platforms/woocommerce , Magento https://ucpchecker.com/platforms/magento , BigCommerce https://ucpchecker.com/platforms/bigcommerce , and custom stacks : your UCP endpoint works fine with this CLI — an agent that has your URL can cart and check out against you today. But you will not appear in the default catalog search . Conformance buys you transactability; it does not buy you discoverability inside a Shopify-owned index. If agent-driven discovery matters to your channel, you need to live in a catalog or directory that spans platforms — and you need your manifest to actually be valid, because an agent that can't parse your profile can't transact with you no matter how it arrived. Run a check https://ucpchecker.com/check . For agent builders : treat the global catalog as a Shopify discovery surface, not a universal one. It's an excellent default for "find me X" with no merchant named. For cross-platform coverage you'll need to bring merchant URLs from elsewhere and lean on discover --business . The transaction primitives are solid and genuinely portable; the discovery primitive is platform-scoped. Plan your retrieval layer accordingly. For evaluators us : this sharpens why we run an independent, cross-platform directory https://ucpchecker.com/directory . We index UCP merchants by verification — does this domain serve a valid, working manifest — not by membership in any one platform's catalog. The WooCommerce and Magento long tail that a Shopify global catalog structurally can't surface is exactly the part of the ecosystem we track. We measured the platform split in our readiness data https://ucpchecker.com/blog/agentic-commerce-optimization-ucp-readiness-data and revisit it every month in the State of Agentic Commerce https://ucpchecker.com/blog/state-of-agentic-commerce-may-2026 census; a Shopify-only discovery default is a meaningful shift in how that long tail gets found. Where to read more - The package: @shopify/ucp-cli on npm - The source: github.com/Shopify/ucp-cli https://github.com/Shopify/ucp-cli - The bundled agent skill: skills/ucp/SKILL.md - Shopify's global catalog extension: global-catalog-extension https://shopify.dev/docs/agents/catalog/global-catalog-extension - How the three protocol layers fit together: MCP vs UCP vs AP2 https://ucpchecker.com/blog/mcp-vs-ucp-vs-ap2-whats-the-difference About UCP Checker UCP Checker is the independent validation and monitoring layer for the Universal Commerce Protocol https://ucpchecker.com/protocol . We crawl, validate, and grade every public UCP manifest we can find — across Shopify https://ucpchecker.com/platforms/shopify , WooCommerce https://ucpchecker.com/platforms/woocommerce , BigCommerce https://ucpchecker.com/platforms/bigcommerce , Magento https://ucpchecker.com/platforms/magento and beyond — and run the cross-platform merchant directory https://ucpchecker.com/directory , the UCP Score https://ucpchecker.com/score , and the adoption stats https://ucpchecker.com/stats . If you want to know whether agents can actually transact with your store, on any platform: run a check https://ucpchecker.com/check . If you want to catch the moment your store's UCP support changes — a platform update, a spec bump, an endpoint breaking silently — set up UCP Alerts https://ucpchecker.com/alerts .