UCP profile

Supporting documents: UCP specification overview

Required by UCP specification overview. Bad: a document is served at /.well-known/ucp but isn't valid JSON with a "ucp" object, so agents can't read it. Fix: serve { "ucp": { "version": ..., "capabilities": ..., "services": ... } }.

Supporting documents: UCP specification overview

Required by UCP specification overview. Bad: the profile omits ucp.services or ucp.payment_handlers, which UCP's business schema requires even when empty, so the document isn't a valid profile whatever else it declares. Fix: declare both keys, e.g. "services": { ... }, "payment_handlers": {}.

Supporting documents: UCP specification overview

Lumar readiness bar: no specification requires this. Bad: no ucp.services entry advertises a connectable transport (rest/mcp/a2a with an https endpoint, or embedded), so agents have no way to connect. This is a Lumar readiness bar, not a schema violation: UCP permits an empty services registry. Fix: declare at least one service binding with its https endpoint.

Supporting documents: UCP specification overview

Required by UCP specification overview. Provisional security check; precision has not yet been measured. Bad: an endpoint, schema, spec or older-version URL in the profile isn't https, so checkout data, or the schema an agent builds requests from, can be read or altered in transit. UCP requires HTTPS for all communication. Fix: serve it over https and change the URL, e.g. "endpoint": "https://shop.example.com/ucp/v1".

An advertised HTTP destination permits unencrypted communication.

Only advertised transport configuration is observed; API deployment security is not fully assessed. Related guidance does not establish exploitation or framework compliance. Security checks are provisional.

Supporting documents: UCP specification overview

Required by UCP specification overview. Provisional security check; precision has not yet been measured. Bad: a capability, service or payment handler's schema is served from a host that doesn't own its name (another domain, an IP address, or a URL with user@ in it). UCP requires the two to match, and agents must reject the entity: anyone could have written that schema. Fix: serve the schema from the domain the name reverses to, e.g. com.example.pay from https://example.com/… or https://pay.example.com/….

A schema authority differs from its declared namespace owner.

Schema provenance is compared; malicious schema execution is not tested. Related guidance does not establish exploitation or framework compliance. Security checks are provisional.

Supporting documents: UCP public key schema, JSON Web Key (JWK)

Required by UCP public key schema and JSON Web Key (JWK). Provisional security check; precision has not yet been measured. Bad: the profile's keys list includes private key material (a JWK d, k or similar member), so anyone who reads the profile can sign as the store. Fix: remove the private members, publish only public keys, and rotate the key: treat the old one as compromised.

Exposed identity material or weak authentication can enable identity misuse.

Actual credential use, permissions and privilege abuse are not tested. Related guidance does not establish exploitation or framework compliance. Security checks are provisional.

Supporting documents: UCP payment mandates extension

Related guidance in UCP payment mandates extension. Provisional security check; precision has not yet been measured. Bad: the profile declares AP2 mandates, which require the store to sign every checkout response, but publishes no keys to verify that signature against, so no agent can confirm the price and items are genuine. Fix: publish the store's public signing key in the profile's top-level "keys" array, with the kid its signatures name.

AP2 is declared without a public key for mandate verification.

Checkout signatures, payment integrity and replay defenses are not tested. Related guidance does not establish exploitation or framework compliance. Security checks are provisional.

Supporting documents: OAuth Authorization Server Metadata, UCP identity linking

Required by OAuth Authorization Server Metadata and UCP identity linking. Provisional security check; precision has not yet been measured. An advertised OAuth provider's metadata names a different issuer. OAuth requires an exact match to prevent issuer impersonation. Publish metadata whose issuer exactly matches the declared auth_url.

Exposed identity material or weak authentication can enable identity misuse.

Actual credential use, permissions and privilege abuse are not tested. Related guidance does not establish exploitation or framework compliance. Security checks are provisional.

Supporting documents: OpenID Connect Discovery, JSON Web Key (JWK)

Required by OpenID Connect Discovery and JSON Web Key (JWK). Provisional security check; precision has not yet been measured. An advertised OAuth provider's public key set carries private material. Remove private members and rotate exposed keys; retain only public verification keys.

Exposed identity material or weak authentication can enable identity misuse.

Actual credential use, permissions and privilege abuse are not tested. Related guidance does not establish exploitation or framework compliance. Security checks are provisional.

Supporting documents: OAuth Authorization Server Metadata

Required by OAuth Authorization Server Metadata. Provisional security check; precision has not yet been measured. An advertised OAuth provider permits none for signed client authentication. OAuth forbids this for token, revocation and introspection endpoint authentication. Remove none from these signing algorithm lists.

The advertised authentication configuration weakens identity protection.

No authenticated transaction or bypass is attempted. Related guidance does not establish exploitation or framework compliance. Security checks are provisional.

Supporting documents: UCP specification overview

Required by UCP specification overview. Bad: /.well-known/ucp answers with a redirect, and UCP forbids both serving the profile that way and following it, so compliant agents never read the profile. Fix: serve the profile directly at /.well-known/ucp with a 200.

Supporting documents: JSON Web Algorithms

Client requirements in JSON Web Algorithms. Provisional security check; precision has not yet been measured. An advertised OAuth provider public key set includes an RSA modulus below 2048 significant bits. No authentication or signature forgery is attempted. Fix: replace the weak key, internal destination or downgraded transport with the intended public secure configuration, as applicable.

A published RSA modulus is below the supported algorithms’ minimum key strength.

Only modulus size is checked; key generation, storage, runtime usage and signature verification are unassessed. Related guidance does not establish exploitation or framework compliance. Security checks are provisional.

Supporting documents: JSON Web Algorithms

Client requirements in JSON Web Algorithms. Provisional security check; precision has not yet been measured. A profile RSA key has a modulus below 2048 significant bits. RFC 7518 sets minimums for RSA algorithm use; publishing a key does not establish how it is used. Fix: replace the weak key, internal destination or downgraded transport with the intended public secure configuration, as applicable.

A published RSA modulus is below the supported algorithms’ minimum key strength.

Only modulus size is checked; key generation, storage, runtime usage and signature verification are unassessed. Related guidance does not establish exploitation or framework compliance. Security checks are provisional.

Supporting documents: UCP specification overview

Required by UCP specification overview. Bad: ucp.version is missing or not a real YYYY-MM-DD date, so agents can't tell which UCP revision to negotiate. Fix: set it to the spec date implemented, e.g. "version": "2026-01-15".

Supporting documents: UCP specification overview

Lumar readiness bar: no specification requires this. Provisional security check; precision has not yet been measured. Bad: a service endpoint only works inside a private network (localhost, a private or link-local IP, an internal name), so it is unreachable from the public internet and the public profile discloses part of the internal network. A Lumar bar: UCP's address rule covers profile fetches, not endpoints. Fix: publish the public https address agents should call.

Public discovery metadata reveals internal service addresses.

Reachability, authorization and SSRF exploitation are not tested. Related guidance does not establish exploitation or framework compliance. Security checks are provisional.

Supporting documents: UCP specification overview, HTTP Message Signatures, CFRG keys in JOSE, JSON Web Key (JWK), JSON Web Signature, JOSE examples

Lumar readiness bar: no specification requires this. Provisional security check; precision has not yet been measured. Bad: the profile publishes a known RFC example key whose private half is printed in the RFC, so anyone can sign as the store. This broader production-key bar is Lumar's; development profiles may intentionally use examples. Fix: generate a new key pair, publish only its public half, and sign with that instead.

Exposed identity material or weak authentication can enable identity misuse.

Actual credential use, permissions and privilege abuse are not tested. Related guidance does not establish exploitation or framework compliance. Security checks are provisional.

Supporting documents: UCP specification overview

Required by UCP specification overview. Bad: the profile's Cache-Control header isn't public with a max-age of at least 60 seconds, or says private, no-store or no-cache, which UCP's hosting rules forbid because profiles are stable documents shared caches should hold. Fix: send Cache-Control: public, max-age=300.

Supporting documents: UCP specification overview

UCP specification overview permits this, so it never fails the site. Informational (does not fail ucpValid): the profile declares no usable capability (a reverse-domain "verb" such as dev.ucp.shopping.checkout with a versioned schema). UCP makes capabilities optional, but declaring them tells agents what the store actually supports.