agentic‑readiness docs
/
Scan at scale Blog Build one › Run a scan ›
Menu

Scan at scaleSites with a broken UCP profile

Sites with a broken UCP profile

A site-wide report: one row per host, over the ucp rows the crawl emitted.

What this report returns

A UCP profile (/.well-known/ucp, the emerging Google/Shopify Universal Commerce Protocol) declares the endpoints, capabilities and signing keys agents transact through.

A row appears here when any of these is wrong, worst first:

  • Invalid DocumentA document is served at /.well-known/ucp but isn't valid JSON with a "ucp" object, so agents can't read it.Fix Serve { "ucp": { "version": ..., "capabilities": ..., "services": ... } }.
  • Missing Required RegistriesThe profile omits ucp.services or ucp.payment_handlers, which UCP's business schema requires even when empty, so the document isn't a valid profile whatever else it declares.Fix Declare both keys, e.g. "services": { ... }, "payment_handlers": {}.
  • Missing TransportsNo ucp.services entry advertises a connectable transport (rest/mcp/a2a with an https endpoint, or embedded), so agents have no way to connect. This is a Lumar readiness bar, not a schema violation: UCP permits an empty services registry.Fix Declare at least one service binding with its https endpoint.
  • Insecure URLAn endpoint, schema, spec or older-version URL in the profile isn't https, so checkout data, or the schema an agent builds requests from, can be read or altered in transit. UCP requires HTTPS for all communication.Fix Serve it over https and change the URL, e.g. "endpoint": "https://shop.example.com/ucp/v1".
  • Schema Authority MismatchA capability, service or payment handler's schema is served from a host that doesn't own its name (another domain, an IP address, or a URL with user@ in it). UCP requires the two to match, and agents must reject the entity: anyone could have written that schema.Fix Serve the schema from the domain the name reverses to, e.g. com.example.pay from https://example.com/… or https://pay.example.com/….
  • Private Key ExposedThe profile's keys list includes private key material (a JWK d, k or similar member), so anyone who reads the profile can sign as the store.Fix Remove the private members, publish only public keys, and rotate the key: treat the old one as compromised.
  • AP2 Mandate Without Signing KeyThe profile declares AP2 mandates, which require the store to sign every checkout response, but publishes no keys to verify that signature against, so no agent can confirm the price and items are genuine.Fix Publish the store's public signing key in the profile's top-level "keys" array, with the kid its signatures name.
  • Redirected Profile/.well-known/ucp answers with a redirect, and UCP forbids both serving the profile that way and following it, so compliant agents never read the profile.Fix Serve the profile directly at /.well-known/ucp with a 200.
  • Invalid VersionUcp.version is missing or not a real YYYY-MM-DD date, so agents can't tell which UCP revision to negotiate.Fix Set it to the spec date implemented, e.g. "version": "2026-01-15".
  • Internal EndpointA service endpoint only works inside a private network (localhost, a private or link-local IP, an internal name), so it is unreachable from the public internet and the public profile discloses part of the internal network. A Lumar bar: UCP's address rule covers profile fetches, not endpoints.Fix Publish the public https address agents should call.
  • Test KeyThe profile publishes a known RFC example key whose private half is printed in the RFC, so anyone can sign as the store. This broader production-key bar is Lumar's; development profiles may intentionally use examples.Fix Generate a new key pair, publish only its public half, and sign with that instead.
  • Invalid Cache-ControlThe profile's Cache-Control header isn't public with a max-age of at least 60 seconds, or says private, no-store or no-cache, which UCP's hosting rules forbid because profiles are stable documents shared caches should hold.Fix Send Cache-Control: public, max-age=300.

(A profile with no declared capabilities is shown for context: capabilities are optional in UCP.)

Security checks are provisional; precision has not yet been measured. A clean row is not a security assessment.

The columns it shows

Every defect this technology can carry is a column in the grid, worst first, so nothing is hidden behind a filter you have to know to apply.

  • Hosthost
  • UCP Profile ValiducpValid
  • UCP Profile Conformance Issue DetecteducpConformanceIssueDetected
  • UCP Security Risk DetecteducpSecurityRiskDetected
  • UCP FindingsucpFindings
  • UCP Partially AssesseducpPartiallyAssessed
  • UCP Declared VersionucpDeclaredVersion
  • UCP Capability NamesucpCapabilityNames
  • UCP Transport NamesucpTransportNames
  • UCP Invalid DocumentucpInvalidDocument
  • UCP Missing Required RegistriesucpMissingRequiredRegistries
  • UCP Missing TransportsucpMissingTransports
  • UCP Insecure URLucpInsecureUrl
  • UCP Schema Authority MismatchucpSchemaAuthorityMismatch
  • UCP Private Key ExposeducpPrivateKeyExposed
  • UCP AP2 Mandate Without Signing KeyucpAp2MandateWithoutSigningKey
  • UCP OAuth Issuer MismatchucpOAuthIssuerMismatch
  • UCP OAuth Private Key ExposeducpOAuthPrivateKeyExposed
  • UCP OAuth Unsigned Signing AlgorithmucpOAuthUnsignedSigningAlgorithm
  • UCP Redirected ProfileucpRedirectedProfile
  • UCP OAuth Weak RSA KeyucpOAuthWeakRsaKey
  • UCP Weak RSA KeyucpWeakRsaKey
  • UCP Invalid VersionucpInvalidVersion
  • UCP Internal EndpointucpInternalEndpoint
  • UCP Test KeyucpTestKey
  • UCP Invalid Cache-ControlucpInvalidCacheControl
  • UCP Missing CapabilitiesucpMissingCapabilities
  • Ruleset VersionrulesetVersion
  • Security Check StatussecurityCheckStatus
  • Related Security FrameworkssecurityFrameworkReferences

About UCP profile

Universal Commerce Protocol discovery for agentic shopping.

Read how UCP profile is checked, including the specification it is validated against and a worked correct and broken example.

Running it

This report comes with Agentic Readiness in Lumar and appears on every crawl of any project that has it turned on. See the whole set, or check a single URL with the scanner on this site, which runs the same code with no account.

Get Lumar pricing