# Sites with a broken UCP profile A site-wide report: one row per host, over the ucp rows the crawl emitted. ## What this report returns A UCP profile (`/.well-known/ucp`, the emerging Google/Shopify Universal Commerce Protocol) declares the endpoints, capabilities and signing keys agents transact through. A row appears here when any of these is wrong, worst first: - **Invalid Document**A document is served at `/.well-known/ucp` but isn't valid JSON with a `"ucp"` object, so agents can't read it.**Fix** Serve `{ "ucp": { "version": ..., "capabilities": ..., "services": ... } }`. - **Missing Required Registries**The profile omits ucp.services or ucp.`payment_handlers`, which UCP's business schema requires even when empty, so the document isn't a valid profile whatever else it declares.**Fix** Declare both keys, e.g. `"services": { ... }, "payment_handlers": {}`. - **Missing Transports**No ucp.services entry advertises a connectable transport (rest/mcp/a2a with an https endpoint, or embedded), so agents have no way to connect. This is a Lumar readiness bar, not a schema violation: UCP permits an empty services registry.**Fix** Declare at least one service binding with its https endpoint. - **Insecure URL**An endpoint, schema, spec or older-version URL in the profile isn't https, so checkout data, or the schema an agent builds requests from, can be read or altered in transit. UCP requires HTTPS for all communication.**Fix** Serve it over https and change the URL, e.g. `"endpoint": "https://shop.example.com/ucp/v1"`. - **Schema Authority Mismatch**A capability, service or payment handler's schema is served from a host that doesn't own its name (another domain, an IP address, or a URL with user@ in it). UCP requires the two to match, and agents must reject the entity: anyone could have written that schema.**Fix** Serve the schema from the domain the name reverses to, e.g. com.example.pay from `https://example.com/`… or `https://pay.example.com/`…. - **Private Key Exposed**The profile's keys list includes private key material (a JWK d, k or similar member), so anyone who reads the profile can sign as the store.**Fix** Remove the private members, publish only public keys, and rotate the key: treat the old one as compromised. - **AP2 Mandate Without Signing Key**The profile declares AP2 mandates, which require the store to sign every checkout response, but publishes no keys to verify that signature against, so no agent can confirm the price and items are genuine.**Fix** Publish the store's public signing key in the profile's top-level `"keys"` array, with the kid its signatures name. - **Redirected Profile**`/.well-known/ucp` answers with a redirect, and UCP forbids both serving the profile that way and following it, so compliant agents never read the profile.**Fix** Serve the profile directly at `/.well-known/ucp` with a 200. - **Invalid Version**Ucp.version is missing or not a real YYYY-MM-DD date, so agents can't tell which UCP revision to negotiate.**Fix** Set it to the spec date implemented, e.g. `"version": "2026-01-15"`. - **Internal Endpoint**A service endpoint only works inside a private network (localhost, a private or link-local IP, an internal name), so it is unreachable from the public internet and the public profile discloses part of the internal network. A Lumar bar: UCP's address rule covers profile fetches, not endpoints.**Fix** Publish the public https address agents should call. - **Test Key**The profile publishes a known RFC example key whose private half is printed in the RFC, so anyone can sign as the store. This broader production-key bar is Lumar's; development profiles may intentionally use examples.**Fix** Generate a new key pair, publish only its public half, and sign with that instead. - **Invalid Cache-Control**The profile's `Cache-Control` header isn't public with a max-age of at least 60 seconds, or says private, no-store or no-cache, which UCP's hosting rules forbid because profiles are stable documents shared caches should hold.**Fix** Send `Cache-Control: public, max-age=300`. (A profile with no declared capabilities is shown for context: capabilities are optional in UCP.) Security checks are provisional; precision has not yet been measured. A clean row is not a security assessment. ## The columns it shows Every defect this technology can carry is a column in the grid, worst first, so nothing is hidden behind a filter you have to know to apply. - Host`host` - UCP Profile Valid`ucpValid` - UCP Profile Conformance Issue Detected`ucpConformanceIssueDetected` - UCP Security Risk Detected`ucpSecurityRiskDetected` - UCP Findings`ucpFindings` - UCP Partially Assessed`ucpPartiallyAssessed` - UCP Declared Version`ucpDeclaredVersion` - UCP Capability Names`ucpCapabilityNames` - UCP Transport Names`ucpTransportNames` - UCP Invalid Document`ucpInvalidDocument` - UCP Missing Required Registries`ucpMissingRequiredRegistries` - UCP Missing Transports`ucpMissingTransports` - UCP Insecure URL`ucpInsecureUrl` - UCP Schema Authority Mismatch`ucpSchemaAuthorityMismatch` - UCP Private Key Exposed`ucpPrivateKeyExposed` - UCP AP2 Mandate Without Signing Key`ucpAp2MandateWithoutSigningKey` - UCP OAuth Issuer Mismatch`ucpOAuthIssuerMismatch` - UCP OAuth Private Key Exposed`ucpOAuthPrivateKeyExposed` - UCP OAuth Unsigned Signing Algorithm`ucpOAuthUnsignedSigningAlgorithm` - UCP Redirected Profile`ucpRedirectedProfile` - UCP OAuth Weak RSA Key`ucpOAuthWeakRsaKey` - UCP Weak RSA Key`ucpWeakRsaKey` - UCP Invalid Version`ucpInvalidVersion` - UCP Internal Endpoint`ucpInternalEndpoint` - UCP Test Key`ucpTestKey` - UCP Invalid Cache-Control`ucpInvalidCacheControl` - UCP Missing Capabilities`ucpMissingCapabilities` - Ruleset Version`rulesetVersion` - Security Check Status`securityCheckStatus` - Related Security Frameworks`securityFrameworkReferences` ## About UCP profile Universal Commerce Protocol discovery for agentic shopping. [Read how UCP profile is checked](https://agentic-readiness.lumar.io/docs/commerce/ucp), including the specification it is validated against and a worked correct and broken example. ## Running it This report comes with Agentic Readiness in Lumar and appears on every crawl of any project that has it turned on. [See the whole set](https://agentic-readiness.lumar.io/scan-at-scale), or check a single URL with the [scanner on this site](https://agentic-readiness.lumar.io/), which runs the same code with no account. [Get Lumar pricing →](https://www.lumar.io/pricing/)