my-shopping-site-gamma.vercel.app
verified_user Multi-version UCP compliance, backward compatibility & transport audit
schedule Last scanned 5/4/2026
Conformance
53%Capability
100%Coverage
43%Backward Compat
0%Negative
36%Transport
80%Latency
99%Audit Details
Cache-Control max-age is within recommended bounds
Cache-Control "no-store, no-cache, must-revalidate, max-age=0" disables caching — agents will re-fetch on every request
Profile response advertises cache headers
Completed in 150ms
Profile declares at least the checkout capability
Profile does not declare dev.ucp.shopping.checkout
Capability version strings are valid ISO dates
(instances ?? []) is not iterable
Profile response Content-Type is application/json
Completed in 130ms
Discovery endpoint exposes CORS headers
Completed in 124ms
Profile is served over HTTPS
Completed in 56ms
Two consecutive profile fetches return identical bodies
Completed in 210ms
Signing JWKs use only allowed kty/crv values
Profile declares no signing_keys array — the field is optional per the UCP spec, but agents cannot verify signed payloads from this merchant
No duplicate capability entries (same name + version)
Completed in 127ms
OpenAPI servers[] URL is reachable
Profile has no loadable service-level OpenAPI document
Business profile has a valid structure
Business profile failed schema validation
Merchant responses are signed with the published signing_keys
Profile declares no signing_keys; nothing to verify against. DISC-0002 tracks absence separately.
robots.txt allows AI agents to read the UCP profile
Completed in 144ms
All declared schema URLs use HTTPS
(bindings ?? []) is not iterable
Signing keys are importable via Web Crypto
Profile declares no signing_keys array — the field is optional per the UCP spec, but agents cannot verify signed payloads from this merchant
Profile advertises well-formed signing keys
Profile declares no signing_keys array — the field is optional per the UCP spec, but agents cannot verify signed payloads from this merchant
Service binding transports are in the allowed set
(bindings ?? []) is not iterable
Profile declares a ucp.version string
Completed in 152ms
Profile ucp.version is one the grader recognizes
Completed in 120ms
Profile is served at the canonical .well-known/ucp path
Completed in 122ms
Declared capabilities match operations in the OpenAPI
No OpenAPI operations available to cross-check
Capability JSON Schemas declare a modern $schema draft
Profile declares no capability JSON Schemas
Capability-level JSON Schemas are well-formed
6 of 6 capability schemas are malformed
OpenAPI components.schemas has no orphans
Profile has no loadable service-level OpenAPI document
Service-level OpenAPI document is valid OpenAPI 3.x
No service-level OpenAPI schema was loaded
Every OpenAPI operation declares a 2xx JSON response schema
Profile has no loadable service-level OpenAPI document
Every $ref referenced schema document is reachable
Profile declares no loadable schema documents
All declared schema URLs return 200
9 of 9 schema URLs failed to load: [service] https://ucp.dev/services/shopping/openapi.json → http_404 [capability] https://ucp.dev/schemas/shopping/discovery.json → http_404 [capability] https://ucp.dev/schemas/shopping/checkout.json → http_404 [capability] https://ucp.dev/schemas/shopping/payment.json → http_404 [capability] https://ucp.dev/schemas/shopping/returns.json → http_404 [capability] https://ucp.dev/schemas/shopping/discount.json → http_404 [capability] https://ucp.dev/schemas/shopping/fulfillment.json → http_404 [payment] https://ucp.dev/schemas/payment/google_pay.json → http_404 [payment] https://ucp.dev/schemas/mock.json → http_404
Cancel session response matches the OpenAPI schema
Expected 2xx, got 404
Create session response matches the OpenAPI schema
UCP spec requires 201 Created for POST /checkout-sessions, but server returned 200. Agents may misinterpret this as a failure. Fix: return HTTP 201 when a session is successfully created.
Discovery profile matches the published JSON Schema
ucp.payment_handlers is missing or not an object
Get session response matches the OpenAPI schema
Expected 200, got 405
Update session response matches the OpenAPI schema
Schema unavailable: no_openapi
Canceling a session twice with the same idempotency key is idempotent
First cancel returned status=404
Canceling a session twice with the same idempotency key is idempotent
Session ended in status=null after double-cancel — expected "canceled"
Cancel a checkout session
cancelSession returned 404
Cancel a checkout session
Expected canceled, got undefined
Create checkout session with defaults
REST: expected 201, got 200
Create checkout session with defaults
Checkout session failed schema validation
Repeated createSession with same idempotency key returns same session
Same key returned different session ids
Repeated createSession with same idempotency key returns same session
Completed in 237ms
Create session then set shipping address
Session updated but no shipments returned
Create session then set shipping address
Session updated but no shipments returned
Retrieve a checkout session by id
getSession returned 405
Retrieve a checkout session by id
Completed in 221ms
Reusing an Idempotency-Key with a different body must be rejected
Server accepted a second create with the same idempotency key but a different currency (USD → EUR). Per the spec, the second call must be rejected.
Reusing an Idempotency-Key with a different body must be rejected
Server accepted a second create with the same idempotency key but a different currency (USD → EUR). Per the spec, the second call must be rejected.
update_checkout is idempotent on replay and rejects conflicting replays
Update with the same Idempotency-Key but a different body was accepted — must be rejected
update_checkout is idempotent on replay and rejects conflicting replays
Update with the same Idempotency-Key but a different body was accepted — must be rejected
Select a shipping method on a checkout session
Merchant returned no shipping options to select
Select a shipping method on a checkout session
Merchant returned no shipping options to select
Shipping methods are returned after setting an address
Fulfillment returned no options
Shipping methods are returned after setting an address
Session has no fulfillment section after address set
Catalog capability advertised for product lookup
Profile does not declare dev.ucp.shopping.catalog.lookup
Catalog capability advertised for product lookup
Profile does not declare dev.ucp.shopping.catalog.lookup
Catalog capability is declared
Profile does not declare dev.ucp.shopping.catalog.search
Catalog capability is declared
Profile does not declare dev.ucp.shopping.catalog.search
Checkout capability is declared and reachable
Completed in 234ms
Checkout capability is declared and reachable
Completed in 117ms