Eight months after launch, the Universal Commerce Protocol has grown dramatically in governance and vertical coverage. Amazon joined the Tech Council, Stripe the Governing Council, and the protocol now spans food delivery and hotel booking.
Agentic commerce is no longer a promise, it's running infrastructure
When Forbes published its January 2026 analysis on the end of "search-based shopping," Google's Universal Commerce Protocol (UCP) was only days old. Eight months later, the protocol has grown dramatically in size, governance, and vertical coverage — and Amazon, the most-discussed absentee at launch, has since joined the table. Here's what has actually changed, with the facts verified since.[^1][^2][^3]
Amazon joined the Tech Council: the "walled garden" got a door
On April 24, 2026, the UCP Tech Council expanded from 5 to 16 seats, with the simultaneous arrival of Amazon, Meta, Microsoft, Salesforce, and Stripe. Amazon is represented by Greg Smith, Meta by James Andersen, Microsoft by Patrick Jordan, Stripe by Prasad Wangikar, and Salesforce by Scot DeDeo. This reversal directly contradicts the Forbes narrative that framed Amazon as the one major player "building walls" rather than bridges — the reality in 2026 is more nuanced: Amazon still defends its interests on its own marketplace while securing a seat in the governance of a protocol that could end up structuring the rest of global e-commerce.[^2][^3]
Another major governance move: Stripe joined the Governing Council on April 28, 2026, alongside permanent members Google and Shopify, with two additional elected seats added for future nominations. Stripe plays a particular role here, having co-developed the rival Agentic Commerce Protocol (ACP) with OpenAI in September 2025, before joining UCP seven months later — a "bridge" position between the two ecosystems.[^4][^3]
UCP moves beyond pure retail: lodging and food join the protocol
The most significant development for international and sector-specific expansion strategies is the protocol's vertical extension, which was initially designed for classic retail commerce. A Food Technical Council was formed on July 16, 2026, with Block (Square), DoorDash, Google, Toast, and Uber Eats as founding members, opening UCP to meal delivery. A month later, on August 11, 2026, a Lodging Technical Council was formed with Amadeus, Booking.com, Expedia, Google, Hilton, Marriott, and Trip.com — bringing UCP into hotel booking.[^4]
This diversification confirms the central thesis of the Forbes article: UCP is not an e-commerce connector but a cross-cutting infrastructure layer, much like TCP/IP. The technical release on August 25, 2026 (v2026-08-25) materializes this ambition, introducing "structural refactorings to support multi-vertical expansion" and "grocery shopping readiness," alongside payment security improvements (3DS2) and independent per-capability versioning.[^1][^4]
The protocol's six capabilities and their technical logic
UCP's architecture rests on three nested levels: services, capabilities, and extensions. The single active service today is the "Shopping Service" (namespace dev.ucp.shopping), which contains six independently negotiable capabilities.[^3]
| Capability | Function | Added on |
|---|---|---|
| Catalog | Real-time product search and lookup (pull-based) | Launch (Jan. 11, 2026) |
| Checkout | Purchase session lifecycle (creation, update, completion) | Launch |
| Order | Post-purchase events driven by webhooks (delivery, returns) | Launch |
| Identity Linking | Account linking via OAuth 2.0, loyalty benefits | March 19, 2026[^5] |
| Cart | Cart building before firm purchase intent | April 9, 2026[^5][^3] |
| Payment Token Exchange | Payment token exchange backed by AP2 | Launch, progressively formalized |
The negotiation mechanism is simple: the agent and the merchant compare their respective manifests published at /.well-known/ucp, take the intersection of supported capabilities, then the highest common version for each capability. This is what lets an SME implement only basic checkout while a large retailer exposes complex loyalty integrations, all within the same protocol.[^3]
The "Trust Triangle": the cornerstone of transactional trust
The most consequential technical point of the protocol — absent from the original Forbes piece — is what UCP documentation calls the "Trust Triangle": payment credentials flow only from the platform (the agent) to the merchant, never in reverse, and merchants are not permitted to echo those credentials back in their responses. In practice, when a Gemini agent buys on a consumer's behalf, it obtains a single-use payment token from the credential provider (Visa, PayPal, Stripe) via the AP2 protocol, passes that token to the merchant, who redeems it directly with the provider without ever seeing the real card. Since the April 2026 version, every UCP request and response is signed per the RFC 9421 standard, strengthening integrity verification at the HTTP level.[^3]
Shopify migrated its native MCP infrastructure to UCP
For Shopify merchants, an important operational change took place in 2026 — building on what we covered back in April about Google's UCP onboarding. On June 24, 2026, Shopify announced the deprecation of its legacy get_cart and update_cart tools on its native MCP endpoint (/api/mcp), replaced by UCP-compliant Cart MCP tools served from a new /api/ucp/mcp endpoint. The old tools stopped working after August 31, 2026, forcing any third-party integration (agencies, developers) to migrate.[^6]
On September 3, 2026, Shopify confirmed that its storefronts now officially support protocol version v2026-08-25, with no configuration changes required from merchants. This update only affects the discovery profile displayed; the capabilities actually supported by Shopify remain unchanged for now.[^7]
The August 2026 release quietly breaks some integrations
A crucial point for any technical team that has built on UCP since January: the v2026-08-25 release contains 17 breaking changes out of 68 total modifications, according to an independent technical analysis. Changes include renaming signing_keys to keys, restructuring fulfillment configuration (dropping the allows_ prefix, converting a boolean map into an array of objects), and restructuring buyer consent into a reverse-DNS map. The good news for merchants who don't want to migrate urgently: the transactional core remains unchanged, and version v2026-04-08 continues to be supported in parallel.[^8][^9]
UCP vs. ACP: the protocol battle continues
The Forbes article mentioned the "infrastructure war" without detailing the direct rival protocol. ACP (Agentic Commerce Protocol), launched by OpenAI and Stripe on September 29, 2025, to power Instant Checkout in ChatGPT, remains UCP's direct competitor. The philosophical difference is clear: ACP assumes ChatGPT is the canonical entry point and can therefore limit itself to a checkout role with platform-side discovery, while UCP assumes no single agent will dominate and that discovery should remain merchant-driven. Several companies, including Stripe, PayPal, Etsy, and Salesforce, sit on both sides — the pragmatic recommendation for 2026 is to support both protocols in parallel, as NVIDIA's agentic commerce blueprint does.[^3]
Why this matters for your content and agentic search strategy
For SEO/GEO and product data structuring efforts, this dynamic confirms the urgency the original Forbes article pointed to: Google is now rolling out dozens of new attributes in Merchant Center designed for conversational discoverability, and the Shopping Graph keeps growing past 50 billion continuously updated product references. UCP-powered checkout is expanding to Canada and Australia, with the UK planned next, and Google is now partnering with industry players to bring the protocol into hotel booking and local meal delivery. Stratechery's analysts note that Google is replaying its classic playbook here: open protocol generosity (UCP, AP2, A2A, MCP) combined with closed proprietary distribution (Gemini, AI Mode, Merchant Center) — the protocol is genuinely open, but the aggregation layer that benefits most from it isn't.[^10][^3]
For an online merchant, the question is no longer "if" but "how fast" to align with these protocols. Busony helps Shopify, WooCommerce, and PrestaShop merchants get UCP/AP2-compliant and build a GEO strategy to stay visible, cited, and actionable for AI agents.
References
1. Google launches Universal Commerce Protocol, bets on AI-powered retail — CNBC, January 11, 2026. 2. Google announces a new protocol to facilitate commerce using AI agents — TechCrunch, January 11, 2026. 3. UCP Tech Council Expansion: Recent Updates and Full Architecture Breakdown — Rankly. 4. Announcements — Universal Commerce Protocol (UCP) — ucp.dev, official governance and release announcements page. 5. Universal Commerce Protocol updates improve AI shopping — Google Blog. 6. Shopify's storefront MCP is becoming UCP, and the old endpoint is going away — Naughton & Bird. 7. Shopify storefronts now support UCP 2026-08-25 — Shopify Dev Changelog. 8. UCP v2026-08-25 Breaks Quietly: 4 Changes That Still Bite — UCP Tools. 9. UCP v2026-08-25 Spec Update — UCP Checker Blog. 10. How we're helping retailers thrive with new Universal Commerce Protocol features and AI tools on Google — Google Blog.