The Agentic Commerce Protocol Stack: What Merchants Actually Need to Support in 2026
There are now seven distinct protocols that govern how AI agents find, evaluate, and purchase from online stores. Plus five foundational web standards that agents depend on before any protocol enters the picture.
Nobody has published a unified map of how they all fit together. Every announcement — Google's UCP updates, OpenAI's ACP, Anthropic's MCP, Stripe's MPP — gets covered in isolation. Merchants are left assembling the picture from fragments, guessing which protocols matter and which are noise.
This is the complete stack. Four layers, twelve standards and protocols, with clear priorities for each platform.
┌─────────────────────────────────────────────────────┐
│ LAYER 4: TRUST & PAYMENT │
│ UCP Signing · MPP (Stripe/Visa) · x402 │
├─────────────────────────────────────────────────────┤
│ LAYER 3: INTERACTION │
│ WebMCP (W3C/Chrome) · A2A (Google) │
├─────────────────────────────────────────────────────┤
│ LAYER 2: COMMERCE PROTOCOLS │
│ UCP (Google/Shopify) · ACP (OpenAI) · MCP (Anthr.) │
├─────────────────────────────────────────────────────┤
│ LAYER 1: DISCOVERY │
│ robots.txt · llms.txt · AGENTS.md · JSON-LD · Sitemaps │
└─────────────────────────────────────────────────────┘
Each layer depends on the ones below it. An agent can't pay (Layer 4) without transacting (Layer 2), can't transact without discovering (Layer 1). Start at the bottom and work up.
Layer 1: Discovery — How Agents Find Your Store
Before an AI agent can buy anything, it has to find you. The discovery layer is the set of standards that make your store visible and parseable to AI systems. None of these are new protocols. They're existing web standards repurposed for agent consumption. But getting them right is now a revenue question, not just an SEO hygiene task.
robots.txt (AI Crawler Access)
What it is: The decades-old standard for telling crawlers what they can and can't index, now extended with AI-specific user agents.
Who's behind it: No single owner. Each AI company registers its own crawler: GPTBot (OpenAI), ClaudeBot (Anthropic), Google-Extended (Google), PerplexityBot (Perplexity). There are over a dozen now.
What to do: ACT NOW. Check your robots.txt today. Many CMS defaults block AI crawlers, either explicitly or through overly restrictive wildcard rules. If GPTBot can't crawl your product pages, your products don't exist in ChatGPT's shopping results. This takes five minutes to verify and fix. There is no reason to delay.
llms.txt (LLM Site Instructions)
What it is: A plain-text file at your domain root that tells LLMs how to understand and interact with your site. Product taxonomy, brand context, key categories, and interaction guidelines in a format optimized for language model consumption rather than HTML parsing.
Who's behind it: Community-driven standard, gaining adoption across AI platforms. No single corporate sponsor, which is both its strength (vendor-neutral) and its weakness (no enforcement mechanism).
What to do: ACT NOW. This is the single most underimplemented standard relative to its impact. A well-structured llms.txt file directly influences how AI agents describe your products, categorize your store, and decide whether to recommend you. Most stores don't have one. That's an advantage for those that do.
AGENTS.md (Agent Instruction File)
What it is: A markdown file that provides structured instructions for AI agents interacting with your site. More detailed than llms.txt — can include specific interaction flows, API endpoints, and behavioral guidelines.
Who's behind it: Emerging community standard, not yet formalized by any standards body.
What to do: WATCH. Useful if you want fine-grained control over how agents interact with your store, but the ROI is lower than llms.txt because fewer agent systems parse it today. Implement it after you've nailed the higher-priority items.
JSON-LD Product Markup (Schema.org)
What it is: Structured data embedded in your product pages that tells machines exactly what a product is: name, price, availability, reviews, SKU, images, shipping details.
Who's behind it: Schema.org consortium (Google, Microsoft, Yahoo, Yandex). The standard has existed for years. What changed is that AI agents now consume it as their primary product data source, not just search engine crawlers.
What to do: ACT NOW. If your JSON-LD is incomplete — missing price currency, availability status, review aggregates, or product identifiers like GTIN — agents see your products as lower-quality inventory. Shopify themes generate basic JSON-LD automatically. "Basic" isn't enough. Audit every field against the Schema.org Product spec. Rich JSON-LD is to agent commerce what page speed is to SEO: a ranking factor with measurable revenue impact.
Sitemaps (Product URL Syndication)
What it is: XML files that list every product URL on your store, with last-modified dates and change frequency hints.
Who's behind it: Established web standard, supported by all major platforms.
What to do: ACT NOW. Ensure your sitemap is auto-generated, includes all product URLs (not just categories), and updates when products are added, removed, or modified. Most platforms handle this by default, but custom and headless builds often have gaps. Agents use sitemaps for initial product discovery scans. Missing URLs mean missing revenue.
Layer 2: Commerce Protocols — How Agents Transact
This is where the real protocol competition lives. Three protocols from three different companies, each enabling AI agents to discover products, manage carts, and complete purchases through structured APIs rather than browser automation.
UCP (Universal Commerce Protocol)
What it is: The dominant protocol for agent-to-store commerce. Defines how AI agents discover product catalogs, add items to carts, apply discounts, and complete checkout through a standardized manifest and API structure. Version 2026-04-08 is current, adding cryptographic signing, split catalog capabilities (search vs. lookup), and structured cart operations.
Who's behind it: Google and Shopify co-developed it. Endorsed by Walmart, Target, Etsy, Visa, Mastercard, American Express, and Stripe (Google, March 2026). Shopify auto-deploys UCP to all storefronts. This is the protocol with the most institutional weight and the broadest adoption.
What to do: ACT NOW. If you're on Shopify, UCP is already live on your store. Verify your manifest is current (v2026-04-08), enable signing if available, and ensure your catalog capabilities are properly declared. If you're not on Shopify, implementing UCP is your highest-priority protocol task. It's the gateway to Google AI Mode, Gemini shopping, and the growing network of UCP-compatible agent systems. The signing feature in v2026-04-08 is optional today and will be expected within months — implement it early.
ACP (Agent Commerce Protocol)
What it is: OpenAI's protocol for ChatGPT and Operator agent interactions with online stores. Enables product discovery, comparison, and checkout through structured API calls rather than browser scraping. Tightly integrated with ChatGPT's shopping features and Operator's autonomous browsing.
Who's behind it: OpenAI. Purpose-built for ChatGPT's commerce ambitions (OpenAI, 2026).
What to do: ACT NOW. ChatGPT has over 400 million weekly active users (OpenAI, March 2026). A meaningful and growing percentage of those users ask ChatGPT to help them shop. ACP is how your store shows up in those interactions. UCP handles the Google ecosystem. ACP handles the OpenAI ecosystem. You need both.
MCP (Model Context Protocol)
What it is: Anthropic's protocol for giving AI agents structured access to external data and tools. In commerce, MCP servers expose product catalogs, cart operations, and checkout flows as callable tools that Claude can use directly. Shopify's Storefront MCP for Hydrogen is the most prominent commerce implementation.
Who's behind it: Anthropic. Adopted broadly beyond commerce for tool use and data access (Anthropic, 2024). Shopify built native Storefront MCP for Hydrogen stores (Shopify, March 2026).
What to do: ACT NOW if you're on Hydrogen. WATCH if you're not. For Hydrogen merchants, Storefront MCP is live and gives Claude agents direct access to your product data and cart. For standard Shopify themes and non-Shopify stores, MCP commerce tooling is less mature than UCP or ACP. But Claude is a major agent platform, and MCP support will matter more as Anthropic expands commerce capabilities. Build the foundation now: rich structured data and clean APIs make MCP integration straightforward when you're ready.
Layer 3: Interaction — How Agents Use Your Store's UI
Not every agent interaction goes through a structured API. Some agents operate by interacting with web interfaces directly. The interaction layer defines how your store's frontend communicates its capabilities to agents navigating your pages.
WebMCP (W3C Draft — Chrome 146)
What it is: A W3C draft specification that lets HTML forms declare themselves as structured agent tools. An agent visiting your product page can read a WebMCP-annotated form and understand "this form adds an item to a cart" or "this form initiates checkout" without parsing the visual layout. Shipped behind a flag in Chrome 146 (Google, March 2026).
Who's behind it: W3C, with Google driving implementation in Chrome.
What to do: ACT NOW for high-traffic stores. WATCH for everyone else. WebMCP is the bridge between structured protocols (UCP, ACP, MCP) and the reality that most stores are still HTML pages. Annotating your key forms — search, add-to-cart, checkout — takes modest development effort and makes your store usable by agents that navigate the web rather than calling APIs directly. It's behind a Chrome flag today, but W3C standardization means it will ship as default behavior. We published an implementation guide with code examples.
A2A (Agent-to-Agent Protocol)
What it is: Google's protocol for agent discovery, capability declaration, and task delegation between AI agents. In commerce, A2A enables scenarios where a consumer's personal shopping agent discovers your store's agent, negotiates capabilities, and delegates a purchase task. Each agent publishes an "Agent Card" describing what it can do.
Who's behind it: Google (Google, April 2025). Designed for the multi-agent future where consumers have personal agents that interact with merchant agents.
What to do: WATCH. A2A is architecturally important but practically early-stage for most merchants. The protocol matters when the dominant shopping pattern becomes "my agent talks to your agent." That's coming, but it's not the primary transaction model today. Merchants with custom agent infrastructure should publish Agent Cards now. Everyone else should focus on UCP, ACP, and the discovery layer first.
Layer 4: Trust and Payment — How Agents Verify and Pay
The newest layer, and the one evolving fastest. As AI agents handle real money, the infrastructure for machine-to-machine trust and payment is being built in real time.
UCP Signing (v2026-04-08)
What it is: Cryptographic request and response signing built into UCP. Stores sign their product data, prices, and checkout responses. Agents verify signatures before transacting, confirming that the data they see is authentic and hasn't been tampered with.
Who's behind it: Part of UCP, so Google and Shopify. Introduced in v2026-04-08 (Google, April 2026).
What to do: ACT NOW. Signing is optional today and will become expected. Agents will prefer signed stores the same way browsers prefer HTTPS. The trust signal directly influences which stores agents recommend. Shopify will likely make signing default in a future update. Non-Shopify merchants should implement signing now to match Shopify parity. We covered this in detail in our UCP v2026-04-08 analysis.
MPP (Machine Payments Protocol)
What it is: A protocol for machine-to-machine payments using HTTP 402 status codes. An agent requests a resource, gets a 402 response with structured payment terms, and completes the transaction programmatically. No checkout pages, no browser sessions, no human interaction in the payment loop.
Who's behind it: Stripe and Visa, with over 100 launch partners (Stripe, March 18, 2026). This is the payments industry's answer to "how do AI agents pay for things?"
What to do: WATCH, with urgency. MPP is live but early in merchant adoption. The protocol is important because it enables fully autonomous agent purchasing — no human in the loop for payment. Stripe merchants should monitor for MPP integration options as they become available. The 100-partner launch coalition signals this will move fast from announcement to mainstream tooling. We wrote a detailed breakdown of what MPP means for merchants.
x402
What it is: An alternative machine payments standard built on HTTP 402, with a focus on cryptocurrency and decentralized payment rails. Enables AI agents to pay for resources using crypto payments without traditional payment processor intermediation.
Who's behind it: Coinbase and Cloudflare (Coinbase, 2026).
What to do: IGNORE for most merchants. Unless your customer base actively uses cryptocurrency, x402 is not a priority. The protocol is technically interesting but addresses a niche payment use case. MPP via Stripe covers the mainstream agent payment scenario. Revisit if crypto payments become a meaningful share of your revenue.
The Priority Matrix by Platform
The protocols you need depend on your stack. Here's what to prioritize, in order.
If you're on Shopify
- Verify UCP v2026-04-08 — auto-deployed, but confirm your manifest is compliant and signing is enabled
- Implement llms.txt — Shopify doesn't generate this. You need to create it manually
- Audit JSON-LD completeness — Shopify themes generate basic markup. Enrich it with full product attributes
- Implement ACP — your store is in Google's ecosystem via UCP. Get it into OpenAI's ecosystem too
- Enable Storefront MCP — if you're on Hydrogen, this is ready now
- Add WebMCP form annotations — progressive enhancement for agent-navigable storefronts
- Monitor MPP — Stripe integration is likely coming to Shopify; be ready to enable it
If you're on WooCommerce
- Fix robots.txt and sitemaps — verify AI crawlers aren't blocked, all product URLs are indexed
- Implement llms.txt — no platform does this for you
- Implement UCP — this is your biggest gap vs. Shopify merchants who get it automatically
- Enrich JSON-LD Product markup — WooCommerce plugins vary in quality. Audit against the full Schema.org Product spec
- Implement ACP — critical for ChatGPT shopping visibility
- Add WebMCP form annotations — WooCommerce themes are form-heavy; annotating them has high ROI
- Monitor MCP and MPP — implement when mature tooling is available for WordPress
If you're headless or custom
- Implement UCP with signing — you have no platform doing this for you. Start here
- Implement llms.txt and complete JSON-LD — your structured data layer is entirely your responsibility
- Implement ACP — get into the ChatGPT ecosystem
- Build MCP server — if you have APIs, wrapping them as MCP tools is straightforward and gives Claude direct access
- Implement WebMCP on all key forms — headless builds often have clean form structures that are easy to annotate
- Publish A2A Agent Cards — custom stacks are the best candidates for agent-to-agent interactions
- Implement MPP — custom payment stacks have the flexibility to adopt HTTP 402 flows early
The Bottom Line
Multi-protocol support wins. Period.
UCP is dominant. It has the broadest coalition — Google, Shopify, Walmart, Target, Visa, Mastercard, Stripe. If you implement one protocol, implement UCP. But UCP alone leaves you invisible to ChatGPT's 400 million users and Claude's agent ecosystem. ACP and MCP fill those gaps.
The discovery layer is not optional. Protocols don't matter if agents can't find your store in the first place. A complete robots.txt, rich JSON-LD, a sitemap that actually includes all your products, and an llms.txt file — these are the foundation everything else builds on. Most stores have gaps here. Fix them before chasing protocol implementations.
The trust and payment layer is where the market moves next. UCP signing is the immediate action item. MPP is the signal to watch. When agents can both verify your data and pay for your products without human intervention, you're in fully autonomous commerce territory. That's not hypothetical. The infrastructure shipped in Q1 2026.
The stores that show up across ChatGPT, Gemini, and Claude — not just one of the three — will capture disproportionate agent traffic. Agent-driven commerce grew 15x on Shopify last year. Brands with agent readiness saw 59% higher sales growth during the 2025 holidays (Salesforce, January 2026). Every month you wait is a month your competitors are building the agent infrastructure you'll eventually need anyway.
Check Where You Stand
The protocol stack is complex. Your store's readiness doesn't have to be a guessing game.
Colter scans your store across every protocol and standard in this stack — discovery layer, commerce protocols, interaction standards, and trust infrastructure — and shows you exactly what's implemented, what's missing, and what to fix first.
Run a free protocol check at agenticcom.ai/check
Protocol versions cited: UCP v2026-04-08 (Google, April 2026), ACP (OpenAI, 2026), MCP (Anthropic, 2024), WebMCP W3C Draft / Chrome 146 (Google, March 2026), A2A (Google, April 2025), MPP (Stripe / Visa, March 2026), x402 (Coinbase / Cloudflare, 2026).