05 · Transact · Open source
UCP Merchant Profile for Magento 2
angeo/module-ucp
Publishes a Universal Commerce Protocol profile at /.well-known/ucp with ECDSA P-256 signing keys, so an AI agent can verify who the merchant is before acting on their behalf.
Free and MIT-licensed. No licence key, no account, no telemetry.
What it does
Four things worth knowing before you install.
A signed, verifiable manifest
The profile is served at the well-known path and signed with an ECDSA P-256 key pair, so an agent can confirm it came from you rather than trusting a URL.
Key rotation without downtime
Keys can be rotated with an overlap period, so agents holding the previous key are not cut off mid-transition.
Validated against the spec
Generated against UCP spec version 2026-04-08, with declared capabilities and correct cache headers, rather than being hand-assembled JSON that happens to parse.
Multi-store scope
One profile per store view where store views represent genuinely different merchants or markets.
This layer is early. Agent-initiated commerce is not yet mainstream traffic. Publishing a profile costs an afternoon and positions you for it; treat it as preparation, not as a source of orders this quarter.
Requirements
| Magento | Open Source / Adobe Commerce 2.4.x |
| PHP | 8.2+ |
| Protocol | Universal Commerce Protocol |
| Signing | ECDSA P-256 |
| Licence | MIT |
Questions
Is UCP the same as ACP?
No. ACP is how a catalogue reaches ChatGPT Shopping. UCP is how an agent verifies the merchant it is dealing with. They cover different steps and are complementary.
Does publishing a profile expose anything sensitive?
No. The manifest contains merchant identity and capability information plus a public key. Private keys never leave the server.
Do agents actually use this today?
Adoption is early. The honest position is that this prepares the store for agent-initiated commerce rather than delivering traffic now.
How do I confirm it works?
Request /.well-known/ucp and check that the manifest parses and the signature validates. The AEO audit also reports it as a signal.
Works with
Each module is independent, but these three are the ones most often installed alongside it.
Not sure whether you need this one?
Run the free scanner on your domain, or install the CLI audit. Both report which signals your store currently fails, so you install only what closes a real gap.