UCP Checker
Sign in Start monitoring
Crawler documentation

UCPCheckerBot

The validation crawler behind UCP Checker, the independent conformance checker for the Universal Commerce Protocol. It reads the public, machine-readable endpoints that merchants publish for AI agents — and nothing else. Operated by PactMode Ltd (England & Wales, company no. 17295877).

Identity

User-Agent
UCPCheckerBot/1.0 (+https://ucpchecker.com/methodology)
Operator
UCP Checker (about) — independent; not affiliated with Google, Shopify, or the UCP consortium
Verification
Web Bot Auth (RFC 9421 HTTP Message Signatures). Our Ed25519 public key is published in a signed key directory at /.well-known/http-message-signatures-directory, so requests from UCPCheckerBot can be verified cryptographically rather than by IP or User-Agent string.
Documentation
Methodology · Contact

What it fetches

UCPCheckerBot requests public machine-configuration endpoints — the files merchants explicitly publish for automated agents to read. It does not crawl product pages, content, or anything behind authentication, and it never submits forms or transacts.

  • /.well-known/ucp — the UCP manifest (the primary subject of validation)
  • /robots.txt, /llms.txt, /sitemap.xml and the homepage's markup signals
  • Spec and schema URLs a manifest declares (fetched once per document, content-addressed)
  • For stores declaring identity linking: /.well-known/oauth-authorization-server (and related RFC 8414 / RFC 9728 metadata) plus the declared JWKS

Crawl behavior

  • Low volume: a handful of requests per store per check, roughly daily per listed store.
  • Deduplicated storage: responses are content-addressed — unchanged documents are not re-stored.
  • Fail-safe backoff: repeatedly failing endpoints are paused for 24 hours.
  • robots.txt compliant (RFC 9309): we fetch and honor your robots.txt before anything else — including User-agent groups, Allow/Disallow rules and */$ wildcards. If robots.txt disallows UCPCheckerBot, the store is not crawled and no secondary endpoints are fetched.

Opting out

Add this to your robots.txt and UCPCheckerBot will stop crawling your site (its status on UCP Checker will show as blocked rather than validated):

User-agent: UCPCheckerBot Disallow: /

To allow validation of your UCP manifest while blocking everything else:

User-agent: UCPCheckerBot Allow: /.well-known/ Allow: /llms.txt Disallow: /

Questions, removal requests, or anything else: contact us.