UCP Checker
Check a store
Industry

How the Personal Agent Protocol and UCP Fit Together

· 3 November 2026 · 9 min read

The Personal Agent Protocol now says how it works with UCP. On 2 November the PAP repository merged a ucp extension into draft 0.3 (PR #63). Its authors, David Pettersson and Ilya Grigorik, both list Shopify on their GitHub profiles.

The answer is a split of jobs. PAP finds the company, says which agent is calling, and signs the person in. UCP handles the shopping, and for a company that uses the extension, the payment too. Three of the sites that already publish a poppy.json also serve a UCP profile today. This post covers what the extension says, where Ask fits, the open financing proposal, and those three sites.

What is the PAP ucp extension?

The ucp extension is a section of the Personal Agent Protocol that tells a personal agent a company speaks UCP, and says how the two protocols divide the work. Its introduction (§1) puts it in one sentence:

"this protocol finds the Company, identifies the Personal Agent and a pseudonymous User, and signs the User in; UCP is the business protocol for how a Personal Agent shops once it is there."

It also maps the names: "UCP's Business, Platform, and Buyer are this protocol's Company, Personal Agent, and User." Where the extension names a UCP field or rule, it says UCP's current specification is the reference: "this page describes the connection, and UCP describes the commerce."

This is draft 0.3 of PAP. Any of the text quoted here may still change.

How a company turns it on

A company that speaks UCP adds one entry to the extensions object in its poppy.json (§2):

"extensions": {
  "ucp": { "version": "1" }
}

Its UCP profile stays where UCP puts it, at https://{organization.domain}/.well-known/ucp. poppy.json carries nothing about capabilities or versions. In §3's words: "What the Company offers an agent is what the negotiated UCP profile says it offers; poppy.json carries nothing about it."

Two rules from that section are worth knowing:

  • No redirects for the UCP profile. "A poppy.json may redirect; a UCP profile doesn't. The Personal Agent MUST NOT follow a redirect from this URL." This matches UCP's own hosting rule.
  • Platform profiles aren't per person. The agent's UCP platform profile "MUST NOT be specific to a User", so its URL can't be used to match one person across stores.

The extension doesn't make PAP a gate in front of UCP. §2: "A Company MUST NOT require a UCP platform to implement this protocol as a condition of access UCP otherwise permits." An agent can still use plain UCP with the same store, and decides per request which way it calls.

Who does what

Job PAP (draft 0.3) UCP
Finding the company /.well-known/poppy.json /.well-known/ucp, on the same host
Capabilities and versions Nothing Negotiated from the UCP profile
Who is calling Session header, operator signature Platform profile in UCP-Agent, signatures
Signing the person in Direct Sign-In at the company's issuer Identity linking, the same issuer (§4)
Questions to the store Conversations, or UCP Ask listed as a conversation protocol (§5) dev.ucp.common.ask
Cart, checkout, order, payment Nothing All of it (§6)
State One Session per visitor One identifier per workflow: cart, checkout, order, conversation (§8)

"UCP is its payment mechanism"

Payment was an open topic when PAP's first draft appeared, and our October post said checkout and payment stayed outside PAP. The extension now answers that for UCP companies. §6, "Commerce and approval":

"Carts, checkouts, orders, catalog search, and payment are defined by UCP, with their schemas, lifecycles, and negotiation."

And on payment:

"Payment is part of UCP checkout: the Company's UCP profile advertises the payment handlers it accepts, the Personal Agent's platform profile says which it supports, and the checkout carries the instrument. For a Company that advertises this extension, UCP is its payment mechanism, and a Personal Agent that supports the extension pays through it."

There is one approval for a purchase, and it is UCP's: the person reviews the checkout in a trusted interface, then the agent calls Complete Checkout. So "a Company SHOULD NOT also return an operation for a UCP capability's operation", because "two approval records for one action can disagree." When a checkout needs the person to finish a step on the store's own page, the continue_url goes to the person's browser, not the agent's (§7).

§10 adds that UCP's payment handlers "tokenize instruments so the Personal Agent carries tokens rather than raw credentials", and those tokens stay out of model context.

Where Ask fits

The extension lets a company list UCP's Ask capability as its conversation protocol, with type ucp in agent.protocols (§5):

"agent": {
  "protocols": [
    { "type": "ucp", "endpoint": "https://example.com/.well-known/ucp" }
  ]
}

A company that lists this entry must also list the extension, and its UCP profile must offer dev.ucp.common.ask. §5 maps PAP's conversation fields onto Ask's: message text becomes query, the reply is answer.plain, and a turn is always idle afterwards because Ask is synchronous. Handing off to a person has no Ask equivalent.

§5 describes Ask as "in UCP's current draft" and says it "ships in a later UCP release". On the same day the extension merged, UCP #1024 backported Ask into the 2026-08-25 release, and the 2026-08-25 Ask docs are live. We walked through Ask on a test store in How UCP's Ask works.

Three sites already publish both

PAP Checker lists 31 sites publishing a poppy.json. On 3 November we made one request to each site's /.well-known/ucp. Three serve a UCP profile:

  • Ticket Fairy: PAP 0.2, UCP 2026-08-25. Its organization.domain is www.ticketfairy.com, and the UCP profile is on that same host, the pairing §3 describes. The profile declares checkout, catalog search, discounts, fulfillment and orders, plus its own ticketing extensions.
  • GT Slot Cars: PAP 0.1, UCP 2026-04-08, with cart, checkout, discounts, fulfillment and orders.
  • X402-BROKER: PAP 0.2, UCP 2026-08-25, with catalog, cart, checkout, identity linking and location capabilities.

These are early adopters running both protocols before the extension existed. None of the three lists the ucp extension in its poppy.json yet, which is expected a day after it merged. You can check a site's poppy.json with the PAP Checker validator and its UCP profile with UCP Checker.

Financing offers: an open proposal

A second item ties the two protocols together on payment. PAP issue #65, opened on 2 November and signed "Synchrony (design partner)", proposes a financing offers extension. A personal agent would ask a lender which offers apply to a purchase, show the lender's disclosures unchanged, and carry the chosen offer into the payment the person approves. It is an open proposal, not part of the draft.

On how it would meet UCP, the proposal says checkout protocols such as UCP are where "a Payee using one can carry offer_id in that protocol's payment data". In UCP, buy now, pay later work sits with the Payments Tech Council's BNPL working group, whose draft charter the council heard on 15 October. Payment terms with instalment schedules (dev.ucp.common.payment.terms) shipped in the 2026-08-25 release, and Affirm publishes vendor BNPL extensions.

Context: Shopify's Q3

Shopify reported its third quarter on 3 November: revenue up 32%, to $3.74 billion, and $119 billion in GMV, up 30% in constant currency. On the call, CFO Jeff Hoffmeister said "we co-led the creation of the Universal Commerce Protocol" and "we're actively driving other standards, like the Personal Agent Protocol". President Harley Finkelstein said "AI traffic is up 2.6x year-over-year" and orders are "growing even faster at 3.3x", adding "it is still quite early." Shopify didn't split agent orders by protocol or give a share of GMV.

What it means for stores and agent builders

  • Stores already on UCP: nothing changes in the UCP profile. A store that also publishes a poppy.json can add "ucp": { "version": "1" }, keep both files on the same host, and serve the UCP profile without a redirect.
  • Stores using PAP sign-in: the extension asks for one sign-in, not two. A store that offers both must offer Direct Sign-In and list private_key_jwt at its issuer, and must list its UCP identity-linking scopes in scopes_supported (§4).
  • Agent builders: fetch both files, negotiate with the UCP profile, send the same platform profile URL everywhere a transport carries it, and pay through UCP checkout. Agents that don't support the extension can still use the store's UCP MCP endpoint if it's listed in apis.

What we'll watch

  • The first sites that list the ucp extension in poppy.json (on papchecker.com/sites).
  • How PAP's separate payments work relates to UCP payment handlers.
  • Whether financing offers become a PAP extension, and how it lines up with UCP's BNPL working group.
  • The WebMCP mapping, which §7 says comes "once UCP's WebMCP binding is published."

FAQ

Does the Personal Agent Protocol work with UCP? Yes. Draft 0.3 adds a ucp extension, merged on 2 November 2026. PAP finds the company and signs the person in; UCP handles catalog, cart, checkout, orders and payment.

Does the Personal Agent Protocol handle payments? For a company that lists the ucp extension, payment goes through UCP checkout. The extension says: "UCP is its payment mechanism." A separate payments proposal for PAP is still being discussed.

Where does a company publish its UCP profile when it uses PAP? At /.well-known/ucp on the same host as its poppy.json (its organization.domain). The agent must not follow a redirect from that URL.

Do I need PAP to use UCP? No. The extension says a company "MUST NOT require a UCP platform to implement this protocol as a condition of access UCP otherwise permits."

Is UCP's Ask capability part of a release? Yes. UCP #1024 backported Ask into the 2026-08-25 release on 2 November 2026. Under the PAP extension a company can list Ask as its conversation protocol.

Which sites publish both poppy.json and a UCP profile? On 3 November 2026, three of the 31 sites on PAP Checker's list served a UCP profile: Ticket Fairy, GT Slot Cars and X402-BROKER.

Does PAP support buy now, pay later? Not yet. A financing offers extension is an open proposal (issue #65). In UCP, payment terms with instalments shipped in 2026-08-25, and the Payments Tech Council has a BNPL working group.

About UCP Checker

UCP Checker is the independent validation and observability layer for the Universal Commerce Protocol. We crawl, validate and grade every public UCP manifest we can find, run the merchant directory, the UCP Score, live adoption stats, the vertical guides and the authority-bound vendor map, and track the spec as it evolves so you don't have to — measured from two vantages (what a business declares, and what actually happens when an agent transacts), the same way for everyone, without picking winners.

Sources

Related coverage: Personal Agent Protocol v0.1 and UCP · How UCP's Ask Works, Step by Step · The UCP Payments Tech Council Is Seated · How UCP works: a real agent buys flowers

What does a UCP agent find at your store?
Check it once and it gets its own status page.
Check a store

Keep reading

27 Oct 2026 /.well-known/ucp is now in the IANA registry Industry · 7 min 23 Oct 2026 Walmart's Agentic Access Terms, Explained: The Rules AI Agents Must Follow to Shop Walmart Industry · 12 min 15 Oct 2026 UCP in the Agent Chain of Trust: What the GoDaddy, Infoblox, Google and Cloudflare Demo Checks Industry · 10 min