UCP Score
UCP Score for vbuy.com.hk
96 out of 100, grade A: ready for UCP agents. The missing 4 points are spread across Conformance and Capabilities.
Discovery 100Conformance 93Capabilities 95release 2026-08-25
UCP Score
96/100
grade A · ready for UCP agents
Points missing→
4
Conformance, Capabilities
Fixes→
1
takes it to 100
Discovery 30%
Can a UCP agent find and read the profile: HTTPS, an answer at /.well-known/ucp, robots.txt allowing it, and five files outside UCP (llms.txt, sitemap, Open Graph, Organization schema, viewport).
100full marks
Conformance 40%
Does the profile follow the spec: valid against its release (counted three times), a dated release, keys published, few warnings, spec and schema links that resolve.
93−2.8 pts
Capabilities 30%
What an agent can do here: how many capabilities, checkout, at least one service, payment handlers, and services that answer our check.
95−1.5 pts
A85–100Ready for UCP agents
B70–84Nearly there
C50–69Partly ready
D30–49Hard for UCP agents
F0–29Not ready
+3
Conformance · effort medium
1Cryptographic message signing is not yet enabled
Your UCP profile lists no public keys, so cryptographic message signing is not yet enabled for this store. HTTPS already confirms your store's identity; signing adds a further layer for checkout, payment and webhook messages.
The UCP spec recommends signing checkout completion and payment responses, and requires it for webhooks. A store that sends order updates by webhook needs keys; others can add them later.
{
"keys": [
{
"kty": "EC",
"crv": "P-256",
"x": "<base64url x>",
"y": "<base64url y>",
"kid": "store-2026-10",
"use": "sig",
"alg": "ES256"
}
],
"ucp": { ... }
}
Create a P-256 (ES256) key pair: ES256 is the one algorithm every UCP agent must be able to check. Add the public key to a "keys" list at the top level of your UCP profile, as in the example, with its own "kid", and keep the private key on your server. The spec recommends a new key every 90 days: publish the new one next to the old, sign with it, and remove the old key a week later.
Agent Discovery · 7 of 8
7 OK
HTTPS, UCP profile reachable, AI bot access, llms.txt, Open Graph tags, Organization schema (JSON-LD), Mobile viewport metaShow
- HTTPS · Profile URL uses https://
- UCP profile reachable · HTTP 200
- AI bot access · robots.txt allows /.well-known/ucp
- llms.txt · Found at /llms.txt
- Open Graph tags · og:title and og:type/url present
- Organization schema (JSON-LD) · Organization-typed JSON-LD detected
- Mobile viewport meta · <meta name="viewport"> present
To fix
Discovery
sitemap.xml
Not assessed: /sitemap.xml got no answer from our request on this check (it timed out or did not connect), so this was not checked.
UCP Conformance · 4 of 5
4 OK
Profile passes schema validation, Protocol version present and well-formed, No validation warnings, Spec & schema URLs resolve (23)Show
- Profile passes schema validation · No structural errors
- Protocol version present and well-formed · Version: 2026-08-25
- No validation warnings · No outstanding validation issues
- Spec & schema URLs resolve (23) · All 23 URLs resolved.
Capability Coverage · 6 of 6
6 OK
Capabilities declared, Checkout capability, Transports declared, Payment handlers, REST search_catalog, MCP transport reachableShow
- Capabilities declared · 3 of 6 capability families detected: Checkout, Cart Management, Catalog. A family counts once however many namespaces or extensions declare it.
- Checkout capability · dev.ucp.shopping.checkout detected
- Transports declared · REST, MCP
- Payment handlers · 3 handlers registered
- REST search_catalog · search_catalog answered with a UCP response in 3012ms
- MCP transport reachable · tools/list returned a JSON-RPC response in 1208ms
Speed among Boutir stores
The profile answered in 673 ms, faster than 49% of the Boutir stores we check.