Agentic Commerce Readiness 2026: 25 Domains Exposed Valid UCP Profiles

Research highlights

• 25 domain observations (0.25% of the frame) exposed a public profile valid against the pinned official UCP business-profile schema.

• Only 25 of 571 exact HTTP 200 responses (4.38%) passed the pinned schema; 535 were not JSON, nine were non-UCP JSON and two were schema-incompatible UCP-shaped documents.

• Two recurring platform-linked capability and transport patterns covered 23 of 25 observations and 21 of 23 unique valid payload hashes.

• All 25 advertised checkout and fulfillment; 16 had a non-empty payment-handler registry and none published profile-level keys.

• The median valid-domain rank was 6,704, with 16 of 25 observations in ranks 5,001-10,000.

Agentic commerce has a measurement problem: a discovery URL can return HTTP 200 without containing UCP, while a schema-valid profile can advertise checkout with no payment-handler entry. This audit separates reachability, JSON parseability, schema conformance and declared capability from endpoint operation in a fixed top-domain frame.

Confirmed UCP discovery in the top 10,000

In the pinned Tranco K9LZW list, 25 of 10,000 domains (0.25%) exposed a public /.well-known/ucp document valid against the official UCP business-profile schema at commit `a85255e`. The collector produced evaluable UCP outcomes for 5,558 domains. Fourteen valid observations carried Shopify-linked signatures, nine Wix endpoint signatures and two custom or other signatures. Collection stopped at the discovery document.

The unit is a domain observation. The 25 observations contained 23 unique payload hashes, including duplicate-profile pairs for wyzecam.com / wyze.com and eufylife.com / eufy.com. Operational capability was outside the collection scope.

The discovery funnel

An HTTP 200 at a well-known path can contain a homepage, login page or branded error document. Schema validation separates those responses from UCP business profiles.

Only 25 of the 571 exact HTTP 200 responses passed the pinned business-profile schema. The remaining 95.62% were not valid UCP business profiles.

The two schema-incompatible UCP-shaped observations shared one exact payload hash. This means the 36 JSON responses represented 31 distinct payload hashes: 25 valid observations with 23 hashes, nine non-UCP observations with seven hashes, and two incompatible observations with one hash. Content-type and status checks alone would have counted unrelated JSON and an incompatible UCP shape as adoption.

Public discovery was evaluable for 5,558 domains. The 25 schema-valid observations equal 0.45% of that measured subset and 0.25% of the full 10,000-domain frame. The conditional 0.45% describes the measured subset only because evaluability was not random.

Implementation signatures

Fourteen valid observations carried Shopify-linked capability or service signals, nine used a Wix shopping endpoint, and two did not match either recurring family. The classification describes technical signatures in captured documents, not commercial relationships.

Platform-linked families

Methodology

Sampling frame

We downloaded the official Tranco daily list K9LZW, created August 13, 2026, and froze its first 10,000 pay-level domains. The source file and metadata are stored with SHA-256 hashes.

Collection boundary

Collection used GET requests to robots.txt, the homepage, /llms.txt and /.well-known/ucp under the declared ProxyWingResearch/1.0 client. Authentication, forms, challenges and transactional endpoints were outside scope.

Schema validation

Every parseable discovery response was validated as a UCP business profile against the official schema tree pinned at repository commit a85255ec65a7dd553341156f8277c9e5fc23e008. Validation used JSON Schema draft 2020-12 through jsonschema 4.25.1. The raw JSON, response hash, validation result and errors are available in the research download.

What valid profiles declared

Capability declarations describe the discovery document. They do not establish inventory freshness, payment authorization, geographic reach, or successful transactions.

Limitations

• Frame: Tranco's popularity-ranked top 10,000 domains.
• Results are domain-level; related domains can resolve to one merchant or profile.
• A single-day, single-vantage snapshot can miss temporal or geographic differences.
• Coverage: public discovery was evaluable for 5,558 domains.
• Schema scope: document structure. Operational capability, permission and transaction success were outside the test.
• Capability, transport, payment-handler, version and key counts are advertised registry contents, not tests of the systems behind them.
• Rank-band results are descriptive because evaluability and site composition differ across bands.
• Snapshot date: August 14, 2026; public UCP deployment can change over time.

Sources

1. Tranco top sites ranking, using the K9LZW snapshot recorded in the data package.
2. Universal Commerce Protocol specification and the pinned official business-profile schema.
3. ProxyWing source manifest with source roles, dates, and rights notes.
4. Full study methodology and reproducibility record.