UCP Profile Validator — Universal Commerce Protocol

UCP Profile Validator checks a Universal Commerce Protocol (UCP) business or platform profile, from a merchant URL such as /.well-known/ucp or from pasted JSON, against the official versioned schema and protocol safety rules, and returns one detailed pass/fail report. It is built for merchants, commerce platforms, payment teams, and developers preparing for AI-agent shopping, and costs USD 5 per 1,000 reports on the FREE pricing tier (USD 0.005 per report) plus a start fee of under one cent per run.

Invalid profiles still get a full report, because the findings are what you pay for. Input mistakes are rejected with a diagnostic and no report charge.

What does the UCP validator check?

It validates the whole profile document, not checkout, cart, or order payloads. On top of the official JSON Schema for the declared ucp.version, it checks:

• that every advertised schema URL sits under the namespace authority its name claims;
• that machine-fetched URLs use HTTPS and contain no user credentials;
• extensions whose parent capability is missing, and capabilities that extend themselves;
• duplicate service transports, payment-handler IDs, and JWK kid values;
• private JWK key material accidentally published in a public profile;
• business profiles that advertise no capabilities (a warning);
• optionally, that advertised schema and specification URLs are reachable and look like JSON Schema, OpenAPI, or OpenRPC documents.

Each finding has a stable code: SCHEMA_VALIDATION, NAMESPACE_AUTHORITY_MISMATCH, ORPHAN_EXTENSION, SELF_EXTENSION, DUPLICATE_TRANSPORT, DUPLICATE_HANDLER_ID, DUPLICATE_JWK_KID, PRIVATE_JWK_MATERIAL, NO_CAPABILITIES, SPEC_NOT_HTTPS, SPEC_URL_INVALID, VERSION_FORMAT, SCHEMA_VERSION_UNKNOWN, OFFICIAL_SCHEMA_UNAVAILABLE, UCP_OBJECT_REQUIRED, REMOTE_RESOURCE_HTTP, REMOTE_RESOURCE_UNREACHABLE, REMOTE_SCHEMA_NOT_JSON, REMOTE_SCHEMA_METADATA, and REMOTE_CHECK_LIMIT.

What does the report contain?

One dataset item per run, also saved as the OUTPUT record.

Field	What it contains
valid	true when there are no structural, semantic, namespace, or requested remote-check errors
schemaValid	Whether the profile matches the official UCP schema for its version
remoteChecksPassed	Whether advertised resources passed, or null when remote checks are off
source	The profile URL that was fetched, or inline-json
profileType	business or platform, the schema variant used
protocolVersion	The date-version declared in ucp.version
schemaUrl	The official schema URL used for validation
summary	One-line outcome, such as "Invalid business profile with 1 error and 0 warnings."
errorCount, warningCount	Blocking and advisory finding totals
capabilityCount, serviceCount, paymentHandlerCount	Registry entry totals
checks	Findings with code, severity, JSON path, message, and url and statusCode where relevant
validatedAt	Completion timestamp

How do I validate a UCP profile?

Choose a source, then run. For a live merchant, set sourceType to url and enter the store's origin; the Actor adds /.well-known/ucp for you.

Input	Default	Accepted values
sourceType	json	json (inline profile) or url
profileUrl	none	HTTPS profile URL or merchant origin
profile	A valid sample business profile	One complete UCP profile object with a top-level ucp member
profileType	auto	auto, business, platform
checkRemoteResources	true	Fetch advertised schema and specification URLs
maxRemoteResources	25	1–100 unique URLs
requestTimeoutSecs	10	3–30 seconds per request

URL mode:

{
  "sourceType": "url",
  "profileUrl": "https://merchant.example",
  "profileType": "auto",
  "checkRemoteResources": true
}

Inline JSON mode, for CI before you publish:

{
  "sourceType": "json",
  "checkRemoteResources": false,
  "profile": {
    "ucp": {
      "version": "2026-08-25",
      "services": {
        "dev.ucp.shopping": [{
          "version": "2026-08-25",
          "transport": "rest",
          "endpoint": "https://merchant.example/ucp",
          "schema": "https://ucp.dev/2026-08-25/services/shopping/rest.openapi.json"
        }]
      },
      "capabilities": {},
      "payment_handlers": {}
    }
  }
}

With profileType: "auto", a profile whose services declare an endpoint is checked as a business profile; anything else is checked as a platform profile.

When should you use it, and when not?

Use it for:

• merchant onboarding checks before you advertise UCP support;
• CI release gates on the profile you ship, with remote checks off for deterministic results;
• scheduled monitoring of a live /.well-known/ucp file.

Do not use it for:

• A scored, store-wide readiness audit that also covers the Agentic Commerce Protocol discovery file, product JSON-LD, policies, and crawlability. Use Agentic Commerce Readiness Audit — UCP, ACP & Product Schema.
• Checkout, cart, or order payloads. Only profile documents are validated.
• Security audits, domain-ownership proof, or HTTP message-signature checks. These are out of scope.

Use it from an AI assistant

UCP Profile Validator works from Claude, ChatGPT, Cursor, or any other MCP client through Apify's MCP server. Add https://mcp.apify.com/?tools=muhammadafzal/ucp-profile-validator to your client and ask, for example: "Check the UCP profile at shop.example.com and explain every error in plain English."

Run it with the API

JavaScript (apify-client):

import { ApifyClient } from 'apify-client';

const client = new ApifyClient({ token: process.env.APIFY_TOKEN });
const run = await client.actor('muhammadafzal/ucp-profile-validator').call({
    sourceType: 'url',
    profileUrl: 'https://merchant.example',
});
const { items: [report] } = await client.dataset(run.defaultDatasetId).listItems();
console.log(report.valid, report.summary);

Python (apify-client 3.x):

import os
from apify_client import ApifyClient

client = ApifyClient(os.environ["APIFY_TOKEN"])
run = client.actor("muhammadafzal/ucp-profile-validator").call(
    run_input={"sourceType": "url", "profileUrl": "https://merchant.example"}
)
report = next(client.dataset(run.default_dataset_id).iterate_items(), None)
if report and not report["valid"]:
    for finding in report["checks"]:
        print(finding["severity"], finding["code"], finding["path"])

Output example

An illustrative report for a profile whose capability schema returns HTTP 404:

{
  "source": "https://merchant.example/.well-known/ucp",
  "profileType": "business",
  "valid": false,
  "schemaValid": true,
  "remoteChecksPassed": false,
  "protocolVersion": "2026-08-25",
  "schemaUrl": "https://ucp.dev/2026-08-25/schemas/profile.json",
  "summary": "Invalid business profile with 1 error and 0 warnings.",
  "errorCount": 1,
  "warningCount": 0,
  "capabilityCount": 1,
  "serviceCount": 1,
  "paymentHandlerCount": 0,
  "checks": [
    {
      "code": "REMOTE_RESOURCE_HTTP",
      "severity": "error",
      "path": "/ucp/capabilities/dev.ucp.shopping.checkout/0/schema",
      "message": "Remote schema returned HTTP 404.",
      "url": "https://ucp.dev/example.json",
      "statusCode": 404
    }
  ],
  "validatedAt": "2026-10-27T12:00:00.000Z"
}

Pricing: how much does UCP validation cost?

You pay one report event per run, plus a start fee. Apify platform usage is included.

Event	FREE	BRONZE	SILVER	GOLD, PLATINUM, DIAMOND
UCP profile validation report (primary event)	USD 0.005001	USD 0.004875	USD 0.00475	USD 0.004
Per 1,000 reports	USD 5.00	USD 4.88	USD 4.75	USD 4.00
Actor start, per started GB of allocated memory	USD 0.006251	USD 0.006094	USD 0.005938	USD 0.005

The default memory is 256 MB, so each run has one start event.

• One profile, FREE tier: USD 0.006251 + USD 0.005001 = about USD 0.011.
• 100 profiles (100 runs), FREE tier: 100 × USD 0.011252 = about USD 1.13 (USD 0.90 on GOLD).

Because each run validates one profile, the start fee applies per profile. Rejected inputs produce no report and no report charge.

Reliability and safety

• The schema is chosen from ucp.version at https://ucp.dev/{version}/schemas/profile.json, so each published version is checked against its own contract. An unpublished version reports OFFICIAL_SCHEMA_UNAVAILABLE rather than silently using another version.
• Fetches use HTTPS only, reject credentials, IP-address hosts, single-label hosts, and private or link-local DNS answers, follow at most four re-checked redirects, and refuse JSON responses over 2 MB.
• Remote checks read advertised schema and specification URLs only. No commerce operation is ever sent to a service endpoint.
• A successful fetch proves reachability at that moment, not long-term availability.

FAQ

What is a UCP profile?

It is the public JSON discovery document, usually at /.well-known/ucp, that declares a business's or platform's UCP version, services, capabilities, and payment handlers so AI agents know how to transact.

Which UCP versions can it validate?

Any date-version whose official schema is published at ucp.dev. The version comes from the profile's own ucp.version field.

Does it support the Agentic Commerce Protocol (ACP)?

No. It validates UCP profiles only. The Agentic Commerce Readiness Audit linked above checks for an ACP discovery file as part of a wider store audit.

Can I use it in CI?

Yes. Send the profile inline with checkRemoteResources: false and fail the build when valid is false.

How do I validate many merchants?

Start one run per profile through the API, or schedule a run per merchant. Each run returns one report.

Is it safe to paste my profile?

Paste only the public profile. Never include private keys, tokens, or cookies; the validator flags private JWK members if they slip in.

Related Actors

• Agentic Commerce Readiness Audit — UCP, ACP & Product Schema: scored readiness audit for a whole store.
• AI Readiness Checker for Website AEO & GEO: AI-crawler access, llms.txt, and structured data checks.
• HTML to JSON Smart Parser — Pages, Tables & Links: JSON-LD and meta tags from any page.

Legal and responsible use

Validate only profiles and domains you are authorized to inspect. UCP profiles are public discovery documents, but treat business configuration with care. For the protocol itself, see the official UCP specification.

Last verified: 2026-10-27