Dmytro Galko · open data
A census of 5,356 live Shopify storefronts · 2026-09-18
Google and Shopify published the Universal Commerce Protocol so an agent can read a shop, find a product and buy it. The obvious question is how many shops actually speak it — and nobody had published a count. Here is one, with the tool, the domain list and the raw results, so anyone can repeat it and get their own number.
The short answer surprised me: adoption is not the problem. 98.9% of these shops publish a valid profile, all of them on the current 2026-08-25 release, none with a blocker. Shopify turned it on for everyone, so "does my shop support it" is already answered. The real variation is one capability — and it is the one that decides whether the agent is a stranger or your customer.
| Agent can sign the shopper into their account | 2,784 | 52.5% |
|---|---|---|
| Agent can only act as a guest | 2,515 | 47.5% |
dev.ucp.common.identity_linking is the only capability these
5,299 shops differ on; the other eight are identical everywhere. Without
it the agent can browse and buy, but as an anonymous visitor: no saved
address, no order history, no loyalty tier, no "the usual". For a
returning customer that is the difference between a checkout and a form.
| Profile read and audited | 5,299 | 98.9% |
|---|---|---|
| No profile published at all | 11 | 0.2% |
| Refused the request (403, 429) | 13 | 0.2% |
| Answered something that is not a profile | 1 | 0.0% |
| No answer | 32 | 0.6% |
46 shops (0.9%) could not be checked either way. They are counted here and nowhere else: a shop that refused the request is not a shop that failed the audit, and none of them appears in any percentage above or below.
How often each capability appears among the 5,299 audited shops.
dev.shopify.cataloguse Shopify's own catalogue extension | 5,299 | 100.0% |
|---|---|---|
dev.ucp.shopping.cartput it in a cart | 5,299 | 100.0% |
dev.ucp.shopping.catalog.lookuplook a product up by id | 5,299 | 100.0% |
dev.ucp.shopping.catalog.searchfind a product by searching | 5,299 | 100.0% |
dev.ucp.shopping.checkoutcomplete the purchase | 5,299 | 100.0% |
dev.ucp.shopping.discountapply a discount code | 5,299 | 100.0% |
dev.ucp.shopping.fulfillmentsee delivery options | 5,299 | 100.0% |
dev.ucp.shopping.orderread the order afterwards | 5,299 | 100.0% |
dev.ucp.common.identity_linkingsign the shopper into their own account | 2,784 | 52.5% |
Eight of the nine are dev.ucp.*, the protocol's own namespace. The
ninth, dev.shopify.catalog, is a platform extension — evidence
that the extension mechanism is being used in production and not only in
the specification.
| 2026-08-25 | 5,299 | 100.0% |
|---|
Not one audited shop is behind the 2026-08-25 release. A platform-wide rollout has no long tail of old versions, which is the opposite of what a self-hosted protocol looks like a year in.
The audit looks for twelve ways a profile can be published and still be useless to an agent — a checkout with no searchable catalogue, a capability declared without the schema needed to call it, an extension naming a parent that is not there, an endpoint on plain HTTP. Across 5,299 shops it found none of them. Worth stating plainly: the tool is not measuring nothing — the same twelve checks do fire on hand-written profiles, which is what they were written against.
*.myshopify.com name: 5,356 shops. Discovery asked a public resolver, never the shop./.well-known/ucp per shop, four at a time, with a pause, an honest user agent naming the tool, and no attempt to get around anything that said no.ucp-audit --batch survey/domains.txt --csv out.csv rebuilds every table above.Want this run against your own shops, or the identity-linking gap closed on yours? Write to hello@dkautomation.dev or open an issue.