Docs
Firmly Agentic Commerce
Docs
Set theme to dark (⇧+D)
  1. Docs
  2. Solutions
  3. ...
  4. ...
  5. UCP
  6. UCP Roadmap

UCP Roadmap

This page covers UCP’s capabilities, Firmly’s current implementation status against the protocol, and the planned roadmap.

​​ UCP protocol — capabilities and extensions

UCP defines a set of core capabilities and optional extensions that expand what a checkout session can do.

​​ Core capabilities

Capability Description
Checkout Session-based cart management: create, update, complete, cancel
Identity Linking OAuth 2.0 flow — lets AI agents act on a user’s behalf on a merchant site

​​ Checkout extensions

Extension ID Description
Fulfillment dev.ucp.shopping.fulfillment Shipping options, pickup locations, delivery windows
Discount dev.ucp.shopping.discount Promo code validation and auto-discount application
AP2 Mandate dev.ucp.shopping.ap2_mandate Cryptographic authorization for autonomous agentic transactions
Buyer Consent No registered extension ID User authorization and privacy consent tracking

​​ Transport bindings

REST (primary), MCP, A2A, Embedded Protocol. Firmly implements the REST and MCP bindings (see the table below); A2A and the Embedded Protocol are not implemented.

​​ What Firmly implements

The table below maps each UCP capability to Firmly’s current status:

Capability / Feature Status Notes
Checkout — Create session ✅ Implemented Idempotency-aware; generates session and device IDs
Checkout — Update session ✅ Implemented Shipping info, shipping method, buyer info; buffers partial updates
Checkout — Complete session ✅ Implemented Google Pay (gateway path); the encrypted card path is proposed (see Firmly Card handler)
Checkout — Cancel session ✅ Implemented Flips the session status to canceled; does not clear the backing cart
Cart resource (pre-purchase) ✅ Implemented dev.ucp.shopping.cart — create, get, update (full-replacement line items), cancel (2026-04-08)
Catalog — search & lookup ✅ Implemented dev.ucp.shopping.catalog.search + .lookup — keyword/filter search, PDP-URL lookup, product detail (2026-04-08)
Fulfillment extension ✅ Implemented Shipping method negotiation via update step
Discount extension ✅ Implemented discounts.codes via the promo-codes endpoint; replacement semantics; rejections surfaced in messages[]
Discovery endpoint (/.well-known/ucp) ✅ Implemented Dynamic per-merchant manifest with payment handlers and signing keys
REST transport binding ✅ Implemented Primary binding for all capabilities
MCP transport binding ✅ Implemented Streamable HTTP (JSON-RPC 2.0); endpoint advertised in discovery
Idempotency ✅ Implemented 24-hour TTL per operation
ES256 signing (outbound) ✅ Implemented ECDSA P-256 key pair; public JWK published in the discovery manifest
Signature verification (inbound) ✅ Implemented RFC 9421 verified when a signature is present (ES256; keys from the caller’s UCP-Agent profile); invalid → 401
UCP-Agent handling ✅ Implemented Profile fetched and cached; agent identity recorded on the trace; the signature is verified when the request is signed
Destination API-key auth ✅ Implemented X-API-Key scheme (api_key_required / api_key_invalid)
Order Management 🔜 Planned Future phase
Identity Linking ❌ Not planned Out of scope — see note below
AP2 Mandate extension 🔜 Planned Future phase

Signing is optional per the UCP signatures specification: unsigned requests are currently accepted as anonymous (a deployment policy, with the agent profile still recorded for audit), while any signature that is presented is always verified. See UCP security for the full model.

Identity Linking (the OAuth 2.0 flow that lets agents act on a user’s behalf on the merchant’s own site) is out of scope for Firmly’s UCP integration. Firmly manages buyer identity internally through its own session and payment tokenization layer; a separate OAuth delegation flow with each merchant platform is not needed for the checkout paths Firmly supports.

​​ Catalog over UCP

The UCP specification centers on checkout and, at its origin, assumed product discovery was solved upstream (a shopping index, merchant feeds, or a platform’s own search), taking over only once a buyer signals intent to purchase. Firmly extends UCP with catalog capabilities — dev.ucp.shopping.catalog.search (keyword and filter search) and dev.ucp.shopping.catalog.lookup (batch PDP-URL lookup and full product detail with option/variant selection). Both shipped at manifest version 2026-04-08 and are exposed over the REST and MCP bindings, giving agents a discovery layer over the same integration that handles checkout rather than relying on a separate upstream index.

​​ Phased roadmap

Phase Status Scope
Phase 1 ✅ Implemented Native checkout — Create, Update, Complete, Cancel sessions
Phase 2 ✅ Implemented Fulfillment support — shipping method negotiation
Phase 3 ✅ Implemented Google Pay payment path
Phase 4 ✅ Implemented Discount extension — promo code application via the checkout/cart update step
Phase 5 ✅ Implemented Cart resource, catalog search/lookup, and the MCP transport binding (2026-04-08)
Phase 6 Planned AP2 Mandate — cryptographic authorization for agentic transactions
Phase 7 Future Merchant-side UCP adapter — place orders on UCP-compliant merchants

Discount extension. Firmly implements UCP’s discount extension. When a buyer enters a promotion code on the AI checkout surface, Firmly maps discounts.codes to the merchant’s promo-code endpoint (POST / DELETE .../cart/promo-codes) and returns updated line-item totals and a revised order summary. Codes use replacement semantics (an empty array clears all applied codes), and a rejected code is surfaced as a recoverable warning in messages[] rather than failing the update. For merchants with active promotions — flash sales, loyalty discounts, coupon campaigns — this matches what a buyer expects from a standard web checkout.