How AI Agents Find and Trust Online Merchants

The Trust Problem in Agentic Commerce

When a person shops online, they use a mix of signals to decide if a merchant is trustworthy. Brand recognition. Reviews. HTTPS padlocks. Familiar payment logos. Years of conditioned web literacy tell them what is safe and what is sketchy.

AI agents do not have that intuition. They need structured signals.

This is one of the less-discussed problems UCP solves. The protocol is not just about making checkout work technically. It is about giving agents a way to evaluate merchants before committing a consumer's money to them.

How Agents Find Merchants Today

There are two main discovery paths in the current UCP ecosystem.

Direct manifest lookup. Every UCP merchant publishes a manifest at a predictable URL: /.well-known/ucp. An agent that knows a domain can check this URL and immediately learn if the merchant supports UCP, what capabilities they offer, and which payment handlers they accept. This is the most basic form of merchant discovery. It works for merchants an agent already knows about.

Directory lookup. For broader discovery, agents query UCP directories: structured registries of merchants organized by category, capability, and status. UCPList is one of these directories. Google Shopping's UCP infrastructure is another. Directories let agents answer the question "who sells hiking backpacks and supports UCP checkout" without having to check every outdoor gear merchant in existence.

In practice, agents use both. Directory for initial discovery, direct manifest check for final verification.

What a Manifest Actually Says

The /.well-known/ucp manifest is a JSON file. Here is a simplified example:

{
  "ucp_version": "1.2",
  "merchant_id": "shopify:example-store",
  "capabilities": ["catalog", "cart", "checkout", "identity"],
  "payment_processors": ["stripe", "shopify_payments"],
  "identity_providers": ["shopify_identity", "google"],
  "endpoints": {
    "catalog": "https://example.com/ucp/v1/catalog",
    "checkout": "https://example.com/ucp/v1/checkout"
  }
}

An agent reads this and learns: the merchant supports full checkout (not just browse), accepts Stripe payments, integrates with Google identity, and has their catalog available for structured queries. All of this, from a single HTTP GET.

If the manifest is missing or malformed, the agent moves on. The merchant is effectively invisible to that agent session.

How Trust Gets Built

A manifest tells you what a merchant claims to support. Trust signals tell you how reliable those claims are.

Several trust mechanisms operate in the current UCP ecosystem.

Verification status. Directories like UCPList verify that merchants actually have working endpoints before listing them as "Live." An agent querying a verified directory can skip the endpoint check and trust that the listing is accurate. Unverified listings are treated as unconfirmed.

Conformance certification. The UCP conformance test suite checks that an implementation handles the full spec correctly, including edge cases: inventory changes mid-checkout, price updates between catalog query and purchase, malformed payment tokens. Merchants who pass the conformance suite can display a certification badge. Agents can check for this badge as a proxy for implementation quality.

Transaction history. Over time, agents accumulate their own trust signals. A merchant that successfully fulfills 50 agent-initiated orders is treated differently from a merchant with zero history. Agent platforms are starting to build proprietary reputation scores based on checkout success rate, inventory accuracy, and response time. These scores are not public, but they influence routing.

Payment handler guarantees. When a consumer pays through a UCP-certified payment handler (Stripe, Adyen, Visa, etc.), those processors provide consumer protection on the transaction. An agent completing checkout through a certified payment handler gives the consumer an additional layer of recourse if something goes wrong.

Why This Matters for Merchants

Trust signals compound. A merchant with a verified listing, a passing conformance score, and a track record of successful transactions will receive more agent traffic than a merchant who just has a manifest file.

This is structurally similar to how Google Search works. Technical eligibility (having a crawlable website) gets you into the index. Trust signals (domain authority, backlinks, review counts) determine where you rank. Both matter. Technical eligibility alone does not win.

For UCP merchants, the practical implication is straightforward.

First, get your endpoint verified. Submit to UCPList and other directories. Let them confirm your manifest is live and your endpoints work. This is the baseline.

Second, run conformance tests. The @ucp/conformance suite is public and free. Run it against your endpoints before going live. Fix the failures. A merchant with a clean conformance report is easier for agents to trust than one with unknown error handling.

Third, keep your data accurate. Inventory, pricing, and shipping information need to stay current. An agent that initiates checkout for an out-of-stock item at a stale price creates a bad experience. That experience feeds into reputation scoring. Accurate data is not just good UX, it is a trust investment.

Agents Are Getting More Selective

In January 2026, when UCP launched, most agents treated any working UCP endpoint as equal. Volume was low enough that they could afford to be permissive.

That is changing. As the merchant count grows and agent transaction volume increases, agent platforms are applying more nuanced routing logic. Verified merchants with conformance badges and positive transaction history are getting prioritized. Unverified merchants with no history are getting fewer referrals.

The gap between a merchant with strong trust signals and one without them will only widen over time.

The UCPList Role

We verify listings before marking them Live. We run our own endpoint checks periodically. If a merchant's endpoint goes down or starts returning invalid data, the badge updates.

For agents that use the UCPList directory as a discovery source, our verification is a trust signal they can rely on. For merchants, being listed and verified here is a way to build trust with agents before those agents have transaction history with you.

If you are a merchant with a working UCP endpoint, submit your listing. If you are a developer building agent discovery logic, the UCPList API gives you programmatic access to our verified merchant data.

Trust in agentic commerce is not automatic. It is built, signal by signal. UCPList is one piece of that infrastructure.