How it works & methodology

Honesty note: Every published value comes from our own checks. The list is a sample, not a cross-section of the web. “MCP declared” means the manifest names an endpoint; we have not tested it with a call. The score is a heuristic for machine reachability (version 1). It says nothing about quality, price, trustworthiness, or whether an automated purchase will succeed. We do not test purchases.

1. Which domains we check (the sample)

We do not take data from other directories. Third-party lists and public web-crawl and DNS data (for example hints that a host runs on Shopify) are used only to find candidate domains. Whether a domain is a shop, whether it has a UCP manifest or an MCP endpoint, and how it is scored is determined only by our own requests. Names and logo links come from the homepage metadata we load during the check.

The list is a sample, not a census, and it is currently dominated by Shopify stores – Shopify serves UCP manifests for many of its shops, which made it possible to verify a large number of domains quickly. Shops on other platforms are added one by one. We do not list shops behind a password page, closed stores, or domains without a valid manifest. Rates therefore do not apply to the whole web.

2. Is it a shop?

A “shop” sells goods or digital products online. We decide with rules and our own evidence and store the reasons and a confidence value: platform detection (for example Shopify markers in HTML and headers), cart/product signals on the homepage, and a valid UCP manifest. Unclear cases stay “unknown” and are not published.

3. Checks

Read-only GET requests only, with an identifiable user agent, honouring robots.txt, with a limited request rate per host and back-off when a host answers “too many requests” (429). No logins, no forms, no purchases, no POST requests to shop endpoints.

/ · /robots.txt · /.well-known/ucp · /llms.txt · /sitemap.xml · /.well-known/mcp · /.well-known/ai-plugin.json

For most shops we also send a single GET to the MCP endpoint named in the UCP manifest to see whether it answers. We call no tools (no tools/list, no POST). “MCP declared” is therefore not “MCP tested”.

Errors (403/429/5xx/timeouts) are not proof that something is missing. A 404 is not a failure.

WebMCP: we note whether the homepage HTML contains a WebMCP hint. We do not read or test the tools, publish no tool counts or kinds, and the hint is not part of the score.

4. Status

Verified – our check confirmed an agent protocol (valid UCP manifest or valid /.well-known/mcp). Most listed shops have this status.
Partial – homepage reachable, but we could not confirm a protocol (only possible for shops added individually).
Unreachable – homepage not fetchable in the last check. After 3 consecutive failures (on different runs) the shop is delisted.

5. Agent-readiness score (version 1)

Sum of the components, maximum 85. Every shop page shows the breakdown. This is a simple first version and will change.

Component	Points	Condition
`ucp_manifest_valid`	25	/.well-known/ucp returns JSON with ucp.version and at least one capability
`ucp_checkout`	10	UCP capability list contains checkout
`ucp_cart`	5	UCP capability list contains cart
`ucp_catalog`	5	UCP capability list contains catalog or search
`ucp_payment_handlers`	5	Manifest declares payment handlers
`mcp_endpoint`	10	UCP manifest declares an MCP endpoint, or /.well-known/mcp returns valid JSON (declared, not tested by a call)
`robots_ai`	15	none of GPTBot, ClaudeBot, Google-Extended, PerplexityBot, OAI-SearchBot, ChatGPT-User is fully blocked (or no robots.txt): 15; some blocked: 8; all blocked or robots.txt unreadable: 0
`llms_txt`	5	/llms.txt exists and is not an HTML page
`sitemap`	3	a sitemap is declared or found at /sitemap.xml
`ai_plugin`	2	/.well-known/ai-plugin.json is valid JSON

The “check coverage” value is the share of checks with a clear result. It tells you how completely we could check.

6. Limitations

A sample, not a census; currently mostly Shopify. The choice of domains to check is not random.
Country: only set when we have evidence (schema.org address, the shop’s platform country, VAT-ID prefix in the imprint) – currently a small minority of shops. The domain suffix is never the answer. Country and EU filters therefore match few shops.
Categories are derived from name, title and domain with keyword rules; no match means “unknown”. They are coarse.
We publish no shop descriptions or other shop copy. Names come from og:site_name or the page title; logos are only links to the shop’s own icon (we host no images).
MCP endpoints are taken from the manifest and not tested. No test of cart or checkout. A valid manifest does not mean every purchase works.
The score can change when we adjust the formula (the version number is raised; changes appear in the changelog).

7. Updates

New candidates are checked regularly and existing shops are re-checked. Changes are listed in the changelog. Last run: 2026-10-18.

8. License and independence

The data is collected by us; you may use it under fair use for private purposes. For commercial use, please get in touch: [email protected]. We are not affiliated with Shopify, Google or any listed shop, and there are no paid placements. Brand and protocol names belong to their owners.