Agentic Commerce in 2026: The Protocols, the Companies, and Which Stores Are Ready

Agentic commerce means an AI agent finds, compares, and buys products for a person, often completing checkout inside a chat window instead of on the merchant's site. In 2026 it runs on a handful of open protocols. OpenAI and Stripe's Agentic Commerce Protocol (ACP) handles checkout. Google's Universal Commerce Protocol (UCP) covers the whole shopping journey. Google's Agent Payments Protocol (AP2) records what the shopper approved, and Visa's Trusted Agent Protocol (TAP) lets a merchant verify the agent. This State of the Industry report explains each protocol, maps 42 companies and standards across six layers of the stack, and shares what we found when we checked 36 well-known online stores for a published UCP profile on October 19, 2026.

Key Takeaways

• Agentic commerce is shopping done by an AI agent on a person's behalf. McKinsey estimates it could orchestrate up to $1 trillion in U.S. retail revenue by 2030, and $3 trillion to $5 trillion globally (McKinsey, via Digital Commerce 360).
• The Agentic Commerce Protocol (OpenAI and Stripe, September 2025) handles checkout using a single-use Shared Payment Token. The Universal Commerce Protocol (Google, January 2026) adds catalog search, carts, identity linking, and orders.
• AP2 adds signed "mandates" that prove what a shopper approved. Visa's TAP signs agent requests with RFC 9421 HTTP Message Signatures so merchants can tell a real agent from a bot.
• On October 19, 2026, 11 of the 36 stores we checked returned a UCP profile at /.well-known/ucp. Nine of the 11 were Shopify brands, all with the same 11 declared capabilities. On 9 sites, bot protection stopped the request or there was no response, so we couldn't complete the check.
• Agents still read the open web for prices, stock, and reviews. Whether an agent can reach a page, and what that page shows in a given country, now affects what it buys.

What is agentic commerce?

Agentic commerce is a purchase made by an AI agent acting for a person. The person states a goal ("white running shoes under $120, delivered by Friday"), and the agent searches, compares, builds a cart, and pays, asking for approval where the person requires it. The merchant still sells the product and, in the main protocols, remains the merchant of record.

It differs from earlier e-commerce in who reads the storefront. A human shopper reads a product page. An agent reads a product feed, a protocol endpoint, or, failing those, the rendered page itself. Whichever it reads is what it acts on.

The market estimates are large and early. In October 2025, McKinsey estimated agentic commerce "could generate as much as $1 trillion in orchestrated U.S. retail revenue by 2030" and "as much as $3 trillion to $5 trillion globally" (Digital Commerce 360). Treat those as a forecast of revenue an agent touches, not as sales already happening.

What are the agentic commerce protocols?

Four commerce protocols do most of the work in 2026, on top of two general agent standards, MCP and A2A. They don't compete head to head. Each one covers a different step: talking to the merchant, paying, proving approval, or proving identity.

Sources: ACP site, Stripe, UCP site, Google Cloud on AP2, Visa (announcement).

How the Agentic Commerce Protocol works

ACP is "an open standard for programmatic commerce flows between buyers, AI agents, and businesses," developed by Stripe and OpenAI and released under Apache 2.0 (agenticcommerce.dev). It launched with Instant Checkout in ChatGPT on September 29, 2025, starting with U.S. Etsy sellers, with Shopify merchants named as coming next (Stripe).

The payment piece is the Shared Payment Token. Stripe describes it as "a new payment primitive that lets applications like ChatGPT initiate a payment." The token hides the buyer's card from the AI app and is limited to one merchant and one cart total. The business configures its checkout so that "any compatible agent can securely initiate checkout," and stays the merchant of record.

How the Universal Commerce Protocol works

UCP describes itself as "the common language for platforms, agents, and businesses" (ucp.dev). Google announced it at the NRF Big Show on January 11, 2026. The live site now lists co-developers including Shopify, Etsy, Wayfair, Target, Walmart, Amazon, Microsoft, Meta, Salesforce and Stripe, plus travel and food partners such as Booking.com, Expedia Group, Marriott, DoorDash and Uber Eats.

UCP's scope is wider than checkout. It covers "Catalog Search and Lookup, Cart Building, Identity Linking, Checkout, and Order Management," runs over REST and JSON-RPC, and supports AP2, A2A and MCP. Discovery is simple, which is what made our test possible: "Every business publishes a machine-readable profile at /.well-known/ucp that declares which services, capabilities, and payment handlers they support" (UCP core concepts).

How AP2 and Visa's Trusted Agent Protocol fit in

AP2 answers "did the person really approve this?" It uses "tamper-proof, cryptographically-signed digital contracts" called mandates (Google Cloud). An Intent Mandate records the instruction, such as a price ceiling. A Cart Mandate records "the exact items and price" the person approved. Together they form an audit trail from request to payment.

Visa's TAP answers "is this really that agent?" An agent attaches a signature with a timestamp, session ID and key ID to each request, generated to RFC 9421, the HTTP Message Signatures standard (GitHub). That is the same building block behind Web Bot Auth, which we covered in our post on Cloudflare's x402 and Web Bot Auth. The UCP spec lets a profile carry public keys and calls them "reusable as a Web Bot Auth key source," so identity and discovery can share one document. In our check, Chewy's and Zara's profiles included a signing_keys array; the nine Shopify profiles did not.

Which online stores support UCP today? We checked 36

Protocol announcements list partners. They don't tell you which storefronts an agent can talk to today. Because UCP puts its profile at a fixed URL, that is checkable. On October 19, 2026 we requested https://<store>/.well-known/ucp from 36 well-known U.S. storefronts. They fall into three groups: 22 large retailers and marketplaces, including the retail co-developers of UCP; 12 direct-to-consumer brands we picked because they are widely known, not at random; and Shopify's own two consumer domains, shopify.com and shop.app.

We sent one browser-like request per store from a single connection, with no login. A 200 HTML page counted as no profile (a soft 404), and we re-fetched the two such pages to confirm; a JavaScript challenge counted as stopped. The 36 aren't a representative sample of retail, so read the results by group, not as a market share.

By group, the difference is stark:

Nine of 12 direct-to-consumer brands published a profile, against 2 of 22 large retailers. We name the stores that published a profile, because that is a public, opt-in signal. We report the other two groups as counts. A missing file at one path, or a security layer that stops an anonymous script, says nothing about whether a retailer takes part in agentic commerce through other channels.

Four things stood out.

Shopify accounts for most of the profiles we found. Nine of the 11 came from Shopify brands, and all nine were nearly identical. Each declared spec version 2026-08-25, MCP and embedded transports, the same three payment handlers (Google Pay, Shopify card, and Shop Pay) and the same 11 capabilities: catalog, search, lookup, cart, checkout, discount, fulfillment, buyer consent, identity linking, order, and permalink. That pattern points to Shopify publishing UCP for its merchants at the platform level, not brand by brand.

Large retailers that built their own stack declare less. Chewy's profile used spec version 2026-01-23 over REST and declared checkout, fulfillment and order. Zara's used 2026-04-08 over REST and declared checkout only. Both listed Google Pay as the payment handler. A narrower profile is a reasonable first step: an agent can complete a purchase, but has to find the product some other way.

"Co-developer" and "published profile" are different things. Several companies that helped write UCP returned no profile at the standard path on the day we checked. That is not a sign they aren't participating. A co-developer can run agentic checkout through Google's own surfaces or a separate domain. For an independent agent, though, the root-domain profile is the discoverable entry point.

A quarter of the checks didn't get through. Seven of the 36 sites answered our single anonymous request with 403, 429, or a JavaScript challenge, and two didn't respond. That is bot protection doing its job, and a retailer can let verified agents through, for example with signed requests like Visa TAP or Web Bot Auth. It does show that agent identity and access will decide which storefronts an agent can read.

We saved the 11 profiles, the request log, and a copy of the UCP co-developer list, and we plan to repeat the check.

The agentic commerce landscape: 42 companies and standards in six layers

Massive's research team maps the companies building each layer of the stack. The Q3 2026 Agentic Commerce Landscape (researched July 16, 2026, re-checked against each protocol's own site for this post) lists 43 entries in six categories. Mastercard Agent Pay appears in two of them, so there are 42 distinct companies and standards.

Two observations from building it. First, the payment networks show up in two layers, because Visa and Mastercard each publish a standard and sell the service built on it. Second, the trust layer is filled by companies that already did fraud and bot detection for human shoppers. Their job now is to approve the right agents, not just block automated traffic.

What does agentic commerce change for pricing and product data teams?

The protocols move checkout into the agent. They don't remove the open web from the decision. UCP's catalog capability gives an agent structured product data where a merchant publishes it, but 25 of the 36 storefronts we checked didn't return a profile at their root domain. For those, and for reviews, competitor prices, and stock in a particular city, the agent falls back to reading pages, which is the same job price monitoring teams already do.

That has three practical effects for teams that track prices and listings:

1. The agent's view becomes a channel to monitor. If a shopping agent can't read a product page, or sees a different price in its region, it may recommend another store. That decision happens outside a merchant's own analytics. Our test of whether ChatGPT gives different answers by country found answers that changed with the asking location.
2. Location still decides the price. Prices, tax display, shipping, and stock vary by country and city. A monitor that checks from one place sees one version of the shelf. Our guide to competitor price monitoring covers how teams set up checks across markets.
3. Access is becoming a priced lane. Some sites now answer automated requests with a payment request instead of a block, as Cloudflare's HTTP 402 tooling allows. Agent builders need a budget rule for that, not only a retry rule.

Massive's part is the fetching layer: the Web Render API returns a public page as rendered HTML or markdown from a chosen country, region, or city, and the Search endpoint returns the live results page for a query in that location. The LLM search stack report maps the companies built on that kind of access. Teams use it to see the page a local shopper, or a local agent, would see, then run their own comparison on top.

The bottom line

• Agentic commerce is real but early. The protocols are public and open source, and checkout inside ChatGPT launched in 2025, but only 2 of the 22 large retailers we checked publish a UCP profile.
• Learn the protocols by job: ACP and UCP talk to the merchant, AP2 proves approval, and TAP proves the agent's identity.
• For pricing and product teams, the agent's view of your shelf is a new channel. Check what it sees, from where your customers are.

Sources

• Digital Commerce 360, "McKinsey forecast: agentic commerce sales"
• Agentic Commerce Protocol, agenticcommerce.dev
• Stripe, "Stripe powers Instant Checkout in ChatGPT"
• Universal Commerce Protocol, ucp.dev and "Core concepts"
• Google Cloud, "Announcing the Agent Payments Protocol (AP2)"
• Visa, "Trusted Agent Protocol"
• IETF, "RFC 9421: HTTP Message Signatures"
• McKinsey, "The agentic commerce opportunity", October 2025
• Massive, Agentic Commerce Landscape, Q3 2026 (first-party market map, researched July 16, 2026)
• Massive, UCP profile check of 36 storefronts, October 19, 2026 (first-party test)