UCP Cart Create Issue

[rsharma-oss]

ucp cart create returns NO_COMPATIBLE_TRANSPORT when merchant offers both mcp and embedded at different versions

@shopify/ucp-cli version: 0.7.0
Node: v24.16.0
Platform: Darwin 25.5.0

Summary

ucp cart create refuses with NO_COMPATIBLE_TRANSPORT against a merchant
whose well-known clearly declares mcp transport at a version my profile
accepts. ucp discover against the same merchant succeeds with the correct
mcp endpoint. Reproduces on a freshly reinitialized profile with cache
cleared.

Reproduction

# 1. Fresh profile pinned to 2026-08-25 only
ucp profile init --name repro --activate --force \
  --protocol-min 2026-08-25 --protocol-max 2026-08-25

# 2. Clear cache
rm -rf ~/.ucp/cache/*

# 3. Discover succeeds
ucp discover https://www.progressivenutritional.com --profile repro --format json
# → returns {"ok": true, ...} with the mcp endpoint

# 4. Cart create fails
ucp cart create --business https://www.progressivenutritional.com \
  --profile repro --format json --refresh \
  --set '/line_items=[{"item":{"id":"gid://shopify/ProductVariant/39580213182596"},"quantity":1}]'
# → NO_COMPATIBLE_TRANSPORT
#   "business offers dev.ucp.shopping within version range but no
#    acceptable transport (acceptable: [mcp]; business: [embedded])"

Evidence

Merchant's well-known — mcp IS at 2026-08-25

{"ucp":{"version":"2026-08-25","supported_versions":{"2026-08-25":"https:\/\/progressive-nutritionals.myshopify.com\/.well-known\/ucp\/2026-08-25","2026-04-08":"https:\/\/progressive-nutritionals.myshopify.com\/.well-known\/ucp\/2026-04-08","2026-01-23":"https:\/\/progressive-nutritionals.myshopify.com\/.well-known\/ucp\/2026-01-23"},"services":{"dev.ucp.shopping":[{"version":"2026-08-25","spec":"https:\/\/ucp.dev\/2026-08-25\/specification\/overview\/","transport":"mcp","endpoint":"https:\/\/progressive-nutritionals.myshopify.com\/api\/ucp\/mcp","schema":"https:\/\/ucp.dev\/2026-08-25\/services\/shopping\/mcp.openrpc.json"},{"version":"2026-04-08","spec":"https:\/\/ucp.dev\/2026-04-08\/specification\/overview\/","transport":"embedded","schema":"https:\/\/ucp.dev\/2026-04-08\/services\/shopping\/embedded.openrpc.json"}]},"capabilities":{"dev.ucp.shopping.checkout":[{"version":"2026-08-25","spec":"https:\/\/ucp.dev\/2026-08-25\/specification\/checkout","schema":"https:\/\/ucp.dev\/2026-08-25\/schemas\/shopping\/checkout.json"}],"dev.ucp.shopping.fulfillment":[{"version":"2026-08-25","spec":"https:\/\/ucp.dev\/2026-08-25\/specification\/fulfillment","schema":"https:\/\/ucp.dev\/2026-

Note both transports appear under dev.ucp.shopping:

• mcp @ 2026-08-25, endpoint https://progressive-nutritionals.myshopify.com/api/ucp/mcp
• embedded @ 2026-04-08 (no endpoint — is that the correct shape?)

The client's error text says "business: [embedded]" — appears to be selecting
the embedded transport for cart-create even though mcp is present at the
same version I've pinned my profile to.

My profile (relevant slices)

meta.json:

{
  "created_at": "2026-08-26T20:18:48.396Z",
  "updated_at": "2026-08-28T20:41:25.512Z",
  "protocol_versions": {
    "min": "2026-08-25",
    "max": "2026-08-25"
  }
}

profile.json services + capabilities:

{
  "ucp.services.dev.ucp.shopping": [
  {
    "version": "2026-01-23",
    "spec": "https://ucp.dev/2026-04-08/specification/overview",
    "transport": "mcp",
    "schema": "https://ucp.dev/2026-04-08/services/shopping/mcp.openrpc.json"
  }
],
  "ucp.capabilities.dev.ucp.shopping.cart": [
  {
    "version": "2026-04-08",
    "spec": "https://ucp.dev/2026-04-08/specification/cart",
    "schema": "https://ucp.dev/2026-04-08/schemas/shopping/cart.json"
  }
]
}

(Profile is stripped of dev.ucp.shopping.checkout and .fulfillment — Grace
declines to declare checkout capability. Cart-write only. If that's the
reason cart-create won't select mcp, please document — I don't see it in
the overview spec.)

Expected behaviour

Cart create dispatches over the mcp transport since:

• My profile accepts mcp
• My profile is pinned to protocol version 2026-08-25
• Merchant advertises mcp service entry with an endpoint at that version

Actual behaviour

Cart create refuses with NO_COMPATIBLE_TRANSPORT claiming the business
only offers embedded — but the well-known clearly shows both.

Impact

Blocks any first-party client from using ucp cart create against a
merchant that mixes transports (which appears to be Shopify's own
default well-known shape post-2026-08-25). discover and catalog search are unaffected.

Additional context

Reproduced multiple times over ~1 hour with cache cleared, --refresh
set, and after re-init. Same behaviour with the profile at protocol
range 2026-01-23 → 2026-08-25 (widened) and pinned 2026-08-25 → 2026-08-25 (narrow).

Reproduces across 4/4 Shopify merchants tested

Not a per-store issue. Same failure across independent Shopify
merchants in two categories:

Merchant	Category	Well-known services	Cart dry-run
paylessmedical.ca	supplies	mcp@2026-08-25 ✓ endpoint, embedded@2026-04-08 no endpoint	NO_COMPATIBLE_TRANSPORT
british-supplements.net	supplements	mcp@2026-08-25 ✓ endpoint, embedded@2026-04-08 no endpoint	NO_COMPATIBLE_TRANSPORT
organicsocean.com	supplements	mcp@2026-08-25 ✓ endpoint, embedded@2026-04-08 no endpoint	NO_COMPATIBLE_TRANSPORT
www.transparentlabs.com	supplements	mcp@2026-08-25 ✓ endpoint, embedded@2026-04-08 no endpoint	NO_COMPATIBLE_TRANSPORT

Every Shopify merchant tested advertises the same shape (mcp@2026-08-25
WITH endpoint + embedded@2026-04-08 WITHOUT endpoint) — normative, not
per-merchant regression.

Vanilla ucp-cli defaults also fail

Fresh ucp profile init (no version flags, no --force, all default
capabilities including dev.ucp.shopping.checkout and .fulfillment,
default protocol range 2026-01-23 → 2026-04-08) also fails cart create
with the same error against every merchant above. Rules out
"user's profile misconfiguration" — a fresh install off npm hits the
same wall.

Question for maintainers

Did 2026-08-25 introduce a new requirement on cart-create that
ucp-cli 0.7.0 doesn't yet know how to satisfy — e.g.:

• An auth handshake (API key, session token, or Partner ID)?
• A new required capability that must accompany dev.ucp.shopping.cart?
• A protocol negotiation step that ucp-cli 0.7.0 skips?

Ideally the client would either:

1. Succeed with mcp@2026-08-25 out of the box, or
2. Surface a more specific error (e.g. AUTH_REQUIRED, CAPABILITY_MISSING: dev.ucp.shopping.checkout) so a first-party client can react.

Happy to share full profile.json + full well-known JSON if useful.