We probed 500 platform-hosted storefronts. Every Wix and Shopify tenant answered MCP — and only the UCP profile found it.

[deangoodman]

I run Known Good, a small index of websites that an automated probe has tested for agent access. On 17 September we ran one bounded experiment that seems relevant to this group, so here it is with the method and the CSVs.

What we did. 50 tenants each from ten website platforms, drawn at random (seed published) from a public technology-detection dataset, probed on one UTC date, ≤20 requests per host, robots.txt respected (4 refusals, nothing fetched past them). For each host we checked, in order: the MCP server card at /.well-known/mcp/server-card.json, the UCP profile at /.well-known/ucp, and — where either pointed at an endpoint — whether that endpoint answered initialize and tools/list.

What we found.

• Wix: 50 of 50 tenants have a live MCP endpoint that answers tools/list. Shopify: 46 of 46 probed (3 excluded by their own consent signals, 1 could not be asked). Endpoints sit on wixapis.com and {shop}.myshopify.com respectively — one decision per platform, not 96 decisions by 96 shops.

• All 96 were found through /.well-known/ucp on the tenant's own domain. None were found through the MCP server card.

• Wix's 8 tools are a strict subset of Shopify's 13: same names, same order. That looks like two implementations of one reference list rather than two designs. I couldn't find that list published; if it exists, I'd like to link it.

• The other eight platforms: 0–2 actionable endpoints per 50. BigCommerce is the interesting mirror image — 45 of 50 negotiate real markdown, none is actionable yet. Webflow's and Squarespace's few positives were Shopify stores on their domains.

What we're careful not to claim. An endpoint that answers tools/list is an actionable endpoint. It is not "an agent can complete a purchase" — that would need checkout tools in the signature and a completed action, which we did not attempt.

Two questions for the people here:

1. Is the UCP profile intended to be the discovery path for a merchant's MCP transport, with the server card left empty? On this sample that's what's deployed, and it means any agent or index still starting from the server card sees nothing.

2. Is there a canonical reference tool list the platforms are implementing? The identical names and ordering across two vendors suggests one.

Write-up with the per-platform table: https://knowngood.sh/census/2026-09 — the per-host CSVs and the method are in the public repo linked from it. Happy to re-run with a different sample or a different check if anyone wants a specific question answered.
— Dean

[send21io]

Dean’s caution is the load-bearing line: an endpoint that answers tools/list is actionable discovery, not “an agent can complete a purchase.” That gap is exactly where human commit belongs.

On Q1: if live Wix/Shopify tenants only surface through /.well-known/ucp and leave the MCP server card empty, then UCP-as-discovery-path is what agents and indexes will actually hit first. Treating the server card as optional (or empty) until a merchant has a real checkout signature is safer than implying purchase capability from tools/list alone.

On Q2: the identical Wix⊂Shopify tool names/order smell like one unpublished reference list. Publishing that list (even as “discovery-only, no spend”) would help agents stop over-reading tools/list as checkout.

We sit on the payment side of that same split: send21 prepares non-custodial payment drafts and pay links (BTC, USDC, USDT, EURC — never USDT or BTC on Base). Agents or API/MCP clients create drafts with scoped keys that cannot spend; the human signs in their own wallet. send21 never holds keys, never signs, never broadcasts. Discovery via UCP/MCP; spend only after a human signature.

[deangoodman]

Thanks — and yes, that's the line I'd want any client to hold: tools/list answering is discovery, and nothing in it should be read as spend authority. Your point on the server card is the one I'd like a maintainer's view on: if UCP is what agents will hit first in practice, it would help to have that said somewhere normative, so indexes and clients stop treating the card as canonical and the profile as incidental.

On the reference list — still looking for whoever holds it. If anyone from Wix, Shopify or the UCP editors can point to it, even as a draft, I'll link it from the write-up with the "discovery-only, no spend" framing you suggest, which is exactly how we label it.

— Dean