generated: '2026-08-23'
method: probed
source: >-
  https://prolonlife.com/.well-known/ucp, https://prolonlife.com/.well-known/openid-configuration,
  live tools/list probe of https://prolonlife.com/api/ucp/mcp, and https://prolonlife.com/llms.txt
description: >-
  Cross-cutting and domain-standard conformance asserted from what the contract says about itself,
  not from marketing prose. Everything below was read out of a document served by an L-Nutra host.
standards:
- id: ucp
  name: Universal Commerce Protocol
  conforms: true
  version: '2026-04-08'
  also_supported: ['2026-01-23']
  domain_standard: true
  sector: commerce / retail
  evidence: >-
    /.well-known/ucp on all three storefronts declares ucp.version 2026-04-08 with a
    dev.ucp.shopping service bound to transport "mcp" at /api/ucp/mcp, and eight declared
    capabilities: dev.ucp.shopping.checkout, .fulfillment, .discount, .cart, .order,
    .catalog.search, .catalog.lookup and the vendor extension dev.shopify.catalog. Live
    tools/list returns the tool set those capabilities imply and the response carries
    x-shopify-ucp-mcp-api-version: 2026-04-08.
  spec: https://ucp.dev/2026-04-08/specification/overview/
- id: mcp
  name: Model Context Protocol
  conforms: true
  evidence: >-
    JSON-RPC 2.0 tools/list returned HTTP 200 with result.tools[] carrying name, description and
    JSON Schema inputSchema on six endpoints across three hosts, unauthenticated.
- id: json-schema-2020-12
  name: JSON Schema draft 2020-12
  conforms: true
  evidence: >-
    Every MCP tool inputSchema declares
    "$schema": "https://json-schema.org/draft/2020-12/schema".
- id: oidc
  name: OpenID Connect Discovery 1.0
  conforms: true
  evidence: >-
    /.well-known/openid-configuration on all three storefronts returns issuer, authorization_endpoint,
    token_endpoint, jwks_uri, response_types_supported, subject_types_supported and
    id_token_signing_alg_values_supported (RS256). Operated by Shopify for the merchant's shop id.
- id: oauth2
  name: OAuth 2.0 Authorization Server Metadata (RFC 8414)
  conforms: true
  evidence: >-
    /.well-known/oauth-authorization-server returns the same metadata document, with
    code_challenge_methods_supported [S256] and grant_types_supported including authorization_code
    and refresh_token.
- id: idempotency
  name: Idempotent write semantics
  conforms: true
  evidence: >-
    The complete_checkout tool declares meta.idempotency-key as a required string in its own
    input schema. See conventions/l-nutra-conventions.yml.
- id: iso-4217
  name: ISO 4217 currency minor units
  conforms: true
  evidence: >-
    Every UCP tool description states that prices are integers in the currency's ISO 4217 minor
    units paired with a currency code.
- id: llmstxt
  name: llms.txt agent instructions
  conforms: true
  evidence: >-
    /llms.txt and /agents.md are served on all three storefronts (HTTP 200) and describe the agent
    flow, the discovery endpoints and the human-approval rule.
- id: rfc9457
  name: RFC 9457 Problem Details
  conforms: false
  evidence: >-
    No application/problem+json surface exists — errors are JSON-RPC error objects, and no error
    catalogue is published.
- id: google-pay-ucp
  name: Google Pay UCP payment handler
  conforms: true
  evidence: >-
    /.well-known/ucp declares payment_handlers["com.google.pay"] version 2026-01-11 with
    merchant_info.merchant_name "Prolon Life" and merchant_origin prolonlife.com.
- id: asyncapi
  name: AsyncAPI
  conforms: false
  evidence: No event, streaming or webhook surface is published by L-Nutra on any host.
compliance:
  certifications_published: []
  note: >-
    No trust centre, SOC 2, ISO 27001, HIPAA or PCI attestation is published on any L-Nutra host.
    probe-security-programs.py returned vdp=none trust=none on 2026-08-23, so no Compliance or
    TrustCenter pointer is emitted.