generated: '2026-08-30'
method: probed
source: >-
  https://shop.truff.com/.well-known/ucp (HTTP 200), https://shop.truff.com/api/ucp/mcp
  tools/list (HTTP 200), https://shop.truff.com/.well-known/openid-configuration (HTTP 200),
  https://shop.truff.com/llms.txt (HTTP 200) — all probed 2026-08-30.
note: >-
  Every conformance below is read off a machine-readable document TRUFF's hosts actually
  served, not off a marketing claim. The implementations are Shopify's platform-native ones
  running under TRUFF's merchant identity.
standards:
- id: ucp
  name: Universal Commerce Protocol
  conforms: true
  version: '2026-08-25'
  evidence: >-
    GET https://shop.truff.com/.well-known/ucp returns a UCP merchant profile declaring
    ucp.version 2026-08-25 plus supported_versions 2026-04-08 and 2026-01-23, the
    dev.ucp.shopping service over MCP transport, and the checkout / cart / fulfillment /
    discount / order / catalog.search / catalog.lookup capability set.
  spec: https://ucp.dev/2026-08-25/specification/overview/
- id: mcp
  name: Model Context Protocol
  conforms: true
  evidence: >-
    POST https://shop.truff.com/api/ucp/mcp with a JSON-RPC 2.0 tools/list request returns
    HTTP 200 and a well-formed result.tools array of 13 tools, each carrying a JSON Schema
    2020-12 inputSchema.
- id: json-schema
  name: JSON Schema 2020-12
  conforms: true
  evidence: >-
    Every MCP tool inputSchema declares
    $schema https://json-schema.org/draft/2020-12/schema.
- id: oidc
  name: OpenID Connect Discovery 1.0
  conforms: true
  evidence: >-
    GET https://shop.truff.com/.well-known/openid-configuration returns issuer, authorization,
    token, jwks and end-session endpoints, response_types_supported [code],
    id_token_signing_alg_values_supported [RS256] and claims_supported. Issuer is Shopify's
    hosted Customer Accounts service for shop 21822603 — shopper identity, not developer
    identity.
- id: oauth2
  name: OAuth 2.0 Authorization Server Metadata (RFC 8414)
  conforms: true
  evidence: >-
    GET https://shop.truff.com/.well-known/oauth-authorization-server returns the RFC 8414
    metadata document; grant_types_supported includes authorization_code and refresh_token and
    code_challenge_methods_supported includes S256 (PKCE).
- id: idempotency
  name: Idempotent write requests
  conforms: true
  evidence: >-
    The complete_checkout MCP tool declares meta.idempotency-key as a REQUIRED string
    ("An idempotency key for completing the checkout"). It is the only idempotent operation on
    the surface; cart and checkout mutations do not accept a key.
- id: llmstxt
  name: llms.txt
  conforms: true
  evidence: >-
    GET https://shop.truff.com/llms.txt returns HTTP 200 text/markdown with a store-specific
    agent instruction document; https://shop.truff.com/agents.md serves the same content.
- id: iso4217
  name: ISO 4217 minor-unit money representation
  conforms: true
  evidence: >-
    Every MCP tool description states prices are integers in the currency's ISO 4217 minor
    units paired with a currency code.
- id: rfc9457
  name: RFC 9457 Problem Details
  conforms: false
  evidence: >-
    No application/problem+json envelope is declared. Errors are returned as JSON-RPC error
    objects and as in-band checkout error fields; no problem-type catalog is published.
- id: openapi
  name: OpenAPI
  conforms: false
  evidence: >-
    No OpenAPI or Swagger document is served from any TRUFF host. /openapi.json, /swagger.json
    and /api-docs all 404 on www.truff.com and shop.truff.com. The UCP service references an
    OpenRPC schema hosted by ucp.dev, which belongs to the protocol, not to TRUFF.
- id: asyncapi
  name: AsyncAPI
  conforms: false
  evidence: No event, streaming or webhook surface is published on any TRUFF host.
domain_standard:
  id: ucp
  name: Universal Commerce Protocol (dev.ucp.shopping)
  market: retail / consumer commerce
  declared: true
  spec_location: >-
    https://shop.truff.com/.well-known/ucp — services["dev.ucp.shopping"][0] declares
    version 2026-08-25, transport "mcp", endpoint
    https://truff-hot-sauce.myshopify.com/api/ucp/mcp and schema
    https://ucp.dev/2026-08-25/services/shopping/mcp.openrpc.json.
  note: >-
    The contract itself declares the domain standard for its market, not a prose claim on a
    marketing page. An agent that already speaks UCP can transact against this store with no
    bespoke connector. Implementation is Shopify's platform-wide one.