UCP standardizes the transaction. GPV-1 gates the decision. Agents should run both.
Google rolled out Universal Cart across Search and the Gemini app: one cart across retailers, price and stock tracking, promo surfacing, perk-optimized payment selection, and checkout through the Universal Commerce Protocol — an open standard already wired into Walmart, Wayfair, Ulta Beauty, a growing base of Shopify merchants, and Newegg. Underneath sits the Shopping Graph: 60+ billion continually refreshed product listings feeding the recommendation layer that decides what a shopper — or an agent — sees first.
The rails converged. One graph now feeds every agent. The graph validates price and stock. It does not validate reviews, seller history, or product evidence. A brushed 4.8-star average that was once one listing's problem is now the canonical fact every cart and every agent cites.
| Layer | Standard | Question it answers | GoBuy's part |
|---|---|---|---|
| Identity | Web Bot Auth, agent protocol (Oct 6) | Who is acting? | — |
| Consent / payment | UCP, Checkout WebMCP | With what permission, through which rails? | — |
| Purchase decision | GPV-1 | Should this purchase proceed? | The whole layer |
UCP closes the transaction correctly. GPV-1 decides whether the transaction should close at all. They are complements, not competitors: a UCP-ready agent that skips the gate executes perfectly through listings with contaminated evidence.
An agent building on Universal Cart should run this sequence for every purchase consideration:
1. DISCOVER product via Shopping Graph / Universal Cart
2. GATE check_product_trust({ retailer, product_id }) ← GPV-1 R1–R7
PASS (score ≥ 55) → proceed
FLAG (35–54) → surface to principal, await confirmation
BLOCK (<35 / not indexed) → do not proceed
3. LOG verdict + rule results + evidence hashes ← GPV-1 R8
4. CHECKOUT via UCP / merchant cartIn prose: the agent finds the product on the graph, gates the decision on independent evidence, records the verdict, and only then hands the item to the Universal Cart. The gate runs before checkout, not after — retroactive verification is an apology, not a control.
The gate is one call on GoBuy's public MCP server — keyless, read-only, rate-limited but free within limits:
mcp: gobuy-product-trust → https://mcp.gobuy.ai/mcp
check_product_trust({
retailer: "amazon", // amazon | walmart | target | bestbuy
product_id: "B0BXYCS74H" // native listing ID
})
→ { evidence_score: 78, verdict: "PASS",
observed: [...], missing: [...], freshness: {...} }For a full wiring with the verdict handling, decision log (R8), and checkout handoff, use the open reference integration: verify-then-checkout — github.com/digitalmentes7-maker/verify-then-checkout (Next.js + Vercel AI SDK; a gated shopping agent in minutes).
GPV-1 R2 and R3 require evidence that is independent of the surface being checked. A second opinion that reads the same source as the first opinion is not a second opinion. GoBuy's Evidence Scores are computed outside the Shopping Graph from review-authenticity signals — temporal bursts, near-duplicate text, verified-purchase distribution, reviewer history — precisely so that contamination in the graph cannot inherit into the verdict. The machine-readable ruleset is at docs.gobuy.ai/standard/v1.json; pin the version and log it with each decision.
Universal Cart made the transaction universal. GPV-1 makes the decision defensible. Run both — and log why.
GoBuy — the trust layer for agentic commerce · Homepage · GPV-1 Specification · docs.gobuy.ai · October 2026