Valid JSON Valid UCP: 10 Checks That Should Fail Your Build

Your UCP manifest passes JSON.parse() . Your linter is happy. But Google AI Mode, Gemini, and every other AI shopping agent that hits /.well-known/ucp silently moves on to the next store. Why? Because valid JSON is not valid UCP . The protocol has structural, security, and network requirements that go beyond syntax. Miss any of them, and you're invisible. This post covers the 10 checks that actually break AI agent discovery — not the optional capabilities you can safely skip. Each check includes its rule ID, what breaks, and a concrete fix. The Discovery Hierarchy When an AI agent visits your store, it follows a strict sequence: 1. FETCH — Can I reach /.well-known/ucp over HTTPS? 2. PARSE — Is the response valid UCP (not just valid JSON)? 3. VERIFY — Are endpoints reachable, schemas fetchable, keys present? 4. NEGOTIATE — Do our capabilities intersect? Fail at level 1, and nothing else matters. Fail at level 2, and the agent can't understand your profile. Levels 3 and 4 are where most