Test stores that speak UCP and WebMCP · no real money, nothing ships · Read the quickstart →
UCP Sandbox
Start an experiment
Changelog

What's new

Changes to the test stores, the console and the docs, newest first.

30 Oct 2026

0.10.0
  • NewEmbedded checkoutflowers-embedded.ucpsandbox.com adds UCP's Embedded transport (Embedded Checkout Protocol, 2026-08-25) to Northlight Flowers: its profile lists the embedded transport, every checkout carries an embedded binding with the delegations it allows, and its continue_url opened in an iframe with ec_version speaks ECP to the host page. A host can take over the payment credential, address changes, payment method changes and links. White Orchid is redirect-only, and test switches cover an unsupported version and a refused host.Protocol
  • NewDocs: embedded checkoutThe quickstart shows how to frame a checkout, what each delegation sends and how to test the error paths.Docs and site

30 Oct 2026

0.9.0
  • NewCheckout over A2Aflowers-a2a.ucpsandbox.com adds UCP's A2A transport to Northlight Flowers: its profile lists an A2A service whose agent card is at /.well-known/agent-card.json, and checkout runs at /ucp/a2a over A2A 0.3 (message/send) or A2A 1.0 (SendMessage), with the UCP extension activated. Each reply carries the checkout in a2a.ucp.checkout. The action names (create_checkout, update_checkout, get_checkout, cancel_checkout, complete_checkout) are our interpretation: UCP's A2A binding shows add_to_checkout and complete_checkout only as examples and defines no list. Catalogue search stays on REST and MCP.Protocol
  • NewDocs: checkout over A2AThe quickstart shows the agent card, the headers for each A2A version and every checkout action.Docs and site

29 Oct 2026

0.8.3
  • FixedA missing idempotency key over MCP is invalid paramsA complete_checkout or cancel_checkout call without meta["idempotency-key"] now answers JSON-RPC -32602 with code idempotency_key_required; -32000 stays for a key reused with a different payload, as the MCP binding's error table has it.Protocol

29 Oct 2026

0.8.2
  • FixedHarbour Row bookings are read and cancelled by their idConfirmation numbers are random, and get_booking and cancel_booking take the booking id from confirmation.booking_id; a confirmation number alone answers not_found.Stores
  • FixedStays warns totals_changed and waits for the new priceWhen a rate changes, the booking session warns totals_changed at $.totals as a disclosure, and complete is refused until the platform updates the session to the new totals, as the lodging draft requires.Protocol
  • FixedRoom capacity is the real maximum occupancycapacity.total is the most a room sleeps, and a party that does not fit is refused with occupancy_exceeded_capacity.Stores
  • ImprovedOrder webhooks are signed with ES256Webhooks are signed with a P-256 key, the algorithm every UCP verifier supports; each store's profile publishes it alongside the existing Ed25519 key.Protocol
  • FixedKettle Street's alcohol warning uses the policy type as its codeThe age disclosure's code is com.ucpsandbox.policy.age_restricted, as UCP 2026-08-25 requires of a warning that refers to a policy.Protocol
  • ImprovedAdd-ons point to their dishAt Kettle Street an add-on line carries line_item.parent_id for the dish it belongs to, on the checkout and on the order. A dish with no allergen recorded no longer reads as free of allergens.Stores

26 Oct 2026

0.7.7
  • FixedLocation search refuses a filter it doesn't supportA location search or lookup with a filter other than hours, amenities or items is now refused with invalid_request, as the spec requires, instead of the filter being ignored and every shop returned.Protocol

26 Oct 2026

0.7.6
  • NewReturn terms an agent can readEvery store has a -returns host, such as flowers-returns.ucpsandbox.com, on the draft Return Policy Extension (dev.ucp.shopping.policy.return, merged to the spec's main branch on 23 October, not yet in a release). Catalogue, cart, checkout and order responses carry the return window, refund types, return channels and fees; final-sale items come with a disclosure, and a delivered order states each return deadline. Responses in 2026-04-08 leave it out.Protocol
  • ImprovedClearer returns at Northlight FlowersFresh flowers and plants: tell us within 48 hours of delivery if they arrive damaged. Vases, accessories and dried flowers: 30 days unused, free in store or $4.95 by mail. Wedding and event pieces are final sale.Stores

26 Oct 2026

0.7.5
  • ImprovedThe Flowers sign-in servers read the resource parameterAn authorization or token request may name the store as its resource (RFC 8707). The store's own resource identifier, as its protected resource metadata gives it, is accepted; any other value is refused with invalid_target.Protocol

23 Oct 2026

0.7.4
  • NewAccount linking with no client registrationflowers-account-noreg.ucpsandbox.com offers identity linking with no registration endpoint, as many sign-in servers do. Use the public client ucpsandbox-test with PKCE S256 and no secret; redirect to https://ucpplayground.com/oauth/callback or a 127.0.0.1 or localhost address.Protocol

23 Oct 2026

0.7.3
  • NewLink a buyer account at Northlight FlowersThe store offers UCP identity linking (dev.ucp.common.identity_linking, 2026-08-25): OAuth 2.0 with PKCE, authorization server and protected resource metadata, client registration, a consent page with test buyers, and token revocation. It offers dev.ucp.shopping.order:manage; order reads stay open.Protocol
  • NewA store where reading an order needs a linked accountflowers-account.ucpsandbox.com offers dev.ucp.shopping.order:read and dev.ucp.shopping.order:manage: get_order without a linked buyer answers identity_required, and a token without the scope answers insufficient_scope.Protocol

21 Oct 2026

0.6.2
  • ImprovedA new look for the siteThe home page, docs, changelog, contact and legal pages have a new design. Nothing about the stores changed.Docs and site

8 Oct 2026

0.5.0
  • NewNorthlight Flowers also speaks UCP 2026-04-08Agents built to the 2026-04-08 release get replies in that release. The store's profile lists it under supported_versions.Protocol
  • ImprovedCarts say when they expire, and orders carry their numberCarts include expires_at, and a completed checkout's order includes its label.Protocol

5 Oct 2026

0.4.0
  • NewSign in with GoogleUse your Google account to sign in to the console, alongside GitHub and an emailed link.Console
  • ImprovedHarbour Row Stays and Kettle Street Noodles are previewsThe UCP spec for lodging and food is still settling, so these two stores will change.Stores

3 Oct 2026

0.3.0
  • NewStores check request signaturesWeb Bot Auth and UCP request signatures are checked against the keys the agent publishes. Unsigned agents are still answered.Protocol
  • NewWho shops hereEach store's analytics page shows which agents shop it and how many proved who they are. Only verified agents are named.Stores

2 Oct 2026

0.2.0
  • NewNorthlight Flowers has five shopsFind a shop by distance, delivery area, opening hours or stock, and collect an order from it.Stores
  • NewLocation search and lookupThe flowers store answers the UCP location calls over REST, MCP and WebMCP.Protocol
  • NewAnalytics for your storesHow far agents got, what they searched for, which result they picked and where calls failed.Console
  • NewEach reference store shows how agents use itShares and timings at /analytics on the store. No agent is named.Stores
  • NewStore versionsA reference store gets a version number when it changes, and an experiment records the version it ran on.Stores
  • NewSign in with GitHub or an emailed linkNo password. Your email is your account.Console
  • NewAccount pageSee your details, download your data, sign out, or delete your account and everything in it.Console
  • NewContact pageOne form for questions, bugs in a test store and data requests.Docs and site
  • ImprovedStays store is clearer about dates and pricesStay dates are spelled out, the booking window is stated, and prices can be shown in the traveller's currency as a guide.Stores
  • ImprovedIdle stores are archivedA store copy nothing has used for 90 days stops answering; you can restore or delete it.Console

1 Oct 2026

0.1.0 · Launch
  • NewUCP Sandbox is liveTest stores any agent can shop, and experiments on your own copy of one.Docs and site
  • NewThree reference storesNorthlight Flowers (retail), Harbour Row Stays (lodging) and Kettle Street Noodles (takeout).Stores
  • NewExperiments: A against B, one changePick a change, point agents at both stores, read the result from the stores' own records.Console
  • NewStores speak UCP release 2026-08-25Over REST and MCP, with WebMCP tools in the storefront pages.Protocol