Should you evaluate UCP?
Evaluate UCP for a shared commerce contract between systems operated by different parties. Its README describes checkout, identity linking, order updates and payment token exchange, and directs implementers to SDKs, samples and conformance resources. That is a different decision from selecting the backend that manages a merchant's products and orders.
UCP lets businesses declare supported capabilities and offer them through REST, MCP or A2A. Begin by identifying the capability, version and transport that both participants will implement. Discovery describes available interfaces; it does not prove that an implementation handles transactions correctly.
What our sandbox established
Our run on 2026-10-10 at commit ad9950b recorded a successful npm installation; build and tests were skipped. The full recorded commit is ad9950ba5c7bcd02af648f849bf7344052f76f57. This is the supplied stored run, not a new execution.
Our harness records installation, build and test outcomes separately. The installation record includes success, elapsed time, exit code and an output tail. Here, the raw duration is 9,959 milliseconds, represented as 10 seconds in the attached summary, and the exit code is 0. Build and test each record a skip with the reason "no script". A skipped step is neither a passing test nor a failed test.
The stored parser summaries record 133 dependency packages and a 37 MB dependency footprint. These figures describe the recorded installation, not unique or exhaustive test coverage. We did not run the documented Python and Rust contributor workflows, a protocol server, a checkout, payment processing or the separate conformance suite. The absence of detected npm scripts does not mean the project has no documented validation workflow.
MrKeyoor's testing methodology explains how command records inform reviews and where their limits lie. Its current text provides provenance context; it does not establish that this older run used today's procedure.
The audit evidence is unresolved
The stored npm audit summary records 0 advisories. The raw installation tail contains conflicting vulnerability warnings, so the summary cannot support a claim that the installed dependencies had no known vulnerabilities. We retain the stored result and identify the conflict rather than substituting command-output figures for the attached summary.
No new execution or complete-log reconciliation was performed. The record omits scannedPackages, so scan coverage is unknown. Audit results concern recorded dependency advisories; they do not assess authorization, payment handling or the security of a deployed UCP implementation.
Plan for version changes
The supplied v2026-08-25 release notes explicitly list backward-incompatible changes requiring schema updates. These include fulfillment structures, buyer consent, signing-key fields, schema locations and payment namespaces.
Use that release as a documented migration reference, without assuming it describes every schema in the October checkout or every prospective counterparty. Agree on exact capability versions before implementation and keep fixtures for the messages each participant must accept.
Check MCP retry behavior in your implementation
The supplied extract of issue #664 is open and reports a conflict between raw-body payload matching and JSON-RPC envelopes that change on retries. Later comments propose separating target-only operations from operations carrying additional payload, and link an implementing pull request.
That discussion is a reported problem and proposed resolution. We did not reproduce it or establish that the proposed change was merged into our recorded checkout. Before relying on MCP completion or cancellation retries, inspect the applicable specification and test duplicate requests against the implementation you will deploy.
Choose the commerce backend separately
Medusa is an open-source commerce platform with a built-in framework for customization. Its supplied README describes commerce primitives and an application setup that creates a server and admin dashboard. Evaluate it when you need a customizable commerce application.
Saleor is a GraphQL-native, API-only commerce platform. Its supplied README describes commerce backend features and separate dashboard and storefront projects. Evaluate it when you want to access and extend the backend through GraphQL APIs.
Medusa and Saleor address the backend decision and can occupy a different architectural layer from a protocol contract. They are alternatives for running commerce services, rather than equivalent replacements for UCP's interoperability role. The supplied extracts do not establish UCP compatibility for either platform.
Rating rubric and evidence
These are editorial assessments, not benchmark results. The rubric uses 1 for substantial documented obstacles, 2 for substantial implementation or migration work, 3 for adequate support with material gaps, 4 for detailed supporting resources or substantive public collaboration, and 5 for broad validation including relevant implementation outcomes. The notes identify the evidence used for each dimension.
Setup ease is 2 because successful npm installation leaves the documented contributor workflows and protocol implementation untested. Documentation is 4 because the README distinguishes schema and documentation workflows and points to SDKs, samples and conformance resources. Community is 4 for the substantive technical discussion and proposed changes visible in issue #664; this is not an adoption or response-time rating. Maturity is 2 because the release documents migration work and the supplied retry discussion identifies behavior an adopter must verify.
Start with one agreed capability
Choose one capability and transport with a prospective counterparty, record the schema versions, and follow the relevant implementation resources. Run the applicable conformance checks and test authorization, duplicate requests and payment outcomes in that implementation. Our sandbox installation leaves those checks undone.