A

Protocol

HIGH

UCP profile Cache-Control is shared-cacheable with max-age ≥ 60s

`/.well-known/ucp` Cache-Control is `public, max-age=N` with N ≥ 60 and no `no-store`/`no-cache`/`private`. If your UCP profile says `no-cache`, agent runtimes re-fetch on every interaction — brittle at scale and prone to rate-limit failures.

What this check looks for

Agent runtimes cache UCP profiles by URL and re-fetch on TTL expiry. Profiles served with no shared-cache directives force every agent to round-trip on every interaction, which is brittle at scale and trips rate limits. We require `public` + `max-age ≥ 60` and the absence of `no-store`, `no-cache`, and `private`. The transport metadata for this check is populated by the v2 runner (Task I1); until then the check returns `na`.

Which AI surfaces it affects

  • Google AI Mode (UCP)100
  • Microsoft Copilot70
  • ChatGPT (ACP)20
  • Perplexity20
  • Meta AI10

Weighted against the live specs — ACP 2026-04-17, UCP 2026-04-08.

How to fix it

Serve `/.well-known/ucp` with `Cache-Control: public, max-age=…`

Shopify

Developer
  1. If you serve `/.well-known/ucp` via a custom proxy/edge worker, set `Cache-Control: public, max-age=3600` on the response.

Platform docs ↗

BigCommerce

Developer
  1. Configure your CDN or edge worker to attach `Cache-Control: public, max-age=3600` to the `/.well-known/ucp` response.

Platform docs ↗

WooCommerce

Developer
  1. In your hosting / .htaccess / nginx config, add a Cache-Control header to the `/.well-known/ucp` route: `Cache-Control: public, max-age=3600`.

Platform docs ↗

Custom / headless

Developer
  1. Set `Cache-Control: public, max-age=3600` (or higher) on the response.
  2. Do NOT use `no-store`, `no-cache`, or `private` — agents rely on shared caches.
HTTP/1.1 200 OK
Content-Type: application/json
Cache-Control: public, max-age=3600

{ "version": "2026-04-08", ... }

The spec it's pinned to

  • UCP overview — profile caching

    The UCP overview expects profiles to be cacheable at shared caches so agents can rely on them between negotiations. Profiles served with `no-store`, `no-cache`, or `private` force per-request re-fetches that break agent discovery at scale.

MDN — Cache-Control ↗

Does your store pass this check?

Run the full audit — 82 checks across five AI shopping surfaces. Most tools only check whether you get mentioned; we check whether an agent can buy from you.

Related protocol checks

← All 82 checks