An AI shopping agent cannot guess how your WooCommerce store works. It needs a document that says where the store is, and an API that can hold a cart. UCP Engine is that plugin. WooCommerce core does not ship the Universal Commerce Protocol, so the plugin sits next to the store you already have.
What the agent actually fetches
Discovery is /.well-known/ucp. That profile points at the shopping API and at OAuth metadata for a signed-in buyer. The shopping routes live under ucp/v1: catalog, cart, checkout sessions, and orders. WordPress also exposes them on the normal /wp-json/ path. The plugin rewrites a shorter /ucp/v1 alias, and verification accepts either path, because the agent signs the URL it actually called.
Orders go through WooCommerce’s CRUD layer so the same code works with High-Performance Order Storage. The plugin does not replace checkout. It talks to it.
Signatures, then strict mode
Agents can sign requests with RFC 9421. The store publishes an ES256 key, and the verifier rebuilds the signature base. It checks freshness, the body digest, and which key signed the request. A signature older than five minutes is stale.
The mode is a setting, not a hope. Off skips verification. Opportunistic checks a signature when one is present. Strict requires one. You start soft, watch the agent simulator in wp-admin, then turn strict on when the calls are real.
I wrote the merchant version of this in what agentic commerce means for a WooCommerce store. The plugin is the part that has to answer.