Methodology
Vokko is not a UCP validator. ucpchecker.com already owns that slice (manifest at /.well-known/ucp, conformance, UCP score). We index every public agent protocol we can detect without completing a purchase.
Cell → spec → probe → never
Each matrix cell is one protocol. Status vocab: absent, present, callable, partial, undiscoverable, error. present[] counts present and callable only. Host JSON also includes capabilityMatrix: declared (brochure), probeOk (expected discovery surface), callable (non-mutating handshake), payable (payment rails only, after a parsed live challenge — never from marketing text); participation (whether agents look welcome, gated, or blocked from public signals — robots, llms.txt, agents.md, agent card; not a legal reading of the terms); and paymentRails (keys: x402, mpp, other/ap2). Each PaymentRailCell has present, payable, optional network?, asset?, notes?, optional status? (not_probeable_on_origin | declared_via_ucp). payable: true only after a parsed challenge. Empty AP2 origin = not_probeable_on_origin. Identical refreshes do not append a change event.
| Cell | Spec | Probe | We never |
|---|---|---|---|
| ucp | https://ucp.dev | GET /.well-known/ucp (JSON). One https same-site host redirect that keeps that path. Parse services, capabilities, payment_handlers, checkout, ap2_mandate. | POST checkout / complete. Follow any 3xx except one https same-site hop that keeps /.well-known/ucp. |
| acp | https://www.agenticcommerce.dev/ | None. Status undiscoverable. | GET invented /.well-known/acp paths. ACP has no public well-known. |
| ap2 | https://github.com/google-agentic-commerce/ap2 | Derived from UCP capability dev.ucp.shopping.ap2_mandate. Nothing on the origin is not_probeable_on_origin, not a failed payment probe. | GET invented /.well-known/ap2. AP2 is a UCP capability (ap2_mandate), cell source ucp_extension. |
| tap | https://corporate.visa.com | GET /.well-known/http-message-signatures-directory. Header-only Signature-Agent → partial. | Visa JWKS, forged TAP signatures, treating cf-ray as TAP. |
| mcp | https://modelcontextprotocol.io | GET manifest JSON → discovery document (present, not callable). On refresh only: unauthenticated JSON-RPC tools/list or initialize (4s, 8KB). HTML 200 and 401/403 are not callable. | tools/call or any authenticated tool invocation. Unauthenticated tools/list or initialize only on ?refresh=1. |
| a2a | https://a2a-protocol.org | GET both /.well-known/agent-card.json and /.well-known/agent.json. Record which path hit. HTML 200 or auth 401/403 is not callable. HEAD interface URL when the card is JSON; callable only on live 2xx. | A2A message:send. Invented /.well-known/a2a paths. Prefer agent-card.json, then agent.json. |
| x402 | https://www.x402.org | Unauthenticated GET homepage + /.well-known/x402. HTTP 402 with PAYMENT-REQUIRED (V2) or X-PAYMENT (V1) → callable. Decode version/scheme/network/asset/amount. HTML 200 → absent. | Send PAYMENT-SIGNATURE or X-PAYMENT to the target. Pay the target's 402. Treat HTML at /.well-known/x402 as x402. |
| mpp | https://docs.stripe.com | Same GETs as x402. WWW-Authenticate: Payment → callable, separate cell. | GET /.well-known/mpp (there is none). Collapse MPP into the x402 cell. |
| llms | https://llmstxt.org | GET /llms.txt and /llms-full.txt. | Treat llms.txt as checkout or payment. |
| ai-plugin | https://platform.openai.com | GET /.well-known/ai-plugin.json. | Follow plugin auth or execute plugin calls. |
| openapi | https://www.openapis.org | GET /.well-known/openapi.json, /openapi.json, /openapi.yaml, /swagger.json. | Call the described API methods beyond GET/HEAD of the document. |
What we fetch
For a normalized host we resolve public DNS (no private/CGNAT/link-local), then GET in parallel:
- /robots.txt — policy for GPTBot, Google-Extended, ClaudeBot, Applebot-Extended, CCBot, PerplexityBot, Bytespider
- Homepage — platform fingerprint, Signature-Agent, HTTP 402, WWW-Authenticate: Payment
- ucp — /.well-known/ucp
- acp — header/homepage signals only
- ap2 — header/homepage signals only
- tap — /.well-known/http-message-signatures-directory
- mcp — /.well-known/mcp.json, /.well-known/mcp, /mcp
- a2a — /.well-known/agent-card.json, /.well-known/agent.json
- x402 — /.well-known/x402
- mpp — header/homepage signals only
- llms — /llms.txt, /llms-full.txt
- ai-plugin — /.well-known/ai-plugin.json
- openapi — /.well-known/openapi.json, /openapi.json, /openapi.yaml, /swagger.json
What we never do
- Add to cart, checkout, or hold payment credentials
- Pay a target's HTTP 402 or send PAYMENT-SIGNATURE / X-PAYMENT to that host
- Follow logins or scrape catalogs behind auth
- Call MCP tools or A2A message:send
- Invent well-knowns (no /.well-known/mpp, /acp, /ap2, /tap)
- Sell placement on the index
- Treat a UCP A-grade as a Vokko A-grade
TTL
Presence documents (UCP profile, TAP directory, MCP manifest, A2A card, llms.txt) cache 24h. Callability (x402 402 / MPP Payment challenge) caches 15 min. Stale callability is re-observed with the same unauthenticated GETs; we still do not pay the target. ?refresh=1 is paywalled (Vokko Pro / Vokko's own x402) and re-runs callability plus MCP tools/list or initialize.
Vokko index (not a UCP score)
Discovery 25% · protocol breadth 40% · machine-payment rails 20% · evidence quality 15%. Payment 20 fires only when x402 or MPP is callable. Breadth is weighted: x402/MPP/UCP/ACP count more than llms.txt. A store that only publishes UCP will score as a specialist. That is intentional.
Provider finder
SKU provider_finder is live at $0.005 USDC (amount 5000) on Base. REST GET /api/v1/providers/find, MCP find_provider. Per-IP rate limit 60/min, then x402 verify and settle, then the index query. Empty answers still cost $0.005 and return 200 with {results: [], reason: 'no_match'}. Placement is never sold. A daily unpaid sync fills provider_index (USDC on Base only). Paid answers read that table only: full-text on tsv, health_status=ok and checked_at within 7 days, then price ascending, then latency. Vokko does not guarantee third-party providers. No live Bazaar fallback. See docs/provider-ranking.md and docs/provider-sync.md.
Identity
User-Agent: VokkoBot/0.1 (+https://vokko.eu/methodology; multi-protocol capability probe)
Timeout 4s · max 8KB per body · HTTPS only. Index rows live in Postgres. To opt out of future batch crawls, disallow this UA in robots.txt or serve /.well-known/vokko-optout.
Crawl
Every successful lookup is written to Postgres. Batch: npm run crawl against data/seeds.txt, concurrency 3, 24h presence freshness, skip if /.well-known/vokko-optout returns 200. We do not import UCP Checker's directory.
API and origin-owner report
Cached GET is free. ?refresh=1 on the bound host is the origin-owner SKU (HTTP 402 without a Bearer key or remaining quota). Subscribe at /pricing — €29/mo EUR, one origin, 30 live reports per billing period. GET /report/{domain} is the origin-owner view (HTML or JSON): missing spec fields to fix, not grade letters. Cached GET stays free. Entitled live refresh skips x402.
GET /api/v1/hosts/{domain}
GET /api/v1/hosts/{domain}?refresh=1
GET /api/v1/index
GET /report/{domain}
GET /llms.txt
GET /.well-known/agent-card.json