惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

A
Arctic Wolf
T
Tenable Blog
T
Troy Hunt's Blog
Exploit-DB.com RSS Feed
Exploit-DB.com RSS Feed
P
Privacy & Cybersecurity Law Blog
NISL@THU
NISL@THU
Application and Cybersecurity Blog
Application and Cybersecurity Blog
H
Hacker News: Front Page
S
Secure Thoughts
AWS News Blog
AWS News Blog
L
LINUX DO - 最新话题
D
Darknet – Hacking Tools, Hacker News & Cyber Security
M
MIT News - Artificial intelligence
T
Tor Project blog
S
Schneier on Security
PCI Perspectives
PCI Perspectives
OSCHINA 社区最新新闻
OSCHINA 社区最新新闻
美团技术团队
Google DeepMind News
Google DeepMind News
V
Visual Studio Blog
爱范儿
爱范儿
Google DeepMind News
Google DeepMind News
Cyberwarzone
Cyberwarzone
T
The Exploit Database - CXSecurity.com
罗磊的独立博客
T
Threat Research - Cisco Blogs
Recent Commits to openclaw:main
Recent Commits to openclaw:main
V
V2EX
C
CXSECURITY Database RSS Feed - CXSecurity.com
Stack Overflow Blog
Stack Overflow Blog
freeCodeCamp Programming Tutorials: Python, JavaScript, Git & More
G
GRAHAM CLULEY
L
LINUX DO - 热门话题
D
Docker
J
Java Code Geeks
GbyAI
GbyAI
H
Heimdal Security Blog
The Hacker News
The Hacker News
MongoDB | Blog
MongoDB | Blog
V
Vulnerabilities – Threatpost
T
Tailwind CSS Blog
Cloudbric
Cloudbric
TaoSecurity Blog
TaoSecurity Blog
C
CERT Recently Published Vulnerability Notes
Y
Y Combinator Blog
Recorded Future
Recorded Future
Cisco Talos Blog
Cisco Talos Blog
T
Threatpost
The Register - Security
The Register - Security
Hacker News - Newest:
Hacker News - Newest: "LLM"

DEV Community

Authentication Security Deep Dive: From Brute Force to Salted Hashing (With Java Examples) Why AI Systems Don’t Fail — They Drift Spilling beans for how i learn for exam😁"Reinforcement Learning Cheat Sheet" I Replaced Chrome with Safari for AI Browser Automation. Here's What Broke (and What Finally Worked) How Python Borrows Other People's Work The $40 Architecture: Processing 1 Billion API Requests with 99.99% Uptime Vibe Coding: A Workflow Guide (From Zero to SaaS) Most webhook security guides protect the wrong side. The scary part is delivery. Headless CMS for TanStack Start: Build a Blog with Cosmic EU Age Verification App "Hacked in 2 Minutes" — What Actually Happened Comfy Cloud’s delete function does not actually remove files Running AI Models on GPU Cloud Servers: A Beginner Guide Event-driven media intelligence with AWS Step Functions and Bedrock I scored 500 AI prompts across 8 quality dimensions — here's what broke How to Call Google Gemini API from Next.js (Free Tier, No Backend Needed) The Portal Protocol: Reclaiming Human Connection in the Age of AI How to Fix Your Team's Scattered Knowledge Problem With a Self-Hosted Forum Intro to tc Cloud Functors: A Graph-First Mental Model for the Modern Cloud Designing Multi-Tenant Backends With Both Ownership and Team Access I Built a Neumorphic CSS Library with 77+ Components — Here's What I Learned PostgreSQL Performance Optimization: Why Connection Pooling Is Critical at Scale Cómo construí un SaaS multi-rubro para gestionar expensas en Argentina con FastAPI + Vue 3 🚀 I Built an Ethical Hacking Scanner Tool – Open Source Project I Replaced /usage and /context in Claude Code With a Single Statusline A Pythonic Way to Handle Emails (IMAP/SMTP) with Auto-Discovery and AI-Ready Design I Collected 8.9 Million Polymarket Price Points — Here's What I Found About How Markets Really Move EcoTrack AI — Carbon Footprint Tracker & Dashboard Everyone's Using AI. No One Agrees How. 5 self-hosted ebook managers worth trying in 2026 Building Your First AI Agent with LangChain: From Chatbot to Autonomous Assistant Common SOC 2 Failures (Real World) Stop Vibe-Checking Your AI App: A Practical Guide to Evals How to Use SonarQube and SonarScanner Locally to Level Up Your Code Quality Your Next To-Do App Is Dead — I Replaced Mine with an OpenClaw AI Sign a Nostr event in 60 lines of Python using coincurve — no nostr-sdk, no nbxplorer, no rust toolchain ITGC Audit Explained Like You’re in Big 4 Patch Tuesday abril 2026: Microsoft parcha 163 vulnerabilidades y un zero-day en SharePoint Stop scraping everything: a better way to track competitor price changes Listing on MCPize + the Official MCP Registry while routing payments OUTSIDE the marketplace — how I kept 100% of my x402 revenue Building an AI-Powered Risk Intelligence System Using Serverless Architecture Why We Ripped Function Overloading Out of Our AI Toolchain Testing AI-Generated Code: How to Actually Know If It Works SaaS Churn Is Killing Your Business. Here Is What to Do About It (Without a Support Team) The Speed of AI Is No Longer Linear - And Self-Improving Models Are Why How to Implement RBAC for MCP Tools: A Practical Guide for Engineering Teams From Standard Quote to Persuasive Proposal: AI Automation for Arborists I built a CLI that scaffolds complete multi-tenant SaaS apps Axios CVE-2025–62718: The Silent SSRF Bug That Could Be Hiding in Your Node.js App Right Now The dashboard that ended our friendship Data Pipelines Explained Simply (and How to Build Them with Python) The Hidden Cost of AI Systems Nobody Talks About. undefined vs undeclared, and how typeof behaves Switching from file-based jobs to NATS/Kafka in Rust without changing code io_uring Adventures: Rust Servers That Love Syscalls Why Agentic AI is Killing the Traditional Database The POUR principles of web accessibility for developers and designers Quantum Neural Network 3D — A Deep Dive into Interactive WebGL Visualization How To Install Caveman In Codex On macOS And Windows Automation Pipeline Reliability: Why Your Workflow Breaks When Nobody Is Watching I Built an 'Open World' AI Coding Agent — It Works From ANY Folder From Freelancing to Product: A Tech Service Company's SaaS Transformation China's AI Giants: Adding Tencent Hunyuan & ByteDance Doubao to AI University (74 Providers) On the Vibe Coders and Their Lies clerk: Auto-Summarize Your Claude Code Sessions AI Weekly — 2026/04/10–04/17 | The Model Lockdown Is Here, but the Toolchain Is the Real Battleground AI 週報 — 2026/04/10–2026/04/17 模型封鎖潮來了,但工具鏈才是真戰場 Maybe this is how Open-Source apps are born... 🚀 Fine-Tune LLMs with LoRA and QLoRA: 2026 Guide tRPC v11 + Next.js App Router: End-to-End Type Safety Without the Boilerplate ShadCN UI in 2026: Why I Stopped Installing Component Libraries and Started Owning My Components SaaS Billing in React Server Components: Stripe + Supabase Without a Single `useEffect` Join our DEV Weekend Challenge — $1,000 in Prizes Across TEN winners! Submissions Due April 20 at 6:59 AM UTC. Implementing FSRS Spaced Repetition in Flutter + Supabase — Adding Memory Science to an AI Learning App "I Texted My Localhost From the Train — Claude Code Fixed the Bug Before I Got Home" I Built a Sales Prep AI and It Went Deeper Than Expected Design to Code #2: One JSON, Eleven Outputs Solving the 100M-Row Problem: A Summary Table Pattern for High-Volume Push Notification Logs Flutter Web With Wasm: What Actually Changes For Developers I Built 50 Royalty-Free Soundtracks for My Side Project in a Weekend Using AI Music Generation The Vibe Coding Security Checklist: 7 Things to Check Before You Ship Stop Letting Googlebot Guess Fix Your React App's SEO Right Desconstruindo o Streaming do LinkedIn: Como Criar um Engine de Extração de Vídeo de Alta Performance com HLS e FFmpeg (EDA Part-1) EDA (Exploratory Data Analysis) Explained With Real Life — Why Looking at Your Data Is the Most Important Step in Machine Learning Brand Relationship Management at Scale: Our 4-Touch Outreach System for 200+ Brands Why String.fromEnvironment() Might Return an Empty String in Dart JGuardrails 1.0.0 — Hardening Java LLM Apps Against Jailbreaks, Toxicity, and Prompt Injection Plan and Schedule a Full Week of Threads Content From One Claude Conversation Coding Cat Oran Ep3, Five Tables Changed Everything Updated: BFF Pattern I'm done watching freelancers get buried by 200 proposals. So I'm building the alternative. This is my first post BFS Algorithm in Java Step by Step Tutorial with Examples Tracking LLM Pricing Monthly: An Open Dataset for 22 AI Models How We Measure Content ROI on a Comparison Site: Revenue Attribution Without Perfect Data Introducing Nova AI Ops: The AI-Native Operating System for SRE Teams I built a free desktop video downloader for Windows — Grabbit How Talkie OCR Helps Vision-Impaired & Dyslexic Users Read the World Around Them VRCFaceTracking安装和iPhone面捕配置教程,有bug Even CrowdStrike Can't See Your Agents The Automation Gold Rush: What n8n Workflows and Claude Are Opening Up for Developers Right Now
Hydrogen MCP UCP Migration: Production Cutover Before June 15
no7software · 2026-05-15 · via DEV Community

Shopify flipped the Storefront Catalog MCP server to the Universal Commerce Protocol on April 22, 2026, per the official Shopify developer changelog. The old /api/mcp endpoint and the previous search_shop_catalog and lookup tool names are deprecated. Both stay live until June 15, 2026 — then they go away. Any Hydrogen storefront, custom AI agent, or third-party integration that still calls the old endpoint after the sunset will fail.

In our experience, this is one of those changes that reads as a footnote on the changelog and lands as a production incident two weeks before the deadline. The work itself is small: an endpoint rename, two tool renames, and a response-schema check against the new UCP catalog spec. The risk is that it is easy to defer until something visible breaks. For Shopify Plus engineering teams running Hydrogen, this is also not the only change in motion. The Hydrogen Winter 26 release made every Hydrogen storefront on Oxygen an MCP-ready endpoint by default, and the Storefront API proxy that exposes the new /api/ucp/mcp path is now expected to be in place. Sequencing matters — UCP assumes the proxy is already wrapping your storefront routes.

The 90-Second Engineering Action List

What changed, in six lines

  • Endpoint: /api/mcp deprecated; new endpoint /api/ucp/mcp.
  • Hard sunset: June 15, 2026 — after that, the legacy endpoint and the previous tool names stop responding.
  • Tool renames: the previous search_shop_catalog maps to search_catalog; the previous lookup tool maps to lookup_catalog; get_product is the new full-product retrieval tool with interactive variant selection and availability signals.
  • Request and response shapes: updated to match the UCP catalog spec — re-run your client-side schema validation against the published UCP catalog reference.
  • Hydrogen Winter 26: Storefront MCP is supported on every Hydrogen storefront on Oxygen out of the box. UCP assumes the Storefront API proxy is in place.
  • Action sequence: grep /api/mcp in your codebase, rename the endpoint, rename the tool calls, validate the response shape against the UCP spec, run a parallel test suite, ship before June 15.

What the Rename Actually Breaks

In our experience, three things tend to break in a half-finished UCP migration. The first is the endpoint. The line is short and easy to find, but easy to miss in a team where MCP calls live in two or three different services — replace https://{storeDomain}/api/mcp with https://{storeDomain}/api/ucp/mcp wherever it appears.

The second is the tool names. We have seen merchants update the endpoint, deploy, and then stare at JSON-RPC errors for an hour because their agent still sends name: "search_shop_catalog" instead of name: "search_catalog". The renames are deterministic — Shopify's changelog is explicit that the previous search and lookup tools are deprecated in favour of search_catalog, lookup_catalog, and get_product, and that the request and response shapes are updated to match UCP.

The third is the response shape itself. UCP is a layered protocol with capability declarations alongside the commerce payload. The shape of a get_product response now follows the UCP catalog specification — pricing, availability, options, and variant data have moved to UCP-aligned fields. Treat the Storefront Catalog MCP documentation as the authoritative reference for the new schemas; client code that hard-coded the legacy field paths will silently produce wrong data, not a hard error, which is the worst kind of regression.

UCP Capability Negotiation Explained

The reason this migration looks small in the changelog and matters more than that in practice is that UCP is not an evolution of MCP — it is a layered protocol with a different mental model. UCP is the Universal Commerce Protocol, co-developed by Shopify and Google and published openly at NRF 2026. The Shopify engineering team describes it as a layered design that separates commerce surface area into three concerns: a shopping service layer that defines core primitives (checkout sessions, line items, totals), capabilities that group functional areas (Catalog, Checkout, Orders) each independently versioned, and extensions that augment capabilities with domain-specific schemas via composition.

What this means for engineering teams is that the response payload now tells you what the merchant supports. If a merchant has a loyalty-vendor extension active, your agent can negotiate reward redemption. If it does not, you get the core checkout schema and your agent should gracefully degrade. UCP uses reverse-domain naming (dev.ucp.shopping.* for the official spec, com.merchantvendor.* for vendor extensions), which means there is no central registry — capabilities can be added by merchants, payment providers, or loyalty vendors without waiting for protocol committees.

The architectural shift this implies for client code: your agent should stop assuming a fixed product schema and start branching on the merchant-declared capabilities. We have found this is the single most common source of latent bugs after the rename — code that worked because the old MCP returned exactly one schema now silently misses fields when capabilities are negotiated differently per merchant. For deeper context on how UCP relates to ACP and the older MCP-only patterns, see our breakdown of agentic commerce protocols.

Hydrogen Winter 26 and the Storefront API Proxy

Per the Hydrogen Winter 26 update, every Hydrogen storefront on Oxygen now supports Storefront MCP, with custom AI agents able to give customers personalised recommendations, manage carts, and walk buyers through checkout — all powered by real-time data through the Storefront API. UCP runs on the same proxy layer that exposes the storefront to AI agents.

For teams already on the latest Hydrogen release, this is a non-event for UCP — the proxy layer is in place and the only work is the endpoint and tool rename. For teams on older Hydrogen releases, there is an extra migration to sequence. The proxy migration must happen first because UCP assumes the proxy is wrapping all storefront routes; without it, the new /api/ucp/mcp endpoint will not be exposed correctly.

Hydrogen Winter 26 also exposes the Dev MCP server for AI coding tools like Cursor and Claude, giving them access to comprehensive Hydrogen documentation, Storefront API references, and the Hydrogen Cookbook. We have found that pulling the Dev MCP into your IDE during the UCP migration significantly reduces the time spent looking up new schema field paths. If your team is sequencing the broader changes alongside UCP, the order is: confirm the Storefront API proxy is wrapping your routes, audit consent-mode handling on that proxy layer, then ship the UCP endpoint and tool rename. For broader Hydrogen production context, see our Hydrogen 2.0 production-readiness guide.

Step-by-Step Migration Diff

We typically execute UCP migrations as a six-step sequence. The work is small, but auditable steps make rollback cheap.

  • Update the endpoint constant. Replace the literal /api/mcp path with /api/ucp/mcp wherever your code constructs the MCP URL. Include environment variables, deployment manifests, and any shared SDK constants in the search.
  • Rename tool calls. Wherever your agent invokes search_shop_catalog, swap to search_catalog. Wherever it invokes the previous lookup tool, swap to lookup_catalog. get_product is the new full-product retrieval tool — expect the UCP-aligned response shape rather than the legacy Storefront MCP fields.
  • Update request shapes against the UCP spec. The core argument keys (query, context) carry over conceptually, but Shopify's changelog explicitly states that the request schemas are updated to match UCP. Treat the Storefront Catalog MCP documentation as the authoritative reference for the new request shape and validate against it before shipping.
  • Verify response field locations. The legacy Storefront MCP returned a flat structure with product_name, price, variant_id, and image_url at the top level. Under UCP the product, pricing, availability, and option data follow the UCP catalog spec, which structures them differently. Re-run your client-side schema validation rather than assuming the legacy field paths still resolve.
  • Run integration tests in parallel. Keep one suite hitting /api/mcp and a duplicate hitting /api/ucp/mcp. Both should pass during the transition window, then drop the legacy suite once the new endpoint is canonical in production and the old endpoint is no longer in use.
  • Ship before June 15. Aim for at least 14 days of canary traffic in production before the sunset, so any latent regression has time to surface under realistic load.

Decision Framework: UCP, Direct Storefront API, or Custom MCP

When to use each pattern

Three commerce-data access patterns now coexist on a Hydrogen storefront. Use this matrix to pick the right one for the job.

Requirement UCP via /api/ucp/mcp Direct Storefront API Custom MCP server
Latency Medium (proxy + UCP wrap) Low (direct GraphQL) Medium-high
Auth Storefront access token Storefront/Admin token Custom (your stack)
Schema versioning Capability-negotiated Storefront API version You own it
AI agent compatibility Native (MCP binding) Requires wrapper Native
Best for Public agentic search and cart Frontend rendering Bespoke enterprise tools

In our experience, the right default for AI-agent-facing surface area is UCP via the Hydrogen proxy. Direct Storefront API calls remain the right choice for your own frontend rendering — there is no reason to pay the UCP wrapping overhead for code you control. Custom MCP servers make sense only when you have bespoke commerce capabilities (custom B2B pricing tiers, ERP-driven inventory rules) that the standard UCP catalog capability cannot model, and even then, we recommend implementing them as UCP extensions under your own reverse-domain namespace rather than as a parallel protocol. The architectural patterns for scaling a custom MCP layer in production are covered separately in our scaling patterns post.

Testing the Cutover Before June 15

The migration is only as safe as the test suite that verifies it. We typically build a parallel suite that hits both endpoints with the same set of fixtures, asserts the response shapes, and gates the legacy suite removal on a clean canary in production.

The first pattern is fixture parity. Capture a set of representative agent requests from production logs, replay them against both /api/mcp and /api/ucp/mcp, and diff the response shapes. The legacy endpoint should still match the old schema; the UCP endpoint should match the new one. Any drift is a sign that your client code is making assumptions that one or the other endpoint does not satisfy.

The second is canary traffic gating. We have found that 1% of agent traffic to the new endpoint for 48 hours is enough to surface most schema-coupling bugs. If you do not have feature-flag infrastructure for agent traffic, a header-based router ahead of the storefront works — branch on a custom header like X-UCP-Migration: enabled for internal testing accounts before cutting over the full agent population.

The third is the sunset rehearsal. Before June 15, point your test suite at a Pilot or staging storefront where the legacy endpoint is already disabled. This forces every code path that quietly depends on the old endpoint to fail loudly, in test, where you can fix it. Sunset rehearsals are how you catch the half-migrated dependency that nobody remembered was still on the old tool name. For teams already running Shopify Functions in production, the same fixture-from-production pattern applies — the broader testing strategy is covered in our post on Shopify Functions in production.

What to do next

If you run a Hydrogen storefront with any custom AI agent integration, the migration is on a fixed clock. We recommend the following sequence over the next 30 days:

  • Audit your codebase. Run grep -r "/api/mcp" across every service that talks to your Hydrogen storefront — including custom agents, Slack integrations, ERP middleware, and any internal tooling. The endpoint is also commonly referenced in environment variables, so include .env, wrangler.toml, and any deployment manifests.
  • Confirm your Hydrogen version. If you are on 2026.3.x or earlier, schedule the proxy and consent-mode migration first. UCP will not work cleanly without the proxy in place, and consent state desync is a quiet failure mode that is expensive to debug after the fact.
  • Update the endpoint and tool names. The two-line fix is as small as it reads. Keep the legacy endpoint operational in your codebase until the parallel test suite is green.
  • Validate response shapes. Map every property your client code reads from MCP responses to its UCP equivalent. Treat the Storefront Catalog MCP documentation as the authoritative schema reference rather than relying on the legacy Storefront MCP field paths.
  • Plan the canary cutover. Aim to land the new endpoint in production with at least two weeks of parallel running, and complete the cutover well ahead of the June 15 sunset rather than racing it.

For most teams, this is a one-day engineering exercise. The hard part is not the rename — it is making sure the migration is sequenced correctly with the proxy and consent changes that landed alongside it. If your storefront is on Hydrogen and you have not yet looked at this, the cost of acting now is much lower than the cost of acting on June 14.

For broader headless context, see our Catalyst vs Hydrogen comparison and our breakdown of Shopify's four native MCP servers. If you are running a Shopify Plus migration alongside the UCP cutover, our Shopify Plus migration service covers the architecture and risk-register work that keeps both threads from colliding mid-cutover.