PHPackages angeo/module-ucp - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [API Development](/categories/api) 4. / 5. angeo/module-ucp ActiveMagento2-module[API Development](/categories/api) angeo/module-ucp ================ Spec-compliant Universal Commerce Protocol (UCP) profile generator for Magento 2. Generates /.well-known/ucp at protocol version 2026-04-08 with ECDSA P-256 signing keys, declared capabilities, and proper cache headers. 1.2.0(1mo ago)451MITPHPPHP >=8.2 Since May 23Pushed 2mo agoCompare [ Source](https://github.com/angeo-dev/module-ucp)[ Packagist](https://packagist.org/packages/angeo/module-ucp)[ RSS](/packages/angeo-module-ucp/feed)WikiDiscussions main Synced 3w ago READMEChangelogDependencies (14)Versions (4)Used By (0) Angeo UCP — `/.well-known/ucp` for Magento 2 ============================================ [](#angeo-ucp--well-knownucp-for-magento-2) Publishes a [Universal Commerce Protocol](https://ucp.dev) business profile at `/.well-known/ucp` so AI shopping agents (Google/Gemini, ChatGPT, etc.) can discover your store's commerce capabilities. - Profile generated per UCP spec **2026-04-08** - Served by a **PHP controller** — correct `Content-Type: application/json`, CORS, and cache headers, with **no nginx/Apache changes** - ECDSA P-256 signing keys, JWK-formatted, **public keys only** in the profile How the endpoint is served -------------------------- [](#how-the-endpoint-is-served) `/.well-known/ucp` is delivered by a controller, not a static file, because the UCP spec requires `Content-Type: application/json` **and** CORS headers (`Access-Control-Allow-Origin: *`) — neither of which a static file without an extension can provide without editing the web server. ComponentRole`Controller\Router`Custom router matching the exact path `/.well-known/ucp` and dispatching the action. Registered in `etc/di.xml` via `RouterList` (sortOrder 22, before the CMS router). Returns `null` for any other path.`Controller\WellKnown\Ucp`Builds and returns the profile as JSON with `Content-Type: application/json`, CORS, `Cache-Control: public, max-age=300`, and hardening headers. Returns **404** when the module is disabled (the site simply does not advertise UCP). Public, no auth — as the spec requires.`Model\ProfileGenerator`Builds the spec-2026-04-08 profile (services, capabilities, extensions, payment handlers, supported versions, public signing keys).`Model\Keys\KeyGenerator` / `JwkFormatter`Generates ECDSA P-256 keys and formats the **public** half as a JWK.### Why this reaches PHP without web-server changes [](#why-this-reaches-php-without-web-server-changes) The stock Magento nginx config ends its main location with `try_files $uri $uri/ /index.php$is_args$args`. A request for `/.well-known/ucp`with **no matching static file** falls through to `index.php`, where the custom router dispatches it. The official Magento nginx sample has no `location ~ /\.` deny rule, so the dot-segment is not blocked. > If your host added a custom `location ~ /\. { deny all; }` rule it blocks all dot-paths, and the profile then needs a one-line nginx allow for `^~ /.well-known/`. The stock config does not have this problem. > Do **not** leave a static file at `pub/.well-known/ucp`: nginx would serve it first (as `application/octet-stream`, no CORS) and the controller would never run. Install ------- [](#install) ``` composer require angeo/module-ucp bin/magento module:enable Angeo_Ucp bin/magento setup:upgrade bin/magento cache:flush ``` Generate signing keys, then verify: ``` bin/magento angeo:ucp:keys:generate curl -sI https://yourstore.com/.well-known/ucp # HTTP/2 200 # content-type: application/json # access-control-allow-origin: * # cache-control: public, max-age=300 ``` CLI --- [](#cli) CommandPurpose`bin/magento angeo:ucp:keys:generate`Generate / rotate the ECDSA P-256 signing key pair.`bin/magento angeo:ucp:validate`Validate the generated profile against the UCP spec.Configuration ------------- [](#configuration) **Stores → Configuration → Angeo UCP** — enable the module and declare which capabilities your store supports (catalog search/lookup, cart, checkout, order, identity linking, fulfillment, discount), payment handlers, and supported protocol versions. Security -------- [](#security) - The profile is **public and unauthenticated** by design (per the UCP spec). Never put secrets, internal URLs, or admin contacts in it. - Only **public** signing keys are published. The private key never leaves the server; `ProfileGenerator` reads public keys only (`getPublicSigningKeys()`). See `SECURITY.md`. - The endpoint sends `X-Content-Type-Options: nosniff`, `X-Frame-Options: DENY`, and `Referrer-Policy: no-referrer`. - Rate-limiting is the operator's responsibility (reverse proxy / WAF). - If a CDN/Varnish fronts the site, the `Cache-Control` header lets it cache the profile; purge `/.well-known/ucp` after rotating keys or changing config. ### Health Score 41 — FairBetter than 87% of packages Maintenance89 Actively maintained with recent releases Popularity10 Limited adoption so far Community9 Small or concentrated contributor base Maturity48 Maturing project, gaining track record Bus Factor1 Top contributor holds 50% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~11 days Total 3 Last Release 40d ago Major Versions 0.1.1-beta → 1.2.02026-06-14 ### Community Maintainers ![](https://avatars.githubusercontent.com/u/557748?v=4)[angeo](/maintainers/angeo)[@angeo](https://github.com/angeo) --- Top Contributors [![TateLyman](https://avatars.githubusercontent.com/u/244852162?v=4)](https://github.com/TateLyman "TateLyman (1 commits)")[![XxXgeoXxX](https://avatars.githubusercontent.com/u/44254165?v=4)](https://github.com/XxXgeoXxX "XxXgeoXxX (1 commits)") --- Tags adobe-commerceagentic-commerceai-agentsgoogle-ucpmagento2magento2-modulephpucpuniversal-commerce-protocolwell-knownmagento2magento 2 moduleai-agentswell-knownangeoagentic commerceaeoucpuniversal-commerce-protocolgoogle-ucp ### Code Quality TestsPHPUnit Static AnalysisPHPStan Type Coverage Yes ### Embed Badge ![Health badge](/badges/angeo-module-ucp/health.svg) ``` [![Health](https://phpackages.com/badges/angeo-module-ucp/health.svg)](https://phpackages.com/packages/angeo-module-ucp) ``` ### Alternatives [mollie/magento2 Mollie Payment Module for Magento 2 1131.9M16](/packages/mollie-magento2)[smile/elasticsuite Magento 2 merchandising and search engine built on ElasticSearch 8064.7M50](/packages/smile-elasticsuite)[loki/magento2-components Core module for defining Alpine.js components with advanced AJAX features 1011.8k26](/packages/loki-magento2-components)[run-as-root/magento2-prometheus-exporter Magento2 Prometheus Exporter 68357.9k](/packages/run-as-root-magento2-prometheus-exporter)[angeo/module-llms-txt Magento 2 module for AI Engine Optimization (AEO). Generates spec-compliant llms.txt and llms-full.txt per llmstxt.org standard, plus streaming JSONL for vector indexing. Multi-store, multi-website, CLI, cron, async admin UI, Page Builder-aware sanitization, customer-group pricing, atomic writes, ETag/Cache-Control, .md mirrors. 111.1k](/packages/angeo-module-llms-txt)[opengento/module-category-import-export This module add the capability to import and export the categories from the back-office. 1310.9k2](/packages/opengento-module-category-import-export) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)