Methodology

Vokko is not a UCP validator. ucpchecker.com already owns that slice (manifest at /.well-known/ucp, conformance, UCP score). We index every public agent protocol we can detect without completing a purchase.

Cell → spec → probe → never

Each matrix cell is one protocol. Status vocab: absent, present, callable, partial, undiscoverable, error. present[] counts present and callable only.

Cell	Spec	Probe	We never
ucp	https://ucp.dev	GET /.well-known/ucp (JSON). One https same-site host redirect that keeps that path. Parse services, capabilities, payment_handlers, checkout, ap2_mandate.	POST checkout / complete. Follow any 3xx except one https same-site hop that keeps /.well-known/ucp.
acp	https://www.agenticcommerce.dev/	None. Status undiscoverable.	GET invented /.well-known/acp paths. ACP has no public well-known.
ap2	https://github.com/google-agentic-commerce/ap2	Derived from UCP capability dev.ucp.shopping.ap2_mandate.	GET invented /.well-known/ap2. AP2 is a UCP capability (ap2_mandate), cell source ucp_extension.
tap	https://corporate.visa.com	GET /.well-known/http-message-signatures-directory. Header-only Signature-Agent → partial.	Visa JWKS, forged TAP signatures, treating cf-ray as TAP.
mcp	https://modelcontextprotocol.io	GET manifest JSON → present. On refresh only: unauthenticated JSON-RPC tools/list or initialize (4s, 8KB). 401/403 stays present + auth_required.	tools/call or any authenticated tool invocation. Unauthenticated tools/list or initialize only on ?refresh=1.
a2a	https://a2a-protocol.org	GET /.well-known/agent-card.json, then /.well-known/agent.json. Parse name/skills. Optional HEAD of interface URL.	A2A message:send. Invented /.well-known/a2a paths. Prefer agent-card.json, then agent.json.
x402	https://www.x402.org	Unauthenticated GET homepage + /.well-known/x402. HTTP 402 with PAYMENT-REQUIRED (V2) or X-PAYMENT (V1) → callable. Decode version/scheme/network/asset/amount. HTML 200 → absent.	Send PAYMENT-SIGNATURE or X-PAYMENT to the target. Pay the target's 402. Treat HTML at /.well-known/x402 as x402.
mpp	https://docs.stripe.com	Same GETs as x402. WWW-Authenticate: Payment → callable, separate cell.	GET /.well-known/mpp (there is none). Collapse MPP into the x402 cell.
llms	https://llmstxt.org	GET /llms.txt and /llms-full.txt.	Treat llms.txt as checkout or payment.
ai-plugin	https://platform.openai.com	GET /.well-known/ai-plugin.json.	Follow plugin auth or execute plugin calls.
openapi	https://www.openapis.org	GET /.well-known/openapi.json, /openapi.json, /openapi.yaml, /swagger.json.	Call the described API methods beyond GET/HEAD of the document.

What we fetch

For a normalized host we resolve public DNS (no private/CGNAT/link-local), then GET in parallel:

/robots.txt — policy for GPTBot, Google-Extended, ClaudeBot, Applebot-Extended, CCBot, PerplexityBot, Bytespider
Homepage — platform fingerprint, Signature-Agent, HTTP 402, WWW-Authenticate: Payment
ucp — /.well-known/ucp
acp — header/homepage signals only
ap2 — header/homepage signals only
tap — /.well-known/http-message-signatures-directory
mcp — /.well-known/mcp.json, /.well-known/mcp, /mcp
a2a — /.well-known/agent-card.json, /.well-known/agent.json
x402 — /.well-known/x402
mpp — header/homepage signals only
llms — /llms.txt, /llms-full.txt
ai-plugin — /.well-known/ai-plugin.json
openapi — /.well-known/openapi.json, /openapi.json, /openapi.yaml, /swagger.json

What we never do

Add to cart, checkout, or hold payment credentials
Pay a target's HTTP 402 or send PAYMENT-SIGNATURE / X-PAYMENT to that host
Follow logins or scrape catalogs behind auth
Call MCP tools or A2A message:send
Invent well-knowns (no /.well-known/mpp, /acp, /ap2, /tap)
Sell placement on the index
Treat a UCP A-grade as a Vokko A-grade

TTL

Presence documents (UCP profile, TAP directory, MCP manifest, A2A card, llms.txt) cache 24h. Callability (x402 402 / MPP Payment challenge) caches 15 min. Stale callability is re-observed with the same unauthenticated GETs; we still do not pay the target. ?refresh=1 is paywalled (Vokko Pro / Vokko's own x402) and re-runs callability plus MCP tools/list or initialize.

Vokko index (not a UCP score)

Discovery 25% · protocol breadth 40% · machine-payment rails 20% · evidence quality 15%. Payment 20 fires only when x402 or MPP is callable. Breadth is weighted: x402/MPP/UCP/ACP count more than llms.txt. A store that only publishes UCP will score as a specialist. That is intentional.

Identity

User-Agent: VokkoBot/0.1 (+https://vokko.eu/methodology; multi-protocol capability probe)

Timeout 4s · max 8KB per body · HTTPS only. Index rows live in Postgres. To opt out of future batch crawls, disallow this UA in robots.txt or serve /.well-known/vokko-optout.

Crawl

Every successful lookup is written to Postgres. Batch: npm run crawl against data/seeds.txt, concurrency 3, 24h presence freshness, skip if /.well-known/vokko-optout returns 200. We do not import UCP Checker's directory.

API and origin-owner report

Cached GET is free. ?refresh=1 on the bound host is the origin-owner SKU (HTTP 402 without a Bearer key or remaining quota). Subscribe at /pricing — €29/mo EUR, one origin, 30 live reports per billing period. GET /report/{domain} is the origin-owner view (HTML or JSON): missing spec fields to fix, not grade letters. Cached GET stays free. Entitled live refresh skips x402.

GET /api/v1/hosts/{domain}
GET /api/v1/hosts/{domain}?refresh=1
GET /api/v1/index
GET /report/{domain}
GET /llms.txt
GET /.well-known/agent-card.json