# UCP Lab agent guide

UCP Lab exposes a stateless remote MCP server at `https://ucp.asen.wang/mcp`.

If the custom domain is unavailable, use the Cloudflare-native fallback at `https://ucp-lab.xasenwang.workers.dev/mcp` with the same token and tools.

## Authentication

Send the visitor token in every request:

```http
Authorization: Bearer ucp_guest_...
```

Users can obtain a guest token without logging in through the UCP Lab web interface. Treat the token as a secret because it grants access to that visitor's query history and connected-store settings.

Users may optionally register or sign in. Account sessions use the `ucp_user_...` prefix and work with the same MCP endpoint and tool schemas. Guest history created before sign-in is merged into the account workspace.

## MCP tools

### `validate_prompt`

Input: `{ "prompt": string }`. Returns a prompt score, checks, normalization, and actionable suggestions.

### `search_catalog`

Input follows the UCP catalog search request: `{ "catalog": { ... } }`. Supports `query`, `like`, `context`, `filters`, `pagination`, and Shopify Global Catalog extensions. Image content uses `{ "image": { "content_type": "image/jpeg", "data": "<base64>" } }` inside `catalog.like`.

### `lookup_catalog`

Input follows UCP catalog lookup: `{ "catalog": { "ids": [ ... ], ... } }`.

### `get_product`

Input follows UCP product detail lookup: `{ "catalog": { "id": "...", "selected": [ ... ], ... } }`.

UCP Lab injects its public agent profile and forwards requests to Shopify. Product, variant, price, availability, checkout, and seller fields preserve Shopify's response semantics.

## Safety and use

- Do not expose a visitor token in public logs or prompts.
- Do not assume inferred catalog fields are merchant-authored.
- Verify price and availability immediately before purchase.
- Use product checkout URLs returned by Shopify rather than constructing them.

UCP Lab is an independent developer tool and is not affiliated with or endorsed by Shopify.