# Bombas

**Canonical:** https://apis.io/providers/bombas/  
**Website:** https://bombas.com/  
**APIs profiled:** 1

Bombas is a New York City based direct-to-consumer comfort apparel brand founded in 2013 by David Heath and Randy Goldberg, selling socks, underwear, t-shirts and slippers on a one-purchased-equals-one-donated model that has powered more than 200 million donated items through a network of over 4,000 giving partners serving people experiencing homelessness. The company is privately held, was funded on Shark Tank in 2014, and runs its ecommerce on Shopify Plus. Bombas does not publish a first-party developer program or REST API, but its storefront at shop.bombas.com exposes a real agent-facing commerce surface: a published llms.txt / agents.md, a Universal Commerce Protocol (UCP) merchant profile at /.well-known/ucp, and a live MCP endpoint at /api/ucp/mcp implementing the UCP Shopping Service, alongside OAuth 2.0 / OpenID Connect discovery for Shopify customer accounts.

## Kin Score — 20.9 / 100 (emerging)

Scored 2026-08-25 under rubric 0.14.0. Trend: flat (+0.0 from 20.9).

| Facet | Score |
|---|---|
| Discoverability | 87.0 |
| Contract Quality | 0.0 |
| Governance | 18.2 |
| Contract Governance | 18.2 |
| Operational Transparency | 2.6 |
| Developer Ergonomics | 14.3 |
| Commercial Clarity | 34.2 |
| Access Clarity | 34.2 |

## Agent readiness — 23.9 (agent-aware)

| Dimension | Value |
|---|---|
| Spec Presence | no |
| Agentic Access | no |
| Reversibility Documented | no |
| MCP Server | verified |
| Auth Clarity | served |
| Idempotency | no |
| Error Semantics | no |
| OpenAPI Examples | no |
| Rate Limit Signal | no |
| Event Surface Described | no |
| Agent Skills | no |
| Well Known Catalog | no |
| Consent Identity | no |
| Agent Card | no |
| Dry Run Mode | no |
| Delegated Identity | served |
| Protected Resource Metadata | verified |
| Dynamic Client Registration | no |
| Agentic Commerce | platform |

## APIs (1)

- **Bombas Commerce (UCP Shopping)** — The agent-facing commerce surface of the Bombas Shopify storefront. The store publishes a Universal Commerce Protocol merchant profile at https://shop.bombas.com/.well-known/ucp...

## MCP servers (1)

- **Bombas MCP Server**

## Security (2)

- **Bombas Authentication** — oauth2/openIdConnect/custom-header · 3 schemes
- **Bombas Domain Security** — TLSv1.3 · HSTS · DMARC

## Tags

Company, Retail, E-Commerce, Apparel, Direct to Consumer, Commerce, Agentic Commerce, Universal Commerce Protocol, MCP, Shopify

---

Profiled by [API Evangelist](https://apievangelist.com) and published on [APIs.io](https://apis.io/providers/bombas/). Scores are computed from the provider's own public artifacts under a published rubric.