{ "data": { "a": { "slug": "ack-pay", "name": "ACK-Pay (Agent Commerce Kit)", "vendor": "Catena Labs, Inc.", "vendorUrl": "https://www.agentcommercekit.com", "kind": "protocol", "category": "pay-per-call", "summary": "ACK-Pay is the open payment protocol in Agent Commerce Kit from Catena Labs. A server returns a signed Payment Request, the client pays through a Payment Service and retries with a receipt issued as a W3C Verifiable Credential.", "url": "https://www.anchorterminal.com/tools/ack-pay", "markdownUrl": "https://www.anchorterminal.com/tools/ack-pay.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/ack-pay.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/ack-pay.json", "dns": "ack-pay.grade.anchorterminal.com", "repo": "https://github.com/agentcommercekit/ack", "license": "MIT (docs and SDK)", "transports": [], "packages": [ { "registry": "npm", "name": "@agentcommercekit/ack-pay" }, { "registry": "npm", "name": "agentcommercekit" } ], "auth": "none", "authNotes": "No account or key. Servers sign Payment Requests with a key bound to a DID, and Receipt Services sign receipts that servers check against their own list of trusted issuer DIDs. Identity checks between parties can use ACK-ID.", "pricing": "free", "pricingNotes": "No protocol fee, and the SDK is MIT with nothing to buy. Settlement costs depend on the Payment Service and rail a deployment chooses. The docs say conversion and bridging fees should be shown to the client. No public Payment Service with published prices was found.", "priceSummary": "Free", "where": "spec", "x402": { "level": "no", "evidence": "A payment protocol, not a tool that accepts payment. The docs describe x402 as fitting the ACK-Pay pattern and list acting as an x402 facilitator as planned research (checked 2026-10-09).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 159, "npmWeekly": 54, "pypiWeekly": null, "asOf": "2026-10-09" }, "docsUrl": "https://www.agentcommercekit.com/ack-pay/introduction", "llmsTxt": "https://www.agentcommercekit.com/llms.txt", "capabilities": [ "payments.protocol", "payments.stablecoin" ], "tags": [ "protocol", "verifiable-credentials", "did", "receipts", "typescript", "mit", "llms-txt" ], "lastRelease": "2026-08-04", "graded": true, "anchor": { "graded": true, "score": 48.9, "grade": "D", "agentReady": false, "rank": 0, "ranked": false, "notRankedWhy": "A protocol, graded on the same scale but not ranked against tools", "rankOf": 1510, "categoryRank": 4, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 47, "maintenance": 43, "payments": 77, "reliability": 38, "schema": 66, "security": 58, "transparency": 62 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-04" }, "negative": -6, "negativeNotes": [ "2026-08-04, @agentcommercekit/ack-pay 0.11.0 fixed a revocation check that treated any failure to fetch or parse the status list as not revoked, so `verifyPaymentReceipt` accepted revoked credentials. The changelog describes the flaw in full and the repository has no published advisory. Released with the flaw described and no advisory, which this check reads as -3 in place of the earlier 2 (https://github.com/agentcommercekit/ack/blob/main/packages/ack-pay/CHANGELOG.md, https://github.com/agentcommercekit/ack/security/advisories)", "2026-08-27 to 2026-09-23, -3. Fixes of described flaws sit on main in changesets and in no release: `verifyPaymentReceipt` didn't check that a receipt's `paymentOptionId` was one the verified Payment Request offered (ack-pay, 27 August), payment amount strings that were malformed, fractional, zero or negative were accepted (ack-pay, 1 September), did:web and did:jwks resolution followed redirects past the `allowedHttpHosts` check (did, 9 September) `isDidKeyUri` accepted `did:key:z` (did, 1 September) and the key type guards accepted JWK objects with invalid private key fields (keys, 23 September). 0.11.0 on 4 August is still the latest tag (https://github.com/agentcommercekit/ack/tree/main/.changeset)" ], "verdict": "Signed payment requests and receipts that any server can verify offline against trusted issuers, with an MIT TypeScript SDK and CI on every push. No public Payment Service was found, demos settle on testnets, no error codes are defined, and fixes to receipt and DID checks made since August wait on main in no release.", "bestFor": "Teams that want receipts a server can verify offline and a single request format across card and stablecoin rails, and that will run their own payment and receipt services.", "strengths": [ "Receipts are W3C Verifiable Credentials signed by a Receipt Service, so a server checks payment without calling the payment system", "One Payment Request can list several options, such as USDC on Base and a card payment through Stripe, each with its own Payment Service", "Docs and code are MIT, with llms.txt and a Markdown copy of every docs page", "The SDK exports Valibot and Zod schemas for the request, the option and the receipt claim", "CI builds, lints and tests on every push, and the last five runs on main on the page read passed" ], "weaknesses": [ "No public Payment Service or Receipt Service was found. The docs use example.com hosts and the demo pays on Base Sepolia, Solana devnet or a simulated Stripe flow", "The protocol defines no error codes, idempotency key or retry header. The operations page tells implementers to design their own", "One SDK, in TypeScript, at 0.11.0. One release in the last 90 days, with nine changesets waiting on main, including a receipt option check", "0.11.0 fixed a revocation check that accepted revoked credentials when the status list was unreachable. No GitHub advisory was published", "Open issue 222 of 21 September 2026 reports that `expiresAt` on a Payment Request is never enforced", "No terms, privacy policy, status page or security.txt on agentcommercekit.com", "Fixes to receipt verification and DID resolution merged between 27 August and 23 September 2026 are in no release; 0.11.0 of 4 August is the latest" ], "agentNotes": [ "Verify `paymentRequestToken` and read amount, recipient and currency from the signed payload, not from `description`", "Pass `trustedReceiptIssuers` to `verifyPaymentReceipt`. Without a trusted issuer list any DID can sign a receipt", "Check amount, recipient and receipt reuse yourself. The SDK's claim verifier checks only the shape of the receipt", "Use `@agentcommercekit/ack-pay` 0.11.0 or later, because earlier releases treated an unreachable revocation list as not revoked", "Plan for a Payment Service and a Receipt Service you run or choose. The protocol names the roles and no public one was found" ], "metrics": { "kind": "spec", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 48.9 } ], "editorialScores": { "ergonomics": 47, "maintenance": 43, "payments": 77, "reliability": 38, "schema": 66, "security": 58, "transparency": 63 }, "provenanceScore": 61, "checked": { "categories": { "ergonomics": "2026-11-04", "maintenance": "2026-11-04", "payments": "2026-11-04", "reliability": "2026-11-04", "schema": "2026-11-04", "security": "2026-11-04", "transparency": "2026-11-04" }, "last": "2026-11-04", "lastMoved": "2026-11-04", "oldest": "2026-11-04", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm i @agentcommercekit/ack-pay" }, "letme": { "capability": "https://letme.dev/payments.protocol", "tool": "https://letme.dev/ack-pay" }, "area": "payments", "provenance": { "legalEntity": "Catena Labs, Inc.", "domain": "agentcommercekit.com", "domainRegistered": "2025-05-02", "domainNote": "The docs site names no legal entity. Catena Labs, Inc. is the copyright holder in the repository's LICENCE file and the author in the package manifests. No terms or privacy policy were found for the docs site, so the MIT licence stands in.", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://github.com/agentcommercekit/ack/blob/main/packages/ack-pay/CHANGELOG.md", "securityTxt": "none", "checked": "2026-10-09", "score": 61 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/ack-pay.json", "live": { "slug": "ack-pay", "versions": [ { "registry": "github", "name": "agentcommercekit/ack", "version": "agentcommercekit@0.11.0", "released": "2026-08-04", "seenAt": "2026-11-06T23:02:23.478751734Z" }, { "registry": "npm", "name": "@agentcommercekit/ack-pay", "version": "0.11.0", "seenAt": "2026-11-06T23:02:19.934020479Z" }, { "registry": "npm", "name": "agentcommercekit", "version": "0.11.0", "seenAt": "2026-11-06T23:02:21.516191725Z" } ], "githubStars": 158, "npmWeekly": 120, "securityTxt": { "url": "https://agentcommercekit.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T15:59:29.184285506Z" }, "llmsTxt": { "url": "https://www.agentcommercekit.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:31:04.935412621Z" }, "domain": { "domain": "agentcommercekit.com", "registered": "2025-05-02", "source": "https://rdap.verisign.com/com/v1/domain/agentcommercekit.com", "checkedAt": "2026-11-01T14:22:41.592032918Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/agentcommercekit/ack/main/packages/ack-pay/CHANGELOG.md", "kind": "changelog", "status": 304, "checkedAt": "2026-11-07T14:19:43.735429698Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "a86c2ee19456" } ], "github": { "repo": "agentcommercekit/ack", "checkedAt": "2026-11-02T08:28:44.55549783Z", "stars": 158, "archived": false, "issuesEnabled": true, "pushedAt": "2026-10-31T16:31:23Z", "openIssues": 19, "openPRs": 40, "issuesOpened90d": 23, "issuesClosed90d": 9, "prsMerged90d": 34, "ci": { "branch": "main", "runs": 50, "success": 45, "failure": 5, "other": 0, "latest": "success", "latestAt": "2026-10-06T09:35:24Z" }, "replies": { "sampled": 25, "unanswered": 16, "medianDays": 17.5 } }, "updatedAt": "2026-11-07T15:59:29.184285506Z" } }, "answer": "Universal Commerce Protocol (UCP) scores 72 (BB) on agent readiness against ACK-Pay (Agent Commerce Kit)'s 48.9 (D), and leads in 5 of 7 scored categories. ACK-Pay (Agent Commerce Kit) leads on payments \u0026 pricing and transparency \u0026 trust.", "b": { "slug": "ucp", "name": "Universal Commerce Protocol (UCP)", "vendor": "UCP Authors (Google, Shopify and co-developers)", "vendorUrl": "https://ucp.dev", "kind": "protocol", "category": "checkout-protocols", "summary": "The Universal Commerce Protocol (UCP) is an open specification, co-developed by Google, Shopify and other retailers and platforms, for agents to discover a business's capabilities and run catalogue, cart, checkout, identity linking and order flows over REST, MCP or A2A.", "url": "https://www.anchorterminal.com/tools/ucp", "markdownUrl": "https://www.anchorterminal.com/tools/ucp.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/ucp.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/ucp.json", "dns": "ucp.grade.anchorterminal.com", "repo": "https://github.com/Universal-Commerce-Protocol/ucp", "license": "Apache-2.0", "transports": [], "packages": [], "auth": "oauth", "authNotes": "A specification, not a service. Identity linking uses OAuth 2.0 for a platform to act for a user at a business. Agent requests carry a UCP-Agent profile, and signed agents send RFC 9421 HTTP message signatures with a Signature-Agent header and a JWK thumbprint key ID. Payment credentials move through payment handlers and token exchange between payment and credential providers, with AP2 mandates supported.", "pricing": "free", "pricingNotes": "The specification, schemas, SDKs and conformance tests are free under Apache-2.0. Costs come from the business's platform and payment provider, not the protocol.", "priceSummary": "Free · OSS", "where": "spec", "x402": { "level": "no", "evidence": "A commerce protocol, not a tool that accepts payment; it supports AP2 mandates and payment handlers (checked 2026-11-06).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 3479, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://ucp.dev/latest/specification/overview/", "llmsTxt": "https://ucp.dev/llms.txt", "openapi": "https://github.com/Universal-Commerce-Protocol/ucp/blob/main/source/services/shopping/rest.openapi.json", "capabilities": [ "payments.protocol", "payments.checkout", "payments.mandate" ], "tags": [ "protocol", "open-standard", "open-source", "mcp", "a2a", "ap2", "openapi", "openrpc", "llms-txt", "shopify", "google", "commerce" ], "lastRelease": "2026-08-25", "graded": true, "anchor": { "graded": true, "score": 72, "grade": "BB", "agentReady": true, "rank": 0, "ranked": false, "notRankedWhy": "A protocol, graded on the same scale but not ranked against tools", "rankOf": 1510, "categoryRank": 1, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 82, "maintenance": 70, "payments": 50, "reliability": 79, "schema": 90, "security": 67, "transparency": 47 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": 0, "verdict": "OpenAPI, OpenRPC and JSON Schema for every surface, official Python and JavaScript SDKs, conformance tests and live use on Shopify stores and Stripe's checkout. Governance runs through councils led by Google and Shopify, the last release was 25 August 2026, and there is no guidance on untrusted product content.", "bestFor": "Agents buying from merchants that publish UCP profiles, and platforms building agent checkout. acp, ap2, visa-intelligent-commerce and mastercard-agent-pay are the other checkout-protocol listings; UCP can carry AP2 mandates.", "strengths": [ "Machine-readable contracts for every transport, OpenAPI, OpenRPC and JSON Schema 2020-12", "Official Python and JavaScript SDKs, a schema validator and a conformance test suite", "Idempotency keys required on MCP checkout calls", "Live on every Shopify store and as Stripe's own-checkout route", "Breaking changes announced two weeks before they merge" ], "weaknesses": [ "No release since v2026-08-25, though main changes most days", "No guidance on product descriptions or business messages as untrusted content for agents", "Lodging is a draft and food ordering unreleased", "Governing and tech councils are led by Google and Shopify members" ], "agentNotes": [ "Read the business profile first and call only the capabilities both profiles declare", "Send a fresh idempotency-key UUID on each checkout call and reuse it on retry", "Hand the buyer the continue_url when a checkout needs a person instead of retrying", "Send a UCP-Agent profile, and sign requests with RFC 9421 if the business requires signed agents" ], "metrics": { "kind": "spec", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 72 } ], "editorialScores": { "ergonomics": 82, "maintenance": 70, "payments": 50, "reliability": 79, "schema": 90, "security": 67, "transparency": 62 }, "provenanceScore": 32, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "letme": { "capability": "https://letme.dev/payments.protocol", "tool": "https://letme.dev/ucp" }, "area": "payments", "provenance": { "legalEntity": "", "domain": "ucp.dev", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://github.com/Universal-Commerce-Protocol/ucp/releases", "securityTxt": "unknown", "checked": "2026-11-06", "notes": [ "Files carry \"Copyright 2026 UCP Authors\" under Apache-2.0. No legal entity runs the project; governance is by councils whose members are named with their companies.", "Security reports go to Google's g.co/vulnz with a five-working-day response, coordinated through GitHub Security Advisories (SECURITY.md in the .github repository).", "ucp.dev has no robots.txt and serves llms.txt. No terms or privacy policy found for the site.", "The registration date of ucp.dev wasn't found through RDAP." ], "score": 32 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/ucp.json", "live": { "slug": "ucp", "versions": [ { "registry": "github", "name": "Universal-Commerce-Protocol/ucp", "version": "v2026-08-25", "released": "2026-08-25", "seenAt": "2026-11-07T00:13:40.257304662Z" } ], "githubStars": 3480, "securityTxt": { "url": "https://ucp.dev/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:23.109475398Z" }, "llmsTxt": { "url": "https://ucp.dev/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:34:12.746672159Z" }, "updatedAt": "2026-11-07T16:00:23.109475398Z" } }, "edges": [ { "by": 41, "category": "reliability", "leads": "ucp", "name": "Reliability", "reasons": { "a": "Graded as a protocol on reference implementations (30), public servers or processors (25), spec stability (25) and test vectors (20). One reference SDK in TypeScript at 0.11.0, with a payments demo and example issuer and verifier services in the repository (15). No public Payment Service or Receipt Service was found. The docs use example.com hosts and the demo settles on Base Sepolia, Solana devnet or a simulated Stripe payment (0). The versioning page names 2025-05-04 as the current stable protocol version and says the date changes only on incompatible changes, but the specification is prose documentation without normative language and the SDK is below 1.0 (15). No test vectors are published, and the specification still names 2025-05-04 as the current version on 4 November. The ack-pay package has seven unit test files, and the Check workflow passed on the last five pushes to main on the page read on 9 October, not re-read on 4 November; the workflow still runs build, lint and the vitest suites on every push and pull request (8). 15 + 0 + 15 + 8 = 38.", "b": "Protocol reading, split as reference implementations 30, live deployments 25, spec stability 25 and test vectors 20. Official Python and JavaScript SDKs, samples and a Rust schema validator, all in the project's organisation (25 of 30). Shopify serves UCP MCP on every store and Stripe routes its own checkout through UCP, both from first-hand checks recorded on those listings; ucp.dev lists about 50 endorsers, which are claims (20 of 25). Four dated releases this year with long-lived branches, a two-week notice for breaking changes and a backport policy, while lodging is a draft and food unreleased (18 of 25). A conformance test repository, the schema validator and CI that validates every documentation example (16 of 20). 25 + 20 + 18 + 16 = 79." }, "scores": { "a": 38, "b": 79 } }, { "by": 35, "category": "ergonomics", "leads": "ucp", "name": "Agent ergonomics", "reasons": { "a": "A paid call takes a 402, a call to a Payment Service, a receipt and a retry, which is one party more than a direct 402 scheme. A receipt can be reused until it expires (15). A request can carry several payment options, there are server-initiated and client-initiated sequences and an optional `serviceCallback`, and no session or metering scheme is defined (12). No protocol error codes. The SDK throws two named error classes and the operations page asks implementers to write their own error taxonomy (5). The request `id` is there to stop replay and verifiers are told to reject reused receipts, with no idempotency key (8). One SDK, in TypeScript (7). 15 + 12 + 5 + 8 + 7 = 47.", "b": "Protocol reading. Capability negotiation means an agent sees only what both sides support, though the schemas are large (18 of 25). Catalogue search pages with a cursor and has_next_page (15 of 20). An error model with codes and continue_url to hand a buyer to the business when the agent can't finish (18). The MCP binding requires an idempotency-key UUID on checkout calls for retry safety (18). Official SDKs in Python and JavaScript; every request needs a UCP-Agent profile (13 of 15). 18 + 15 + 18 + 18 + 13 = 82." }, "scores": { "a": 47, "b": 82 } }, { "by": 27, "category": "payments", "leads": "ack-pay", "name": "Payments \u0026 pricing", "reasons": { "a": "ACK-Pay is a payment protocol with a 402 request and a verifiable receipt, but it names no settlement method of its own and no public Payment Service was found to pay through (25). Scored with the self-hosted rule for the rest. No protocol fee, with any conversion fee left to the Payment Service to disclose (20). Docs and SDK are MIT with nothing to buy (20). The SDK installs from npm with no account, but a payment needs a Payment Service and a Receipt Service that somebody has to run (12). 25 + 20 + 20 + 12 = 77.", "b": "Protocol reading. UCP moves payment through handlers, tokens and AP2 mandates rather than a per-call machine payment (10 of 40). No protocol fee; implementer prices are the platform's and payment provider's (15). The spec, SDKs and samples are free (20). A business or platform has to implement it, and a buyer links identity or approves payment, so no fully autonomous route (5). 10 + 15 + 20 + 5 = 50." }, "scores": { "a": 77, "b": 50 } }, { "by": 27, "category": "maintenance", "leads": "ucp", "name": "Maintenance \u0026 community", "reasons": { "a": "0.11.0 of every package was tagged on 4 August 2026, 92 days before this check, and no tag has followed (10, in place of 20, cause time). No release from 6 August, and nine changesets wait on main, the newest from 23 September (0). GitHub's issue, pull request and Actions pages weren't readable on 4 November (the proxy answers 403); readings from them are per the 9 October check. 16 open issues, the oldest from 10 August 2026, and 37 open pull requests on 9 October; outside contributions were merged in September and on 6 October 2026, the last commit on main (15). One official SDK, current on npm (8). CI on every push, Dependabot and a scheduled daily audit workflow (10). 10 + 0 + 15 + 8 + 10 = 43.", "b": "The latest release is v2026-08-25, 73 days before this check (20). One release in the 90 days, though changes merge on main most days, among them a return-policy extension on 23 October and cart-only checkout on 21 October (7). Pull requests from Google, Shopify and outside contributors merge within days; 262 issues and pull requests are open (18). Official SDKs, updated 5 November (15). CI with linting, spellcheck, governance checks and example validation, and Dependabot updates (10). 20 + 7 + 18 + 15 + 10 = 70." }, "scores": { "a": 43, "b": 70 } }, { "by": 24, "category": "schema", "leads": "ucp", "name": "Schema \u0026 documentation", "reasons": { "a": "The SDK exports Valibot and Zod schemas for the Payment Request, the payment option and the receipt claim, with no JSON Schema or OpenAPI file (15). llms.txt lists 42 pages on 4 November and each has a Markdown copy (10). Pages on roles, both sequences, the Payment Service and receipts explain when each flow applies, in descriptive prose without MUST or SHOULD rules (13). A field table gives type and required status for every request field, while `network` and `recipient` are free strings whose format varies by network (10). JSON examples of a request and a receipt are given, and no error responses are defined (7). Date-based protocol versions and a changelog per package, though the docs and SDK disagree in places. The docs allow a DID in `serviceCallback` and open issue 205 reports the schema rejects it (11). 15 + 10 + 13 + 10 + 7 + 11 = 66.", "b": "OpenAPI for each REST service, OpenRPC for the MCP and embedded bindings and JSON Schema 2020-12 throughout (25). ucp.dev serves llms.txt, and AGENT_IMPLEMENTER.md guides agents implementing the spec (10). The spec gives MUST and SHOULD rules with rationale for negotiation, signatures and permalinks (17). Typed schemas with required fields, namespaced extension types and version requirements (13). Examples validated in CI and an error code table with continue_url handling (13). Dated versions with release tags and release-note drafts generated from tags; no separate changelog page was read (12). 25 + 10 + 17 + 13 + 13 + 12 = 90." }, "scores": { "a": 66, "b": 90 } }, { "by": 15, "category": "transparency", "leads": "ack-pay", "name": "Transparency \u0026 trust", "reasons": { "a": "Docs and code are MIT, copyright Catena Labs, Inc. (30). No privacy policy or terms were found for agentcommercekit.com. The protocol pages say receipt metadata must not hold secrets or customer data and that the Payment Service hides the server's settlement account from the client (10). The versioning page defines Draft, Current and Final revisions, and the 0.11.0 changelog lists each removed API with its replacement (13). The ack-pay package depends on four workspace packages and valibot, and no telemetry was found in its manifest. The docs site names no legal entity, which appears only in the repository's LICENCE file and package manifests (10). 30 + 10 + 13 + 10 = 63.", "b": "Apache-2.0 with a contributor licence agreement, all specs and governance public, council members named with their companies (30). ucp.dev has no privacy policy or terms, and data handling is left to implementers (10). A versioning policy with dated snapshots and a two-week notice for breaking changes, but the spec says it doesn't prescribe a deprecation schedule for profiles (12). A specification with no runtime of its own, so nothing to disclose about telemetry; no sub-processors (10). 30 + 10 + 12 + 10 = 62." }, "scores": { "a": 62, "b": 47 } } ], "facts": [ { "a": "Payment protocol", "b": "Payment protocol", "name": "Kind" }, { "a": "Catena Labs, Inc.", "b": "UCP Authors (Google, Shopify and co-developers)", "name": "Vendor" }, { "a": "no (local only)", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "", "b": "", "name": "Transports" }, { "a": "None", "b": "OAuth", "name": "Auth" }, { "a": "Free", "b": "Free", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "MIT (docs and SDK)", "b": "Apache-2.0", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "2026-08-04", "b": "2026-08-25", "name": "Last release" }, { "a": "no document linked", "b": "no document linked", "name": "Terms last updated" }, { "a": "no document linked", "b": "no document linked", "name": "Privacy policy last updated" }, { "a": "159 stars, 54 npm/wk", "b": "3.5k stars", "name": "Popularity" } ], "faq": [ { "answer": "Universal Commerce Protocol (UCP) scores 72 (BB) on agent readiness against ACK-Pay (Agent Commerce Kit)'s 48.9 (D), and leads in 5 of 7 scored categories. ACK-Pay (Agent Commerce Kit) leads on payments \u0026 pricing and transparency \u0026 trust.", "question": "Which is better for AI agents, ACK-Pay (Agent Commerce Kit) or Universal Commerce Protocol (UCP)?" }, { "answer": "No open-source release is listed for ACK-Pay (Agent Commerce Kit). Universal Commerce Protocol (UCP) is open source (Apache-2.0).", "question": "Are ACK-Pay (Agent Commerce Kit) and Universal Commerce Protocol (UCP) open source?" } ], "goodFor": [ { "aheadOn": [ "Payments \u0026 pricing, 77 against 50", "Transparency \u0026 trust, 62 against 47" ], "also": [ "No key needed to call it" ], "goodFor": "Teams that want receipts a server can verify offline and a single request format across card and stablecoin rails, and that will run their own payment and receipt services.", "slug": "ack-pay", "watchFor": "No public Payment Service or Receipt Service was found. The docs use example.com hosts and the demo pays on Base Sepolia, Solana devnet or a simulated Stripe flow" }, { "aheadOn": [ "Reliability, 79 against 38", "Schema \u0026 documentation, 90 against 66", "Agent ergonomics, 82 against 47", "Security \u0026 auth, 67 against 58", "Maintenance \u0026 community, 70 against 43" ], "also": [ "Agent-ready, a grade of BB or better", "Open source", "No incidents deducted, where ACK-Pay (Agent Commerce Kit) loses 6 points for them" ], "goodFor": "Agents buying from merchants that publish UCP profiles, and platforms building agent checkout. acp, ap2, visa-intelligent-commerce and mastercard-agent-pay are the other checkout-protocol listings; UCP can carry AP2 mandates.", "slug": "ucp", "watchFor": "No release since v2026-08-25, though main changes most days" } ], "history": { "ack-pay": [ { "causes": [ "correction", "time" ], "date": "2026-11-04", "delta": -4.9, "from": 53.8, "fromGrade": "D", "to": 48.9, "toGrade": "D" }, { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.2, "from": 53.6, "fromGrade": "D", "to": 53.8, "toGrade": "D" } ], "ucp": null }, "job": { "capability": "payments.protocol", "name": "Agent payment protocols" }, "others": [ { "json": "https://www.anchorterminal.com/compare/ack-pay-vs-acp.json", "title": "ACK-Pay (Agent Commerce Kit) vs Agentic Commerce Protocol (ACP)", "url": "https://www.anchorterminal.com/compare/ack-pay-vs-acp" }, { "json": "https://www.anchorterminal.com/compare/ack-pay-vs-amex-ace.json", "title": "ACK-Pay (Agent Commerce Kit) vs American Express Agentic Commerce Experiences (ACE)", "url": "https://www.anchorterminal.com/compare/ack-pay-vs-amex-ace" }, { "json": "https://www.anchorterminal.com/compare/ack-pay-vs-ap2.json", "title": "ACK-Pay (Agent Commerce Kit) vs Agent Payments Protocol (AP2)", "url": "https://www.anchorterminal.com/compare/ack-pay-vs-ap2" }, { "json": "https://www.anchorterminal.com/compare/ack-pay-vs-l402.json", "title": "ACK-Pay (Agent Commerce Kit) vs L402", "url": "https://www.anchorterminal.com/compare/ack-pay-vs-l402" }, { "json": "https://www.anchorterminal.com/compare/ack-pay-vs-mastercard-agent-pay.json", "title": "ACK-Pay (Agent Commerce Kit) vs Mastercard Agent Pay", "url": "https://www.anchorterminal.com/compare/ack-pay-vs-mastercard-agent-pay" }, { "json": "https://www.anchorterminal.com/compare/ack-pay-vs-mpp.json", "title": "ACK-Pay (Agent Commerce Kit) vs Machine Payments Protocol (MPP)", "url": "https://www.anchorterminal.com/compare/ack-pay-vs-mpp" }, { "json": "https://www.anchorterminal.com/compare/ack-pay-vs-visa-intelligent-commerce.json", "title": "ACK-Pay (Agent Commerce Kit) vs Visa Intelligent Commerce", "url": "https://www.anchorterminal.com/compare/ack-pay-vs-visa-intelligent-commerce" }, { "json": "https://www.anchorterminal.com/compare/ack-pay-vs-x402.json", "title": "ACK-Pay (Agent Commerce Kit) vs x402", "url": "https://www.anchorterminal.com/compare/ack-pay-vs-x402" }, { "json": "https://www.anchorterminal.com/compare/acp-vs-ucp.json", "title": "Agentic Commerce Protocol (ACP) vs Universal Commerce Protocol (UCP)", "url": "https://www.anchorterminal.com/compare/acp-vs-ucp" }, { "json": "https://www.anchorterminal.com/compare/amex-ace-vs-ucp.json", "title": "American Express Agentic Commerce Experiences (ACE) vs Universal Commerce Protocol (UCP)", "url": "https://www.anchorterminal.com/compare/amex-ace-vs-ucp" }, { "json": "https://www.anchorterminal.com/compare/ap2-vs-ucp.json", "title": "Agent Payments Protocol (AP2) vs Universal Commerce Protocol (UCP)", "url": "https://www.anchorterminal.com/compare/ap2-vs-ucp" }, { "json": "https://www.anchorterminal.com/compare/l402-vs-ucp.json", "title": "L402 vs Universal Commerce Protocol (UCP)", "url": "https://www.anchorterminal.com/compare/l402-vs-ucp" }, { "json": "https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-ucp.json", "title": "Mastercard Agent Pay vs Universal Commerce Protocol (UCP)", "url": "https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-ucp" }, { "json": "https://www.anchorterminal.com/compare/mpp-vs-ucp.json", "title": "Machine Payments Protocol (MPP) vs Universal Commerce Protocol (UCP)", "url": "https://www.anchorterminal.com/compare/mpp-vs-ucp" }, { "json": "https://www.anchorterminal.com/compare/ucp-vs-visa-intelligent-commerce.json", "title": "Universal Commerce Protocol (UCP) vs Visa Intelligent Commerce", "url": "https://www.anchorterminal.com/compare/ucp-vs-visa-intelligent-commerce" }, { "json": "https://www.anchorterminal.com/compare/ucp-vs-x402.json", "title": "Universal Commerce Protocol (UCP) vs x402", "url": "https://www.anchorterminal.com/compare/ucp-vs-x402" } ], "panel": null, "scores": [ { "ack-pay": 38, "by": 41, "edge": "ucp", "key": "reliability", "name": "Reliability", "ucp": 79, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "ack-pay": 66, "by": 24, "edge": "ucp", "key": "schema", "name": "Schema \u0026 documentation", "ucp": 90, "weight": 13 }, { "ack-pay": 47, "by": 35, "edge": "ucp", "key": "ergonomics", "name": "Agent ergonomics", "ucp": 82, "weight": 13 }, { "ack-pay": 58, "by": 9, "edge": "ucp", "key": "security", "name": "Security \u0026 auth", "ucp": 67, "weight": 14 }, { "ack-pay": 77, "by": 27, "edge": "ack-pay", "key": "payments", "name": "Payments \u0026 pricing", "ucp": 50, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "ack-pay": 43, "by": 27, "edge": "ucp", "key": "maintenance", "name": "Maintenance \u0026 community", "ucp": 70, "weight": 7 }, { "ack-pay": 62, "by": 15, "edge": "ack-pay", "key": "transparency", "name": "Transparency \u0026 trust", "ucp": 47, "weight": 7 } ], "summary": "Universal Commerce Protocol (UCP) scores 72 (BB) on agent readiness against ACK-Pay (Agent Commerce Kit)'s 48.9 (D), and leads in 5 of 7 scored categories. ACK-Pay (Agent Commerce Kit) leads on payments \u0026 pricing and transparency \u0026 trust. Both do agent payment protocols.", "tasks": null, "tutorials": [ { "title": "Run the ACK-Pay payment-and-receipt demo", "tool": "ack-pay", "url": "https://www.anchorterminal.com/tutorials/ack-pay/" } ], "verdicts": { "ack-pay": "Signed payment requests and receipts that any server can verify offline against trusted issuers, with an MIT TypeScript SDK and CI on every push. No public Payment Service was found, demos settle on testnets, no error codes are defined, and fixes to receipt and DID checks made since August wait on main in no release.", "ucp": "OpenAPI, OpenRPC and JSON Schema for every surface, official Python and JavaScript SDKs, conformance tests and live use on Shopify stores and Stripe's checkout. Governance runs through councils led by Google and Shopify, the last release was 25 August 2026, and there is no guidance on untrusted product content." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/ack-pay-vs-ucp", "json": "https://www.anchorterminal.com/compare/ack-pay-vs-ucp.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/ack-pay-vs-ucp.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/ack-pay-vs-ucp.min.md" }, "markdown": "Universal Commerce Protocol (UCP) scores 72 (BB) on agent readiness against ACK-Pay (Agent Commerce Kit)'s 48.9 (D), and leads in 5 of 7 scored categories. ACK-Pay (Agent Commerce Kit) leads on payments \u0026 pricing and transparency \u0026 trust. Both do agent payment protocols.\n\n- ACK-Pay (Agent Commerce Kit): grade D, 48.9/100, rank graded, not ranked against tools. Markdown https://www.anchorterminal.com/tools/ack-pay.md · JSON https://www.anchorterminal.com/api/v1/tools/ack-pay.json\n- Universal Commerce Protocol (UCP): grade BB, 72/100, rank graded, not ranked against tools. Markdown https://www.anchorterminal.com/tools/ucp.md · JSON https://www.anchorterminal.com/api/v1/tools/ucp.json\n- All 30 pay per call comparisons: https://www.anchorterminal.com/compare/pay-per-call/index.md\n- All 39 checkout comparisons: https://www.anchorterminal.com/compare/checkout-protocols/index.md\n\n## Which one, for what\n\n### ACK-Pay (Agent Commerce Kit) (D)\n\nGood for: Teams that want receipts a server can verify offline and a single request format across card and stablecoin rails, and that will run their own payment and receipt services.\n\nAhead on:\n- Payments \u0026 pricing, 77 against 50\n- Transparency \u0026 trust, 62 against 47\n\nAlso in its favour:\n- No key needed to call it\n\nWatch for: No public Payment Service or Receipt Service was found. The docs use example.com hosts and the demo pays on Base Sepolia, Solana devnet or a simulated Stripe flow\n\n### Universal Commerce Protocol (UCP) (BB)\n\nGood for: Agents buying from merchants that publish UCP profiles, and platforms building agent checkout. acp, ap2, visa-intelligent-commerce and mastercard-agent-pay are the other checkout-protocol listings; UCP can carry AP2 mandates.\n\nAhead on:\n- Reliability, 79 against 38\n- Schema \u0026 documentation, 90 against 66\n- Agent ergonomics, 82 against 47\n- Security \u0026 auth, 67 against 58\n- Maintenance \u0026 community, 70 against 43\n\nAlso in its favour:\n- Agent-ready, a grade of BB or better\n- Open source\n- No incidents deducted, where ACK-Pay (Agent Commerce Kit) loses 6 points for them\n\nWatch for: No release since v2026-08-25, though main changes most days\n\n\n## Why the edge\n\n### Reliability: Universal Commerce Protocol (UCP) +41\n\n- ACK-Pay (Agent Commerce Kit) (38): Graded as a protocol on reference implementations (30), public servers or processors (25), spec stability (25) and test vectors (20). One reference SDK in TypeScript at 0.11.0, with a payments demo and example issuer and verifier services in the repository (15). No public Payment Service or Receipt Service was found. The docs use example.com hosts and the demo settles on Base Sepolia, Solana devnet or a simulated Stripe payment (0). The versioning page names 2025-05-04 as the current stable protocol version and says the date changes only on incompatible changes, but the specification is prose documentation without normative language and the SDK is below 1.0 (15). No test vectors are published, and the specification still names 2025-05-04 as the current version on 4 November. The ack-pay package has seven unit test files, and the Check workflow passed on the last five pushes to main on the page read on 9 October, not re-read on 4 November; the workflow still runs build, lint and the vitest suites on every push and pull request (8). 15 + 0 + 15 + 8 = 38.\n- Universal Commerce Protocol (UCP) (79): Protocol reading, split as reference implementations 30, live deployments 25, spec stability 25 and test vectors 20. Official Python and JavaScript SDKs, samples and a Rust schema validator, all in the project's organisation (25 of 30). Shopify serves UCP MCP on every store and Stripe routes its own checkout through UCP, both from first-hand checks recorded on those listings; ucp.dev lists about 50 endorsers, which are claims (20 of 25). Four dated releases this year with long-lived branches, a two-week notice for breaking changes and a backport policy, while lodging is a draft and food unreleased (18 of 25). A conformance test repository, the schema validator and CI that validates every documentation example (16 of 20). 25 + 20 + 18 + 16 = 79.\n\n### Agent ergonomics: Universal Commerce Protocol (UCP) +35\n\n- ACK-Pay (Agent Commerce Kit) (47): A paid call takes a 402, a call to a Payment Service, a receipt and a retry, which is one party more than a direct 402 scheme. A receipt can be reused until it expires (15). A request can carry several payment options, there are server-initiated and client-initiated sequences and an optional `serviceCallback`, and no session or metering scheme is defined (12). No protocol error codes. The SDK throws two named error classes and the operations page asks implementers to write their own error taxonomy (5). The request `id` is there to stop replay and verifiers are told to reject reused receipts, with no idempotency key (8). One SDK, in TypeScript (7). 15 + 12 + 5 + 8 + 7 = 47.\n- Universal Commerce Protocol (UCP) (82): Protocol reading. Capability negotiation means an agent sees only what both sides support, though the schemas are large (18 of 25). Catalogue search pages with a cursor and has_next_page (15 of 20). An error model with codes and continue_url to hand a buyer to the business when the agent can't finish (18). The MCP binding requires an idempotency-key UUID on checkout calls for retry safety (18). Official SDKs in Python and JavaScript; every request needs a UCP-Agent profile (13 of 15). 18 + 15 + 18 + 18 + 13 = 82.\n\n### Payments \u0026 pricing: ACK-Pay (Agent Commerce Kit) +27\n\n- ACK-Pay (Agent Commerce Kit) (77): ACK-Pay is a payment protocol with a 402 request and a verifiable receipt, but it names no settlement method of its own and no public Payment Service was found to pay through (25). Scored with the self-hosted rule for the rest. No protocol fee, with any conversion fee left to the Payment Service to disclose (20). Docs and SDK are MIT with nothing to buy (20). The SDK installs from npm with no account, but a payment needs a Payment Service and a Receipt Service that somebody has to run (12). 25 + 20 + 20 + 12 = 77.\n- Universal Commerce Protocol (UCP) (50): Protocol reading. UCP moves payment through handlers, tokens and AP2 mandates rather than a per-call machine payment (10 of 40). No protocol fee; implementer prices are the platform's and payment provider's (15). The spec, SDKs and samples are free (20). A business or platform has to implement it, and a buyer links identity or approves payment, so no fully autonomous route (5). 10 + 15 + 20 + 5 = 50.\n\n### Maintenance \u0026 community: Universal Commerce Protocol (UCP) +27\n\n- ACK-Pay (Agent Commerce Kit) (43): 0.11.0 of every package was tagged on 4 August 2026, 92 days before this check, and no tag has followed (10, in place of 20, cause time). No release from 6 August, and nine changesets wait on main, the newest from 23 September (0). GitHub's issue, pull request and Actions pages weren't readable on 4 November (the proxy answers 403); readings from them are per the 9 October check. 16 open issues, the oldest from 10 August 2026, and 37 open pull requests on 9 October; outside contributions were merged in September and on 6 October 2026, the last commit on main (15). One official SDK, current on npm (8). CI on every push, Dependabot and a scheduled daily audit workflow (10). 10 + 0 + 15 + 8 + 10 = 43.\n- Universal Commerce Protocol (UCP) (70): The latest release is v2026-08-25, 73 days before this check (20). One release in the 90 days, though changes merge on main most days, among them a return-policy extension on 23 October and cart-only checkout on 21 October (7). Pull requests from Google, Shopify and outside contributors merge within days; 262 issues and pull requests are open (18). Official SDKs, updated 5 November (15). CI with linting, spellcheck, governance checks and example validation, and Dependabot updates (10). 20 + 7 + 18 + 15 + 10 = 70.\n\n### Schema \u0026 documentation: Universal Commerce Protocol (UCP) +24\n\n- ACK-Pay (Agent Commerce Kit) (66): The SDK exports Valibot and Zod schemas for the Payment Request, the payment option and the receipt claim, with no JSON Schema or OpenAPI file (15). llms.txt lists 42 pages on 4 November and each has a Markdown copy (10). Pages on roles, both sequences, the Payment Service and receipts explain when each flow applies, in descriptive prose without MUST or SHOULD rules (13). A field table gives type and required status for every request field, while `network` and `recipient` are free strings whose format varies by network (10). JSON examples of a request and a receipt are given, and no error responses are defined (7). Date-based protocol versions and a changelog per package, though the docs and SDK disagree in places. The docs allow a DID in `serviceCallback` and open issue 205 reports the schema rejects it (11). 15 + 10 + 13 + 10 + 7 + 11 = 66.\n- Universal Commerce Protocol (UCP) (90): OpenAPI for each REST service, OpenRPC for the MCP and embedded bindings and JSON Schema 2020-12 throughout (25). ucp.dev serves llms.txt, and AGENT_IMPLEMENTER.md guides agents implementing the spec (10). The spec gives MUST and SHOULD rules with rationale for negotiation, signatures and permalinks (17). Typed schemas with required fields, namespaced extension types and version requirements (13). Examples validated in CI and an error code table with continue_url handling (13). Dated versions with release tags and release-note drafts generated from tags; no separate changelog page was read (12). 25 + 10 + 17 + 13 + 13 + 12 = 90.\n\n### Transparency \u0026 trust: ACK-Pay (Agent Commerce Kit) +15\n\n- ACK-Pay (Agent Commerce Kit) (62): Docs and code are MIT, copyright Catena Labs, Inc. (30). No privacy policy or terms were found for agentcommercekit.com. The protocol pages say receipt metadata must not hold secrets or customer data and that the Payment Service hides the server's settlement account from the client (10). The versioning page defines Draft, Current and Final revisions, and the 0.11.0 changelog lists each removed API with its replacement (13). The ack-pay package depends on four workspace packages and valibot, and no telemetry was found in its manifest. The docs site names no legal entity, which appears only in the repository's LICENCE file and package manifests (10). 30 + 10 + 13 + 10 = 63.\n- Universal Commerce Protocol (UCP) (47): Apache-2.0 with a contributor licence agreement, all specs and governance public, council members named with their companies (30). ucp.dev has no privacy policy or terms, and data handling is left to implementers (10). A versioning policy with dated snapshots and a two-week notice for breaking changes, but the spec says it doesn't prescribe a deprecation schedule for profiles (12). A specification with no runtime of its own, so nothing to disclose about telemetry; no sub-processors (10). 30 + 10 + 12 + 10 = 62.\n\n## Score by category\n\n| Category | Weight | ACK-Pay (Agent Commerce Kit) | Universal Commerce Protocol (UCP) | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 38 | 79 | Universal Commerce Protocol (UCP) +41 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 66 | 90 | Universal Commerce Protocol (UCP) +24 |\n| Agent ergonomics | 13% (16.2 this run) | 47 | 82 | Universal Commerce Protocol (UCP) +35 |\n| Security \u0026 auth | 14% (17.5 this run) | 58 | 67 | Universal Commerce Protocol (UCP) +9 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 77 | 50 | ACK-Pay (Agent Commerce Kit) +27 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 43 | 70 | Universal Commerce Protocol (UCP) +27 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 62 | 47 | ACK-Pay (Agent Commerce Kit) +15 |\n| Negative events | ≤15 | -6 | 0 | |\n| **Total** | | **48.9 · D** | **72 · BB** | |\n\n## Facts side by side\n\n| Fact | ACK-Pay (Agent Commerce Kit) | Universal Commerce Protocol (UCP) |\n| --- | --- | --- |\n| Kind | Payment protocol | Payment protocol |\n| Vendor | Catena Labs, Inc. | UCP Authors (Google, Shopify and co-developers) |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports | | |\n| Auth | None | OAuth |\n| Pricing | Free | Free |\n| x402 | no | no |\n| Licence | MIT (docs and SDK) | Apache-2.0 |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| Last release | 2026-08-04 | 2026-08-25 |\n| Terms last updated | no document linked | no document linked |\n| Privacy policy last updated | no document linked | no document linked |\n| Popularity | 159 stars, 54 npm/wk | 3.5k stars |\n\n## How the scores have moved\n\n### ACK-Pay (Agent Commerce Kit)\n\n- -4.9 on 4 November 2026: correction, time\n- +0.2 on 27 October 2026: checklist\n\n### Universal Commerce Protocol (UCP)\n\nNo score change since it was listed.\n\n## Verdicts\n\n**ACK-Pay (Agent Commerce Kit).** Signed payment requests and receipts that any server can verify offline against trusted issuers, with an MIT TypeScript SDK and CI on every push. No public Payment Service was found, demos settle on testnets, no error codes are defined, and fixes to receipt and DID checks made since August wait on main in no release.\n\n**Universal Commerce Protocol (UCP).** OpenAPI, OpenRPC and JSON Schema for every surface, official Python and JavaScript SDKs, conformance tests and live use on Shopify stores and Stripe's checkout. Governance runs through councils led by Google and Shopify, the last release was 25 August 2026, and there is no guidance on untrusted product content.\n\n## Before you call either\n\n### ACK-Pay (Agent Commerce Kit)\n\n1. Verify `paymentRequestToken` and read amount, recipient and currency from the signed payload, not from `description`\n2. Pass `trustedReceiptIssuers` to `verifyPaymentReceipt`. Without a trusted issuer list any DID can sign a receipt\n3. Check amount, recipient and receipt reuse yourself. The SDK's claim verifier checks only the shape of the receipt\n4. Use `@agentcommercekit/ack-pay` 0.11.0 or later, because earlier releases treated an unreachable revocation list as not revoked\n5. Plan for a Payment Service and a Receipt Service you run or choose. The protocol names the roles and no public one was found\n\n### Universal Commerce Protocol (UCP)\n\n1. Read the business profile first and call only the capabilities both profiles declare\n2. Send a fresh idempotency-key UUID on each checkout call and reuse it on retry\n3. Hand the buyer the continue_url when a checkout needs a person instead of retrying\n4. Send a UCP-Agent profile, and sign requests with RFC 9421 if the business requires signed agents\n\n## Tutorials\n\n- [Run the ACK-Pay payment-and-receipt demo](https://www.anchorterminal.com/tutorials/ack-pay/), for ACK-Pay (Agent Commerce Kit)\n\n## Questions\n\n### Which is better for AI agents, ACK-Pay (Agent Commerce Kit) or Universal Commerce Protocol (UCP)?\n\nUniversal Commerce Protocol (UCP) scores 72 (BB) on agent readiness against ACK-Pay (Agent Commerce Kit)'s 48.9 (D), and leads in 5 of 7 scored categories. ACK-Pay (Agent Commerce Kit) leads on payments \u0026 pricing and transparency \u0026 trust.\n\n### Are ACK-Pay (Agent Commerce Kit) and Universal Commerce Protocol (UCP) open source?\n\nNo open-source release is listed for ACK-Pay (Agent Commerce Kit). Universal Commerce Protocol (UCP) is open source (Apache-2.0).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/ack-pay-vs-ucp.json, and with the fewest tokens: https://www.anchorterminal.com/compare/ack-pay-vs-ucp.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"ack-pay\", \"b\": \"ucp\"}`. From a terminal: `anchor compare ack-pay ucp`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/ack-pay.json and https://www.anchorterminal.com/api/v1/tools/ucp.json\n\n## Other comparisons with ACK-Pay (Agent Commerce Kit) or Universal Commerce Protocol (UCP)\n\n- [ACK-Pay (Agent Commerce Kit) vs Agentic Commerce Protocol (ACP)](https://www.anchorterminal.com/compare/ack-pay-vs-acp.md)\n- [ACK-Pay (Agent Commerce Kit) vs American Express Agentic Commerce Experiences (ACE)](https://www.anchorterminal.com/compare/ack-pay-vs-amex-ace.md)\n- [ACK-Pay (Agent Commerce Kit) vs Agent Payments Protocol (AP2)](https://www.anchorterminal.com/compare/ack-pay-vs-ap2.md)\n- [ACK-Pay (Agent Commerce Kit) vs L402](https://www.anchorterminal.com/compare/ack-pay-vs-l402.md)\n- [ACK-Pay (Agent Commerce Kit) vs Mastercard Agent Pay](https://www.anchorterminal.com/compare/ack-pay-vs-mastercard-agent-pay.md)\n- [ACK-Pay (Agent Commerce Kit) vs Machine Payments Protocol (MPP)](https://www.anchorterminal.com/compare/ack-pay-vs-mpp.md)\n- [ACK-Pay (Agent Commerce Kit) vs Visa Intelligent Commerce](https://www.anchorterminal.com/compare/ack-pay-vs-visa-intelligent-commerce.md)\n- [ACK-Pay (Agent Commerce Kit) vs x402](https://www.anchorterminal.com/compare/ack-pay-vs-x402.md)\n- [Agentic Commerce Protocol (ACP) vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/acp-vs-ucp.md)\n- [American Express Agentic Commerce Experiences (ACE) vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/amex-ace-vs-ucp.md)\n- [Agent Payments Protocol (AP2) vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/ap2-vs-ucp.md)\n- [L402 vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/l402-vs-ucp.md)\n- [Mastercard Agent Pay vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-ucp.md)\n- [Machine Payments Protocol (MPP) vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/mpp-vs-ucp.md)\n- [Universal Commerce Protocol (UCP) vs Visa Intelligent Commerce](https://www.anchorterminal.com/compare/ucp-vs-visa-intelligent-commerce.md)\n- [Universal Commerce Protocol (UCP) vs x402](https://www.anchorterminal.com/compare/ucp-vs-x402.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "ACK-Pay (Agent Commerce Kit) vs Universal Commerce Protocol (UCP)", "url": "" } ], "description": "Universal Commerce Protocol scores 72 (BB) to ACK-Pay's 48.9 (D) for agent payment protocols. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "ACK-Pay (Agent Commerce Kit) D 48.9", "Universal Commerce Protocol (UCP) BB 72", "scores" ], "h1": "ACK-Pay (Agent Commerce Kit) vs Universal Commerce Protocol (UCP)", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/ack-pay-vs-ucp", "published": "2026-10-01", "section": "tools", "title": "ACK-Pay vs Universal Commerce Protocol for AI agents (2026)", "toc": null, "updated": "2026-11-06", "url": "https://www.anchorterminal.com/compare/ack-pay-vs-ucp" }, "tokens": { "markdown": 4650, "slim": 2830 }, "version": 1 }