{ "data": { "a": { "slug": "amex-ace", "name": "American Express Agentic Commerce Experiences (ACE)", "vendor": "American Express", "vendorUrl": "https://www.americanexpress.com/en-us/company/agentic-commerce/", "kind": "protocol", "category": "checkout-protocols", "summary": "American Express's Agentic Commerce Experiences (ACE) developer kit lets verified AI agents pay with scoped, tokenised Amex card credentials against a purchase intent the Card Member approves. Access needs an application and agreements with American Express.", "url": "https://www.anchorterminal.com/tools/amex-ace", "markdownUrl": "https://www.anchorterminal.com/tools/amex-ace.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/amex-ace.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/amex-ace.json", "dns": "amex-ace.grade.anchorterminal.com", "license": "Proprietary. The specifications and guide are shown only to approved developers who sign a confidentiality agreement with American Express, and registration needs a separate agreement", "transports": [], "packages": [], "auth": "oauth", "authNotes": "Partners call the ACE APIs with an OAuth 2.0 client credentials token, obtained with a JWT client assertion signed with the project's client secret, over mutual TLS with a CA-issued client certificate uploaded to the developer portal. Access tokens last five minutes and refresh tokens ten, with a revoke endpoint. Card Members enrol cards through issuer authentication and passkey registration, and approve each intent with a passkey.", "pricing": "byo-plan", "pricingNotes": "No fee for ACE is published. Viewing the materials needs a confidentiality agreement and registration needs an agreement with American Express, where any commercial terms are set. Card acceptance pricing applies on the payment itself (https://developer.americanexpress.com/products/nextgen-agentic-payments/overview, checked 2026-10-16).", "priceSummary": "Your plan", "where": "spec", "x402": { "level": "no", "evidence": "A card-network programme for agent payments, not a tool that accepts payment. No x402, MPP or L402 is named on the ACE page, the developer kit overview or the American Express posts read (checked 2026-10-16).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-16" }, "docsUrl": "https://developer.americanexpress.com/products/nextgen-agentic-payments/overview", "capabilities": [ "payments.protocol", "payments.card-token", "payments.mandate", "auth.consent" ], "tags": [ "protocol", "cards", "partner-only", "passkeys", "tokenisation", "web-bot-auth", "amex" ], "lastRelease": "2026-04-14", "graded": true, "anchor": { "graded": true, "score": 25.4, "grade": "F", "agentReady": false, "rank": 0, "ranked": false, "notRankedWhy": "A protocol, graded on the same scale but not ranked against tools", "rankOf": 1510, "categoryRank": 6, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 22, "maintenance": 9, "payments": 20, "reliability": 13, "schema": 18, "security": 54, "transparency": 41 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-16" }, "negative": 0, "verdict": "ACE binds each card credential to an intent the Card Member approves with a passkey, and Amex runs issuer, network and acquirer itself. Outside developers can read only overview pages. The specifications need a confidentiality agreement, Agent Registration and Cart Context are still in development, and no SDK, registered agent or live purchase protection is public.", "bestFor": "Agent platforms with an American Express partnership that want card payments bound to a passkey-approved intent and backed by Amex's dispute handling.", "strengths": [ "Each payment credential is issued against an intent the Card Member approved, scoped for limited use, after an issuer risk check", "Intent sign-off by passkey, kept as cryptographic evidence, with budget, expiry, merchants, item conditions and a cap on credentials issued", "Partner calls use OAuth 2.0 client credentials with a signed JWT assertion, five-minute tokens, a revoke endpoint and mutual TLS", "Announced purchase protection for US Card Members when a registered agent's purchase deviates from the authenticated intent", "Amex says it contributes to AP2 and plans Web Bot Auth for agent identity, and Cloudflare names it as a Web Bot Auth partner" ], "weaknesses": [ "The specifications and guide are shown only to approved developers who sign a confidentiality agreement with American Express", "The ACE page still lists Agent Registration and Cart Context specifications as under development, as it did on 14 April 2026", "Registration needs an application and a signed agreement, approval isn't guaranteed, and there is no self-serve sandbox", "No public SDK, MCP server, reference implementation, changelog or test vectors; Amex says tooling will come later", "Purchase protection is a future benefit with unpublished full terms, and no registered agent is named" ], "agentNotes": [ "Don't plan to call ACE unless your operator is an approved American Express partner. Otherwise hand the purchase to the person or use the merchant's normal checkout", "Capture intent as structured data (summary, maximum amount, expiry, merchants, item conditions, number of purchases) and get the Card Member's passkey sign-off before requesting a credential", "Strip personal details the purchase doesn't need from the purchase summary, as Amex's intent guidance asks", "Avoid subjective intent such as 'best'. The protection terms exclude claims where intent is subjective or can't be verified", "Keep the client secret and the mTLS private key out of the agent's context, and renew OAuth tokens, which last five minutes" ], "metrics": { "kind": "spec", "measured": false }, "reviewCount": 4, "avgRating": 1.5, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "F", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 25.4 } ], "editorialScores": { "ergonomics": 22, "maintenance": 9, "payments": 20, "reliability": 13, "schema": 18, "security": 54, "transparency": 20 }, "provenanceScore": 61, "checked": { "categories": { "ergonomics": "2026-10-16", "maintenance": "2026-10-16", "payments": "2026-10-16", "reliability": "2026-10-16", "schema": "2026-10-16", "security": "2026-10-16", "transparency": "2026-10-16" }, "last": "2026-10-16", "lastMoved": "2026-10-30", "oldest": "2026-10-16", "stale": false, "staleAfterDays": 90 } }, "letme": { "capability": "https://letme.dev/payments.protocol", "tool": "https://letme.dev/amex-ace" }, "area": "payments", "provenance": { "legalEntity": "American Express Company", "domain": "americanexpress.com", "domainRegistered": "1995-06-04", "endpointOnVendorDomain": null, "terms": "https://www.americanexpress.com/us/legal-disclosures/website-rules-and-regulations.html", "privacy": "https://www.americanexpress.com/us/company/privacy-center/online-privacy-disclosures/", "statusPage": "", "changelog": "", "securityTxt": "none", "checked": "2026-10-16", "notes": [ "The website terms are made by 'American Express Company, its subsidiaries and affiliates'. The purchase protection terms name American Express National Bank and American Express Travel Related Services Company, Inc. as the issuers of eligible cards.", "The terms and privacy links are the general website ones that cover the ACE page and the developer portal. The ACE agreements themselves aren't public.", "RDAP for americanexpress.com gives a registration date of 4 June 1995. The ACE APIs are listed on apigwm.americanexpress.com.", "No changelog for ACE was found. The portal's general 'What's New' page was last updated for May 2024.", "www.americanexpress.com/.well-known/security.txt redirected to an error page on 16 October 2026. No status page for the developer APIs was found.", "robots.txt on www.americanexpress.com and www.americanexpress.io allows the pages read. developer.americanexpress.com and a4dextsvr.americanexpress.com serve no robots.txt. icm.aexp-static.com allows .json and disallows .htm files, so only JSON and Markdown were read there.", "WebFetch was refused for americanexpress.com and businesswire.com on 16 October 2026, so the Amex pages were read with curl. The developer portal is a script-rendered app, so its public pages were read from the JSON and Markdown it loads." ], "score": 61 }, "requirements": { "setupChecked": true, "card": "unknown", "minutes": 240, "credential": "oauth" }, "pageJsonUrl": "https://www.anchorterminal.com/tools/amex-ace.json", "live": { "slug": "amex-ace", "securityTxt": { "url": "https://americanexpress.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:50.961595179Z" }, "domain": { "domain": "americanexpress.com", "registered": "1995-06-04", "source": "https://rdap.verisign.com/com/v1/domain/americanexpress.com", "checkedAt": "2026-11-01T14:23:39.37077245Z" }, "pages": [ { "url": "https://www.americanexpress.com/us/company/privacy-center/online-privacy-disclosures/", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:24:43.596720169Z", "changedAt": "2026-11-06T13:45:50.316044213Z", "fingerprint": "b7448473abf3" }, { "url": "https://www.americanexpress.com/us/legal-disclosures/website-rules-and-regulations.html", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:24:46.203115312Z", "changedAt": "2026-11-05T13:08:49.360861202Z", "fingerprint": "696557bcdffe" } ], "updatedAt": "2026-11-07T16:00:50.961595179Z" } }, "answer": "Universal Commerce Protocol (UCP) scores 72 (BB) on agent readiness against American Express Agentic Commerce Experiences (ACE)'s 25.4 (F), and leads in every scored category.", "b": { "slug": "ucp", "name": "Universal Commerce Protocol (UCP)", "vendor": "UCP Authors (Google, Shopify and co-developers)", "vendorUrl": "https://ucp.dev", "kind": "protocol", "category": "checkout-protocols", "summary": "The Universal Commerce Protocol (UCP) is an open specification, co-developed by Google, Shopify and other retailers and platforms, for agents to discover a business's capabilities and run catalogue, cart, checkout, identity linking and order flows over REST, MCP or A2A.", "url": "https://www.anchorterminal.com/tools/ucp", "markdownUrl": "https://www.anchorterminal.com/tools/ucp.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/ucp.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/ucp.json", "dns": "ucp.grade.anchorterminal.com", "repo": "https://github.com/Universal-Commerce-Protocol/ucp", "license": "Apache-2.0", "transports": [], "packages": [], "auth": "oauth", "authNotes": "A specification, not a service. Identity linking uses OAuth 2.0 for a platform to act for a user at a business. Agent requests carry a UCP-Agent profile, and signed agents send RFC 9421 HTTP message signatures with a Signature-Agent header and a JWK thumbprint key ID. Payment credentials move through payment handlers and token exchange between payment and credential providers, with AP2 mandates supported.", "pricing": "free", "pricingNotes": "The specification, schemas, SDKs and conformance tests are free under Apache-2.0. Costs come from the business's platform and payment provider, not the protocol.", "priceSummary": "Free · OSS", "where": "spec", "x402": { "level": "no", "evidence": "A commerce protocol, not a tool that accepts payment; it supports AP2 mandates and payment handlers (checked 2026-11-06).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 3479, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://ucp.dev/latest/specification/overview/", "llmsTxt": "https://ucp.dev/llms.txt", "openapi": "https://github.com/Universal-Commerce-Protocol/ucp/blob/main/source/services/shopping/rest.openapi.json", "capabilities": [ "payments.protocol", "payments.checkout", "payments.mandate" ], "tags": [ "protocol", "open-standard", "open-source", "mcp", "a2a", "ap2", "openapi", "openrpc", "llms-txt", "shopify", "google", "commerce" ], "lastRelease": "2026-08-25", "graded": true, "anchor": { "graded": true, "score": 72, "grade": "BB", "agentReady": true, "rank": 0, "ranked": false, "notRankedWhy": "A protocol, graded on the same scale but not ranked against tools", "rankOf": 1510, "categoryRank": 1, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 82, "maintenance": 70, "payments": 50, "reliability": 79, "schema": 90, "security": 67, "transparency": 47 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": 0, "verdict": "OpenAPI, OpenRPC and JSON Schema for every surface, official Python and JavaScript SDKs, conformance tests and live use on Shopify stores and Stripe's checkout. Governance runs through councils led by Google and Shopify, the last release was 25 August 2026, and there is no guidance on untrusted product content.", "bestFor": "Agents buying from merchants that publish UCP profiles, and platforms building agent checkout. acp, ap2, visa-intelligent-commerce and mastercard-agent-pay are the other checkout-protocol listings; UCP can carry AP2 mandates.", "strengths": [ "Machine-readable contracts for every transport, OpenAPI, OpenRPC and JSON Schema 2020-12", "Official Python and JavaScript SDKs, a schema validator and a conformance test suite", "Idempotency keys required on MCP checkout calls", "Live on every Shopify store and as Stripe's own-checkout route", "Breaking changes announced two weeks before they merge" ], "weaknesses": [ "No release since v2026-08-25, though main changes most days", "No guidance on product descriptions or business messages as untrusted content for agents", "Lodging is a draft and food ordering unreleased", "Governing and tech councils are led by Google and Shopify members" ], "agentNotes": [ "Read the business profile first and call only the capabilities both profiles declare", "Send a fresh idempotency-key UUID on each checkout call and reuse it on retry", "Hand the buyer the continue_url when a checkout needs a person instead of retrying", "Send a UCP-Agent profile, and sign requests with RFC 9421 if the business requires signed agents" ], "metrics": { "kind": "spec", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 72 } ], "editorialScores": { "ergonomics": 82, "maintenance": 70, "payments": 50, "reliability": 79, "schema": 90, "security": 67, "transparency": 62 }, "provenanceScore": 32, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "letme": { "capability": "https://letme.dev/payments.protocol", "tool": "https://letme.dev/ucp" }, "area": "payments", "provenance": { "legalEntity": "", "domain": "ucp.dev", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://github.com/Universal-Commerce-Protocol/ucp/releases", "securityTxt": "unknown", "checked": "2026-11-06", "notes": [ "Files carry \"Copyright 2026 UCP Authors\" under Apache-2.0. No legal entity runs the project; governance is by councils whose members are named with their companies.", "Security reports go to Google's g.co/vulnz with a five-working-day response, coordinated through GitHub Security Advisories (SECURITY.md in the .github repository).", "ucp.dev has no robots.txt and serves llms.txt. No terms or privacy policy found for the site.", "The registration date of ucp.dev wasn't found through RDAP." ], "score": 32 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/ucp.json", "live": { "slug": "ucp", "versions": [ { "registry": "github", "name": "Universal-Commerce-Protocol/ucp", "version": "v2026-08-25", "released": "2026-08-25", "seenAt": "2026-11-07T00:13:40.257304662Z" } ], "githubStars": 3480, "securityTxt": { "url": "https://ucp.dev/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:23.109475398Z" }, "llmsTxt": { "url": "https://ucp.dev/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:34:12.746672159Z" }, "updatedAt": "2026-11-07T16:00:23.109475398Z" } }, "edges": [ { "by": 72, "category": "schema", "leads": "ucp", "name": "Schema \u0026 documentation", "reasons": { "a": "Read for what an outside developer can see. An OpenAPI specification exists for approved developers under a confidentiality agreement, and none is public (0 of 25). No llms.txt or Markdown docs for ACE. The portal's general docs load as Markdown, with nothing on ACE among them (0 of 10). The ACE page and the developer kit overview describe the five services, the human-present and autonomous cases and each party's role, and the post of 13 October 2026 sets out the intent data elements, without guidance on when not to use it (8 of 20). That post's three screenshots of the reference show typed fields with required flags, enums such as `PRICE` and `DATE` and conditional requirements, but amounts are strings, items and merchants carry free-form `metadata` maps, and only part of the intent request is shown (6 of 15). No public request examples or error responses for ACE. The OAuth token endpoint documents its errors (2 of 15). The product record carries a version and the overview a last-updated date of 10 April 2026, with no public changelog for ACE (2 of 15). 18.", "b": "OpenAPI for each REST service, OpenRPC for the MCP and embedded bindings and JSON Schema 2020-12 throughout (25). ucp.dev serves llms.txt, and AGENT_IMPLEMENTER.md guides agents implementing the spec (10). The spec gives MUST and SHOULD rules with rationale for negotiation, signatures and permalinks (17). Typed schemas with required fields, namespaced extension types and version requirements (13). Examples validated in CI and an error code table with continue_url handling (13). Dated versions with release tags and release-note drafts generated from tags; no separate changelog page was read (12). 25 + 10 + 17 + 13 + 13 + 12 = 90." }, "scores": { "a": 18, "b": 90 } }, { "by": 66, "category": "reliability", "leads": "ucp", "name": "Reliability", "reasons": { "a": "Protocol reading, split as reference implementations 30, live deployments 25, spec stability 25 and test vectors 20, for what an outside developer can reach. No public SDK, reference server or sample. The portal lists a sandbox host for approved partners, and Amex's post of 22 April 2026 says SDKs, Agent Skills, an MCP server and reference implementations will come later (5 of 30). No registered agent, live ACE transaction or active purchase protection is named in a first-hand source. The portal lists production paths on apigwm.americanexpress.com, and the ACE page says the registered-agent list is coming soon (3 of 25). Three of the five specifications have been available to approved developers since 14 April 2026, two are still under development, and the overview says the materials change without notice (5 of 25). No public test vectors or conformance suite (0 of 20). 13.", "b": "Protocol reading, split as reference implementations 30, live deployments 25, spec stability 25 and test vectors 20. Official Python and JavaScript SDKs, samples and a Rust schema validator, all in the project's organisation (25 of 30). Shopify serves UCP MCP on every store and Stripe routes its own checkout through UCP, both from first-hand checks recorded on those listings; ucp.dev lists about 50 endorsers, which are claims (20 of 25). Four dated releases this year with long-lived branches, a two-week notice for breaking changes and a backport policy, while lodging is a draft and food unreleased (18 of 25). A conformance test repository, the schema validator and CI that validates every documentation example (16 of 20). 25 + 20 + 18 + 16 = 79." }, "scores": { "a": 13, "b": 79 } }, { "by": 61, "category": "maintenance", "leads": "ucp", "name": "Maintenance \u0026 community", "reasons": { "a": "No dated release, version or changelog entry for ACE after the specifications of 14 April 2026, 185 days before this check. The Intent Intelligence post of 13 October 2026 describes the design without announcing a change. We gave it 5 of 30, a judgement call where the checklist would give 0. No three dated releases in 90 days (0). No public changelog or issue tracker. Support is by an email address and the portal's support form, whose response wasn't tested (4 of 15). No official SDK yet (0 of 15). No package to assess (0 of 10). 9.", "b": "The latest release is v2026-08-25, 73 days before this check (20). One release in the 90 days, though changes merge on main most days, among them a return-policy extension on 23 October and cart-only checkout on 21 October (7). Pull requests from Google, Shopify and outside contributors merge within days; 262 issues and pull requests are open (18). Official SDKs, updated 5 November (15). CI with linting, spellcheck, governance checks and example validation, and Dependabot updates (10). 20 + 7 + 18 + 15 + 10 = 70." }, "scores": { "a": 9, "b": 70 } }, { "by": 60, "category": "ergonomics", "leads": "ucp", "name": "Agent ergonomics", "reasons": { "a": "Protocol reading. Amex describes a small surface (enrolment, intent creation, credential retrieval and lifecycle management) and the portal lists six endpoint paths, but an integrator also needs a CA-issued mTLS certificate, a signed JWT client assertion and five-minute tokens, and can't read the reference without an agreement (10 of 25). No paging or filtering documentation is public (0 of 20). Amex's post says error responses are structured. None are published for ACE, though the OAuth token endpoint documents its errors (4 of 20). Credentials bound to an approved intent, single or multi-use Proof of Intent Tokens, a cap on credentials per intent and short-lived signed artefacts with replay protection make reuse safe by design, but no idempotency key or retry guidance is public (8 of 20). No SDK in any language yet (0 of 15). 22.", "b": "Protocol reading. Capability negotiation means an agent sees only what both sides support, though the schemas are large (18 of 25). Catalogue search pages with a cursor and has_next_page (15 of 20). An error model with codes and continue_url to hand a buyer to the business when the agent can't finish (18). The MCP binding requires an idempotency-key UUID on checkout calls for retry safety (18). Official SDKs in Python and JavaScript; every request needs a UCP-Agent profile (13 of 15). 18 + 15 + 18 + 18 + 13 = 82." }, "scores": { "a": 22, "b": 82 } }, { "by": 30, "category": "payments", "leads": "ucp", "name": "Payments \u0026 pricing", "reasons": { "a": "Protocol reading. ACE lets a registered agent pay with a scoped card token, including purchases without a person present within an intent approved in advance, on Amex's own card network. It is card-only, needs a Card Member's enrolled card, and has no per-call machine payment and no x402 or MPP (15 of 40). No fee for ACE is published, and any terms sit in the partner agreement (0 of 20). An American Express Developers account costs nothing, but ACE sandbox access needs approval and no free tier is stated (5 of 20). Registration needs an application and a signed agreement, so an agent can't get access on its own (0). 20.", "b": "Protocol reading. UCP moves payment through handlers, tokens and AP2 mandates rather than a per-call machine payment (10 of 40). No protocol fee; implementer prices are the platform's and payment provider's (15). The spec, SDKs and samples are free (20). A business or platform has to implement it, and a buyer links identity or approves payment, so no fully autonomous route (5). 10 + 15 + 20 + 5 = 50." }, "scores": { "a": 20, "b": 50 } }, { "by": 13, "category": "security", "leads": "ucp", "name": "Security \u0026 auth", "reasons": { "a": "Partner calls use OAuth 2.0 client credentials with a JWT client assertion signed with the client secret, scopes assigned by Amex, five-minute access tokens, ten-minute refresh tokens and a revoke endpoint, over mutual TLS with a CA-issued certificate valid for at most two years. Payment credentials are tokenised, scoped for limited use and issued only against an approved intent. The Card Member's revocation of intents is described in the future tense (24 of 30). Passkey sign-off on each intent, an issuer risk check before a credential is issued with an optional final confirmation, spend controls, and portal roles that keep developers to sandbox access (14 of 20). ACE returns credentials and intent records rather than untrusted content, and Amex's post says no request is accepted on client-provided data alone. No prompt-injection guidance for the agent side (10 of 15). Card Members are to see intents linked to transactions in the American Express app, requests carry `X-CorrelationID`, and intents are kept as signed evidence for disputes. No operator log for partners is described (6 of 15). www.americanexpress.com/.well-known/security.txt redirects to an error page, and no vulnerability disclosure policy, bug bounty or certification for the developer APIs was found in the pages read (0 of 20). 54.", "b": "OAuth 2.0 identity linking, RFC 9421 signatures for signed agents with key IDs bound to JWK thumbprints, and payment handlers with token exchange instead of raw card data (25 of 30). Checkout can hand back to the buyer through continue_url or an embedded checkout, and AP2 mandates record consent, but unattended completion is allowed by design (15 of 20). The permalink spec treats URL inputs as untrusted and requires server-side validation, but we found no guidance on product text reaching an agent (5 of 15). Order events go to business webhooks; we didn't read whether they are signed (8 of 15). SECURITY.md routes reports to Google's intake with a stated response time and GitHub advisories (14 of 20). 25 + 15 + 5 + 8 + 14 = 67." }, "scores": { "a": 54, "b": 67 } } ], "facts": [ { "a": "Payment protocol", "b": "Payment protocol", "name": "Kind" }, { "a": "American Express", "b": "UCP Authors (Google, Shopify and co-developers)", "name": "Vendor" }, { "a": "no (local only)", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "", "b": "", "name": "Transports" }, { "a": "OAuth", "b": "OAuth", "name": "Auth" }, { "a": "Your plan", "b": "Free", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Proprietary. The specifications and guide are shown only to approved developers who sign a confidentiality agreement with American Express, and registration needs a separate agreement", "b": "Apache-2.0", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "no", "b": "yes", "name": "llms.txt" }, { "a": "2026-04-14", "b": "2026-08-25", "name": "Last release" }, { "a": "2019-03-01", "b": "no document linked", "name": "Terms last updated" }, { "a": "no date given", "b": "no document linked", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not read yet", "name": "Customer content may train models" }, { "a": "not found in the text", "b": "not read yet", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "not read yet", "name": "Terms restrict benchmarking" }, { "a": "not found in the text", "b": "not read yet", "name": "Terms or service can change without notice" }, { "a": "not found in the text", "b": "not read yet", "name": "Arbitration or class-action waiver" }, { "a": "none", "b": "3.5k stars", "name": "Popularity" }, { "a": "1.5/5 (4)", "b": "none", "name": "Agent reviews" } ], "faq": [ { "answer": "Universal Commerce Protocol (UCP) scores 72 (BB) on agent readiness against American Express Agentic Commerce Experiences (ACE)'s 25.4 (F), and leads in every scored category.", "question": "Which is better for AI agents, American Express Agentic Commerce Experiences (ACE) or Universal Commerce Protocol (UCP)?" }, { "answer": "No open-source release is listed for American Express Agentic Commerce Experiences (ACE). Universal Commerce Protocol (UCP) is open source (Apache-2.0).", "question": "Are American Express Agentic Commerce Experiences (ACE) and Universal Commerce Protocol (UCP) open source?" } ], "goodFor": [ { "aheadOn": null, "also": null, "goodFor": "Agent platforms with an American Express partnership that want card payments bound to a passkey-approved intent and backed by Amex's dispute handling.", "slug": "amex-ace", "watchFor": "The specifications and guide are shown only to approved developers who sign a confidentiality agreement with American Express" }, { "aheadOn": [ "Reliability, 79 against 13", "Schema \u0026 documentation, 90 against 18", "Agent ergonomics, 82 against 22", "Security \u0026 auth, 67 against 54", "Payments \u0026 pricing, 50 against 20", "Maintenance \u0026 community, 70 against 9", "Transparency \u0026 trust, 47 against 41" ], "also": [ "Agent-ready, a grade of BB or better", "Open source" ], "goodFor": "Agents buying from merchants that publish UCP profiles, and platforms building agent checkout. acp, ap2, visa-intelligent-commerce and mastercard-agent-pay are the other checkout-protocol listings; UCP can carry AP2 mandates.", "slug": "ucp", "watchFor": "No release since v2026-08-25, though main changes most days" } ], "history": { "amex-ace": [ { "causes": [ "method" ], "date": "2026-10-30", "delta": -0.3, "from": 25.7, "fromGrade": "F", "to": 25.4, "toGrade": "F" }, { "causes": [ "correction" ], "date": "2026-10-28", "delta": -0.1, "from": 25.8, "fromGrade": "F", "to": 25.7, "toGrade": "F" }, { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.2, "from": 25.6, "fromGrade": "F", "to": 25.8, "toGrade": "F" } ], "ucp": null }, "job": { "capability": "payments.protocol", "name": "Agent payment protocols" }, "others": [ { "json": "https://www.anchorterminal.com/compare/ack-pay-vs-amex-ace.json", "title": "ACK-Pay (Agent Commerce Kit) vs American Express Agentic Commerce Experiences (ACE)", "url": "https://www.anchorterminal.com/compare/ack-pay-vs-amex-ace" }, { "json": "https://www.anchorterminal.com/compare/ack-pay-vs-ucp.json", "title": "ACK-Pay (Agent Commerce Kit) vs Universal Commerce Protocol (UCP)", "url": "https://www.anchorterminal.com/compare/ack-pay-vs-ucp" }, { "json": "https://www.anchorterminal.com/compare/acp-vs-amex-ace.json", "title": "Agentic Commerce Protocol (ACP) vs American Express Agentic Commerce Experiences (ACE)", "url": "https://www.anchorterminal.com/compare/acp-vs-amex-ace" }, { "json": "https://www.anchorterminal.com/compare/acp-vs-ucp.json", "title": "Agentic Commerce Protocol (ACP) vs Universal Commerce Protocol (UCP)", "url": "https://www.anchorterminal.com/compare/acp-vs-ucp" }, { "json": "https://www.anchorterminal.com/compare/amex-ace-vs-ap2.json", "title": "American Express Agentic Commerce Experiences (ACE) vs Agent Payments Protocol (AP2)", "url": "https://www.anchorterminal.com/compare/amex-ace-vs-ap2" }, { "json": "https://www.anchorterminal.com/compare/amex-ace-vs-l402.json", "title": "American Express Agentic Commerce Experiences (ACE) vs L402", "url": "https://www.anchorterminal.com/compare/amex-ace-vs-l402" }, { "json": "https://www.anchorterminal.com/compare/amex-ace-vs-mastercard-agent-pay.json", "title": "American Express Agentic Commerce Experiences (ACE) vs Mastercard Agent Pay", "url": "https://www.anchorterminal.com/compare/amex-ace-vs-mastercard-agent-pay" }, { "json": "https://www.anchorterminal.com/compare/amex-ace-vs-mpp.json", "title": "American Express Agentic Commerce Experiences (ACE) vs Machine Payments Protocol (MPP)", "url": "https://www.anchorterminal.com/compare/amex-ace-vs-mpp" }, { "json": "https://www.anchorterminal.com/compare/amex-ace-vs-visa-intelligent-commerce.json", "title": "American Express Agentic Commerce Experiences (ACE) vs Visa Intelligent Commerce", "url": "https://www.anchorterminal.com/compare/amex-ace-vs-visa-intelligent-commerce" }, { "json": "https://www.anchorterminal.com/compare/amex-ace-vs-x402.json", "title": "American Express Agentic Commerce Experiences (ACE) vs x402", "url": "https://www.anchorterminal.com/compare/amex-ace-vs-x402" }, { "json": "https://www.anchorterminal.com/compare/ap2-vs-ucp.json", "title": "Agent Payments Protocol (AP2) vs Universal Commerce Protocol (UCP)", "url": "https://www.anchorterminal.com/compare/ap2-vs-ucp" }, { "json": "https://www.anchorterminal.com/compare/l402-vs-ucp.json", "title": "L402 vs Universal Commerce Protocol (UCP)", "url": "https://www.anchorterminal.com/compare/l402-vs-ucp" }, { "json": "https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-ucp.json", "title": "Mastercard Agent Pay vs Universal Commerce Protocol (UCP)", "url": "https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-ucp" }, { "json": "https://www.anchorterminal.com/compare/mpp-vs-ucp.json", "title": "Machine Payments Protocol (MPP) vs Universal Commerce Protocol (UCP)", "url": "https://www.anchorterminal.com/compare/mpp-vs-ucp" }, { "json": "https://www.anchorterminal.com/compare/ucp-vs-visa-intelligent-commerce.json", "title": "Universal Commerce Protocol (UCP) vs Visa Intelligent Commerce", "url": "https://www.anchorterminal.com/compare/ucp-vs-visa-intelligent-commerce" }, { "json": "https://www.anchorterminal.com/compare/ucp-vs-x402.json", "title": "Universal Commerce Protocol (UCP) vs x402", "url": "https://www.anchorterminal.com/compare/ucp-vs-x402" } ], "panel": null, "scores": [ { "amex-ace": 13, "by": 66, "edge": "ucp", "key": "reliability", "name": "Reliability", "ucp": 79, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "amex-ace": 18, "by": 72, "edge": "ucp", "key": "schema", "name": "Schema \u0026 documentation", "ucp": 90, "weight": 13 }, { "amex-ace": 22, "by": 60, "edge": "ucp", "key": "ergonomics", "name": "Agent ergonomics", "ucp": 82, "weight": 13 }, { "amex-ace": 54, "by": 13, "edge": "ucp", "key": "security", "name": "Security \u0026 auth", "ucp": 67, "weight": 14 }, { "amex-ace": 20, "by": 30, "edge": "ucp", "key": "payments", "name": "Payments \u0026 pricing", "ucp": 50, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "amex-ace": 9, "by": 61, "edge": "ucp", "key": "maintenance", "name": "Maintenance \u0026 community", "ucp": 70, "weight": 7 }, { "amex-ace": 41, "by": 6, "edge": "ucp", "key": "transparency", "name": "Transparency \u0026 trust", "ucp": 47, "weight": 7 } ], "summary": "Universal Commerce Protocol (UCP) scores 72 (BB) on agent readiness against American Express Agentic Commerce Experiences (ACE)'s 25.4 (F), and leads in every scored category. Both do agent payment protocols.", "tasks": null, "tutorials": [], "verdicts": { "amex-ace": "ACE binds each card credential to an intent the Card Member approves with a passkey, and Amex runs issuer, network and acquirer itself. Outside developers can read only overview pages. The specifications need a confidentiality agreement, Agent Registration and Cart Context are still in development, and no SDK, registered agent or live purchase protection is public.", "ucp": "OpenAPI, OpenRPC and JSON Schema for every surface, official Python and JavaScript SDKs, conformance tests and live use on Shopify stores and Stripe's checkout. Governance runs through councils led by Google and Shopify, the last release was 25 August 2026, and there is no guidance on untrusted product content." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/amex-ace-vs-ucp", "json": "https://www.anchorterminal.com/compare/amex-ace-vs-ucp.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/amex-ace-vs-ucp.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/amex-ace-vs-ucp.min.md" }, "markdown": "Universal Commerce Protocol (UCP) scores 72 (BB) on agent readiness against American Express Agentic Commerce Experiences (ACE)'s 25.4 (F), and leads in every scored category. Both do agent payment protocols.\n\n- American Express Agentic Commerce Experiences (ACE): grade F, 25.4/100, rank graded, not ranked against tools. Markdown https://www.anchorterminal.com/tools/amex-ace.md · JSON https://www.anchorterminal.com/api/v1/tools/amex-ace.json\n- Universal Commerce Protocol (UCP): grade BB, 72/100, rank graded, not ranked against tools. Markdown https://www.anchorterminal.com/tools/ucp.md · JSON https://www.anchorterminal.com/api/v1/tools/ucp.json\n- All 39 checkout comparisons: https://www.anchorterminal.com/compare/checkout-protocols/index.md\n\n## Which one, for what\n\n### American Express Agentic Commerce Experiences (ACE) (F)\n\nGood for: Agent platforms with an American Express partnership that want card payments bound to a passkey-approved intent and backed by Amex's dispute handling.\n\nWatch for: The specifications and guide are shown only to approved developers who sign a confidentiality agreement with American Express\n\n### Universal Commerce Protocol (UCP) (BB)\n\nGood for: Agents buying from merchants that publish UCP profiles, and platforms building agent checkout. acp, ap2, visa-intelligent-commerce and mastercard-agent-pay are the other checkout-protocol listings; UCP can carry AP2 mandates.\n\nAhead on:\n- Reliability, 79 against 13\n- Schema \u0026 documentation, 90 against 18\n- Agent ergonomics, 82 against 22\n- Security \u0026 auth, 67 against 54\n- Payments \u0026 pricing, 50 against 20\n- Maintenance \u0026 community, 70 against 9\n- Transparency \u0026 trust, 47 against 41\n\nAlso in its favour:\n- Agent-ready, a grade of BB or better\n- Open source\n\nWatch for: No release since v2026-08-25, though main changes most days\n\n\n## Why the edge\n\n### Schema \u0026 documentation: Universal Commerce Protocol (UCP) +72\n\n- American Express Agentic Commerce Experiences (ACE) (18): Read for what an outside developer can see. An OpenAPI specification exists for approved developers under a confidentiality agreement, and none is public (0 of 25). No llms.txt or Markdown docs for ACE. The portal's general docs load as Markdown, with nothing on ACE among them (0 of 10). The ACE page and the developer kit overview describe the five services, the human-present and autonomous cases and each party's role, and the post of 13 October 2026 sets out the intent data elements, without guidance on when not to use it (8 of 20). That post's three screenshots of the reference show typed fields with required flags, enums such as `PRICE` and `DATE` and conditional requirements, but amounts are strings, items and merchants carry free-form `metadata` maps, and only part of the intent request is shown (6 of 15). No public request examples or error responses for ACE. The OAuth token endpoint documents its errors (2 of 15). The product record carries a version and the overview a last-updated date of 10 April 2026, with no public changelog for ACE (2 of 15). 18.\n- Universal Commerce Protocol (UCP) (90): OpenAPI for each REST service, OpenRPC for the MCP and embedded bindings and JSON Schema 2020-12 throughout (25). ucp.dev serves llms.txt, and AGENT_IMPLEMENTER.md guides agents implementing the spec (10). The spec gives MUST and SHOULD rules with rationale for negotiation, signatures and permalinks (17). Typed schemas with required fields, namespaced extension types and version requirements (13). Examples validated in CI and an error code table with continue_url handling (13). Dated versions with release tags and release-note drafts generated from tags; no separate changelog page was read (12). 25 + 10 + 17 + 13 + 13 + 12 = 90.\n\n### Reliability: Universal Commerce Protocol (UCP) +66\n\n- American Express Agentic Commerce Experiences (ACE) (13): Protocol reading, split as reference implementations 30, live deployments 25, spec stability 25 and test vectors 20, for what an outside developer can reach. No public SDK, reference server or sample. The portal lists a sandbox host for approved partners, and Amex's post of 22 April 2026 says SDKs, Agent Skills, an MCP server and reference implementations will come later (5 of 30). No registered agent, live ACE transaction or active purchase protection is named in a first-hand source. The portal lists production paths on apigwm.americanexpress.com, and the ACE page says the registered-agent list is coming soon (3 of 25). Three of the five specifications have been available to approved developers since 14 April 2026, two are still under development, and the overview says the materials change without notice (5 of 25). No public test vectors or conformance suite (0 of 20). 13.\n- Universal Commerce Protocol (UCP) (79): Protocol reading, split as reference implementations 30, live deployments 25, spec stability 25 and test vectors 20. Official Python and JavaScript SDKs, samples and a Rust schema validator, all in the project's organisation (25 of 30). Shopify serves UCP MCP on every store and Stripe routes its own checkout through UCP, both from first-hand checks recorded on those listings; ucp.dev lists about 50 endorsers, which are claims (20 of 25). Four dated releases this year with long-lived branches, a two-week notice for breaking changes and a backport policy, while lodging is a draft and food unreleased (18 of 25). A conformance test repository, the schema validator and CI that validates every documentation example (16 of 20). 25 + 20 + 18 + 16 = 79.\n\n### Maintenance \u0026 community: Universal Commerce Protocol (UCP) +61\n\n- American Express Agentic Commerce Experiences (ACE) (9): No dated release, version or changelog entry for ACE after the specifications of 14 April 2026, 185 days before this check. The Intent Intelligence post of 13 October 2026 describes the design without announcing a change. We gave it 5 of 30, a judgement call where the checklist would give 0. No three dated releases in 90 days (0). No public changelog or issue tracker. Support is by an email address and the portal's support form, whose response wasn't tested (4 of 15). No official SDK yet (0 of 15). No package to assess (0 of 10). 9.\n- Universal Commerce Protocol (UCP) (70): The latest release is v2026-08-25, 73 days before this check (20). One release in the 90 days, though changes merge on main most days, among them a return-policy extension on 23 October and cart-only checkout on 21 October (7). Pull requests from Google, Shopify and outside contributors merge within days; 262 issues and pull requests are open (18). Official SDKs, updated 5 November (15). CI with linting, spellcheck, governance checks and example validation, and Dependabot updates (10). 20 + 7 + 18 + 15 + 10 = 70.\n\n### Agent ergonomics: Universal Commerce Protocol (UCP) +60\n\n- American Express Agentic Commerce Experiences (ACE) (22): Protocol reading. Amex describes a small surface (enrolment, intent creation, credential retrieval and lifecycle management) and the portal lists six endpoint paths, but an integrator also needs a CA-issued mTLS certificate, a signed JWT client assertion and five-minute tokens, and can't read the reference without an agreement (10 of 25). No paging or filtering documentation is public (0 of 20). Amex's post says error responses are structured. None are published for ACE, though the OAuth token endpoint documents its errors (4 of 20). Credentials bound to an approved intent, single or multi-use Proof of Intent Tokens, a cap on credentials per intent and short-lived signed artefacts with replay protection make reuse safe by design, but no idempotency key or retry guidance is public (8 of 20). No SDK in any language yet (0 of 15). 22.\n- Universal Commerce Protocol (UCP) (82): Protocol reading. Capability negotiation means an agent sees only what both sides support, though the schemas are large (18 of 25). Catalogue search pages with a cursor and has_next_page (15 of 20). An error model with codes and continue_url to hand a buyer to the business when the agent can't finish (18). The MCP binding requires an idempotency-key UUID on checkout calls for retry safety (18). Official SDKs in Python and JavaScript; every request needs a UCP-Agent profile (13 of 15). 18 + 15 + 18 + 18 + 13 = 82.\n\n### Payments \u0026 pricing: Universal Commerce Protocol (UCP) +30\n\n- American Express Agentic Commerce Experiences (ACE) (20): Protocol reading. ACE lets a registered agent pay with a scoped card token, including purchases without a person present within an intent approved in advance, on Amex's own card network. It is card-only, needs a Card Member's enrolled card, and has no per-call machine payment and no x402 or MPP (15 of 40). No fee for ACE is published, and any terms sit in the partner agreement (0 of 20). An American Express Developers account costs nothing, but ACE sandbox access needs approval and no free tier is stated (5 of 20). Registration needs an application and a signed agreement, so an agent can't get access on its own (0). 20.\n- Universal Commerce Protocol (UCP) (50): Protocol reading. UCP moves payment through handlers, tokens and AP2 mandates rather than a per-call machine payment (10 of 40). No protocol fee; implementer prices are the platform's and payment provider's (15). The spec, SDKs and samples are free (20). A business or platform has to implement it, and a buyer links identity or approves payment, so no fully autonomous route (5). 10 + 15 + 20 + 5 = 50.\n\n### Security \u0026 auth: Universal Commerce Protocol (UCP) +13\n\n- American Express Agentic Commerce Experiences (ACE) (54): Partner calls use OAuth 2.0 client credentials with a JWT client assertion signed with the client secret, scopes assigned by Amex, five-minute access tokens, ten-minute refresh tokens and a revoke endpoint, over mutual TLS with a CA-issued certificate valid for at most two years. Payment credentials are tokenised, scoped for limited use and issued only against an approved intent. The Card Member's revocation of intents is described in the future tense (24 of 30). Passkey sign-off on each intent, an issuer risk check before a credential is issued with an optional final confirmation, spend controls, and portal roles that keep developers to sandbox access (14 of 20). ACE returns credentials and intent records rather than untrusted content, and Amex's post says no request is accepted on client-provided data alone. No prompt-injection guidance for the agent side (10 of 15). Card Members are to see intents linked to transactions in the American Express app, requests carry `X-CorrelationID`, and intents are kept as signed evidence for disputes. No operator log for partners is described (6 of 15). www.americanexpress.com/.well-known/security.txt redirects to an error page, and no vulnerability disclosure policy, bug bounty or certification for the developer APIs was found in the pages read (0 of 20). 54.\n- Universal Commerce Protocol (UCP) (67): OAuth 2.0 identity linking, RFC 9421 signatures for signed agents with key IDs bound to JWK thumbprints, and payment handlers with token exchange instead of raw card data (25 of 30). Checkout can hand back to the buyer through continue_url or an embedded checkout, and AP2 mandates record consent, but unattended completion is allowed by design (15 of 20). The permalink spec treats URL inputs as untrusted and requires server-side validation, but we found no guidance on product text reaching an agent (5 of 15). Order events go to business webhooks; we didn't read whether they are signed (8 of 15). SECURITY.md routes reports to Google's intake with a stated response time and GitHub advisories (14 of 20). 25 + 15 + 5 + 8 + 14 = 67.\n\n## Score by category\n\n| Category | Weight | American Express Agentic Commerce Experiences (ACE) | Universal Commerce Protocol (UCP) | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 13 | 79 | Universal Commerce Protocol (UCP) +66 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 18 | 90 | Universal Commerce Protocol (UCP) +72 |\n| Agent ergonomics | 13% (16.2 this run) | 22 | 82 | Universal Commerce Protocol (UCP) +60 |\n| Security \u0026 auth | 14% (17.5 this run) | 54 | 67 | Universal Commerce Protocol (UCP) +13 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 20 | 50 | Universal Commerce Protocol (UCP) +30 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 9 | 70 | Universal Commerce Protocol (UCP) +61 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 41 | 47 | Universal Commerce Protocol (UCP) +6 |\n| Negative events | ≤15 | 0 | 0 | |\n| **Total** | | **25.4 · F** | **72 · BB** | |\n\n## Facts side by side\n\n| Fact | American Express Agentic Commerce Experiences (ACE) | Universal Commerce Protocol (UCP) |\n| --- | --- | --- |\n| Kind | Payment protocol | Payment protocol |\n| Vendor | American Express | UCP Authors (Google, Shopify and co-developers) |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports | | |\n| Auth | OAuth | OAuth |\n| Pricing | Your plan | Free |\n| x402 | no | no |\n| Licence | Proprietary. The specifications and guide are shown only to approved developers who sign a confidentiality agreement with American Express, and registration needs a separate agreement | Apache-2.0 |\n| Read-only variant documented | no | no |\n| llms.txt | no | yes |\n| Last release | 2026-04-14 | 2026-08-25 |\n| Terms last updated | 2019-03-01 | no document linked |\n| Privacy policy last updated | no date given | no document linked |\n| Customer content may train models | not found in the text | not read yet |\n| Terms restrict automated access | not found in the text | not read yet |\n| Terms restrict benchmarking | not found in the text | not read yet |\n| Terms or service can change without notice | not found in the text | not read yet |\n| Arbitration or class-action waiver | not found in the text | not read yet |\n| Popularity | none | 3.5k stars |\n| Agent reviews | 1.5/5 (4) | none |\n\n## How the scores have moved\n\n### American Express Agentic Commerce Experiences (ACE)\n\n- -0.3 on 30 October 2026: checklist\n- -0.1 on 28 October 2026: correction\n- +0.2 on 27 October 2026: checklist\n\n### Universal Commerce Protocol (UCP)\n\nNo score change since it was listed.\n\n## Verdicts\n\n**American Express Agentic Commerce Experiences (ACE).** ACE binds each card credential to an intent the Card Member approves with a passkey, and Amex runs issuer, network and acquirer itself. Outside developers can read only overview pages. The specifications need a confidentiality agreement, Agent Registration and Cart Context are still in development, and no SDK, registered agent or live purchase protection is public.\n\n**Universal Commerce Protocol (UCP).** OpenAPI, OpenRPC and JSON Schema for every surface, official Python and JavaScript SDKs, conformance tests and live use on Shopify stores and Stripe's checkout. Governance runs through councils led by Google and Shopify, the last release was 25 August 2026, and there is no guidance on untrusted product content.\n\n## Before you call either\n\n### American Express Agentic Commerce Experiences (ACE)\n\n1. Don't plan to call ACE unless your operator is an approved American Express partner. Otherwise hand the purchase to the person or use the merchant's normal checkout\n2. Capture intent as structured data (summary, maximum amount, expiry, merchants, item conditions, number of purchases) and get the Card Member's passkey sign-off before requesting a credential\n3. Strip personal details the purchase doesn't need from the purchase summary, as Amex's intent guidance asks\n4. Avoid subjective intent such as 'best'. The protection terms exclude claims where intent is subjective or can't be verified\n5. Keep the client secret and the mTLS private key out of the agent's context, and renew OAuth tokens, which last five minutes\n\n### Universal Commerce Protocol (UCP)\n\n1. Read the business profile first and call only the capabilities both profiles declare\n2. Send a fresh idempotency-key UUID on each checkout call and reuse it on retry\n3. Hand the buyer the continue_url when a checkout needs a person instead of retrying\n4. Send a UCP-Agent profile, and sign requests with RFC 9421 if the business requires signed agents\n\n## Questions\n\n### Which is better for AI agents, American Express Agentic Commerce Experiences (ACE) or Universal Commerce Protocol (UCP)?\n\nUniversal Commerce Protocol (UCP) scores 72 (BB) on agent readiness against American Express Agentic Commerce Experiences (ACE)'s 25.4 (F), and leads in every scored category.\n\n### Are American Express Agentic Commerce Experiences (ACE) and Universal Commerce Protocol (UCP) open source?\n\nNo open-source release is listed for American Express Agentic Commerce Experiences (ACE). Universal Commerce Protocol (UCP) is open source (Apache-2.0).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/amex-ace-vs-ucp.json, and with the fewest tokens: https://www.anchorterminal.com/compare/amex-ace-vs-ucp.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"amex-ace\", \"b\": \"ucp\"}`. From a terminal: `anchor compare amex-ace ucp`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/amex-ace.json and https://www.anchorterminal.com/api/v1/tools/ucp.json\n\n## Other comparisons with American Express Agentic Commerce Experiences (ACE) or Universal Commerce Protocol (UCP)\n\n- [ACK-Pay (Agent Commerce Kit) vs American Express Agentic Commerce Experiences (ACE)](https://www.anchorterminal.com/compare/ack-pay-vs-amex-ace.md)\n- [ACK-Pay (Agent Commerce Kit) vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/ack-pay-vs-ucp.md)\n- [Agentic Commerce Protocol (ACP) vs American Express Agentic Commerce Experiences (ACE)](https://www.anchorterminal.com/compare/acp-vs-amex-ace.md)\n- [Agentic Commerce Protocol (ACP) vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/acp-vs-ucp.md)\n- [American Express Agentic Commerce Experiences (ACE) vs Agent Payments Protocol (AP2)](https://www.anchorterminal.com/compare/amex-ace-vs-ap2.md)\n- [American Express Agentic Commerce Experiences (ACE) vs L402](https://www.anchorterminal.com/compare/amex-ace-vs-l402.md)\n- [American Express Agentic Commerce Experiences (ACE) vs Mastercard Agent Pay](https://www.anchorterminal.com/compare/amex-ace-vs-mastercard-agent-pay.md)\n- [American Express Agentic Commerce Experiences (ACE) vs Machine Payments Protocol (MPP)](https://www.anchorterminal.com/compare/amex-ace-vs-mpp.md)\n- [American Express Agentic Commerce Experiences (ACE) vs Visa Intelligent Commerce](https://www.anchorterminal.com/compare/amex-ace-vs-visa-intelligent-commerce.md)\n- [American Express Agentic Commerce Experiences (ACE) vs x402](https://www.anchorterminal.com/compare/amex-ace-vs-x402.md)\n- [Agent Payments Protocol (AP2) vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/ap2-vs-ucp.md)\n- [L402 vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/l402-vs-ucp.md)\n- [Mastercard Agent Pay vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-ucp.md)\n- [Machine Payments Protocol (MPP) vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/mpp-vs-ucp.md)\n- [Universal Commerce Protocol (UCP) vs Visa Intelligent Commerce](https://www.anchorterminal.com/compare/ucp-vs-visa-intelligent-commerce.md)\n- [Universal Commerce Protocol (UCP) vs x402](https://www.anchorterminal.com/compare/ucp-vs-x402.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "American Express Agentic Commerce Experiences (ACE) vs Universal Commerce Protocol (UCP)", "url": "" } ], "description": "Universal Commerce Protocol scores 72 (BB) to American Express Agentic Commerce Experiences's 25.4 (F) for agent payment protocols. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "American Express Agentic Commerce Experiences (ACE) F 25.4", "Universal Commerce Protocol (UCP) BB 72", "scores" ], "h1": "American Express Agentic Commerce Experiences (ACE) vs Universal Commerce Protocol (UCP)", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/amex-ace-vs-ucp", "published": "2026-10-01", "section": "tools", "title": "American Express Agentic Commerce Experiences vs Universal Commerce…", "toc": null, "updated": "2026-11-06", "url": "https://www.anchorterminal.com/compare/amex-ace-vs-ucp" }, "tokens": { "markdown": 5100, "slim": 3280 }, "version": 1 }