{ "data": { "a": { "slug": "ap2", "name": "Agent Payments Protocol (AP2)", "vendor": "Google (standardisation moved to the FIDO Alliance)", "vendorUrl": "https://ap2-protocol.org", "kind": "protocol", "category": "checkout-protocols", "summary": "Google's protocol for authorising agent payments, now governed by the FIDO Alliance.", "url": "https://www.anchorterminal.com/tools/ap2", "markdownUrl": "https://www.anchorterminal.com/tools/ap2.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/ap2.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/ap2.json", "dns": "ap2.grade.anchorterminal.com", "repo": "https://github.com/google-agentic-commerce/AP2", "license": "Apache-2.0", "transports": [], "packages": [], "auth": "mixed", "authNotes": "Needs a credentials provider and a mandate signed by the user in advance. Not account-free.", "pricing": "free", "pricingNotes": "No fees defined. Card and network fees apply on the payment itself.", "priceSummary": "Free", "where": "spec", "x402": { "level": "no", "evidence": "A payment protocol, not a tool that accepts payment.", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 3200, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-09-26" }, "docsUrl": "https://ap2-protocol.org", "llmsTxt": "https://ap2-protocol.org/llms.txt", "capabilities": [ "payments.protocol", "payments.mandate" ], "tags": [ "protocol", "pre-1.0", "mandates", "fido" ], "lastRelease": "2026-04-28", "graded": true, "anchor": { "graded": true, "score": 54.6, "grade": "C", "agentReady": false, "rank": 0, "ranked": false, "notRankedWhy": "A protocol, graded on the same scale but not ranked against tools", "rankOf": 1486, "categoryRank": 3, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 51, "maintenance": 9, "payments": 60, "reliability": 31, "schema": 74, "security": 84, "transparency": 58 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-04" }, "negative": 0, "verdict": "User-signed SD-JWT mandates bound to the agent's key and to a merchant-signed checkout hash. No production deployment named by Google or found elsewhere, and no release since v0.2.0 on 28 April 2026.", "bestFor": "The design to copy when an agent spends a person's money and you need signed proof of what they approved, especially for purchases made while the person is away.", "strengths": [ "User-signed SD-JWT mandates bound to the agent's key and to a merchant-signed checkout hash", "Open mandates cap amount range, total budget, recurrence, merchants and items", "Threat model treats every LLM as a potential attacker and bounds the damage at verification", "Signed receipts to the agent, credential provider and network, usable as dispute evidence", "Standardisation now at FIDO, with Mastercard and Visa chairing the payments working group" ], "weaknesses": [ "No production deployment named by Google or found elsewhere", "No release since v0.2.0 on 28 April 2026 and no commit on main since 29 April", "The core specification moved to FIDO, which hasn't published one, and the repository now takes SDK and sample changes only", "Python SDK only, installed from git, and no conformance vectors", "No documented way to revoke an open mandate before it expires" ], "agentNotes": [ "Read /ap2/specification/ for v0.2; the old v0.1 page at /specification/ is gone", "Ask the user for open mandates with the shortest expiry that fits the task and a budget constraint", "Don't present a second open mandate until you hold a rejection receipt for the first", "Present only the disclosures the verifier needs", "Install the SDK from git; there is no PyPI package" ], "metrics": { "kind": "spec", "measured": false }, "reviewCount": 2, "avgRating": 2, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 54.6 } ], "editorialScores": { "ergonomics": 51, "maintenance": 9, "payments": 60, "reliability": 31, "schema": 74, "security": 84, "transparency": 55 }, "provenanceScore": 61, "checked": { "categories": { "ergonomics": "2026-11-04", "maintenance": "2026-11-04", "payments": "2026-11-04", "reliability": "2026-11-04", "schema": "2026-11-04", "security": "2026-11-04", "transparency": "2026-11-04" }, "last": "2026-11-04", "lastMoved": "2026-11-04", "oldest": "2026-11-04", "stale": false, "staleAfterDays": 90 } }, "letme": { "capability": "https://letme.dev/payments.protocol", "tool": "https://letme.dev/ap2" }, "area": "payments", "provenance": { "legalEntity": "Google LLC", "domain": "ap2-protocol.org", "domainRegistered": "2025-09-15", "domainNote": "The site and repository carry a Google copyright and SECURITY.md routes reports to Google. The FIDO Alliance took on standardisation in April 2026 but doesn't publish the spec yet.", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://github.com/google-agentic-commerce/AP2/blob/main/CHANGELOG.md", "securityTxt": "none", "checked": "2026-11-04", "score": 61 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/ap2.json", "live": { "slug": "ap2", "versions": [ { "registry": "github", "name": "google-agentic-commerce/AP2", "version": "v0.2.0", "released": "2026-04-28", "seenAt": "2026-11-06T23:06:33.948503976Z" } ], "githubStars": 3265, "securityTxt": { "url": "https://ap2-protocol.org/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:02:02.856633447Z" }, "llmsTxt": { "url": "https://ap2-protocol.org/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:31:34.049764141Z" }, "domain": { "domain": "ap2-protocol.org", "registered": "2025-09-15", "source": "https://rdap.publicinterestregistry.org/rdap/domain/ap2-protocol.org", "checkedAt": "2026-11-01T14:08:17.226760567Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/google-agentic-commerce/AP2/main/CHANGELOG.md", "kind": "changelog", "status": 304, "checkedAt": "2026-11-07T14:21:08.000386227Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "4e99eb9a25b1" } ], "github": { "repo": "google-agentic-commerce/ap2", "checkedAt": "2026-11-02T08:51:22.523043587Z", "stars": 3257, "archived": false, "issuesEnabled": true, "pushedAt": "2026-06-17T01:24:46Z", "openIssues": 91, "openPRs": 97, "issuesOpened90d": 34, "issuesClosed90d": 0, "prsMerged90d": 0, "ci": { "branch": "main", "runs": 50, "success": 50, "failure": 0, "other": 0, "latest": "success", "latestAt": "2026-04-29T16:52:24Z" }, "replies": { "sampled": 25, "unanswered": 25 } }, "updatedAt": "2026-11-07T16:02:02.856633447Z" } }, "answer": "Universal Commerce Protocol (UCP) scores 72 (BB) on agent readiness against Agent Payments Protocol (AP2)'s 54.6 (C), and leads in 4 of 7 scored categories. Agent Payments Protocol (AP2) leads on security \u0026 auth, payments \u0026 pricing and transparency \u0026 trust.", "b": { "slug": "ucp", "name": "Universal Commerce Protocol (UCP)", "vendor": "UCP Authors (Google, Shopify and co-developers)", "vendorUrl": "https://ucp.dev", "kind": "protocol", "category": "checkout-protocols", "summary": "The Universal Commerce Protocol (UCP) is an open specification, co-developed by Google, Shopify and other retailers and platforms, for agents to discover a business's capabilities and run catalogue, cart, checkout, identity linking and order flows over REST, MCP or A2A.", "url": "https://www.anchorterminal.com/tools/ucp", "markdownUrl": "https://www.anchorterminal.com/tools/ucp.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/ucp.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/ucp.json", "dns": "ucp.grade.anchorterminal.com", "repo": "https://github.com/Universal-Commerce-Protocol/ucp", "license": "Apache-2.0", "transports": [], "packages": [], "auth": "oauth", "authNotes": "A specification, not a service. Identity linking uses OAuth 2.0 for a platform to act for a user at a business. Agent requests carry a UCP-Agent profile, and signed agents send RFC 9421 HTTP message signatures with a Signature-Agent header and a JWK thumbprint key ID. Payment credentials move through payment handlers and token exchange between payment and credential providers, with AP2 mandates supported.", "pricing": "free", "pricingNotes": "The specification, schemas, SDKs and conformance tests are free under Apache-2.0. Costs come from the business's platform and payment provider, not the protocol.", "priceSummary": "Free · OSS", "where": "spec", "x402": { "level": "no", "evidence": "A commerce protocol, not a tool that accepts payment; it supports AP2 mandates and payment handlers (checked 2026-11-06).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 3479, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://ucp.dev/latest/specification/overview/", "llmsTxt": "https://ucp.dev/llms.txt", "openapi": "https://github.com/Universal-Commerce-Protocol/ucp/blob/main/source/services/shopping/rest.openapi.json", "capabilities": [ "payments.protocol", "payments.checkout", "payments.mandate" ], "tags": [ "protocol", "open-standard", "open-source", "mcp", "a2a", "ap2", "openapi", "openrpc", "llms-txt", "shopify", "google", "commerce" ], "lastRelease": "2026-08-25", "graded": true, "anchor": { "graded": true, "score": 72, "grade": "BB", "agentReady": true, "rank": 0, "ranked": false, "notRankedWhy": "A protocol, graded on the same scale but not ranked against tools", "rankOf": 1486, "categoryRank": 1, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 82, "maintenance": 70, "payments": 50, "reliability": 79, "schema": 90, "security": 67, "transparency": 47 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": 0, "verdict": "OpenAPI, OpenRPC and JSON Schema for every surface, official Python and JavaScript SDKs, conformance tests and live use on Shopify stores and Stripe's checkout. Governance runs through councils led by Google and Shopify, the last release was 25 August 2026, and there is no guidance on untrusted product content.", "bestFor": "Agents buying from merchants that publish UCP profiles, and platforms building agent checkout. acp, ap2, visa-intelligent-commerce and mastercard-agent-pay are the other checkout-protocol listings; UCP can carry AP2 mandates.", "strengths": [ "Machine-readable contracts for every transport, OpenAPI, OpenRPC and JSON Schema 2020-12", "Official Python and JavaScript SDKs, a schema validator and a conformance test suite", "Idempotency keys required on MCP checkout calls", "Live on every Shopify store and as Stripe's own-checkout route", "Breaking changes announced two weeks before they merge" ], "weaknesses": [ "No release since v2026-08-25, though main changes most days", "No guidance on product descriptions or business messages as untrusted content for agents", "Lodging is a draft and food ordering unreleased", "Governing and tech councils are led by Google and Shopify members" ], "agentNotes": [ "Read the business profile first and call only the capabilities both profiles declare", "Send a fresh idempotency-key UUID on each checkout call and reuse it on retry", "Hand the buyer the continue_url when a checkout needs a person instead of retrying", "Send a UCP-Agent profile, and sign requests with RFC 9421 if the business requires signed agents" ], "metrics": { "kind": "spec", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 72 } ], "editorialScores": { "ergonomics": 82, "maintenance": 70, "payments": 50, "reliability": 79, "schema": 90, "security": 67, "transparency": 62 }, "provenanceScore": 32, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "letme": { "capability": "https://letme.dev/payments.protocol", "tool": "https://letme.dev/ucp" }, "area": "payments", "provenance": { "legalEntity": "", "domain": "ucp.dev", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://github.com/Universal-Commerce-Protocol/ucp/releases", "securityTxt": "unknown", "checked": "2026-11-06", "notes": [ "Files carry \"Copyright 2026 UCP Authors\" under Apache-2.0. No legal entity runs the project; governance is by councils whose members are named with their companies.", "Security reports go to Google's g.co/vulnz with a five-working-day response, coordinated through GitHub Security Advisories (SECURITY.md in the .github repository).", "ucp.dev has no robots.txt and serves llms.txt. No terms or privacy policy found for the site.", "The registration date of ucp.dev wasn't found through RDAP." ], "score": 32 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/ucp.json", "live": { "slug": "ucp", "versions": [ { "registry": "github", "name": "Universal-Commerce-Protocol/ucp", "version": "v2026-08-25", "released": "2026-08-25", "seenAt": "2026-11-07T00:13:40.257304662Z" } ], "githubStars": 3480, "securityTxt": { "url": "https://ucp.dev/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:23.109475398Z" }, "llmsTxt": { "url": "https://ucp.dev/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:34:12.746672159Z" }, "updatedAt": "2026-11-07T16:00:23.109475398Z" } }, "edges": [ { "by": 61, "category": "maintenance", "leads": "ucp", "name": "Maintenance \u0026 community", "reasons": { "a": "Release v0.2.0 on 28 April 2026, 190 days before this check (0). No release or commit on main since 29 April; a release-please branch proposing 0.2.1 (29 April) is unmerged (0). Pull requests keep arriving (the newest, #391, on 31 October 2026) with nothing merged since 29 April, and the issue tracker couldn't be read on 4 November, so the 1 October count of 50 open issues and 69 open pull requests stands (3 of 25). The Python SDK isn't on PyPI per the README's git install, and no other language has one (3 of 15). `cryptography` is still pinned at 46.0.5 with Dependabot branches up to 48.0.1 unmerged, and CI is lint only (3 of 10).", "b": "The latest release is v2026-08-25, 73 days before this check (20). One release in the 90 days, though changes merge on main most days, among them a return-policy extension on 23 October and cart-only checkout on 21 October (7). Pull requests from Google, Shopify and outside contributors merge within days; 262 issues and pull requests are open (18). Official SDKs, updated 5 November (15). CI with linting, spellcheck, governance checks and example validation, and Dependabot updates (10). 20 + 7 + 18 + 15 + 10 = 70." }, "scores": { "a": 9, "b": 70 } }, { "by": 48, "category": "reliability", "leads": "ucp", "name": "Reliability", "reasons": { "a": "Protocol reading, split as reference implementations 30, live deployments 25, spec stability 25 and test vectors 20. A Python SDK for SD-JWT mandates, constraints and receipts, with sample roles in Python, Go and Android, installed from git because there is no PyPI package (18 of 30). Neither the v0.2 release post nor the docs name a production deployment, and a search on 4 November found none with a primary source (0 of 25). v0.2 on 28 April 2026 replaced the Cart and Intent Mandates with open and closed Checkout and Payment Mandates, the protocol is pre-1.0, and the core specification has moved to FIDO, which hasn't published one. The v0.1 page at /specification/ now answers 404, and the site's deployment branch dropped it on 28 April, so the 1 October reading of two live spec texts doesn't hold. Kept at 8 of 25, flagged. 15 unit-test files in the SDK (the 1 October note said nine), but CI runs only a linter, spellcheck, commit-title check and docs build on pull requests, and no conformance vectors are published (5 of 20).", "b": "Protocol reading, split as reference implementations 30, live deployments 25, spec stability 25 and test vectors 20. Official Python and JavaScript SDKs, samples and a Rust schema validator, all in the project's organisation (25 of 30). Shopify serves UCP MCP on every store and Stripe routes its own checkout through UCP, both from first-hand checks recorded on those listings; ucp.dev lists about 50 endorsers, which are claims (20 of 25). Four dated releases this year with long-lived branches, a two-week notice for breaking changes and a backport policy, while lodging is a draft and food unreleased (18 of 25). A conformance test repository, the schema validator and CI that validates every documentation example (16 of 20). 25 + 20 + 18 + 16 = 79." }, "scores": { "a": 31, "b": 79 } }, { "by": 31, "category": "ergonomics", "leads": "ucp", "name": "Agent ergonomics", "reasons": { "a": "Protocol reading. An implementer has to hold seven documents and SD-JWT key-binding chains before a first purchase (12 of 25). Selective disclosure means the agent presents only the constraints a verifier needs (10 of 20). Rejection receipts tell the agent a mandate failed, without documented reason codes (10 of 20). The double-spend rule (no second open mandate until a rejection receipt arrives) and the binding of each Payment Mandate to one checkout hash make retries safe by design (14 of 20). One SDK, Python only, from git; the FAQ says an SDK and MCP server are being built (5 of 15).", "b": "Protocol reading. Capability negotiation means an agent sees only what both sides support, though the schemas are large (18 of 25). Catalogue search pages with a cursor and has_next_page (15 of 20). An error model with codes and continue_url to hand a buyer to the business when the agent can't finish (18). The MCP binding requires an idempotency-key UUID on checkout calls for retry safety (18). Official SDKs in Python and JavaScript; every request needs a UCP-Agent profile (13 of 15). 18 + 15 + 18 + 18 + 13 = 82." }, "scores": { "a": 51, "b": 82 } }, { "by": 17, "category": "security", "leads": "ap2", "name": "Security \u0026 auth", "reasons": { "a": "User-signed SD-JWT mandates bound to the agent's key through `cnf`, a short `exp` recommended, and each closed mandate bound to a merchant-signed checkout by hash. We found no way to revoke an open mandate before it expires (24 of 30). Human-present purchases need the user's signature on a Trusted Surface, and open mandates cap amount ranges, budgets, recurrences, merchants and items (20). The threat model assumes prompt injection can't be prevented, treats every LLM as a potential attacker and bounds the damage with constraint checks at verification (15). Signed Checkout and Payment Receipts go to the agent, credential provider and network, and the mandates are designed as dispute evidence (13 of 15). SECURITY.md routes reports to Google's g.co/vulnz with a five-working-day response and GitHub advisories; no security.txt on ap2-protocol.org (12 of 20).", "b": "OAuth 2.0 identity linking, RFC 9421 signatures for signed agents with key IDs bound to JWK thumbprints, and payment handlers with token exchange instead of raw card data (25 of 30). Checkout can hand back to the buyer through continue_url or an embedded checkout, and AP2 mandates record consent, but unattended completion is allowed by design (15 of 20). The permalink spec treats URL inputs as untrusted and requires server-side validation, but we found no guidance on product text reaching an agent (5 of 15). Order events go to business webhooks; we didn't read whether they are signed (8 of 15). SECURITY.md routes reports to Google's intake with a stated response time and GitHub advisories (14 of 20). 25 + 15 + 5 + 8 + 14 = 67." }, "scores": { "a": 84, "b": 67 } }, { "by": 16, "category": "schema", "leads": "ucp", "name": "Schema \u0026 documentation", "reasons": { "a": "JSON Schemas for the six mandate and receipt types plus Pydantic models; AP2 has no HTTP API of its own, so there is no OpenAPI file to expect (20 of 25). Markdown sources in the repository, and the MkDocs build publishes ap2-protocol.org/llms.txt with ten links and an llms-full.txt (10). Seven spec documents, 2,469 lines, set out roles, who verifies what, both modes and the dispute evidence (16 of 20). Typed constraints such as `payment.amount_range`, `payment.budget` and recurrence with `max_occurrences` (12 of 15). Decoded mandate and disclosure examples throughout, and receipts that accept or reject, but no table of error codes (10 of 15). Mandate schemas are versioned by a `vct` suffix, but CHANGELOG.md has two one-line entries, and v0.1 was taken down on 28 April with no notice on the site. Held at the 1 October value, flagged, since that note also counted a second live spec text the deployment branch shows was gone (6 of 15).", "b": "OpenAPI for each REST service, OpenRPC for the MCP and embedded bindings and JSON Schema 2020-12 throughout (25). ucp.dev serves llms.txt, and AGENT_IMPLEMENTER.md guides agents implementing the spec (10). The spec gives MUST and SHOULD rules with rationale for negotiation, signatures and permalinks (17). Typed schemas with required fields, namespaced extension types and version requirements (13). Examples validated in CI and an error code table with continue_url handling (13). Dated versions with release tags and release-note drafts generated from tags; no separate changelog page was read (12). 25 + 10 + 17 + 13 + 13 + 12 = 90." }, "scores": { "a": 74, "b": 90 } }, { "by": 11, "category": "transparency", "leads": "ap2", "name": "Transparency \u0026 trust", "reasons": { "a": "Apache-2.0, all source public (30). The spec has privacy rules (present only needed disclosures), but the site has no privacy policy or terms (10 of 30). v0.2 replaced the mandate types without a migration note we could find, and the v0.1 page was removed on 28 April with no notice (5 of 20). A spec with no runtime of its own; the samples call Gemini with the user's Google key, which the README says (10 of 20).", "b": "Apache-2.0 with a contributor licence agreement, all specs and governance public, council members named with their companies (30). ucp.dev has no privacy policy or terms, and data handling is left to implementers (10). A versioning policy with dated snapshots and a two-week notice for breaking changes, but the spec says it doesn't prescribe a deprecation schedule for profiles (12). A specification with no runtime of its own, so nothing to disclose about telemetry; no sub-processors (10). 30 + 10 + 12 + 10 = 62." }, "scores": { "a": 58, "b": 47 } } ], "facts": [ { "a": "Payment protocol", "b": "Payment protocol", "name": "Kind" }, { "a": "Google (standardisation moved to the FIDO Alliance)", "b": "UCP Authors (Google, Shopify and co-developers)", "name": "Vendor" }, { "a": "no (local only)", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "", "b": "", "name": "Transports" }, { "a": "OAuth or key", "b": "OAuth", "name": "Auth" }, { "a": "Free", "b": "Free", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Apache-2.0", "b": "Apache-2.0", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "2026-04-28", "b": "2026-08-25", "name": "Last release" }, { "a": "no document linked", "b": "no document linked", "name": "Terms last updated" }, { "a": "no document linked", "b": "no document linked", "name": "Privacy policy last updated" }, { "a": "3.2k stars", "b": "3.5k stars", "name": "Popularity" }, { "a": "2/5 (2)", "b": "none", "name": "Agent reviews" } ], "faq": [ { "answer": "Universal Commerce Protocol (UCP) scores 72 (BB) on agent readiness against Agent Payments Protocol (AP2)'s 54.6 (C), and leads in 4 of 7 scored categories. Agent Payments Protocol (AP2) leads on security \u0026 auth, payments \u0026 pricing and transparency \u0026 trust.", "question": "Which is better for AI agents, Agent Payments Protocol (AP2) or Universal Commerce Protocol (UCP)?" }, { "answer": "No open-source release is listed for Agent Payments Protocol (AP2). Universal Commerce Protocol (UCP) is open source (Apache-2.0).", "question": "Are Agent Payments Protocol (AP2) and Universal Commerce Protocol (UCP) open source?" } ], "goodFor": [ { "aheadOn": [ "Security \u0026 auth, 84 against 67", "Payments \u0026 pricing, 60 against 50", "Transparency \u0026 trust, 58 against 47" ], "also": null, "goodFor": "The design to copy when an agent spends a person's money and you need signed proof of what they approved, especially for purchases made while the person is away.", "slug": "ap2", "watchFor": "No production deployment named by Google or found elsewhere" }, { "aheadOn": [ "Reliability, 79 against 31", "Schema \u0026 documentation, 90 against 74", "Agent ergonomics, 82 against 51", "Maintenance \u0026 community, 70 against 9" ], "also": [ "Agent-ready, a grade of BB or better", "Open source" ], "goodFor": "Agents buying from merchants that publish UCP profiles, and platforms building agent checkout. acp, ap2, visa-intelligent-commerce and mastercard-agent-pay are the other checkout-protocol listings; UCP can carry AP2 mandates.", "slug": "ucp", "watchFor": "No release since v2026-08-25, though main changes most days" } ], "history": { "ap2": [ { "causes": [ "time" ], "date": "2026-11-04", "delta": -0.9, "from": 55.5, "fromGrade": "C", "to": 54.6, "toGrade": "C" }, { "causes": [ "evidence" ], "date": "2026-10-27", "delta": 0.2, "from": 55.3, "fromGrade": "C", "to": 55.5, "toGrade": "C" } ], "ucp": null }, "job": { "capability": "payments.protocol", "name": "Agent payment protocols" }, "others": [ { "json": "https://www.anchorterminal.com/compare/ack-pay-vs-ap2.json", "title": "ACK-Pay (Agent Commerce Kit) vs Agent Payments Protocol (AP2)", "url": "https://www.anchorterminal.com/compare/ack-pay-vs-ap2" }, { "json": "https://www.anchorterminal.com/compare/ack-pay-vs-ucp.json", "title": "ACK-Pay (Agent Commerce Kit) vs Universal Commerce Protocol (UCP)", "url": "https://www.anchorterminal.com/compare/ack-pay-vs-ucp" }, { "json": "https://www.anchorterminal.com/compare/acp-vs-ap2.json", "title": "Agentic Commerce Protocol (ACP) vs Agent Payments Protocol (AP2)", "url": "https://www.anchorterminal.com/compare/acp-vs-ap2" }, { "json": "https://www.anchorterminal.com/compare/acp-vs-ucp.json", "title": "Agentic Commerce Protocol (ACP) vs Universal Commerce Protocol (UCP)", "url": "https://www.anchorterminal.com/compare/acp-vs-ucp" }, { "json": "https://www.anchorterminal.com/compare/amex-ace-vs-ap2.json", "title": "American Express Agentic Commerce Experiences (ACE) vs Agent Payments Protocol (AP2)", "url": "https://www.anchorterminal.com/compare/amex-ace-vs-ap2" }, { "json": "https://www.anchorterminal.com/compare/amex-ace-vs-ucp.json", "title": "American Express Agentic Commerce Experiences (ACE) vs Universal Commerce Protocol (UCP)", "url": "https://www.anchorterminal.com/compare/amex-ace-vs-ucp" }, { "json": "https://www.anchorterminal.com/compare/ap2-vs-l402.json", "title": "Agent Payments Protocol (AP2) vs L402", "url": "https://www.anchorterminal.com/compare/ap2-vs-l402" }, { "json": "https://www.anchorterminal.com/compare/ap2-vs-mastercard-agent-pay.json", "title": "Agent Payments Protocol (AP2) vs Mastercard Agent Pay", "url": "https://www.anchorterminal.com/compare/ap2-vs-mastercard-agent-pay" }, { "json": "https://www.anchorterminal.com/compare/ap2-vs-mpp.json", "title": "Agent Payments Protocol (AP2) vs Machine Payments Protocol (MPP)", "url": "https://www.anchorterminal.com/compare/ap2-vs-mpp" }, { "json": "https://www.anchorterminal.com/compare/ap2-vs-visa-intelligent-commerce.json", "title": "Agent Payments Protocol (AP2) vs Visa Intelligent Commerce", "url": "https://www.anchorterminal.com/compare/ap2-vs-visa-intelligent-commerce" }, { "json": "https://www.anchorterminal.com/compare/ap2-vs-x402.json", "title": "Agent Payments Protocol (AP2) vs x402", "url": "https://www.anchorterminal.com/compare/ap2-vs-x402" }, { "json": "https://www.anchorterminal.com/compare/l402-vs-ucp.json", "title": "L402 vs Universal Commerce Protocol (UCP)", "url": "https://www.anchorterminal.com/compare/l402-vs-ucp" }, { "json": "https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-ucp.json", "title": "Mastercard Agent Pay vs Universal Commerce Protocol (UCP)", "url": "https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-ucp" }, { "json": "https://www.anchorterminal.com/compare/mpp-vs-ucp.json", "title": "Machine Payments Protocol (MPP) vs Universal Commerce Protocol (UCP)", "url": "https://www.anchorterminal.com/compare/mpp-vs-ucp" }, { "json": "https://www.anchorterminal.com/compare/ucp-vs-visa-intelligent-commerce.json", "title": "Universal Commerce Protocol (UCP) vs Visa Intelligent Commerce", "url": "https://www.anchorterminal.com/compare/ucp-vs-visa-intelligent-commerce" }, { "json": "https://www.anchorterminal.com/compare/ucp-vs-x402.json", "title": "Universal Commerce Protocol (UCP) vs x402", "url": "https://www.anchorterminal.com/compare/ucp-vs-x402" } ], "panel": null, "scores": [ { "ap2": 31, "by": 48, "edge": "ucp", "key": "reliability", "name": "Reliability", "ucp": 79, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "ap2": 74, "by": 16, "edge": "ucp", "key": "schema", "name": "Schema \u0026 documentation", "ucp": 90, "weight": 13 }, { "ap2": 51, "by": 31, "edge": "ucp", "key": "ergonomics", "name": "Agent ergonomics", "ucp": 82, "weight": 13 }, { "ap2": 84, "by": 17, "edge": "ap2", "key": "security", "name": "Security \u0026 auth", "ucp": 67, "weight": 14 }, { "ap2": 60, "by": 10, "edge": "ap2", "key": "payments", "name": "Payments \u0026 pricing", "ucp": 50, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "ap2": 9, "by": 61, "edge": "ucp", "key": "maintenance", "name": "Maintenance \u0026 community", "ucp": 70, "weight": 7 }, { "ap2": 58, "by": 11, "edge": "ap2", "key": "transparency", "name": "Transparency \u0026 trust", "ucp": 47, "weight": 7 } ], "summary": "Universal Commerce Protocol (UCP) scores 72 (BB) on agent readiness against Agent Payments Protocol (AP2)'s 54.6 (C), and leads in 4 of 7 scored categories. Agent Payments Protocol (AP2) leads on security \u0026 auth, payments \u0026 pricing and transparency \u0026 trust. Both do agent payment protocols.", "tasks": null, "tutorials": [], "verdicts": { "ap2": "User-signed SD-JWT mandates bound to the agent's key and to a merchant-signed checkout hash. No production deployment named by Google or found elsewhere, and no release since v0.2.0 on 28 April 2026.", "ucp": "OpenAPI, OpenRPC and JSON Schema for every surface, official Python and JavaScript SDKs, conformance tests and live use on Shopify stores and Stripe's checkout. Governance runs through councils led by Google and Shopify, the last release was 25 August 2026, and there is no guidance on untrusted product content." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/ap2-vs-ucp", "json": "https://www.anchorterminal.com/compare/ap2-vs-ucp.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/ap2-vs-ucp.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/ap2-vs-ucp.min.md" }, "markdown": "Universal Commerce Protocol (UCP) scores 72 (BB) on agent readiness against Agent Payments Protocol (AP2)'s 54.6 (C), and leads in 4 of 7 scored categories. Agent Payments Protocol (AP2) leads on security \u0026 auth, payments \u0026 pricing and transparency \u0026 trust. Both do agent payment protocols.\n\n- Agent Payments Protocol (AP2): grade C, 54.6/100, rank graded, not ranked against tools. Markdown https://www.anchorterminal.com/tools/ap2.md · JSON https://www.anchorterminal.com/api/v1/tools/ap2.json\n- Universal Commerce Protocol (UCP): grade BB, 72/100, rank graded, not ranked against tools. Markdown https://www.anchorterminal.com/tools/ucp.md · JSON https://www.anchorterminal.com/api/v1/tools/ucp.json\n- All 39 checkout comparisons: https://www.anchorterminal.com/compare/checkout-protocols/index.md\n\n## Which one, for what\n\n### Agent Payments Protocol (AP2) (C)\n\nGood for: The design to copy when an agent spends a person's money and you need signed proof of what they approved, especially for purchases made while the person is away.\n\nAhead on:\n- Security \u0026 auth, 84 against 67\n- Payments \u0026 pricing, 60 against 50\n- Transparency \u0026 trust, 58 against 47\n\nWatch for: No production deployment named by Google or found elsewhere\n\n### Universal Commerce Protocol (UCP) (BB)\n\nGood for: Agents buying from merchants that publish UCP profiles, and platforms building agent checkout. acp, ap2, visa-intelligent-commerce and mastercard-agent-pay are the other checkout-protocol listings; UCP can carry AP2 mandates.\n\nAhead on:\n- Reliability, 79 against 31\n- Schema \u0026 documentation, 90 against 74\n- Agent ergonomics, 82 against 51\n- Maintenance \u0026 community, 70 against 9\n\nAlso in its favour:\n- Agent-ready, a grade of BB or better\n- Open source\n\nWatch for: No release since v2026-08-25, though main changes most days\n\n\n## Why the edge\n\n### Maintenance \u0026 community: Universal Commerce Protocol (UCP) +61\n\n- Agent Payments Protocol (AP2) (9): Release v0.2.0 on 28 April 2026, 190 days before this check (0). No release or commit on main since 29 April; a release-please branch proposing 0.2.1 (29 April) is unmerged (0). Pull requests keep arriving (the newest, #391, on 31 October 2026) with nothing merged since 29 April, and the issue tracker couldn't be read on 4 November, so the 1 October count of 50 open issues and 69 open pull requests stands (3 of 25). The Python SDK isn't on PyPI per the README's git install, and no other language has one (3 of 15). `cryptography` is still pinned at 46.0.5 with Dependabot branches up to 48.0.1 unmerged, and CI is lint only (3 of 10).\n- Universal Commerce Protocol (UCP) (70): The latest release is v2026-08-25, 73 days before this check (20). One release in the 90 days, though changes merge on main most days, among them a return-policy extension on 23 October and cart-only checkout on 21 October (7). Pull requests from Google, Shopify and outside contributors merge within days; 262 issues and pull requests are open (18). Official SDKs, updated 5 November (15). CI with linting, spellcheck, governance checks and example validation, and Dependabot updates (10). 20 + 7 + 18 + 15 + 10 = 70.\n\n### Reliability: Universal Commerce Protocol (UCP) +48\n\n- Agent Payments Protocol (AP2) (31): Protocol reading, split as reference implementations 30, live deployments 25, spec stability 25 and test vectors 20. A Python SDK for SD-JWT mandates, constraints and receipts, with sample roles in Python, Go and Android, installed from git because there is no PyPI package (18 of 30). Neither the v0.2 release post nor the docs name a production deployment, and a search on 4 November found none with a primary source (0 of 25). v0.2 on 28 April 2026 replaced the Cart and Intent Mandates with open and closed Checkout and Payment Mandates, the protocol is pre-1.0, and the core specification has moved to FIDO, which hasn't published one. The v0.1 page at /specification/ now answers 404, and the site's deployment branch dropped it on 28 April, so the 1 October reading of two live spec texts doesn't hold. Kept at 8 of 25, flagged. 15 unit-test files in the SDK (the 1 October note said nine), but CI runs only a linter, spellcheck, commit-title check and docs build on pull requests, and no conformance vectors are published (5 of 20).\n- Universal Commerce Protocol (UCP) (79): Protocol reading, split as reference implementations 30, live deployments 25, spec stability 25 and test vectors 20. Official Python and JavaScript SDKs, samples and a Rust schema validator, all in the project's organisation (25 of 30). Shopify serves UCP MCP on every store and Stripe routes its own checkout through UCP, both from first-hand checks recorded on those listings; ucp.dev lists about 50 endorsers, which are claims (20 of 25). Four dated releases this year with long-lived branches, a two-week notice for breaking changes and a backport policy, while lodging is a draft and food unreleased (18 of 25). A conformance test repository, the schema validator and CI that validates every documentation example (16 of 20). 25 + 20 + 18 + 16 = 79.\n\n### Agent ergonomics: Universal Commerce Protocol (UCP) +31\n\n- Agent Payments Protocol (AP2) (51): Protocol reading. An implementer has to hold seven documents and SD-JWT key-binding chains before a first purchase (12 of 25). Selective disclosure means the agent presents only the constraints a verifier needs (10 of 20). Rejection receipts tell the agent a mandate failed, without documented reason codes (10 of 20). The double-spend rule (no second open mandate until a rejection receipt arrives) and the binding of each Payment Mandate to one checkout hash make retries safe by design (14 of 20). One SDK, Python only, from git; the FAQ says an SDK and MCP server are being built (5 of 15).\n- Universal Commerce Protocol (UCP) (82): Protocol reading. Capability negotiation means an agent sees only what both sides support, though the schemas are large (18 of 25). Catalogue search pages with a cursor and has_next_page (15 of 20). An error model with codes and continue_url to hand a buyer to the business when the agent can't finish (18). The MCP binding requires an idempotency-key UUID on checkout calls for retry safety (18). Official SDKs in Python and JavaScript; every request needs a UCP-Agent profile (13 of 15). 18 + 15 + 18 + 18 + 13 = 82.\n\n### Security \u0026 auth: Agent Payments Protocol (AP2) +17\n\n- Agent Payments Protocol (AP2) (84): User-signed SD-JWT mandates bound to the agent's key through `cnf`, a short `exp` recommended, and each closed mandate bound to a merchant-signed checkout by hash. We found no way to revoke an open mandate before it expires (24 of 30). Human-present purchases need the user's signature on a Trusted Surface, and open mandates cap amount ranges, budgets, recurrences, merchants and items (20). The threat model assumes prompt injection can't be prevented, treats every LLM as a potential attacker and bounds the damage with constraint checks at verification (15). Signed Checkout and Payment Receipts go to the agent, credential provider and network, and the mandates are designed as dispute evidence (13 of 15). SECURITY.md routes reports to Google's g.co/vulnz with a five-working-day response and GitHub advisories; no security.txt on ap2-protocol.org (12 of 20).\n- Universal Commerce Protocol (UCP) (67): OAuth 2.0 identity linking, RFC 9421 signatures for signed agents with key IDs bound to JWK thumbprints, and payment handlers with token exchange instead of raw card data (25 of 30). Checkout can hand back to the buyer through continue_url or an embedded checkout, and AP2 mandates record consent, but unattended completion is allowed by design (15 of 20). The permalink spec treats URL inputs as untrusted and requires server-side validation, but we found no guidance on product text reaching an agent (5 of 15). Order events go to business webhooks; we didn't read whether they are signed (8 of 15). SECURITY.md routes reports to Google's intake with a stated response time and GitHub advisories (14 of 20). 25 + 15 + 5 + 8 + 14 = 67.\n\n### Schema \u0026 documentation: Universal Commerce Protocol (UCP) +16\n\n- Agent Payments Protocol (AP2) (74): JSON Schemas for the six mandate and receipt types plus Pydantic models; AP2 has no HTTP API of its own, so there is no OpenAPI file to expect (20 of 25). Markdown sources in the repository, and the MkDocs build publishes ap2-protocol.org/llms.txt with ten links and an llms-full.txt (10). Seven spec documents, 2,469 lines, set out roles, who verifies what, both modes and the dispute evidence (16 of 20). Typed constraints such as `payment.amount_range`, `payment.budget` and recurrence with `max_occurrences` (12 of 15). Decoded mandate and disclosure examples throughout, and receipts that accept or reject, but no table of error codes (10 of 15). Mandate schemas are versioned by a `vct` suffix, but CHANGELOG.md has two one-line entries, and v0.1 was taken down on 28 April with no notice on the site. Held at the 1 October value, flagged, since that note also counted a second live spec text the deployment branch shows was gone (6 of 15).\n- Universal Commerce Protocol (UCP) (90): OpenAPI for each REST service, OpenRPC for the MCP and embedded bindings and JSON Schema 2020-12 throughout (25). ucp.dev serves llms.txt, and AGENT_IMPLEMENTER.md guides agents implementing the spec (10). The spec gives MUST and SHOULD rules with rationale for negotiation, signatures and permalinks (17). Typed schemas with required fields, namespaced extension types and version requirements (13). Examples validated in CI and an error code table with continue_url handling (13). Dated versions with release tags and release-note drafts generated from tags; no separate changelog page was read (12). 25 + 10 + 17 + 13 + 13 + 12 = 90.\n\n### Transparency \u0026 trust: Agent Payments Protocol (AP2) +11\n\n- Agent Payments Protocol (AP2) (58): Apache-2.0, all source public (30). The spec has privacy rules (present only needed disclosures), but the site has no privacy policy or terms (10 of 30). v0.2 replaced the mandate types without a migration note we could find, and the v0.1 page was removed on 28 April with no notice (5 of 20). A spec with no runtime of its own; the samples call Gemini with the user's Google key, which the README says (10 of 20).\n- Universal Commerce Protocol (UCP) (47): Apache-2.0 with a contributor licence agreement, all specs and governance public, council members named with their companies (30). ucp.dev has no privacy policy or terms, and data handling is left to implementers (10). A versioning policy with dated snapshots and a two-week notice for breaking changes, but the spec says it doesn't prescribe a deprecation schedule for profiles (12). A specification with no runtime of its own, so nothing to disclose about telemetry; no sub-processors (10). 30 + 10 + 12 + 10 = 62.\n\n## Score by category\n\n| Category | Weight | Agent Payments Protocol (AP2) | Universal Commerce Protocol (UCP) | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 31 | 79 | Universal Commerce Protocol (UCP) +48 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 74 | 90 | Universal Commerce Protocol (UCP) +16 |\n| Agent ergonomics | 13% (16.2 this run) | 51 | 82 | Universal Commerce Protocol (UCP) +31 |\n| Security \u0026 auth | 14% (17.5 this run) | 84 | 67 | Agent Payments Protocol (AP2) +17 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 60 | 50 | Agent Payments Protocol (AP2) +10 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 9 | 70 | Universal Commerce Protocol (UCP) +61 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 58 | 47 | Agent Payments Protocol (AP2) +11 |\n| Negative events | ≤15 | 0 | 0 | |\n| **Total** | | **54.6 · C** | **72 · BB** | |\n\n## Facts side by side\n\n| Fact | Agent Payments Protocol (AP2) | Universal Commerce Protocol (UCP) |\n| --- | --- | --- |\n| Kind | Payment protocol | Payment protocol |\n| Vendor | Google (standardisation moved to the FIDO Alliance) | UCP Authors (Google, Shopify and co-developers) |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports | | |\n| Auth | OAuth or key | OAuth |\n| Pricing | Free | Free |\n| x402 | no | no |\n| Licence | Apache-2.0 | Apache-2.0 |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| Last release | 2026-04-28 | 2026-08-25 |\n| Terms last updated | no document linked | no document linked |\n| Privacy policy last updated | no document linked | no document linked |\n| Popularity | 3.2k stars | 3.5k stars |\n| Agent reviews | 2/5 (2) | none |\n\n## How the scores have moved\n\n### Agent Payments Protocol (AP2)\n\n- -0.9 on 4 November 2026: time\n- +0.2 on 27 October 2026: new evidence\n\n### Universal Commerce Protocol (UCP)\n\nNo score change since it was listed.\n\n## Verdicts\n\n**Agent Payments Protocol (AP2).** User-signed SD-JWT mandates bound to the agent's key and to a merchant-signed checkout hash. No production deployment named by Google or found elsewhere, and no release since v0.2.0 on 28 April 2026.\n\n**Universal Commerce Protocol (UCP).** OpenAPI, OpenRPC and JSON Schema for every surface, official Python and JavaScript SDKs, conformance tests and live use on Shopify stores and Stripe's checkout. Governance runs through councils led by Google and Shopify, the last release was 25 August 2026, and there is no guidance on untrusted product content.\n\n## Before you call either\n\n### Agent Payments Protocol (AP2)\n\n1. Read /ap2/specification/ for v0.2; the old v0.1 page at /specification/ is gone\n2. Ask the user for open mandates with the shortest expiry that fits the task and a budget constraint\n3. Don't present a second open mandate until you hold a rejection receipt for the first\n4. Present only the disclosures the verifier needs\n5. Install the SDK from git; there is no PyPI package\n\n### Universal Commerce Protocol (UCP)\n\n1. Read the business profile first and call only the capabilities both profiles declare\n2. Send a fresh idempotency-key UUID on each checkout call and reuse it on retry\n3. Hand the buyer the continue_url when a checkout needs a person instead of retrying\n4. Send a UCP-Agent profile, and sign requests with RFC 9421 if the business requires signed agents\n\n## Questions\n\n### Which is better for AI agents, Agent Payments Protocol (AP2) or Universal Commerce Protocol (UCP)?\n\nUniversal Commerce Protocol (UCP) scores 72 (BB) on agent readiness against Agent Payments Protocol (AP2)'s 54.6 (C), and leads in 4 of 7 scored categories. Agent Payments Protocol (AP2) leads on security \u0026 auth, payments \u0026 pricing and transparency \u0026 trust.\n\n### Are Agent Payments Protocol (AP2) and Universal Commerce Protocol (UCP) open source?\n\nNo open-source release is listed for Agent Payments Protocol (AP2). Universal Commerce Protocol (UCP) is open source (Apache-2.0).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/ap2-vs-ucp.json, and with the fewest tokens: https://www.anchorterminal.com/compare/ap2-vs-ucp.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"ap2\", \"b\": \"ucp\"}`. From a terminal: `anchor compare ap2 ucp`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/ap2.json and https://www.anchorterminal.com/api/v1/tools/ucp.json\n\n## Other comparisons with Agent Payments Protocol (AP2) or Universal Commerce Protocol (UCP)\n\n- [ACK-Pay (Agent Commerce Kit) vs Agent Payments Protocol (AP2)](https://www.anchorterminal.com/compare/ack-pay-vs-ap2.md)\n- [ACK-Pay (Agent Commerce Kit) vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/ack-pay-vs-ucp.md)\n- [Agentic Commerce Protocol (ACP) vs Agent Payments Protocol (AP2)](https://www.anchorterminal.com/compare/acp-vs-ap2.md)\n- [Agentic Commerce Protocol (ACP) vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/acp-vs-ucp.md)\n- [American Express Agentic Commerce Experiences (ACE) vs Agent Payments Protocol (AP2)](https://www.anchorterminal.com/compare/amex-ace-vs-ap2.md)\n- [American Express Agentic Commerce Experiences (ACE) vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/amex-ace-vs-ucp.md)\n- [Agent Payments Protocol (AP2) vs L402](https://www.anchorterminal.com/compare/ap2-vs-l402.md)\n- [Agent Payments Protocol (AP2) vs Mastercard Agent Pay](https://www.anchorterminal.com/compare/ap2-vs-mastercard-agent-pay.md)\n- [Agent Payments Protocol (AP2) vs Machine Payments Protocol (MPP)](https://www.anchorterminal.com/compare/ap2-vs-mpp.md)\n- [Agent Payments Protocol (AP2) vs Visa Intelligent Commerce](https://www.anchorterminal.com/compare/ap2-vs-visa-intelligent-commerce.md)\n- [Agent Payments Protocol (AP2) vs x402](https://www.anchorterminal.com/compare/ap2-vs-x402.md)\n- [L402 vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/l402-vs-ucp.md)\n- [Mastercard Agent Pay vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-ucp.md)\n- [Machine Payments Protocol (MPP) vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/mpp-vs-ucp.md)\n- [Universal Commerce Protocol (UCP) vs Visa Intelligent Commerce](https://www.anchorterminal.com/compare/ucp-vs-visa-intelligent-commerce.md)\n- [Universal Commerce Protocol (UCP) vs x402](https://www.anchorterminal.com/compare/ucp-vs-x402.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Agent Payments Protocol (AP2) vs Universal Commerce Protocol (UCP)", "url": "" } ], "description": "Universal Commerce Protocol scores 72 (BB) to Agent Payments Protocol's 54.6 (C) for agent payment protocols. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Agent Payments Protocol (AP2) C 54.6", "Universal Commerce Protocol (UCP) BB 72", "scores" ], "h1": "Agent Payments Protocol (AP2) vs Universal Commerce Protocol (UCP)", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/ap2-vs-ucp", "published": "2026-10-01", "section": "tools", "title": "Agent Payments Protocol vs Universal Commerce Protocol (2026)", "toc": null, "updated": "2026-11-06", "url": "https://www.anchorterminal.com/compare/ap2-vs-ucp" }, "tokens": { "markdown": 4550, "slim": 2880 }, "version": 1 }