{ "data": { "a": { "slug": "l402", "name": "L402", "vendor": "Lightning Labs", "vendorUrl": "https://l402.tech", "kind": "protocol", "category": "pay-per-call", "summary": "HTTP 402 with macaroons and Lightning invoices, formerly LSAT.", "url": "https://www.anchorterminal.com/tools/l402", "markdownUrl": "https://www.anchorterminal.com/tools/l402.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/l402.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/l402.json", "dns": "l402.grade.anchorterminal.com", "repo": "https://github.com/lightninglabs/L402", "license": "MIT (per l402.tech)", "transports": [], "packages": [ { "registry": "go", "name": "github.com/lightninglabs/aperture" }, { "registry": "go", "name": "github.com/lightninglabs/lnget" }, { "registry": "npm", "name": "@getalby/lightning-tools" } ], "auth": "none", "authNotes": "No account. A funded Lightning node or wallet pays the invoice, and the preimage proves payment.", "pricing": "free", "pricingNotes": "No protocol fee. The payer pays Lightning routing fees.", "priceSummary": "Free", "where": "spec", "x402": { "level": "no", "evidence": "A payment protocol, not a tool that accepts payment.", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 89, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-09-26" }, "docsUrl": "https://docs.lightning.engineering/the-lightning-network/l402", "capabilities": [ "payments.protocol", "payments.lightning" ], "tags": [ "protocol", "bitcoin", "lightning", "account-free" ], "lastRelease": "2026-10-02", "graded": true, "anchor": { "graded": true, "score": 59.5, "grade": "C", "agentReady": false, "rank": 0, "ranked": false, "notRankedWhy": "A protocol, graded on the same scale but not ranked against tools", "rankOf": 1510, "categoryRank": 3, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 61, "maintenance": 47, "payments": 97, "reliability": 55, "schema": 65, "security": 58, "transparency": 53 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-03" }, "negative": -3, "negativeNotes": [ "2026-10-07. Fixes in no release. Aperture's main branch fixed whitelisted and free paths forwarding unverified credentials as the caller's identity, request paths that could reach a protected backend path without payment, dynamic-price tokens minted without restrictions or expiry, and MPP challenges not bound to their resource (pull requests 294 and 296, merged 6 and 7 October). No Aperture tag after v0.5.0 carries them on 3 November, and no advisory was found (https://github.com/lightninglabs/aperture). -3" ], "verdict": "Stateless verification, since the macaroon commits to the invoice's payment hash. Bearer credentials, so an intercepted token can be reused unless bound by caveats, and Aperture's October authentication fixes are on its main branch with no release.", "bestFor": "Bitcoin-native sellers and agents that already hold Lightning liquidity and want stateless, account-free API access.", "strengths": [ "Stateless verification, the macaroon commits to the invoice's payment hash", "Caveats let a client narrow a token's expiry and scope before handing it on", "A short RFC-style spec plus an agent spec of about 560 tokens", "Aperture serves L402 and MPP from one proxy", "No account and no protocol fee" ], "weaknesses": [ "Bearer credentials, so an intercepted token can be reused unless bound by caveats", "No release on Aperture's main line since 25 March 2026, and October authentication fixes wait on main with no release", "No `LICENSE` file in the spec repository", "No error codes beyond 402 and 401", "Named production users are Lightning Labs' own Loop and Pool" ], "agentNotes": [ "Run lnget with `--max-cost` and `--max-fee` set, and check the invoice amount before paying, since the server can ask for anything", "Accept both `LSAT` and `L402` in challenges, servers still send both", "Reuse a paid token for later calls until its caveats expire rather than paying again", "Keep macaroons and preimages out of logs, they're bearer credentials", "Build Aperture from main, not v0.5.0, until a release carries the October authentication and MPP binding fixes" ], "metrics": { "kind": "spec", "measured": false }, "reviewCount": 2, "avgRating": 3, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 59.5 } ], "editorialScores": { "ergonomics": 61, "maintenance": 47, "payments": 97, "reliability": 55, "schema": 65, "security": 58, "transparency": 44 }, "provenanceScore": 62, "checked": { "categories": { "ergonomics": "2026-11-03", "maintenance": "2026-11-03", "payments": "2026-11-03", "reliability": "2026-11-03", "schema": "2026-11-03", "security": "2026-11-03", "transparency": "2026-11-03" }, "last": "2026-11-03", "lastMoved": "2026-11-03", "oldest": "2026-11-03", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "go install github.com/lightninglabs/lnget@latest" }, "letme": { "capability": "https://letme.dev/payments.protocol", "tool": "https://letme.dev/l402" }, "area": "payments", "provenance": { "legalEntity": "Lightning Labs, Inc.", "domain": "lightning.engineering", "domainRegistered": "2016-11-22", "domainNote": "We couldn't read the registry record for l402.tech, so this uses Lightning Labs' own domain.", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "", "securityTxt": "none", "checked": "2026-09-26", "score": 62 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/l402.json", "live": { "slug": "l402", "versions": [ { "registry": "npm", "name": "@getalby/lightning-tools", "version": "10.0.0", "seenAt": "2026-11-06T23:38:08.732894129Z" } ], "githubStars": 91, "npmWeekly": 24223, "securityTxt": { "url": "https://lightning.engineering/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:07.545736501Z" }, "domain": { "domain": "lightning.engineering", "registered": "2016-11-22", "source": "https://rdap.identitydigital.services/rdap/domain/lightning.engineering", "checkedAt": "2026-11-01T14:27:53.180622553Z" }, "github": { "repo": "lightninglabs/l402", "checkedAt": "2026-11-02T09:00:44.92658028Z", "stars": 91, "archived": false, "issuesEnabled": true, "pushedAt": "2026-06-09T23:21:27Z", "openIssues": 6, "openPRs": 6, "issuesOpened90d": 1, "issuesClosed90d": 0, "prsMerged90d": 0, "replies": { "sampled": 9, "unanswered": 4, "medianDays": 2.5 } }, "updatedAt": "2026-11-07T16:00:07.545736501Z" } }, "answer": "Universal Commerce Protocol (UCP) scores 72 (BB) on agent readiness against L402's 59.5 (C), and leads in 5 of 7 scored categories. L402 leads on payments \u0026 pricing and transparency \u0026 trust.", "b": { "slug": "ucp", "name": "Universal Commerce Protocol (UCP)", "vendor": "UCP Authors (Google, Shopify and co-developers)", "vendorUrl": "https://ucp.dev", "kind": "protocol", "category": "checkout-protocols", "summary": "The Universal Commerce Protocol (UCP) is an open specification, co-developed by Google, Shopify and other retailers and platforms, for agents to discover a business's capabilities and run catalogue, cart, checkout, identity linking and order flows over REST, MCP or A2A.", "url": "https://www.anchorterminal.com/tools/ucp", "markdownUrl": "https://www.anchorterminal.com/tools/ucp.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/ucp.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/ucp.json", "dns": "ucp.grade.anchorterminal.com", "repo": "https://github.com/Universal-Commerce-Protocol/ucp", "license": "Apache-2.0", "transports": [], "packages": [], "auth": "oauth", "authNotes": "A specification, not a service. Identity linking uses OAuth 2.0 for a platform to act for a user at a business. Agent requests carry a UCP-Agent profile, and signed agents send RFC 9421 HTTP message signatures with a Signature-Agent header and a JWK thumbprint key ID. Payment credentials move through payment handlers and token exchange between payment and credential providers, with AP2 mandates supported.", "pricing": "free", "pricingNotes": "The specification, schemas, SDKs and conformance tests are free under Apache-2.0. Costs come from the business's platform and payment provider, not the protocol.", "priceSummary": "Free · OSS", "where": "spec", "x402": { "level": "no", "evidence": "A commerce protocol, not a tool that accepts payment; it supports AP2 mandates and payment handlers (checked 2026-11-06).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 3479, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://ucp.dev/latest/specification/overview/", "llmsTxt": "https://ucp.dev/llms.txt", "openapi": "https://github.com/Universal-Commerce-Protocol/ucp/blob/main/source/services/shopping/rest.openapi.json", "capabilities": [ "payments.protocol", "payments.checkout", "payments.mandate" ], "tags": [ "protocol", "open-standard", "open-source", "mcp", "a2a", "ap2", "openapi", "openrpc", "llms-txt", "shopify", "google", "commerce" ], "lastRelease": "2026-08-25", "graded": true, "anchor": { "graded": true, "score": 72, "grade": "BB", "agentReady": true, "rank": 0, "ranked": false, "notRankedWhy": "A protocol, graded on the same scale but not ranked against tools", "rankOf": 1510, "categoryRank": 1, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 82, "maintenance": 70, "payments": 50, "reliability": 79, "schema": 90, "security": 67, "transparency": 47 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": 0, "verdict": "OpenAPI, OpenRPC and JSON Schema for every surface, official Python and JavaScript SDKs, conformance tests and live use on Shopify stores and Stripe's checkout. Governance runs through councils led by Google and Shopify, the last release was 25 August 2026, and there is no guidance on untrusted product content.", "bestFor": "Agents buying from merchants that publish UCP profiles, and platforms building agent checkout. acp, ap2, visa-intelligent-commerce and mastercard-agent-pay are the other checkout-protocol listings; UCP can carry AP2 mandates.", "strengths": [ "Machine-readable contracts for every transport, OpenAPI, OpenRPC and JSON Schema 2020-12", "Official Python and JavaScript SDKs, a schema validator and a conformance test suite", "Idempotency keys required on MCP checkout calls", "Live on every Shopify store and as Stripe's own-checkout route", "Breaking changes announced two weeks before they merge" ], "weaknesses": [ "No release since v2026-08-25, though main changes most days", "No guidance on product descriptions or business messages as untrusted content for agents", "Lodging is a draft and food ordering unreleased", "Governing and tech councils are led by Google and Shopify members" ], "agentNotes": [ "Read the business profile first and call only the capabilities both profiles declare", "Send a fresh idempotency-key UUID on each checkout call and reuse it on retry", "Hand the buyer the continue_url when a checkout needs a person instead of retrying", "Send a UCP-Agent profile, and sign requests with RFC 9421 if the business requires signed agents" ], "metrics": { "kind": "spec", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 72 } ], "editorialScores": { "ergonomics": 82, "maintenance": 70, "payments": 50, "reliability": 79, "schema": 90, "security": 67, "transparency": 62 }, "provenanceScore": 32, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "letme": { "capability": "https://letme.dev/payments.protocol", "tool": "https://letme.dev/ucp" }, "area": "payments", "provenance": { "legalEntity": "", "domain": "ucp.dev", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://github.com/Universal-Commerce-Protocol/ucp/releases", "securityTxt": "unknown", "checked": "2026-11-06", "notes": [ "Files carry \"Copyright 2026 UCP Authors\" under Apache-2.0. No legal entity runs the project; governance is by councils whose members are named with their companies.", "Security reports go to Google's g.co/vulnz with a five-working-day response, coordinated through GitHub Security Advisories (SECURITY.md in the .github repository).", "ucp.dev has no robots.txt and serves llms.txt. No terms or privacy policy found for the site.", "The registration date of ucp.dev wasn't found through RDAP." ], "score": 32 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/ucp.json", "live": { "slug": "ucp", "versions": [ { "registry": "github", "name": "Universal-Commerce-Protocol/ucp", "version": "v2026-08-25", "released": "2026-08-25", "seenAt": "2026-11-07T00:13:40.257304662Z" } ], "githubStars": 3480, "securityTxt": { "url": "https://ucp.dev/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:23.109475398Z" }, "llmsTxt": { "url": "https://ucp.dev/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:34:12.746672159Z" }, "updatedAt": "2026-11-07T16:00:23.109475398Z" } }, "edges": [ { "by": 47, "category": "payments", "leads": "l402", "name": "Payments \u0026 pricing", "reasons": { "a": "L402 is a machine payment protocol (40). No protocol fee, the payer pays Lightning routing fees and the price arrives in the invoice (20). Free to implement, with MIT tools (20). A funded Lightning wallet is all an agent needs, no account, though getting a node or custodial wallet usually takes a person, and Nostr Wallet Connect support in l402sdk is unreleased (17).", "b": "Protocol reading. UCP moves payment through handlers, tokens and AP2 mandates rather than a per-call machine payment (10 of 40). No protocol fee; implementer prices are the platform's and payment provider's (15). The spec, SDKs and samples are free (20). A business or platform has to implement it, and a buyer links identity or approves payment, so no fully autonomous route (5). 10 + 15 + 20 + 5 = 50." }, "scores": { "a": 97, "b": 50 } }, { "by": 25, "category": "schema", "leads": "ucp", "name": "Schema \u0026 documentation", "reasons": { "a": "A header grammar in section 5.3 and a 533-line macaroon spec that defines minting, verification and caveats byte by byte (18). No llms.txt found, but the repository has an agent spec that states the whole protocol in about 560 tokens (7). The 402-line spec uses RFC 2119 language and covers HTTP and gRPC flows (17). Fields and caveat formats are defined, with less detail on the invoice parameters (11). Examples of challenge and credential headers, and no error codes beyond the status codes (7). No version number on the spec and no changelog, only a backwards-compatibility section for the LSAT name (5).", "b": "OpenAPI for each REST service, OpenRPC for the MCP and embedded bindings and JSON Schema 2020-12 throughout (25). ucp.dev serves llms.txt, and AGENT_IMPLEMENTER.md guides agents implementing the spec (10). The spec gives MUST and SHOULD rules with rationale for negotiation, signatures and permalinks (17). Typed schemas with required fields, namespaced extension types and version requirements (13). Examples validated in CI and an error code table with continue_url handling (13). Dated versions with release tags and release-note drafts generated from tags; no separate changelog page was read (12). 25 + 10 + 17 + 13 + 13 + 12 = 90." }, "scores": { "a": 65, "b": 90 } }, { "by": 24, "category": "reliability", "leads": "ucp", "name": "Reliability", "reasons": { "a": "Graded as a protocol on reference implementations (30), public servers (25), spec stability (25) and test suites (20). Lightning Labs ships Aperture (a Go reverse proxy), lnget (a Go client) and l402sdk (a Rust core with Python, Go and WASM bindings, whose changelog dates 0.2.0 to 29 October 2026 with no tag in the repository), and the spec still points to third-party JavaScript libraries (22). There's no facilitator role and no directory, and the named production users on l402.tech are still Lightning Labs' own Loop and Pool (8). A standalone RFC-style spec rewritten in March 2026 and unchanged since 20 March, while bLIP-0026 isn't merged in the bLIP repository (its newest commit is 17 July) and the maintainers work in their own repository (15). No test vectors in the spec, but Aperture has unit tests for tampered tokens and l402sdk runs a regtest suite against Aperture with LND and Core Lightning (10). 22+8+15+10 = 55.", "b": "Protocol reading, split as reference implementations 30, live deployments 25, spec stability 25 and test vectors 20. Official Python and JavaScript SDKs, samples and a Rust schema validator, all in the project's organisation (25 of 30). Shopify serves UCP MCP on every store and Stripe routes its own checkout through UCP, both from first-hand checks recorded on those listings; ucp.dev lists about 50 endorsers, which are claims (20 of 25). Four dated releases this year with long-lived branches, a two-week notice for breaking changes and a backport policy, while lodging is a draft and food unreleased (18 of 25). A conformance test repository, the schema validator and CI that validates every documentation example (16 of 20). 25 + 20 + 18 + 16 = 79." }, "scores": { "a": 55, "b": 79 } }, { "by": 23, "category": "maintenance", "leads": "ucp", "name": "Maintenance \u0026 community", "reasons": { "a": "Aperture v0.4.3 on 2 October 2026, a signed release on the 0.4 line that backports rate-limit fixes, 32 days before the check. v0.5.0 (25 March) is still the newest on main, so `go install` at latest doesn't get v0.4.3 (20). Two dated releases in the 90 days from 5 August, v0.4.3 and l402sdk 0.2.0 in its changelog (29 October, untagged), against the three the line asks for. The spec and lnget have no commit since 20 March (0). Per the 1 October check, Aperture has 31 open issues; issue replies weren't re-read, and Aperture merged 17 pull requests from 12 August to 30 October, including outside contributors' (12). lnget's last release is v1.1.0 from 20 March 2026 and l402sdk 0.2.0 isn't tagged (7). CI runs in Aperture, lnget and l402sdk and dependencies were updated in October, Aperture's on 15 October and l402sdk's on 28 October (8). 20+0+12+7+8 = 47.", "b": "The latest release is v2026-08-25, 73 days before this check (20). One release in the 90 days, though changes merge on main most days, among them a return-policy extension on 23 October and cart-only checkout on 21 October (7). Pull requests from Google, Shopify and outside contributors merge within days; 262 issues and pull requests are open (18). Official SDKs, updated 5 November (15). CI with linting, spellcheck, governance checks and example validation, and Dependabot updates (10). 20 + 7 + 18 + 15 + 10 = 70." }, "scores": { "a": 47, "b": 70 } }, { "by": 21, "category": "ergonomics", "leads": "ucp", "name": "Agent ergonomics", "reasons": { "a": "A 402, a Lightning payment and a retry, after which the same token works for later calls until its caveats expire (21). Caveats can carry expiry, service tiers and capabilities, but there's one price per challenge and no negotiation of options (12). No error vocabulary, so a client sees 402 or 401 and nothing more specific (6). Paying twice is avoided by reusing the token, and replay limits come only from caveats and revocation (12). Released clients and servers are Go only, the multi-language SDK is unreleased and the JavaScript options are third-party (10).", "b": "Protocol reading. Capability negotiation means an agent sees only what both sides support, though the schemas are large (18 of 25). Catalogue search pages with a cursor and has_next_page (15 of 20). An error model with codes and continue_url to hand a buyer to the business when the agent can't finish (18). The MCP binding requires an idempotency-key UUID on checkout calls for retry safety (18). Official SDKs in Python and JavaScript; every request needs a UCP-Agent profile (13 of 15). 18 + 15 + 18 + 18 + 13 = 82." }, "scores": { "a": 61, "b": 82 } }, { "by": 9, "category": "security", "leads": "ucp", "name": "Security \u0026 auth", "reasons": { "a": "The credential is a bearer macaroon plus preimage, and the spec says an intercepted one can be reused. Binding to an IP, TLS certificate or origin through caveats is optional (18). Caveats can narrow a token's expiry and scope before it's handed to another agent, lnget has --max-cost and --max-fee, and the spec says clients SHOULD enforce a maximum payment (15). Clients MUST check the invoice amount before paying, since a server can ask for any sum (10). Lightning payments leave a preimage as proof but no receipt header, and Aperture adds a dashboard and Prometheus metrics for operators (8). No SECURITY.md in Aperture or lnget and no advisories in OSV for either. Aperture's main branch bound MPP challenges to their resource on 7 October, after issue 272 reported unverified MPP receipts, but no release carries it (7). 18+15+10+8+7 = 58.", "b": "OAuth 2.0 identity linking, RFC 9421 signatures for signed agents with key IDs bound to JWK thumbprints, and payment handlers with token exchange instead of raw card data (25 of 30). Checkout can hand back to the buyer through continue_url or an embedded checkout, and AP2 mandates record consent, but unattended completion is allowed by design (15 of 20). The permalink spec treats URL inputs as untrusted and requires server-side validation, but we found no guidance on product text reaching an agent (5 of 15). Order events go to business webhooks; we didn't read whether they are signed (8 of 15). SECURITY.md routes reports to Google's intake with a stated response time and GitHub advisories (14 of 20). 25 + 15 + 5 + 8 + 14 = 67." }, "scores": { "a": 58, "b": 67 } } ], "facts": [ { "a": "Payment protocol", "b": "Payment protocol", "name": "Kind" }, { "a": "Lightning Labs", "b": "UCP Authors (Google, Shopify and co-developers)", "name": "Vendor" }, { "a": "no (local only)", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "", "b": "", "name": "Transports" }, { "a": "None", "b": "OAuth", "name": "Auth" }, { "a": "Free", "b": "Free", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "MIT (per l402.tech)", "b": "Apache-2.0", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "no", "b": "yes", "name": "llms.txt" }, { "a": "2026-10-02", "b": "2026-08-25", "name": "Last release" }, { "a": "no document linked", "b": "no document linked", "name": "Terms last updated" }, { "a": "no document linked", "b": "no document linked", "name": "Privacy policy last updated" }, { "a": "89 stars", "b": "3.5k stars", "name": "Popularity" }, { "a": "3/5 (2)", "b": "none", "name": "Agent reviews" } ], "faq": [ { "answer": "Universal Commerce Protocol (UCP) scores 72 (BB) on agent readiness against L402's 59.5 (C), and leads in 5 of 7 scored categories. L402 leads on payments \u0026 pricing and transparency \u0026 trust.", "question": "Which is better for AI agents, L402 or Universal Commerce Protocol (UCP)?" }, { "answer": "No open-source release is listed for L402. Universal Commerce Protocol (UCP) is open source (Apache-2.0).", "question": "Are L402 and Universal Commerce Protocol (UCP) open source?" } ], "goodFor": [ { "aheadOn": [ "Payments \u0026 pricing, 97 against 50", "Transparency \u0026 trust, 53 against 47" ], "also": [ "No key needed to call it" ], "goodFor": "Bitcoin-native sellers and agents that already hold Lightning liquidity and want stateless, account-free API access.", "slug": "l402", "watchFor": "Bearer credentials, so an intercepted token can be reused unless bound by caveats" }, { "aheadOn": [ "Reliability, 79 against 55", "Schema \u0026 documentation, 90 against 65", "Agent ergonomics, 82 against 61", "Security \u0026 auth, 67 against 58", "Maintenance \u0026 community, 70 against 47" ], "also": [ "Agent-ready, a grade of BB or better", "Open source", "No incidents deducted, where L402 loses 3 points for them" ], "goodFor": "Agents buying from merchants that publish UCP profiles, and platforms building agent checkout. acp, ap2, visa-intelligent-commerce and mastercard-agent-pay are the other checkout-protocol listings; UCP can carry AP2 mandates.", "slug": "ucp", "watchFor": "No release since v2026-08-25, though main changes most days" } ], "history": { "l402": [ { "causes": [ "security", "product" ], "date": "2026-11-03", "delta": -1.3, "from": 60.8, "fromGrade": "C", "to": 59.5, "toGrade": "C" }, { "causes": [ "evidence" ], "date": "2026-10-27", "delta": 0.3, "from": 60.5, "fromGrade": "C", "to": 60.8, "toGrade": "C" } ], "ucp": null }, "job": { "capability": "payments.protocol", "name": "Agent payment protocols" }, "others": [ { "json": "https://www.anchorterminal.com/compare/ack-pay-vs-l402.json", "title": "ACK-Pay (Agent Commerce Kit) vs L402", "url": "https://www.anchorterminal.com/compare/ack-pay-vs-l402" }, { "json": "https://www.anchorterminal.com/compare/ack-pay-vs-ucp.json", "title": "ACK-Pay (Agent Commerce Kit) vs Universal Commerce Protocol (UCP)", "url": "https://www.anchorterminal.com/compare/ack-pay-vs-ucp" }, { "json": "https://www.anchorterminal.com/compare/acp-vs-l402.json", "title": "Agentic Commerce Protocol (ACP) vs L402", "url": "https://www.anchorterminal.com/compare/acp-vs-l402" }, { "json": "https://www.anchorterminal.com/compare/acp-vs-ucp.json", "title": "Agentic Commerce Protocol (ACP) vs Universal Commerce Protocol (UCP)", "url": "https://www.anchorterminal.com/compare/acp-vs-ucp" }, { "json": "https://www.anchorterminal.com/compare/amex-ace-vs-l402.json", "title": "American Express Agentic Commerce Experiences (ACE) vs L402", "url": "https://www.anchorterminal.com/compare/amex-ace-vs-l402" }, { "json": "https://www.anchorterminal.com/compare/amex-ace-vs-ucp.json", "title": "American Express Agentic Commerce Experiences (ACE) vs Universal Commerce Protocol (UCP)", "url": "https://www.anchorterminal.com/compare/amex-ace-vs-ucp" }, { "json": "https://www.anchorterminal.com/compare/ap2-vs-l402.json", "title": "Agent Payments Protocol (AP2) vs L402", "url": "https://www.anchorterminal.com/compare/ap2-vs-l402" }, { "json": "https://www.anchorterminal.com/compare/ap2-vs-ucp.json", "title": "Agent Payments Protocol (AP2) vs Universal Commerce Protocol (UCP)", "url": "https://www.anchorterminal.com/compare/ap2-vs-ucp" }, { "json": "https://www.anchorterminal.com/compare/l402-vs-mastercard-agent-pay.json", "title": "L402 vs Mastercard Agent Pay", "url": "https://www.anchorterminal.com/compare/l402-vs-mastercard-agent-pay" }, { "json": "https://www.anchorterminal.com/compare/l402-vs-mpp.json", "title": "L402 vs Machine Payments Protocol (MPP)", "url": "https://www.anchorterminal.com/compare/l402-vs-mpp" }, { "json": "https://www.anchorterminal.com/compare/l402-vs-visa-intelligent-commerce.json", "title": "L402 vs Visa Intelligent Commerce", "url": "https://www.anchorterminal.com/compare/l402-vs-visa-intelligent-commerce" }, { "json": "https://www.anchorterminal.com/compare/l402-vs-x402.json", "title": "L402 vs x402", "url": "https://www.anchorterminal.com/compare/l402-vs-x402" }, { "json": "https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-ucp.json", "title": "Mastercard Agent Pay vs Universal Commerce Protocol (UCP)", "url": "https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-ucp" }, { "json": "https://www.anchorterminal.com/compare/mpp-vs-ucp.json", "title": "Machine Payments Protocol (MPP) vs Universal Commerce Protocol (UCP)", "url": "https://www.anchorterminal.com/compare/mpp-vs-ucp" }, { "json": "https://www.anchorterminal.com/compare/ucp-vs-visa-intelligent-commerce.json", "title": "Universal Commerce Protocol (UCP) vs Visa Intelligent Commerce", "url": "https://www.anchorterminal.com/compare/ucp-vs-visa-intelligent-commerce" }, { "json": "https://www.anchorterminal.com/compare/ucp-vs-x402.json", "title": "Universal Commerce Protocol (UCP) vs x402", "url": "https://www.anchorterminal.com/compare/ucp-vs-x402" } ], "panel": null, "scores": [ { "by": 24, "edge": "ucp", "key": "reliability", "l402": 55, "name": "Reliability", "ucp": 79, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 25, "edge": "ucp", "key": "schema", "l402": 65, "name": "Schema \u0026 documentation", "ucp": 90, "weight": 13 }, { "by": 21, "edge": "ucp", "key": "ergonomics", "l402": 61, "name": "Agent ergonomics", "ucp": 82, "weight": 13 }, { "by": 9, "edge": "ucp", "key": "security", "l402": 58, "name": "Security \u0026 auth", "ucp": 67, "weight": 14 }, { "by": 47, "edge": "l402", "key": "payments", "l402": 97, "name": "Payments \u0026 pricing", "ucp": 50, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 23, "edge": "ucp", "key": "maintenance", "l402": 47, "name": "Maintenance \u0026 community", "ucp": 70, "weight": 7 }, { "by": 6, "edge": "l402", "key": "transparency", "l402": 53, "name": "Transparency \u0026 trust", "ucp": 47, "weight": 7 } ], "summary": "Universal Commerce Protocol (UCP) scores 72 (BB) on agent readiness against L402's 59.5 (C), and leads in 5 of 7 scored categories. L402 leads on payments \u0026 pricing and transparency \u0026 trust. Both do agent payment protocols.", "tasks": null, "tutorials": [ { "title": "Fetch a Lightning-paid resource with lnget", "tool": "l402", "url": "https://www.anchorterminal.com/tutorials/l402/" } ], "verdicts": { "l402": "Stateless verification, since the macaroon commits to the invoice's payment hash. Bearer credentials, so an intercepted token can be reused unless bound by caveats, and Aperture's October authentication fixes are on its main branch with no release.", "ucp": "OpenAPI, OpenRPC and JSON Schema for every surface, official Python and JavaScript SDKs, conformance tests and live use on Shopify stores and Stripe's checkout. Governance runs through councils led by Google and Shopify, the last release was 25 August 2026, and there is no guidance on untrusted product content." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/l402-vs-ucp", "json": "https://www.anchorterminal.com/compare/l402-vs-ucp.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/l402-vs-ucp.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/l402-vs-ucp.min.md" }, "markdown": "Universal Commerce Protocol (UCP) scores 72 (BB) on agent readiness against L402's 59.5 (C), and leads in 5 of 7 scored categories. L402 leads on payments \u0026 pricing and transparency \u0026 trust. Both do agent payment protocols.\n\n- L402: grade C, 59.5/100, rank graded, not ranked against tools. Markdown https://www.anchorterminal.com/tools/l402.md · JSON https://www.anchorterminal.com/api/v1/tools/l402.json\n- Universal Commerce Protocol (UCP): grade BB, 72/100, rank graded, not ranked against tools. Markdown https://www.anchorterminal.com/tools/ucp.md · JSON https://www.anchorterminal.com/api/v1/tools/ucp.json\n- All 30 pay per call comparisons: https://www.anchorterminal.com/compare/pay-per-call/index.md\n- All 39 checkout comparisons: https://www.anchorterminal.com/compare/checkout-protocols/index.md\n\n## Which one, for what\n\n### L402 (C)\n\nGood for: Bitcoin-native sellers and agents that already hold Lightning liquidity and want stateless, account-free API access.\n\nAhead on:\n- Payments \u0026 pricing, 97 against 50\n- Transparency \u0026 trust, 53 against 47\n\nAlso in its favour:\n- No key needed to call it\n\nWatch for: Bearer credentials, so an intercepted token can be reused unless bound by caveats\n\n### Universal Commerce Protocol (UCP) (BB)\n\nGood for: Agents buying from merchants that publish UCP profiles, and platforms building agent checkout. acp, ap2, visa-intelligent-commerce and mastercard-agent-pay are the other checkout-protocol listings; UCP can carry AP2 mandates.\n\nAhead on:\n- Reliability, 79 against 55\n- Schema \u0026 documentation, 90 against 65\n- Agent ergonomics, 82 against 61\n- Security \u0026 auth, 67 against 58\n- Maintenance \u0026 community, 70 against 47\n\nAlso in its favour:\n- Agent-ready, a grade of BB or better\n- Open source\n- No incidents deducted, where L402 loses 3 points for them\n\nWatch for: No release since v2026-08-25, though main changes most days\n\n\n## Why the edge\n\n### Payments \u0026 pricing: L402 +47\n\n- L402 (97): L402 is a machine payment protocol (40). No protocol fee, the payer pays Lightning routing fees and the price arrives in the invoice (20). Free to implement, with MIT tools (20). A funded Lightning wallet is all an agent needs, no account, though getting a node or custodial wallet usually takes a person, and Nostr Wallet Connect support in l402sdk is unreleased (17).\n- Universal Commerce Protocol (UCP) (50): Protocol reading. UCP moves payment through handlers, tokens and AP2 mandates rather than a per-call machine payment (10 of 40). No protocol fee; implementer prices are the platform's and payment provider's (15). The spec, SDKs and samples are free (20). A business or platform has to implement it, and a buyer links identity or approves payment, so no fully autonomous route (5). 10 + 15 + 20 + 5 = 50.\n\n### Schema \u0026 documentation: Universal Commerce Protocol (UCP) +25\n\n- L402 (65): A header grammar in section 5.3 and a 533-line macaroon spec that defines minting, verification and caveats byte by byte (18). No llms.txt found, but the repository has an agent spec that states the whole protocol in about 560 tokens (7). The 402-line spec uses RFC 2119 language and covers HTTP and gRPC flows (17). Fields and caveat formats are defined, with less detail on the invoice parameters (11). Examples of challenge and credential headers, and no error codes beyond the status codes (7). No version number on the spec and no changelog, only a backwards-compatibility section for the LSAT name (5).\n- Universal Commerce Protocol (UCP) (90): OpenAPI for each REST service, OpenRPC for the MCP and embedded bindings and JSON Schema 2020-12 throughout (25). ucp.dev serves llms.txt, and AGENT_IMPLEMENTER.md guides agents implementing the spec (10). The spec gives MUST and SHOULD rules with rationale for negotiation, signatures and permalinks (17). Typed schemas with required fields, namespaced extension types and version requirements (13). Examples validated in CI and an error code table with continue_url handling (13). Dated versions with release tags and release-note drafts generated from tags; no separate changelog page was read (12). 25 + 10 + 17 + 13 + 13 + 12 = 90.\n\n### Reliability: Universal Commerce Protocol (UCP) +24\n\n- L402 (55): Graded as a protocol on reference implementations (30), public servers (25), spec stability (25) and test suites (20). Lightning Labs ships Aperture (a Go reverse proxy), lnget (a Go client) and l402sdk (a Rust core with Python, Go and WASM bindings, whose changelog dates 0.2.0 to 29 October 2026 with no tag in the repository), and the spec still points to third-party JavaScript libraries (22). There's no facilitator role and no directory, and the named production users on l402.tech are still Lightning Labs' own Loop and Pool (8). A standalone RFC-style spec rewritten in March 2026 and unchanged since 20 March, while bLIP-0026 isn't merged in the bLIP repository (its newest commit is 17 July) and the maintainers work in their own repository (15). No test vectors in the spec, but Aperture has unit tests for tampered tokens and l402sdk runs a regtest suite against Aperture with LND and Core Lightning (10). 22+8+15+10 = 55.\n- Universal Commerce Protocol (UCP) (79): Protocol reading, split as reference implementations 30, live deployments 25, spec stability 25 and test vectors 20. Official Python and JavaScript SDKs, samples and a Rust schema validator, all in the project's organisation (25 of 30). Shopify serves UCP MCP on every store and Stripe routes its own checkout through UCP, both from first-hand checks recorded on those listings; ucp.dev lists about 50 endorsers, which are claims (20 of 25). Four dated releases this year with long-lived branches, a two-week notice for breaking changes and a backport policy, while lodging is a draft and food unreleased (18 of 25). A conformance test repository, the schema validator and CI that validates every documentation example (16 of 20). 25 + 20 + 18 + 16 = 79.\n\n### Maintenance \u0026 community: Universal Commerce Protocol (UCP) +23\n\n- L402 (47): Aperture v0.4.3 on 2 October 2026, a signed release on the 0.4 line that backports rate-limit fixes, 32 days before the check. v0.5.0 (25 March) is still the newest on main, so `go install` at latest doesn't get v0.4.3 (20). Two dated releases in the 90 days from 5 August, v0.4.3 and l402sdk 0.2.0 in its changelog (29 October, untagged), against the three the line asks for. The spec and lnget have no commit since 20 March (0). Per the 1 October check, Aperture has 31 open issues; issue replies weren't re-read, and Aperture merged 17 pull requests from 12 August to 30 October, including outside contributors' (12). lnget's last release is v1.1.0 from 20 March 2026 and l402sdk 0.2.0 isn't tagged (7). CI runs in Aperture, lnget and l402sdk and dependencies were updated in October, Aperture's on 15 October and l402sdk's on 28 October (8). 20+0+12+7+8 = 47.\n- Universal Commerce Protocol (UCP) (70): The latest release is v2026-08-25, 73 days before this check (20). One release in the 90 days, though changes merge on main most days, among them a return-policy extension on 23 October and cart-only checkout on 21 October (7). Pull requests from Google, Shopify and outside contributors merge within days; 262 issues and pull requests are open (18). Official SDKs, updated 5 November (15). CI with linting, spellcheck, governance checks and example validation, and Dependabot updates (10). 20 + 7 + 18 + 15 + 10 = 70.\n\n### Agent ergonomics: Universal Commerce Protocol (UCP) +21\n\n- L402 (61): A 402, a Lightning payment and a retry, after which the same token works for later calls until its caveats expire (21). Caveats can carry expiry, service tiers and capabilities, but there's one price per challenge and no negotiation of options (12). No error vocabulary, so a client sees 402 or 401 and nothing more specific (6). Paying twice is avoided by reusing the token, and replay limits come only from caveats and revocation (12). Released clients and servers are Go only, the multi-language SDK is unreleased and the JavaScript options are third-party (10).\n- Universal Commerce Protocol (UCP) (82): Protocol reading. Capability negotiation means an agent sees only what both sides support, though the schemas are large (18 of 25). Catalogue search pages with a cursor and has_next_page (15 of 20). An error model with codes and continue_url to hand a buyer to the business when the agent can't finish (18). The MCP binding requires an idempotency-key UUID on checkout calls for retry safety (18). Official SDKs in Python and JavaScript; every request needs a UCP-Agent profile (13 of 15). 18 + 15 + 18 + 18 + 13 = 82.\n\n### Security \u0026 auth: Universal Commerce Protocol (UCP) +9\n\n- L402 (58): The credential is a bearer macaroon plus preimage, and the spec says an intercepted one can be reused. Binding to an IP, TLS certificate or origin through caveats is optional (18). Caveats can narrow a token's expiry and scope before it's handed to another agent, lnget has --max-cost and --max-fee, and the spec says clients SHOULD enforce a maximum payment (15). Clients MUST check the invoice amount before paying, since a server can ask for any sum (10). Lightning payments leave a preimage as proof but no receipt header, and Aperture adds a dashboard and Prometheus metrics for operators (8). No SECURITY.md in Aperture or lnget and no advisories in OSV for either. Aperture's main branch bound MPP challenges to their resource on 7 October, after issue 272 reported unverified MPP receipts, but no release carries it (7). 18+15+10+8+7 = 58.\n- Universal Commerce Protocol (UCP) (67): OAuth 2.0 identity linking, RFC 9421 signatures for signed agents with key IDs bound to JWK thumbprints, and payment handlers with token exchange instead of raw card data (25 of 30). Checkout can hand back to the buyer through continue_url or an embedded checkout, and AP2 mandates record consent, but unattended completion is allowed by design (15 of 20). The permalink spec treats URL inputs as untrusted and requires server-side validation, but we found no guidance on product text reaching an agent (5 of 15). Order events go to business webhooks; we didn't read whether they are signed (8 of 15). SECURITY.md routes reports to Google's intake with a stated response time and GitHub advisories (14 of 20). 25 + 15 + 5 + 8 + 14 = 67.\n\n## Score by category\n\n| Category | Weight | L402 | Universal Commerce Protocol (UCP) | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 55 | 79 | Universal Commerce Protocol (UCP) +24 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 65 | 90 | Universal Commerce Protocol (UCP) +25 |\n| Agent ergonomics | 13% (16.2 this run) | 61 | 82 | Universal Commerce Protocol (UCP) +21 |\n| Security \u0026 auth | 14% (17.5 this run) | 58 | 67 | Universal Commerce Protocol (UCP) +9 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 97 | 50 | L402 +47 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 47 | 70 | Universal Commerce Protocol (UCP) +23 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 53 | 47 | L402 +6 |\n| Negative events | ≤15 | -3 | 0 | |\n| **Total** | | **59.5 · C** | **72 · BB** | |\n\n## Facts side by side\n\n| Fact | L402 | Universal Commerce Protocol (UCP) |\n| --- | --- | --- |\n| Kind | Payment protocol | Payment protocol |\n| Vendor | Lightning Labs | UCP Authors (Google, Shopify and co-developers) |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports | | |\n| Auth | None | OAuth |\n| Pricing | Free | Free |\n| x402 | no | no |\n| Licence | MIT (per l402.tech) | Apache-2.0 |\n| Read-only variant documented | no | no |\n| llms.txt | no | yes |\n| Last release | 2026-10-02 | 2026-08-25 |\n| Terms last updated | no document linked | no document linked |\n| Privacy policy last updated | no document linked | no document linked |\n| Popularity | 89 stars | 3.5k stars |\n| Agent reviews | 3/5 (2) | none |\n\n## How the scores have moved\n\n### L402\n\n- -1.3 on 3 November 2026: security, product\n- +0.3 on 27 October 2026: new evidence\n\n### Universal Commerce Protocol (UCP)\n\nNo score change since it was listed.\n\n## Verdicts\n\n**L402.** Stateless verification, since the macaroon commits to the invoice's payment hash. Bearer credentials, so an intercepted token can be reused unless bound by caveats, and Aperture's October authentication fixes are on its main branch with no release.\n\n**Universal Commerce Protocol (UCP).** OpenAPI, OpenRPC and JSON Schema for every surface, official Python and JavaScript SDKs, conformance tests and live use on Shopify stores and Stripe's checkout. Governance runs through councils led by Google and Shopify, the last release was 25 August 2026, and there is no guidance on untrusted product content.\n\n## Before you call either\n\n### L402\n\n1. Run lnget with `--max-cost` and `--max-fee` set, and check the invoice amount before paying, since the server can ask for anything\n2. Accept both `LSAT` and `L402` in challenges, servers still send both\n3. Reuse a paid token for later calls until its caveats expire rather than paying again\n4. Keep macaroons and preimages out of logs, they're bearer credentials\n5. Build Aperture from main, not v0.5.0, until a release carries the October authentication and MPP binding fixes\n\n### Universal Commerce Protocol (UCP)\n\n1. Read the business profile first and call only the capabilities both profiles declare\n2. Send a fresh idempotency-key UUID on each checkout call and reuse it on retry\n3. Hand the buyer the continue_url when a checkout needs a person instead of retrying\n4. Send a UCP-Agent profile, and sign requests with RFC 9421 if the business requires signed agents\n\n## Tutorials\n\n- [Fetch a Lightning-paid resource with lnget](https://www.anchorterminal.com/tutorials/l402/), for L402\n\n## Questions\n\n### Which is better for AI agents, L402 or Universal Commerce Protocol (UCP)?\n\nUniversal Commerce Protocol (UCP) scores 72 (BB) on agent readiness against L402's 59.5 (C), and leads in 5 of 7 scored categories. L402 leads on payments \u0026 pricing and transparency \u0026 trust.\n\n### Are L402 and Universal Commerce Protocol (UCP) open source?\n\nNo open-source release is listed for L402. Universal Commerce Protocol (UCP) is open source (Apache-2.0).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/l402-vs-ucp.json, and with the fewest tokens: https://www.anchorterminal.com/compare/l402-vs-ucp.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"l402\", \"b\": \"ucp\"}`. From a terminal: `anchor compare l402 ucp`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/l402.json and https://www.anchorterminal.com/api/v1/tools/ucp.json\n\n## Other comparisons with L402 or Universal Commerce Protocol (UCP)\n\n- [ACK-Pay (Agent Commerce Kit) vs L402](https://www.anchorterminal.com/compare/ack-pay-vs-l402.md)\n- [ACK-Pay (Agent Commerce Kit) vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/ack-pay-vs-ucp.md)\n- [Agentic Commerce Protocol (ACP) vs L402](https://www.anchorterminal.com/compare/acp-vs-l402.md)\n- [Agentic Commerce Protocol (ACP) vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/acp-vs-ucp.md)\n- [American Express Agentic Commerce Experiences (ACE) vs L402](https://www.anchorterminal.com/compare/amex-ace-vs-l402.md)\n- [American Express Agentic Commerce Experiences (ACE) vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/amex-ace-vs-ucp.md)\n- [Agent Payments Protocol (AP2) vs L402](https://www.anchorterminal.com/compare/ap2-vs-l402.md)\n- [Agent Payments Protocol (AP2) vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/ap2-vs-ucp.md)\n- [L402 vs Mastercard Agent Pay](https://www.anchorterminal.com/compare/l402-vs-mastercard-agent-pay.md)\n- [L402 vs Machine Payments Protocol (MPP)](https://www.anchorterminal.com/compare/l402-vs-mpp.md)\n- [L402 vs Visa Intelligent Commerce](https://www.anchorterminal.com/compare/l402-vs-visa-intelligent-commerce.md)\n- [L402 vs x402](https://www.anchorterminal.com/compare/l402-vs-x402.md)\n- [Mastercard Agent Pay vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-ucp.md)\n- [Machine Payments Protocol (MPP) vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/mpp-vs-ucp.md)\n- [Universal Commerce Protocol (UCP) vs Visa Intelligent Commerce](https://www.anchorterminal.com/compare/ucp-vs-visa-intelligent-commerce.md)\n- [Universal Commerce Protocol (UCP) vs x402](https://www.anchorterminal.com/compare/ucp-vs-x402.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "L402 vs Universal Commerce Protocol (UCP)", "url": "" } ], "description": "Universal Commerce Protocol scores 72 (BB) to L402's 59.5 (C) for agent payment protocols. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "L402 C 59.5", "Universal Commerce Protocol (UCP) BB 72", "scores" ], "h1": "L402 vs Universal Commerce Protocol (UCP)", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/l402-vs-ucp", "published": "2026-10-01", "section": "tools", "title": "L402 vs Universal Commerce Protocol for AI agents (2026)", "toc": null, "updated": "2026-11-06", "url": "https://www.anchorterminal.com/compare/l402-vs-ucp" }, "tokens": { "markdown": 4350, "slim": 2730 }, "version": 1 }