Mastercard Agent Pay vs Universal Commerce Protocol (UCP)

Mastercard Agent Pay 23

The last dated change is Agent Pay for Machines on 10 June 2026, 128 days before this check (10). No three dated releases in the last 90 days. The last Verifiable Intent commit is 20 April 2026 (0). No public Agent Pay changelog or issue tracker. Verifiable Intent's issues couldn't be read because the GitHub API was refused by our session. Mastercard Developers has a support route (5 of 15 for a closed service). No official Agent Pay SDK, and Verifiable Intent's SDK isn't on PyPI (3 of 15). Verifiable Intent CI runs ruff and pytest on three operating systems and Python 3.10 to 3.13, with actions pinned to tags (5 of 10). 23.

Universal Commerce Protocol (UCP) 70

The latest release is v2026-08-25, 73 days before this check (20). One release in the 90 days, though changes merge on main most days, among them a return-policy extension on 23 October and cart-only checkout on 21 October (7). Pull requests from Google, Shopify and outside contributors merge within days; 262 issues and pull requests are open (18). Official SDKs, updated 5 November (15). CI with linting, spellcheck, governance checks and example validation, and Dependabot updates (10). 20 + 7 + 18 + 15 + 10 = 70.

Mastercard Agent Pay 38

Protocol reading. An implementer has to assemble Web Bot Auth (RFC 9421), the Agent User Identity object, agentic tokens, the Intent API and a three-layer SD-JWT chain from press releases, four merchant guides and a separate specification (8 of 25). Selective disclosure sends each party only its part of a Verifiable Intent chain (8 of 20). No documented Agent Pay errors. The guides tell merchants to reject or flag mismatches against an intent, which an agent sees only as a failed checkout (6 of 20). Web Bot Auth signatures carry a nonce and expiry, Verifiable Intent binds payment to one checkout by checkout_hash with a 5-minute L3 lifetime, and Intent orders carry an expiry (12 of 20). One SDK, Python, from git. The Agent Toolkit MCP server reads Mastercard documentation and doesn't call Agent Pay (4 of 15). 38.

Universal Commerce Protocol (UCP) 82

Protocol reading. Capability negotiation means an agent sees only what both sides support, though the schemas are large (18 of 25). Catalogue search pages with a cursor and has_next_page (15 of 20). An error model with codes and continue_url to hand a buyer to the business when the agent can't finish (18). The MCP binding requires an idempotency-key UUID on checkout calls for retry safety (18). Official SDKs in Python and JavaScript; every request needs a UCP-Agent profile (13 of 15). 18 + 15 + 18 + 18 + 13 = 82.

Mastercard Agent Pay 47

No public Agent Pay API contract. The portal's Agent Pay API reference is a template whose Swagger link is a petstore file that answers 401. Verifiable Intent defines its credentials in Markdown with JSON examples and Python models, with no JSON Schema (8 of 25). developer.mastercard.com serves llms.txt and Markdown for every page, but Agent Pay has no entry in it. Verifiable Intent's site has no llms.txt, though its Markdown sources are in the repository (7 of 10). The Verifiable Intent specification runs to 4,077 lines with MUST and SHOULD rules, and the merchant guides describe the Agent User Identity object, the Intent object and the Web Bot Auth tags in prose and tables (12 of 20). Verifiable Intent constraints are typed, such as mandate.payment.amount_range with currency and integer minor units. The Intent fields in the guides carry no types (9 of 15). Examples in the specification and guides. No Agent Pay error codes (7 of 15). Verifiable Intent keeps a CHANGELOG.md with one entry, and its April breaking change isn't in it. Agent Pay has no changelog (4 of 15). 47.

Universal Commerce Protocol (UCP) 90

OpenAPI for each REST service, OpenRPC for the MCP and embedded bindings and JSON Schema 2020-12 throughout (25). ucp.dev serves llms.txt, and AGENT_IMPLEMENTER.md guides agents implementing the spec (10). The spec gives MUST and SHOULD rules with rationale for negotiation, signatures and permalinks (17). Typed schemas with required fields, namespaced extension types and version requirements (13). Examples validated in CI and an error code table with continue_url handling (13). Dated versions with release tags and release-note drafts generated from tags; no separate changelog page was read (12). 25 + 10 + 17 + 13 + 13 + 12 = 90.

Mastercard Agent Pay 40

Protocol reading, as for AP2 and ACP, split as reference implementations 30, live deployments 25, spec stability 25 and test vectors 20. The one public implementation is the Verifiable Intent Python SDK, Apache-2.0 and installed from a clone (no PyPI package), with five example scripts. Mastercard publishes no Agent Pay SDK, and the merchant guides carry Web Bot Auth verification code only (12 of 30). Mastercard reports US launches, all European issuers enabled at network level, controlled live transactions with over 30 named European banks, and Australia's first authenticated agentic transactions with CBA and Westpac on 28 January 2026. Most are described as controlled trials (18 of 25). No public Agent Pay specification. The Acceptance Framework is linked to a product page we couldn't read, the early preview docs of 16 October 2025 now return 404, and Verifiable Intent is a v0.1 draft with a breaking field change on 17 April 2026 (5 of 25). Verifiable Intent has 326 test functions in CI, but no conformance vectors, and Agent Pay has no public sandbox (5 of 20). 40.

Universal Commerce Protocol (UCP) 79

Protocol reading, split as reference implementations 30, live deployments 25, spec stability 25 and test vectors 20. Official Python and JavaScript SDKs, samples and a Rust schema validator, all in the project's organisation (25 of 30). Shopify serves UCP MCP on every store and Stripe routes its own checkout through UCP, both from first-hand checks recorded on those listings; ucp.dev lists about 50 endorsers, which are claims (20 of 25). Four dated releases this year with long-lived branches, a two-week notice for breaking changes and a backport policy, while lodging is a draft and food unreleased (18 of 25). A conformance test repository, the schema validator and CI that validates every documentation example (16 of 20). 25 + 20 + 18 + 16 = 79.

Mastercard Agent Pay 25

Protocol reading. Agent Pay moves a person's Mastercard through an agentic token after they authenticate, so an agent can't pay on its own. Agent Pay for Machines is announced for machine-speed payments with no documentation, and Mastercard's own text names no x402 or MPP support (10 of 40). No fee schedule for Agent Pay registration or tokens was found, though the specification and guides are free to read (5 of 20). Verifiable Intent and the merchant guides are free with no account. Agent Pay itself has no public sandbox or trial (10 of 20). Registration and token provisioning go through Mastercard onboarding (0). 25.

Universal Commerce Protocol (UCP) 50

Protocol reading. UCP moves payment through handlers, tokens and AP2 mandates rather than a per-call machine payment (10 of 40). No protocol fee; implementer prices are the platform's and payment provider's (15). The spec, SDKs and samples are free (20). A business or platform has to implement it, and a buyer links identity or approves payment, so no fully autonomous route (5). 10 + 15 + 20 + 5 = 50.

Mastercard Agent Pay 38

Agent Pay is closed and its programme rules weren't found in public. Verifiable Intent is Apache-2.0 under a DCO (15 of 30). No Agent Pay data handling statement was found. Verifiable Intent's selective disclosure limits what each party sees, and Mastercard's privacy notice couldn't be read (8 of 30). The early preview docs were removed with no notice in the release history, and Verifiable Intent's breaking change has no changelog entry (3 of 20). No sub-processors or data locations were found for Agent Pay (5 of 20). 31.

Universal Commerce Protocol (UCP) 47

Apache-2.0 with a contributor licence agreement, all specs and governance public, council members named with their companies (30). ucp.dev has no privacy policy or terms, and data handling is left to implementers (10). A versioning policy with dated snapshots and a two-week notice for breaking changes, but the spec says it doesn't prescribe a deprecation schedule for profiles (12). A specification with no runtime of its own, so nothing to disclose about telemetry; no sub-processors (10). 30 + 10 + 12 + 10 = 62.