{ "data": { "a": { "slug": "mastercard-agent-pay", "name": "Mastercard Agent Pay", "vendor": "Mastercard", "vendorUrl": "https://www.mastercard.com/us/en/business/artificial-intelligence/mastercard-agent-pay.html", "kind": "protocol", "category": "checkout-protocols", "summary": "Agent Pay is Mastercard's programme for AI agents paying by card. Registered agents identify themselves with Web Bot Auth signatures and pay with scoped agentic tokens. Agent Pay for Machines, announced in June 2026, extends it to machine payments.", "url": "https://www.anchorterminal.com/tools/mastercard-agent-pay", "markdownUrl": "https://www.anchorterminal.com/tools/mastercard-agent-pay.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/mastercard-agent-pay.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/mastercard-agent-pay.json", "dns": "mastercard-agent-pay.grade.anchorterminal.com", "repo": "https://github.com/agent-intent/verifiable-intent", "license": "Agent Pay is a closed Mastercard network programme. Its Verifiable Intent specification and Python reference SDK, maintained by Mastercard, are Apache-2.0", "transports": [], "packages": [], "auth": "mixed", "authNotes": "Not self-serve. Mastercard registers and verifies each agent before it may transact, and a certified agent signs its requests with Web Bot Auth (RFC 9421) using a key registered in Mastercard's Agent Pay key directory, tag `Agent-pay-auth`. Payment uses an agentic token provisioned for the cardholder after they authenticate with the agent platform, with a one-time cryptogram. Merchants are registered through their acquirer or PSP.", "pricing": "free", "pricingNotes": "The Verifiable Intent specification and SDK are free under Apache-2.0, and the merchant guides on Mastercard Developers need no account. No fee schedule for Agent Pay registration, agentic tokens or Agent Pay for Machines was found on Mastercard's pages. Card and network fees apply on the payment itself.", "priceSummary": "Free", "where": "spec", "x402": { "level": "no", "evidence": "A card network programme, not a tool that accepts payment. Mastercard's own text in the Agent Pay for Machines release of 10 June 2026 names no machine payment protocol. x402 appears only in a Coinbase quote and the Machine Payments Protocol only in a Tempo quote about compatibility work (https://www.mastercard.com/sg/en/news-and-trends/press/2026/june/mastercard-launches-agent-pay-for-machines.html, checked 2026-10-16).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-16" }, "docsUrl": "https://developer.mastercard.com/merchant-cloud/documentation/tutorials-and-guides/agentic-commerce-guide/index.md", "llmsTxt": "https://developer.mastercard.com/llms.txt", "capabilities": [ "payments.protocol", "payments.card-token", "payments.mandate", "auth.agent-identity" ], "tags": [ "protocol", "cards", "partner-only", "pre-1.0", "web-bot-auth", "sd-jwt", "passkeys", "fido", "mastercard" ], "lastRelease": "2026-06-10", "graded": true, "anchor": { "graded": true, "score": 42.7, "grade": "E", "agentReady": false, "rank": 0, "ranked": false, "notRankedWhy": "A protocol, graded on the same scale but not ranked against tools", "rankOf": 1486, "categoryRank": 5, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 38, "maintenance": 23, "payments": 25, "reliability": 40, "schema": 47, "security": 71, "transparency": 38 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "low", "date": "2026-10-16" }, "negative": 0, "verdict": "Mastercard reports Agent Pay transactions with banks in the US, Europe and Australia, and its open Verifiable Intent draft binds an agent's purchase to constraints the user signed. Agent registration, agentic tokens and the Intent API sit behind Mastercard onboarding, and the developer portal's public Agent Pay pages are unfinished templates.", "bestFor": "Agent platforms that can partner with Mastercard and need card purchases issuers recognise as agentic, with tokens instead of card numbers.", "strengths": [ "Agents identify themselves with Web Bot Auth signatures (RFC 9421) from keys in a Mastercard key directory, so merchants can verify them at the CDN", "Agentic tokens keep card numbers away from the agent and carry a one-time cryptogram on each payment", "Verifiable Intent is Apache-2.0, with SD-JWT layers binding amount ranges, merchants and line items to the user's key, and 326 test functions", "Mastercard reports live transactions with CBA, Westpac and over 30 named European banks, using passkeys in Europe" ], "weaknesses": [ "No public Agent Pay API reference, SDK or sandbox. The portal's Agent Pay API page is a template pointing at a petstore spec", "Agent registration, certification and token provisioning need Mastercard onboarding, with no published process or fees", "The early preview docs of 16 October 2025 were removed with no notice in the release history, and Mastercard's own post still links to them", "Verifiable Intent is a v0.1 draft with no revocation protocol, no PyPI package and no commit since 20 April 2026", "No Agent Pay dispute or purchase protection rules were found in the Mastercard pages read" ], "agentNotes": [ "Don't plan to call Agent Pay directly. Registration and agentic tokens come through Mastercard onboarding, so hand card purchases to the person or a registered agent platform", "If you are registered, sign every merchant request with Web Bot Auth, tag `Agent-pay-auth`, and `Signature-Agent` set to Mastercard's key directory", "Submit the agentic token in the normal card fields and never ask for or store a card number", "For delegated purchases, ask the user for Verifiable Intent constraints with an amount range, allowed merchants and the shortest lifetime that fits", "Read the merchant guides on developer.mastercard.com as Markdown. The Agent Pay docs section there has no public content" ], "metrics": { "kind": "spec", "measured": false }, "reviewCount": 4, "avgRating": 2, "history": [ { "basis": "public evidence", "confidence": "low", "grade": "E", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 42.7 } ], "editorialScores": { "ergonomics": 38, "maintenance": 23, "payments": 25, "reliability": 40, "schema": 47, "security": 71, "transparency": 31 }, "provenanceScore": 44, "checked": { "categories": { "ergonomics": "2026-10-16", "maintenance": "2026-10-16", "payments": "2026-10-16", "reliability": "2026-10-16", "schema": "2026-10-16", "security": "2026-10-16", "transparency": "2026-10-16" }, "last": "2026-10-16", "lastMoved": "2026-10-30", "oldest": "2026-10-16", "stale": false, "staleAfterDays": 90 } }, "letme": { "capability": "https://letme.dev/payments.protocol", "tool": "https://letme.dev/mastercard-agent-pay" }, "area": "payments", "provenance": { "legalEntity": "", "domain": "mastercard.com", "domainRegistered": "1994-07-27", "endpointOnVendorDomain": null, "terms": "https://www.mastercard.com/au/en/terms-of-use.html", "privacy": "https://www.mastercard.com/au/en/privacy.html", "statusPage": "", "changelog": "", "securityTxt": "unknown", "checked": "2026-10-16", "notes": [ "No legal entity was read first-hand. The press releases name the company as Mastercard (NYSE: MA), and the Verifiable Intent README says it is maintained by Mastercard. The terms page wasn't readable in this session.", "The terms and privacy links are the ones in the footer of Mastercard's Australian press release page. Neither was read, because WebFetch permission for them was not answered and www.mastercard.com answers curl with 403, robots.txt included.", "RDAP gives mastercard.com a registration date of 27 July 1994 and verifiableintent.dev one of 22 February 2026.", "No changelog for Agent Pay exists. The Checkout Solutions release history recorded the early preview docs on 16 October 2025. Verifiable Intent keeps a CHANGELOG.md with one entry, 0.1.0.", "security.txt on www.mastercard.com couldn't be read (403 to curl). On developer.mastercard.com it redirects to a login. Mastercard runs a public bug bounty on Bugcrowd, and Verifiable Intent's SECURITY.md takes reports by email or GitHub private reporting.", "developer.mastercard.com robots.txt disallows only /media/ and a download path. verifiableintent.dev's robots.txt carries content-signal comments and no rules.", "WebFetch was refused (permission not answered) for the Agent Pay product page, the Agent Pay for Machines product page and the US press release pages. Locale copies of the same releases were read instead. Mastercard Developers pages were read with curl as Markdown." ], "score": 44 }, "requirements": { "setupChecked": true, "card": "unknown", "minutes": 600, "credential": "mixed" }, "pageJsonUrl": "https://www.anchorterminal.com/tools/mastercard-agent-pay.json", "live": { "slug": "mastercard-agent-pay", "githubStars": 104, "securityTxt": { "url": "https://mastercard.com/.well-known/security.txt", "state": "unknown", "checkedAt": "2026-11-07T16:01:50.542853029Z" }, "llmsTxt": { "url": "https://developer.mastercard.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:32:58.075949208Z" }, "domain": { "domain": "mastercard.com", "registered": "1994-07-27", "source": "https://rdap.verisign.com/com/v1/domain/mastercard.com", "checkedAt": "2026-11-01T14:24:21.912708352Z" }, "pages": [ { "url": "https://www.mastercard.com/au/en/privacy.html", "kind": "privacy", "status": 403, "checkedAt": "2026-11-07T14:31:22.116441891Z", "changedAt": "0001-01-01T00:00:00Z" }, { "url": "https://www.mastercard.com/au/en/terms-of-use.html", "kind": "terms", "status": 403, "checkedAt": "2026-11-07T14:31:24.158269503Z", "changedAt": "0001-01-01T00:00:00Z" } ], "github": { "repo": "agent-intent/verifiable-intent", "checkedAt": "2026-11-02T08:28:26.568790042Z", "stars": 103, "archived": false, "issuesEnabled": true, "pushedAt": "2026-04-20T20:43:36Z", "openIssues": 25, "openPRs": 13, "issuesOpened90d": 10, "issuesClosed90d": 0, "prsMerged90d": 0, "ci": { "branch": "main", "runs": 6, "success": 6, "failure": 0, "other": 0, "latest": "success", "latestAt": "2026-04-20T19:07:41Z" }, "replies": { "sampled": 24, "unanswered": 23, "medianDays": 14.6 } }, "updatedAt": "2026-11-07T16:01:50.542853029Z" } }, "answer": "Universal Commerce Protocol (UCP) scores 72 (BB) on agent readiness against Mastercard Agent Pay's 42.7 (E), and leads in 6 of 7 scored categories.", "b": { "slug": "ucp", "name": "Universal Commerce Protocol (UCP)", "vendor": "UCP Authors (Google, Shopify and co-developers)", "vendorUrl": "https://ucp.dev", "kind": "protocol", "category": "checkout-protocols", "summary": "The Universal Commerce Protocol (UCP) is an open specification, co-developed by Google, Shopify and other retailers and platforms, for agents to discover a business's capabilities and run catalogue, cart, checkout, identity linking and order flows over REST, MCP or A2A.", "url": "https://www.anchorterminal.com/tools/ucp", "markdownUrl": "https://www.anchorterminal.com/tools/ucp.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/ucp.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/ucp.json", "dns": "ucp.grade.anchorterminal.com", "repo": "https://github.com/Universal-Commerce-Protocol/ucp", "license": "Apache-2.0", "transports": [], "packages": [], "auth": "oauth", "authNotes": "A specification, not a service. Identity linking uses OAuth 2.0 for a platform to act for a user at a business. Agent requests carry a UCP-Agent profile, and signed agents send RFC 9421 HTTP message signatures with a Signature-Agent header and a JWK thumbprint key ID. Payment credentials move through payment handlers and token exchange between payment and credential providers, with AP2 mandates supported.", "pricing": "free", "pricingNotes": "The specification, schemas, SDKs and conformance tests are free under Apache-2.0. Costs come from the business's platform and payment provider, not the protocol.", "priceSummary": "Free · OSS", "where": "spec", "x402": { "level": "no", "evidence": "A commerce protocol, not a tool that accepts payment; it supports AP2 mandates and payment handlers (checked 2026-11-06).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 3479, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://ucp.dev/latest/specification/overview/", "llmsTxt": "https://ucp.dev/llms.txt", "openapi": "https://github.com/Universal-Commerce-Protocol/ucp/blob/main/source/services/shopping/rest.openapi.json", "capabilities": [ "payments.protocol", "payments.checkout", "payments.mandate" ], "tags": [ "protocol", "open-standard", "open-source", "mcp", "a2a", "ap2", "openapi", "openrpc", "llms-txt", "shopify", "google", "commerce" ], "lastRelease": "2026-08-25", "graded": true, "anchor": { "graded": true, "score": 72, "grade": "BB", "agentReady": true, "rank": 0, "ranked": false, "notRankedWhy": "A protocol, graded on the same scale but not ranked against tools", "rankOf": 1486, "categoryRank": 1, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 82, "maintenance": 70, "payments": 50, "reliability": 79, "schema": 90, "security": 67, "transparency": 47 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": 0, "verdict": "OpenAPI, OpenRPC and JSON Schema for every surface, official Python and JavaScript SDKs, conformance tests and live use on Shopify stores and Stripe's checkout. Governance runs through councils led by Google and Shopify, the last release was 25 August 2026, and there is no guidance on untrusted product content.", "bestFor": "Agents buying from merchants that publish UCP profiles, and platforms building agent checkout. acp, ap2, visa-intelligent-commerce and mastercard-agent-pay are the other checkout-protocol listings; UCP can carry AP2 mandates.", "strengths": [ "Machine-readable contracts for every transport, OpenAPI, OpenRPC and JSON Schema 2020-12", "Official Python and JavaScript SDKs, a schema validator and a conformance test suite", "Idempotency keys required on MCP checkout calls", "Live on every Shopify store and as Stripe's own-checkout route", "Breaking changes announced two weeks before they merge" ], "weaknesses": [ "No release since v2026-08-25, though main changes most days", "No guidance on product descriptions or business messages as untrusted content for agents", "Lodging is a draft and food ordering unreleased", "Governing and tech councils are led by Google and Shopify members" ], "agentNotes": [ "Read the business profile first and call only the capabilities both profiles declare", "Send a fresh idempotency-key UUID on each checkout call and reuse it on retry", "Hand the buyer the continue_url when a checkout needs a person instead of retrying", "Send a UCP-Agent profile, and sign requests with RFC 9421 if the business requires signed agents" ], "metrics": { "kind": "spec", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 72 } ], "editorialScores": { "ergonomics": 82, "maintenance": 70, "payments": 50, "reliability": 79, "schema": 90, "security": 67, "transparency": 62 }, "provenanceScore": 32, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "letme": { "capability": "https://letme.dev/payments.protocol", "tool": "https://letme.dev/ucp" }, "area": "payments", "provenance": { "legalEntity": "", "domain": "ucp.dev", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://github.com/Universal-Commerce-Protocol/ucp/releases", "securityTxt": "unknown", "checked": "2026-11-06", "notes": [ "Files carry \"Copyright 2026 UCP Authors\" under Apache-2.0. No legal entity runs the project; governance is by councils whose members are named with their companies.", "Security reports go to Google's g.co/vulnz with a five-working-day response, coordinated through GitHub Security Advisories (SECURITY.md in the .github repository).", "ucp.dev has no robots.txt and serves llms.txt. No terms or privacy policy found for the site.", "The registration date of ucp.dev wasn't found through RDAP." ], "score": 32 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/ucp.json", "live": { "slug": "ucp", "versions": [ { "registry": "github", "name": "Universal-Commerce-Protocol/ucp", "version": "v2026-08-25", "released": "2026-08-25", "seenAt": "2026-11-07T00:13:40.257304662Z" } ], "githubStars": 3480, "securityTxt": { "url": "https://ucp.dev/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:23.109475398Z" }, "llmsTxt": { "url": "https://ucp.dev/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:34:12.746672159Z" }, "updatedAt": "2026-11-07T16:00:23.109475398Z" } }, "edges": [ { "by": 47, "category": "maintenance", "leads": "ucp", "name": "Maintenance \u0026 community", "reasons": { "a": "The last dated change is Agent Pay for Machines on 10 June 2026, 128 days before this check (10). No three dated releases in the last 90 days. The last Verifiable Intent commit is 20 April 2026 (0). No public Agent Pay changelog or issue tracker. Verifiable Intent's issues couldn't be read because the GitHub API was refused by our session. Mastercard Developers has a support route (5 of 15 for a closed service). No official Agent Pay SDK, and Verifiable Intent's SDK isn't on PyPI (3 of 15). Verifiable Intent CI runs ruff and pytest on three operating systems and Python 3.10 to 3.13, with actions pinned to tags (5 of 10). 23.", "b": "The latest release is v2026-08-25, 73 days before this check (20). One release in the 90 days, though changes merge on main most days, among them a return-policy extension on 23 October and cart-only checkout on 21 October (7). Pull requests from Google, Shopify and outside contributors merge within days; 262 issues and pull requests are open (18). Official SDKs, updated 5 November (15). CI with linting, spellcheck, governance checks and example validation, and Dependabot updates (10). 20 + 7 + 18 + 15 + 10 = 70." }, "scores": { "a": 23, "b": 70 } }, { "by": 44, "category": "ergonomics", "leads": "ucp", "name": "Agent ergonomics", "reasons": { "a": "Protocol reading. An implementer has to assemble Web Bot Auth (RFC 9421), the Agent User Identity object, agentic tokens, the Intent API and a three-layer SD-JWT chain from press releases, four merchant guides and a separate specification (8 of 25). Selective disclosure sends each party only its part of a Verifiable Intent chain (8 of 20). No documented Agent Pay errors. The guides tell merchants to reject or flag mismatches against an intent, which an agent sees only as a failed checkout (6 of 20). Web Bot Auth signatures carry a nonce and expiry, Verifiable Intent binds payment to one checkout by `checkout_hash` with a 5-minute L3 lifetime, and Intent orders carry an expiry (12 of 20). One SDK, Python, from git. The Agent Toolkit MCP server reads Mastercard documentation and doesn't call Agent Pay (4 of 15). 38.", "b": "Protocol reading. Capability negotiation means an agent sees only what both sides support, though the schemas are large (18 of 25). Catalogue search pages with a cursor and has_next_page (15 of 20). An error model with codes and continue_url to hand a buyer to the business when the agent can't finish (18). The MCP binding requires an idempotency-key UUID on checkout calls for retry safety (18). Official SDKs in Python and JavaScript; every request needs a UCP-Agent profile (13 of 15). 18 + 15 + 18 + 18 + 13 = 82." }, "scores": { "a": 38, "b": 82 } }, { "by": 43, "category": "schema", "leads": "ucp", "name": "Schema \u0026 documentation", "reasons": { "a": "No public Agent Pay API contract. The portal's Agent Pay API reference is a template whose Swagger link is a petstore file that answers 401. Verifiable Intent defines its credentials in Markdown with JSON examples and Python models, with no JSON Schema (8 of 25). developer.mastercard.com serves llms.txt and Markdown for every page, but Agent Pay has no entry in it. Verifiable Intent's site has no llms.txt, though its Markdown sources are in the repository (7 of 10). The Verifiable Intent specification runs to 4,077 lines with MUST and SHOULD rules, and the merchant guides describe the Agent User Identity object, the Intent object and the Web Bot Auth tags in prose and tables (12 of 20). Verifiable Intent constraints are typed, such as `mandate.payment.amount_range` with currency and integer minor units. The Intent fields in the guides carry no types (9 of 15). Examples in the specification and guides. No Agent Pay error codes (7 of 15). Verifiable Intent keeps a CHANGELOG.md with one entry, and its April breaking change isn't in it. Agent Pay has no changelog (4 of 15). 47.", "b": "OpenAPI for each REST service, OpenRPC for the MCP and embedded bindings and JSON Schema 2020-12 throughout (25). ucp.dev serves llms.txt, and AGENT_IMPLEMENTER.md guides agents implementing the spec (10). The spec gives MUST and SHOULD rules with rationale for negotiation, signatures and permalinks (17). Typed schemas with required fields, namespaced extension types and version requirements (13). Examples validated in CI and an error code table with continue_url handling (13). Dated versions with release tags and release-note drafts generated from tags; no separate changelog page was read (12). 25 + 10 + 17 + 13 + 13 + 12 = 90." }, "scores": { "a": 47, "b": 90 } }, { "by": 39, "category": "reliability", "leads": "ucp", "name": "Reliability", "reasons": { "a": "Protocol reading, as for AP2 and ACP, split as reference implementations 30, live deployments 25, spec stability 25 and test vectors 20. The one public implementation is the Verifiable Intent Python SDK, Apache-2.0 and installed from a clone (no PyPI package), with five example scripts. Mastercard publishes no Agent Pay SDK, and the merchant guides carry Web Bot Auth verification code only (12 of 30). Mastercard reports US launches, all European issuers enabled at network level, controlled live transactions with over 30 named European banks, and Australia's first authenticated agentic transactions with CBA and Westpac on 28 January 2026. Most are described as controlled trials (18 of 25). No public Agent Pay specification. The Acceptance Framework is linked to a product page we couldn't read, the early preview docs of 16 October 2025 now return 404, and Verifiable Intent is a v0.1 draft with a breaking field change on 17 April 2026 (5 of 25). Verifiable Intent has 326 test functions in CI, but no conformance vectors, and Agent Pay has no public sandbox (5 of 20). 40.", "b": "Protocol reading, split as reference implementations 30, live deployments 25, spec stability 25 and test vectors 20. Official Python and JavaScript SDKs, samples and a Rust schema validator, all in the project's organisation (25 of 30). Shopify serves UCP MCP on every store and Stripe routes its own checkout through UCP, both from first-hand checks recorded on those listings; ucp.dev lists about 50 endorsers, which are claims (20 of 25). Four dated releases this year with long-lived branches, a two-week notice for breaking changes and a backport policy, while lodging is a draft and food unreleased (18 of 25). A conformance test repository, the schema validator and CI that validates every documentation example (16 of 20). 25 + 20 + 18 + 16 = 79." }, "scores": { "a": 40, "b": 79 } }, { "by": 25, "category": "payments", "leads": "ucp", "name": "Payments \u0026 pricing", "reasons": { "a": "Protocol reading. Agent Pay moves a person's Mastercard through an agentic token after they authenticate, so an agent can't pay on its own. Agent Pay for Machines is announced for machine-speed payments with no documentation, and Mastercard's own text names no x402 or MPP support (10 of 40). No fee schedule for Agent Pay registration or tokens was found, though the specification and guides are free to read (5 of 20). Verifiable Intent and the merchant guides are free with no account. Agent Pay itself has no public sandbox or trial (10 of 20). Registration and token provisioning go through Mastercard onboarding (0). 25.", "b": "Protocol reading. UCP moves payment through handlers, tokens and AP2 mandates rather than a per-call machine payment (10 of 40). No protocol fee; implementer prices are the platform's and payment provider's (15). The spec, SDKs and samples are free (20). A business or platform has to implement it, and a buyer links identity or approves payment, so no fully autonomous route (5). 10 + 15 + 20 + 5 = 50." }, "scores": { "a": 25, "b": 50 } }, { "by": 9, "category": "transparency", "leads": "ucp", "name": "Transparency \u0026 trust", "reasons": { "a": "Agent Pay is closed and its programme rules weren't found in public. Verifiable Intent is Apache-2.0 under a DCO (15 of 30). No Agent Pay data handling statement was found. Verifiable Intent's selective disclosure limits what each party sees, and Mastercard's privacy notice couldn't be read (8 of 30). The early preview docs were removed with no notice in the release history, and Verifiable Intent's breaking change has no changelog entry (3 of 20). No sub-processors or data locations were found for Agent Pay (5 of 20). 31.", "b": "Apache-2.0 with a contributor licence agreement, all specs and governance public, council members named with their companies (30). ucp.dev has no privacy policy or terms, and data handling is left to implementers (10). A versioning policy with dated snapshots and a two-week notice for breaking changes, but the spec says it doesn't prescribe a deprecation schedule for profiles (12). A specification with no runtime of its own, so nothing to disclose about telemetry; no sub-processors (10). 30 + 10 + 12 + 10 = 62." }, "scores": { "a": 38, "b": 47 } } ], "facts": [ { "a": "Payment protocol", "b": "Payment protocol", "name": "Kind" }, { "a": "Mastercard", "b": "UCP Authors (Google, Shopify and co-developers)", "name": "Vendor" }, { "a": "no (local only)", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "", "b": "", "name": "Transports" }, { "a": "OAuth or key", "b": "OAuth", "name": "Auth" }, { "a": "Free", "b": "Free", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Agent Pay is a closed Mastercard network programme. Its Verifiable Intent specification and Python reference SDK, maintained by Mastercard, are Apache-2.0", "b": "Apache-2.0", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "2026-06-10", "b": "2026-08-25", "name": "Last release" }, { "a": "couldn't be read", "b": "no document linked", "name": "Terms last updated" }, { "a": "couldn't be read", "b": "no document linked", "name": "Privacy policy last updated" }, { "a": "couldn't be read", "b": "not read yet", "name": "Customer content may train models" }, { "a": "couldn't be read", "b": "not read yet", "name": "Terms restrict automated access" }, { "a": "couldn't be read", "b": "not read yet", "name": "Terms restrict benchmarking" }, { "a": "couldn't be read", "b": "not read yet", "name": "Terms or service can change without notice" }, { "a": "couldn't be read", "b": "not read yet", "name": "Arbitration or class-action waiver" }, { "a": "none", "b": "3.5k stars", "name": "Popularity" }, { "a": "2/5 (4)", "b": "none", "name": "Agent reviews" } ], "faq": [ { "answer": "Universal Commerce Protocol (UCP) scores 72 (BB) on agent readiness against Mastercard Agent Pay's 42.7 (E), and leads in 6 of 7 scored categories.", "question": "Which is better for AI agents, Mastercard Agent Pay or Universal Commerce Protocol (UCP)?" }, { "answer": "No open-source release is listed for Mastercard Agent Pay. Universal Commerce Protocol (UCP) is open source (Apache-2.0).", "question": "Are Mastercard Agent Pay and Universal Commerce Protocol (UCP) open source?" } ], "goodFor": [ { "aheadOn": null, "also": null, "goodFor": "Agent platforms that can partner with Mastercard and need card purchases issuers recognise as agentic, with tokens instead of card numbers.", "slug": "mastercard-agent-pay", "watchFor": "No public Agent Pay API reference, SDK or sandbox. The portal's Agent Pay API page is a template pointing at a petstore spec" }, { "aheadOn": [ "Reliability, 79 against 40", "Schema \u0026 documentation, 90 against 47", "Agent ergonomics, 82 against 38", "Payments \u0026 pricing, 50 against 25", "Maintenance \u0026 community, 70 against 23", "Transparency \u0026 trust, 47 against 38" ], "also": [ "Agent-ready, a grade of BB or better", "Open source" ], "goodFor": "Agents buying from merchants that publish UCP profiles, and platforms building agent checkout. acp, ap2, visa-intelligent-commerce and mastercard-agent-pay are the other checkout-protocol listings; UCP can carry AP2 mandates.", "slug": "ucp", "watchFor": "No release since v2026-08-25, though main changes most days" } ], "history": { "mastercard-agent-pay": [ { "causes": [ "method" ], "date": "2026-10-30", "delta": -0.3, "from": 43, "fromGrade": "E", "to": 42.7, "toGrade": "E" }, { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.5, "from": 42.5, "fromGrade": "E", "to": 43, "toGrade": "E" } ], "ucp": null }, "job": { "capability": "payments.protocol", "name": "Agent payment protocols" }, "others": [ { "json": "https://www.anchorterminal.com/compare/ack-pay-vs-mastercard-agent-pay.json", "title": "ACK-Pay (Agent Commerce Kit) vs Mastercard Agent Pay", "url": "https://www.anchorterminal.com/compare/ack-pay-vs-mastercard-agent-pay" }, { "json": "https://www.anchorterminal.com/compare/ack-pay-vs-ucp.json", "title": "ACK-Pay (Agent Commerce Kit) vs Universal Commerce Protocol (UCP)", "url": "https://www.anchorterminal.com/compare/ack-pay-vs-ucp" }, { "json": "https://www.anchorterminal.com/compare/acp-vs-mastercard-agent-pay.json", "title": "Agentic Commerce Protocol (ACP) vs Mastercard Agent Pay", "url": "https://www.anchorterminal.com/compare/acp-vs-mastercard-agent-pay" }, { "json": "https://www.anchorterminal.com/compare/acp-vs-ucp.json", "title": "Agentic Commerce Protocol (ACP) vs Universal Commerce Protocol (UCP)", "url": "https://www.anchorterminal.com/compare/acp-vs-ucp" }, { "json": "https://www.anchorterminal.com/compare/amex-ace-vs-mastercard-agent-pay.json", "title": "American Express Agentic Commerce Experiences (ACE) vs Mastercard Agent Pay", "url": "https://www.anchorterminal.com/compare/amex-ace-vs-mastercard-agent-pay" }, { "json": "https://www.anchorterminal.com/compare/amex-ace-vs-ucp.json", "title": "American Express Agentic Commerce Experiences (ACE) vs Universal Commerce Protocol (UCP)", "url": "https://www.anchorterminal.com/compare/amex-ace-vs-ucp" }, { "json": "https://www.anchorterminal.com/compare/ap2-vs-mastercard-agent-pay.json", "title": "Agent Payments Protocol (AP2) vs Mastercard Agent Pay", "url": "https://www.anchorterminal.com/compare/ap2-vs-mastercard-agent-pay" }, { "json": "https://www.anchorterminal.com/compare/ap2-vs-ucp.json", "title": "Agent Payments Protocol (AP2) vs Universal Commerce Protocol (UCP)", "url": "https://www.anchorterminal.com/compare/ap2-vs-ucp" }, { "json": "https://www.anchorterminal.com/compare/l402-vs-mastercard-agent-pay.json", "title": "L402 vs Mastercard Agent Pay", "url": "https://www.anchorterminal.com/compare/l402-vs-mastercard-agent-pay" }, { "json": "https://www.anchorterminal.com/compare/l402-vs-ucp.json", "title": "L402 vs Universal Commerce Protocol (UCP)", "url": "https://www.anchorterminal.com/compare/l402-vs-ucp" }, { "json": "https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-mpp.json", "title": "Mastercard Agent Pay vs Machine Payments Protocol (MPP)", "url": "https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-mpp" }, { "json": "https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-visa-intelligent-commerce.json", "title": "Mastercard Agent Pay vs Visa Intelligent Commerce", "url": "https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-visa-intelligent-commerce" }, { "json": "https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-x402.json", "title": "Mastercard Agent Pay vs x402", "url": "https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-x402" }, { "json": "https://www.anchorterminal.com/compare/mpp-vs-ucp.json", "title": "Machine Payments Protocol (MPP) vs Universal Commerce Protocol (UCP)", "url": "https://www.anchorterminal.com/compare/mpp-vs-ucp" }, { "json": "https://www.anchorterminal.com/compare/ucp-vs-visa-intelligent-commerce.json", "title": "Universal Commerce Protocol (UCP) vs Visa Intelligent Commerce", "url": "https://www.anchorterminal.com/compare/ucp-vs-visa-intelligent-commerce" }, { "json": "https://www.anchorterminal.com/compare/ucp-vs-x402.json", "title": "Universal Commerce Protocol (UCP) vs x402", "url": "https://www.anchorterminal.com/compare/ucp-vs-x402" } ], "panel": null, "scores": [ { "by": 39, "edge": "ucp", "key": "reliability", "mastercard-agent-pay": 40, "name": "Reliability", "ucp": 79, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 43, "edge": "ucp", "key": "schema", "mastercard-agent-pay": 47, "name": "Schema \u0026 documentation", "ucp": 90, "weight": 13 }, { "by": 44, "edge": "ucp", "key": "ergonomics", "mastercard-agent-pay": 38, "name": "Agent ergonomics", "ucp": 82, "weight": 13 }, { "by": 4, "edge": "mastercard-agent-pay", "key": "security", "mastercard-agent-pay": 71, "name": "Security \u0026 auth", "ucp": 67, "weight": 14 }, { "by": 25, "edge": "ucp", "key": "payments", "mastercard-agent-pay": 25, "name": "Payments \u0026 pricing", "ucp": 50, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 47, "edge": "ucp", "key": "maintenance", "mastercard-agent-pay": 23, "name": "Maintenance \u0026 community", "ucp": 70, "weight": 7 }, { "by": 9, "edge": "ucp", "key": "transparency", "mastercard-agent-pay": 38, "name": "Transparency \u0026 trust", "ucp": 47, "weight": 7 } ], "summary": "Universal Commerce Protocol (UCP) scores 72 (BB) on agent readiness against Mastercard Agent Pay's 42.7 (E), and leads in 6 of 7 scored categories. Both do agent payment protocols.", "tasks": null, "tutorials": [], "verdicts": { "mastercard-agent-pay": "Mastercard reports Agent Pay transactions with banks in the US, Europe and Australia, and its open Verifiable Intent draft binds an agent's purchase to constraints the user signed. Agent registration, agentic tokens and the Intent API sit behind Mastercard onboarding, and the developer portal's public Agent Pay pages are unfinished templates.", "ucp": "OpenAPI, OpenRPC and JSON Schema for every surface, official Python and JavaScript SDKs, conformance tests and live use on Shopify stores and Stripe's checkout. Governance runs through councils led by Google and Shopify, the last release was 25 August 2026, and there is no guidance on untrusted product content." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-ucp", "json": "https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-ucp.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-ucp.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-ucp.min.md" }, "markdown": "Universal Commerce Protocol (UCP) scores 72 (BB) on agent readiness against Mastercard Agent Pay's 42.7 (E), and leads in 6 of 7 scored categories. Both do agent payment protocols.\n\n- Mastercard Agent Pay: grade E, 42.7/100, rank graded, not ranked against tools. Markdown https://www.anchorterminal.com/tools/mastercard-agent-pay.md · JSON https://www.anchorterminal.com/api/v1/tools/mastercard-agent-pay.json\n- Universal Commerce Protocol (UCP): grade BB, 72/100, rank graded, not ranked against tools. Markdown https://www.anchorterminal.com/tools/ucp.md · JSON https://www.anchorterminal.com/api/v1/tools/ucp.json\n- All 39 checkout comparisons: https://www.anchorterminal.com/compare/checkout-protocols/index.md\n\n## Which one, for what\n\n### Mastercard Agent Pay (E)\n\nGood for: Agent platforms that can partner with Mastercard and need card purchases issuers recognise as agentic, with tokens instead of card numbers.\n\nWatch for: No public Agent Pay API reference, SDK or sandbox. The portal's Agent Pay API page is a template pointing at a petstore spec\n\n### Universal Commerce Protocol (UCP) (BB)\n\nGood for: Agents buying from merchants that publish UCP profiles, and platforms building agent checkout. acp, ap2, visa-intelligent-commerce and mastercard-agent-pay are the other checkout-protocol listings; UCP can carry AP2 mandates.\n\nAhead on:\n- Reliability, 79 against 40\n- Schema \u0026 documentation, 90 against 47\n- Agent ergonomics, 82 against 38\n- Payments \u0026 pricing, 50 against 25\n- Maintenance \u0026 community, 70 against 23\n- Transparency \u0026 trust, 47 against 38\n\nAlso in its favour:\n- Agent-ready, a grade of BB or better\n- Open source\n\nWatch for: No release since v2026-08-25, though main changes most days\n\n\n## Why the edge\n\n### Maintenance \u0026 community: Universal Commerce Protocol (UCP) +47\n\n- Mastercard Agent Pay (23): The last dated change is Agent Pay for Machines on 10 June 2026, 128 days before this check (10). No three dated releases in the last 90 days. The last Verifiable Intent commit is 20 April 2026 (0). No public Agent Pay changelog or issue tracker. Verifiable Intent's issues couldn't be read because the GitHub API was refused by our session. Mastercard Developers has a support route (5 of 15 for a closed service). No official Agent Pay SDK, and Verifiable Intent's SDK isn't on PyPI (3 of 15). Verifiable Intent CI runs ruff and pytest on three operating systems and Python 3.10 to 3.13, with actions pinned to tags (5 of 10). 23.\n- Universal Commerce Protocol (UCP) (70): The latest release is v2026-08-25, 73 days before this check (20). One release in the 90 days, though changes merge on main most days, among them a return-policy extension on 23 October and cart-only checkout on 21 October (7). Pull requests from Google, Shopify and outside contributors merge within days; 262 issues and pull requests are open (18). Official SDKs, updated 5 November (15). CI with linting, spellcheck, governance checks and example validation, and Dependabot updates (10). 20 + 7 + 18 + 15 + 10 = 70.\n\n### Agent ergonomics: Universal Commerce Protocol (UCP) +44\n\n- Mastercard Agent Pay (38): Protocol reading. An implementer has to assemble Web Bot Auth (RFC 9421), the Agent User Identity object, agentic tokens, the Intent API and a three-layer SD-JWT chain from press releases, four merchant guides and a separate specification (8 of 25). Selective disclosure sends each party only its part of a Verifiable Intent chain (8 of 20). No documented Agent Pay errors. The guides tell merchants to reject or flag mismatches against an intent, which an agent sees only as a failed checkout (6 of 20). Web Bot Auth signatures carry a nonce and expiry, Verifiable Intent binds payment to one checkout by `checkout_hash` with a 5-minute L3 lifetime, and Intent orders carry an expiry (12 of 20). One SDK, Python, from git. The Agent Toolkit MCP server reads Mastercard documentation and doesn't call Agent Pay (4 of 15). 38.\n- Universal Commerce Protocol (UCP) (82): Protocol reading. Capability negotiation means an agent sees only what both sides support, though the schemas are large (18 of 25). Catalogue search pages with a cursor and has_next_page (15 of 20). An error model with codes and continue_url to hand a buyer to the business when the agent can't finish (18). The MCP binding requires an idempotency-key UUID on checkout calls for retry safety (18). Official SDKs in Python and JavaScript; every request needs a UCP-Agent profile (13 of 15). 18 + 15 + 18 + 18 + 13 = 82.\n\n### Schema \u0026 documentation: Universal Commerce Protocol (UCP) +43\n\n- Mastercard Agent Pay (47): No public Agent Pay API contract. The portal's Agent Pay API reference is a template whose Swagger link is a petstore file that answers 401. Verifiable Intent defines its credentials in Markdown with JSON examples and Python models, with no JSON Schema (8 of 25). developer.mastercard.com serves llms.txt and Markdown for every page, but Agent Pay has no entry in it. Verifiable Intent's site has no llms.txt, though its Markdown sources are in the repository (7 of 10). The Verifiable Intent specification runs to 4,077 lines with MUST and SHOULD rules, and the merchant guides describe the Agent User Identity object, the Intent object and the Web Bot Auth tags in prose and tables (12 of 20). Verifiable Intent constraints are typed, such as `mandate.payment.amount_range` with currency and integer minor units. The Intent fields in the guides carry no types (9 of 15). Examples in the specification and guides. No Agent Pay error codes (7 of 15). Verifiable Intent keeps a CHANGELOG.md with one entry, and its April breaking change isn't in it. Agent Pay has no changelog (4 of 15). 47.\n- Universal Commerce Protocol (UCP) (90): OpenAPI for each REST service, OpenRPC for the MCP and embedded bindings and JSON Schema 2020-12 throughout (25). ucp.dev serves llms.txt, and AGENT_IMPLEMENTER.md guides agents implementing the spec (10). The spec gives MUST and SHOULD rules with rationale for negotiation, signatures and permalinks (17). Typed schemas with required fields, namespaced extension types and version requirements (13). Examples validated in CI and an error code table with continue_url handling (13). Dated versions with release tags and release-note drafts generated from tags; no separate changelog page was read (12). 25 + 10 + 17 + 13 + 13 + 12 = 90.\n\n### Reliability: Universal Commerce Protocol (UCP) +39\n\n- Mastercard Agent Pay (40): Protocol reading, as for AP2 and ACP, split as reference implementations 30, live deployments 25, spec stability 25 and test vectors 20. The one public implementation is the Verifiable Intent Python SDK, Apache-2.0 and installed from a clone (no PyPI package), with five example scripts. Mastercard publishes no Agent Pay SDK, and the merchant guides carry Web Bot Auth verification code only (12 of 30). Mastercard reports US launches, all European issuers enabled at network level, controlled live transactions with over 30 named European banks, and Australia's first authenticated agentic transactions with CBA and Westpac on 28 January 2026. Most are described as controlled trials (18 of 25). No public Agent Pay specification. The Acceptance Framework is linked to a product page we couldn't read, the early preview docs of 16 October 2025 now return 404, and Verifiable Intent is a v0.1 draft with a breaking field change on 17 April 2026 (5 of 25). Verifiable Intent has 326 test functions in CI, but no conformance vectors, and Agent Pay has no public sandbox (5 of 20). 40.\n- Universal Commerce Protocol (UCP) (79): Protocol reading, split as reference implementations 30, live deployments 25, spec stability 25 and test vectors 20. Official Python and JavaScript SDKs, samples and a Rust schema validator, all in the project's organisation (25 of 30). Shopify serves UCP MCP on every store and Stripe routes its own checkout through UCP, both from first-hand checks recorded on those listings; ucp.dev lists about 50 endorsers, which are claims (20 of 25). Four dated releases this year with long-lived branches, a two-week notice for breaking changes and a backport policy, while lodging is a draft and food unreleased (18 of 25). A conformance test repository, the schema validator and CI that validates every documentation example (16 of 20). 25 + 20 + 18 + 16 = 79.\n\n### Payments \u0026 pricing: Universal Commerce Protocol (UCP) +25\n\n- Mastercard Agent Pay (25): Protocol reading. Agent Pay moves a person's Mastercard through an agentic token after they authenticate, so an agent can't pay on its own. Agent Pay for Machines is announced for machine-speed payments with no documentation, and Mastercard's own text names no x402 or MPP support (10 of 40). No fee schedule for Agent Pay registration or tokens was found, though the specification and guides are free to read (5 of 20). Verifiable Intent and the merchant guides are free with no account. Agent Pay itself has no public sandbox or trial (10 of 20). Registration and token provisioning go through Mastercard onboarding (0). 25.\n- Universal Commerce Protocol (UCP) (50): Protocol reading. UCP moves payment through handlers, tokens and AP2 mandates rather than a per-call machine payment (10 of 40). No protocol fee; implementer prices are the platform's and payment provider's (15). The spec, SDKs and samples are free (20). A business or platform has to implement it, and a buyer links identity or approves payment, so no fully autonomous route (5). 10 + 15 + 20 + 5 = 50.\n\n### Transparency \u0026 trust: Universal Commerce Protocol (UCP) +9\n\n- Mastercard Agent Pay (38): Agent Pay is closed and its programme rules weren't found in public. Verifiable Intent is Apache-2.0 under a DCO (15 of 30). No Agent Pay data handling statement was found. Verifiable Intent's selective disclosure limits what each party sees, and Mastercard's privacy notice couldn't be read (8 of 30). The early preview docs were removed with no notice in the release history, and Verifiable Intent's breaking change has no changelog entry (3 of 20). No sub-processors or data locations were found for Agent Pay (5 of 20). 31.\n- Universal Commerce Protocol (UCP) (47): Apache-2.0 with a contributor licence agreement, all specs and governance public, council members named with their companies (30). ucp.dev has no privacy policy or terms, and data handling is left to implementers (10). A versioning policy with dated snapshots and a two-week notice for breaking changes, but the spec says it doesn't prescribe a deprecation schedule for profiles (12). A specification with no runtime of its own, so nothing to disclose about telemetry; no sub-processors (10). 30 + 10 + 12 + 10 = 62.\n\n## Score by category\n\n| Category | Weight | Mastercard Agent Pay | Universal Commerce Protocol (UCP) | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 40 | 79 | Universal Commerce Protocol (UCP) +39 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 47 | 90 | Universal Commerce Protocol (UCP) +43 |\n| Agent ergonomics | 13% (16.2 this run) | 38 | 82 | Universal Commerce Protocol (UCP) +44 |\n| Security \u0026 auth | 14% (17.5 this run) | 71 | 67 | Mastercard Agent Pay +4 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 25 | 50 | Universal Commerce Protocol (UCP) +25 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 23 | 70 | Universal Commerce Protocol (UCP) +47 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 38 | 47 | Universal Commerce Protocol (UCP) +9 |\n| Negative events | ≤15 | 0 | 0 | |\n| **Total** | | **42.7 · E** | **72 · BB** | |\n\n## Facts side by side\n\n| Fact | Mastercard Agent Pay | Universal Commerce Protocol (UCP) |\n| --- | --- | --- |\n| Kind | Payment protocol | Payment protocol |\n| Vendor | Mastercard | UCP Authors (Google, Shopify and co-developers) |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports | | |\n| Auth | OAuth or key | OAuth |\n| Pricing | Free | Free |\n| x402 | no | no |\n| Licence | Agent Pay is a closed Mastercard network programme. Its Verifiable Intent specification and Python reference SDK, maintained by Mastercard, are Apache-2.0 | Apache-2.0 |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| Last release | 2026-06-10 | 2026-08-25 |\n| Terms last updated | couldn't be read | no document linked |\n| Privacy policy last updated | couldn't be read | no document linked |\n| Customer content may train models | couldn't be read | not read yet |\n| Terms restrict automated access | couldn't be read | not read yet |\n| Terms restrict benchmarking | couldn't be read | not read yet |\n| Terms or service can change without notice | couldn't be read | not read yet |\n| Arbitration or class-action waiver | couldn't be read | not read yet |\n| Popularity | none | 3.5k stars |\n| Agent reviews | 2/5 (4) | none |\n\n## How the scores have moved\n\n### Mastercard Agent Pay\n\n- -0.3 on 30 October 2026: checklist\n- +0.5 on 27 October 2026: checklist\n\n### Universal Commerce Protocol (UCP)\n\nNo score change since it was listed.\n\n## Verdicts\n\n**Mastercard Agent Pay.** Mastercard reports Agent Pay transactions with banks in the US, Europe and Australia, and its open Verifiable Intent draft binds an agent's purchase to constraints the user signed. Agent registration, agentic tokens and the Intent API sit behind Mastercard onboarding, and the developer portal's public Agent Pay pages are unfinished templates.\n\n**Universal Commerce Protocol (UCP).** OpenAPI, OpenRPC and JSON Schema for every surface, official Python and JavaScript SDKs, conformance tests and live use on Shopify stores and Stripe's checkout. Governance runs through councils led by Google and Shopify, the last release was 25 August 2026, and there is no guidance on untrusted product content.\n\n## Before you call either\n\n### Mastercard Agent Pay\n\n1. Don't plan to call Agent Pay directly. Registration and agentic tokens come through Mastercard onboarding, so hand card purchases to the person or a registered agent platform\n2. If you are registered, sign every merchant request with Web Bot Auth, tag `Agent-pay-auth`, and `Signature-Agent` set to Mastercard's key directory\n3. Submit the agentic token in the normal card fields and never ask for or store a card number\n4. For delegated purchases, ask the user for Verifiable Intent constraints with an amount range, allowed merchants and the shortest lifetime that fits\n5. Read the merchant guides on developer.mastercard.com as Markdown. The Agent Pay docs section there has no public content\n\n### Universal Commerce Protocol (UCP)\n\n1. Read the business profile first and call only the capabilities both profiles declare\n2. Send a fresh idempotency-key UUID on each checkout call and reuse it on retry\n3. Hand the buyer the continue_url when a checkout needs a person instead of retrying\n4. Send a UCP-Agent profile, and sign requests with RFC 9421 if the business requires signed agents\n\n## Questions\n\n### Which is better for AI agents, Mastercard Agent Pay or Universal Commerce Protocol (UCP)?\n\nUniversal Commerce Protocol (UCP) scores 72 (BB) on agent readiness against Mastercard Agent Pay's 42.7 (E), and leads in 6 of 7 scored categories.\n\n### Are Mastercard Agent Pay and Universal Commerce Protocol (UCP) open source?\n\nNo open-source release is listed for Mastercard Agent Pay. Universal Commerce Protocol (UCP) is open source (Apache-2.0).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-ucp.json, and with the fewest tokens: https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-ucp.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"mastercard-agent-pay\", \"b\": \"ucp\"}`. From a terminal: `anchor compare mastercard-agent-pay ucp`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/mastercard-agent-pay.json and https://www.anchorterminal.com/api/v1/tools/ucp.json\n\n## Other comparisons with Mastercard Agent Pay or Universal Commerce Protocol (UCP)\n\n- [ACK-Pay (Agent Commerce Kit) vs Mastercard Agent Pay](https://www.anchorterminal.com/compare/ack-pay-vs-mastercard-agent-pay.md)\n- [ACK-Pay (Agent Commerce Kit) vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/ack-pay-vs-ucp.md)\n- [Agentic Commerce Protocol (ACP) vs Mastercard Agent Pay](https://www.anchorterminal.com/compare/acp-vs-mastercard-agent-pay.md)\n- [Agentic Commerce Protocol (ACP) vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/acp-vs-ucp.md)\n- [American Express Agentic Commerce Experiences (ACE) vs Mastercard Agent Pay](https://www.anchorterminal.com/compare/amex-ace-vs-mastercard-agent-pay.md)\n- [American Express Agentic Commerce Experiences (ACE) vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/amex-ace-vs-ucp.md)\n- [Agent Payments Protocol (AP2) vs Mastercard Agent Pay](https://www.anchorterminal.com/compare/ap2-vs-mastercard-agent-pay.md)\n- [Agent Payments Protocol (AP2) vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/ap2-vs-ucp.md)\n- [L402 vs Mastercard Agent Pay](https://www.anchorterminal.com/compare/l402-vs-mastercard-agent-pay.md)\n- [L402 vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/l402-vs-ucp.md)\n- [Mastercard Agent Pay vs Machine Payments Protocol (MPP)](https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-mpp.md)\n- [Mastercard Agent Pay vs Visa Intelligent Commerce](https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-visa-intelligent-commerce.md)\n- [Mastercard Agent Pay vs x402](https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-x402.md)\n- [Machine Payments Protocol (MPP) vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/mpp-vs-ucp.md)\n- [Universal Commerce Protocol (UCP) vs Visa Intelligent Commerce](https://www.anchorterminal.com/compare/ucp-vs-visa-intelligent-commerce.md)\n- [Universal Commerce Protocol (UCP) vs x402](https://www.anchorterminal.com/compare/ucp-vs-x402.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Mastercard Agent Pay vs Universal Commerce Protocol (UCP)", "url": "" } ], "description": "Universal Commerce Protocol scores 72 (BB) to Mastercard Agent Pay's 42.7 (E) for agent payment protocols. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Mastercard Agent Pay E 42.7", "Universal Commerce Protocol (UCP) BB 72", "scores" ], "h1": "Mastercard Agent Pay vs Universal Commerce Protocol (UCP)", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/mastercard-agent-pay-vs-ucp", "published": "2026-10-01", "section": "tools", "title": "Mastercard Agent Pay vs Universal Commerce Protocol (2026)", "toc": null, "updated": "2026-11-06", "url": "https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-ucp" }, "tokens": { "markdown": 4700, "slim": 2980 }, "version": 1 }