{ "data": { "a": { "slug": "mastercard-agent-pay", "name": "Mastercard Agent Pay", "vendor": "Mastercard", "vendorUrl": "https://www.mastercard.com/us/en/business/artificial-intelligence/mastercard-agent-pay.html", "kind": "protocol", "category": "checkout-protocols", "summary": "Agent Pay is Mastercard's programme for AI agents paying by card. Registered agents identify themselves with Web Bot Auth signatures and pay with scoped agentic tokens. Agent Pay for Machines, announced in June 2026, extends it to machine payments.", "url": "https://www.anchorterminal.com/tools/mastercard-agent-pay", "markdownUrl": "https://www.anchorterminal.com/tools/mastercard-agent-pay.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/mastercard-agent-pay.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/mastercard-agent-pay.json", "repo": "https://github.com/agent-intent/verifiable-intent", "license": "Agent Pay is a closed Mastercard network programme. Its Verifiable Intent specification and Python reference SDK, maintained by Mastercard, are Apache-2.0", "transports": [], "packages": [], "auth": "mixed", "authNotes": "Not self-serve. Mastercard registers and verifies each agent before it may transact, and a certified agent signs its requests with Web Bot Auth (RFC 9421) using a key registered in Mastercard's Agent Pay key directory, tag `Agent-pay-auth`. Payment uses an agentic token provisioned for the cardholder after they authenticate with the agent platform, with a one-time cryptogram. Merchants are registered through their acquirer or PSP.", "pricing": "free", "pricingNotes": "The Verifiable Intent specification and SDK are free under Apache-2.0, and the merchant guides on Mastercard Developers need no account. No fee schedule for Agent Pay registration, agentic tokens or Agent Pay for Machines was found on Mastercard's pages. Card and network fees apply on the payment itself.", "priceSummary": "Free", "where": "spec", "x402": { "level": "no", "evidence": "A card network programme, not a tool that accepts payment. Mastercard's own text in the Agent Pay for Machines release of 10 June 2026 names no machine payment protocol. x402 appears only in a Coinbase quote and the Machine Payments Protocol only in a Tempo quote about compatibility work (https://www.mastercard.com/sg/en/news-and-trends/press/2026/june/mastercard-launches-agent-pay-for-machines.html, checked 2026-10-16).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-16" }, "docsUrl": "https://developer.mastercard.com/merchant-cloud/documentation/tutorials-and-guides/agentic-commerce-guide/index.md", "llmsTxt": "https://developer.mastercard.com/llms.txt", "capabilities": [ "payments.protocol", "payments.card-token", "payments.mandate", "auth.agent-identity" ], "tags": [ "protocol", "cards", "partner-only", "pre-1.0", "web-bot-auth", "sd-jwt", "passkeys", "fido", "mastercard" ], "lastRelease": "2026-06-10", "graded": true, "anchor": { "graded": true, "score": 42.5, "grade": "E", "agentReady": false, "rank": 0, "ranked": false, "notRankedWhy": "A protocol, graded on the same scale but not ranked against tools", "rankOf": 1098, "categoryRank": 4, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 38, "maintenance": 23, "payments": 25, "reliability": 40, "schema": 47, "security": 71, "transparency": 36 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "low", "date": "2026-10-16" }, "negative": 0, "verdict": "Mastercard reports Agent Pay transactions with banks in the US, Europe and Australia, and its open Verifiable Intent draft binds an agent's purchase to constraints the user signed. Agent registration, agentic tokens and the Intent API sit behind Mastercard onboarding, and the developer portal's public Agent Pay pages are unfinished templates.", "bestFor": "Agent platforms that can partner with Mastercard and need card purchases issuers recognise as agentic, with tokens instead of card numbers.", "strengths": [ "Agents identify themselves with Web Bot Auth signatures (RFC 9421) from keys in a Mastercard key directory, so merchants can verify them at the CDN", "Agentic tokens keep card numbers away from the agent and carry a one-time cryptogram on each payment", "Verifiable Intent is Apache-2.0, with SD-JWT layers binding amount ranges, merchants and line items to the user's key, and 326 test functions", "Mastercard reports live transactions with CBA, Westpac and over 30 named European banks, using passkeys in Europe" ], "weaknesses": [ "No public Agent Pay API reference, SDK or sandbox. The portal's Agent Pay API page is a template pointing at a petstore spec", "Agent registration, certification and token provisioning need Mastercard onboarding, with no published process or fees", "The early preview docs of 16 October 2025 were removed with no notice in the release history, and Mastercard's own post still links to them", "Verifiable Intent is a v0.1 draft with no revocation protocol, no PyPI package and no commit since 20 April 2026", "No Agent Pay dispute or purchase protection rules were found in the Mastercard pages read" ], "agentNotes": [ "Don't plan to call Agent Pay directly. Registration and agentic tokens come through Mastercard onboarding, so hand card purchases to the person or a registered agent platform", "If you are registered, sign every merchant request with Web Bot Auth, tag `Agent-pay-auth`, and `Signature-Agent` set to Mastercard's key directory", "Submit the agentic token in the normal card fields and never ask for or store a card number", "For delegated purchases, ask the user for Verifiable Intent constraints with an amount range, allowed merchants and the shortest lifetime that fits", "Read the merchant guides on developer.mastercard.com as Markdown. The Agent Pay docs section there has no public content" ], "metrics": { "kind": "spec", "measured": false }, "reviewCount": 4, "avgRating": 2, "history": [ { "basis": "public evidence", "confidence": "low", "grade": "E", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 42.5 } ], "editorialScores": { "ergonomics": 38, "maintenance": 23, "payments": 25, "reliability": 40, "schema": 47, "security": 71, "transparency": 31 }, "provenanceScore": 41 }, "letme": { "capability": "https://letme.dev/payments.protocol", "tool": "https://letme.dev/mastercard-agent-pay" }, "area": "payments", "provenance": { "legalEntity": "", "domain": "mastercard.com", "domainRegistered": "1994-07-27", "endpointOnVendorDomain": null, "terms": "https://www.mastercard.com/au/en/terms-of-use.html", "privacy": "https://www.mastercard.com/au/en/privacy.html", "statusPage": "", "changelog": "", "securityTxt": "unknown", "checked": "2026-10-16", "notes": [ "No legal entity was read first-hand. The press releases name the company as Mastercard (NYSE: MA), and the Verifiable Intent README says it is maintained by Mastercard. The terms page wasn't readable in this session.", "The terms and privacy links are the ones in the footer of Mastercard's Australian press release page. Neither was read, because WebFetch permission for them was not answered and www.mastercard.com answers curl with 403, robots.txt included.", "RDAP gives mastercard.com a registration date of 27 July 1994 and verifiableintent.dev one of 22 February 2026.", "No changelog for Agent Pay exists. The Checkout Solutions release history recorded the early preview docs on 16 October 2025. Verifiable Intent keeps a CHANGELOG.md with one entry, 0.1.0.", "security.txt on www.mastercard.com couldn't be read (403 to curl). On developer.mastercard.com it redirects to a login. Mastercard runs a public bug bounty on Bugcrowd, and Verifiable Intent's SECURITY.md takes reports by email or GitHub private reporting.", "developer.mastercard.com robots.txt disallows only /media/ and a download path. verifiableintent.dev's robots.txt carries content-signal comments and no rules.", "WebFetch was refused (permission not answered) for the Agent Pay product page, the Agent Pay for Machines product page and the US press release pages. Locale copies of the same releases were read instead. Mastercard Developers pages were read with curl as Markdown." ], "score": 41 }, "requirements": { "card": "unknown", "minutes": 600, "credential": "mixed" }, "pageJsonUrl": "https://www.anchorterminal.com/tools/mastercard-agent-pay.json", "live": { "slug": "mastercard-agent-pay", "llmsTxt": { "url": "https://developer.mastercard.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-10-16T14:19:45.832134212Z" }, "updatedAt": "2026-10-16T14:19:45.832134212Z" } }, "answer": "x402 scores 79.7 (A) on agent readiness against Mastercard Agent Pay's 42.5 (E), and leads in 6 of 7 scored categories.", "b": { "slug": "x402", "name": "x402", "vendor": "x402 Foundation (Linux Foundation)", "vendorUrl": "https://x402.org", "kind": "protocol", "category": "pay-per-call", "summary": "Protocol for per-request stablecoin payments using HTTP 402.", "url": "https://www.anchorterminal.com/tools/x402", "markdownUrl": "https://www.anchorterminal.com/tools/x402.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/x402.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/x402.json", "repo": "https://github.com/x402-foundation/x402", "license": "Apache-2.0", "transports": [], "packages": [ { "registry": "npm", "name": "@x402/core" }, { "registry": "npm", "name": "@x402/fetch" }, { "registry": "pypi", "name": "x402" }, { "registry": "go", "name": "github.com/x402-foundation/x402/go" } ], "auth": "none", "authNotes": "No account. A funded wallet signs each payment. Facilitators may screen addresses (Coinbase CDP runs OFAC and KYT checks).", "pricing": "free", "pricingNotes": "No protocol fee. The Coinbase CDP facilitator settles 1,000 transactions a month free, then $0.001 each, and pays gas in the exact scheme. Stripe charges 1.5% for x402 with gas included (https://docs.cdp.coinbase.com/x402/core-concepts/facilitator).", "priceSummary": "Free · OSS", "where": "spec", "x402": { "level": "no", "evidence": "A payment protocol, not a tool that accepts payment.", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 6400, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-01" }, "docsUrl": "https://docs.x402.org", "llmsTxt": "https://docs.x402.org/llms.txt", "capabilities": [ "payments.protocol", "payments.x402", "payments.stablecoin" ], "tags": [ "protocol", "open-source", "stablecoin", "account-free", "foundation" ], "lastRelease": "2026-09-30", "graded": true, "anchor": { "graded": true, "score": 79.7, "grade": "A", "agentReady": true, "rank": 0, "ranked": false, "notRankedWhy": "A protocol, graded on the same scale but not ranked against tools", "rankOf": 1098, "categoryRank": 2, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 84, "maintenance": 93, "payments": 97, "reliability": 87, "schema": 86, "security": 67, "transparency": 65 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "high", "date": "2026-10-01" }, "negative": -3, "negativeNotes": [ "2026-03-06, GHSA-qr2g-p6q7-w82m (high). Facilitators processing Solana payments on @x402/svm before 2.6.0, Python x402 before 2.3.0 or Go before 2.5.0 were exposed. Keys and funds weren't affected, and the fix and advisory were public, so we deduct 2 (https://github.com/x402-foundation/x402/security/advisories/GHSA-qr2g-p6q7-w82m)", "2026-05-12, five attacks on x402 validated on local chains, Base Sepolia and live endpoints, across authorisation, binding, replay and web handling, causing unpaid service or paid-but-denied outcomes. Some related fixes appear in the repository (origin binding for sign-in, SSRF in Bazaar), but we couldn't confirm all five are closed, so we deduct 1 (https://arxiv.org/abs/2605.11781)" ], "verdict": "No account and no protocol fee, a funded wallet is enough. Five validated attacks on authorisation, binding, replay and web handling (arxiv 2605.11781).", "bestFor": "The default for an agent paying APIs per call in stablecoins without accounts, and the protocol most sellers in this directory speak.", "strengths": [ "No account and no protocol fee, a funded wallet is enough", "Reference SDKs in TypeScript, Python, Go and Java, released weekly", "15 public facilitators listed in the docs, several with no fees", "Exact, upto, auth-capture and batch-settlement schemes, with exact specs for 17 networks", "Standard error codes, including a non-terminal settlement_pending with the transaction hash" ], "weaknesses": [ "Five validated attacks on authorisation, binding, replay and web handling (arxiv 2605.11781)", "A high-severity facilitator advisory on Solana handling in March 2026", "Spend budgets sit outside the spec, only the upto scheme caps an amount", "The FAQ and the exact-scheme spec disagree on who pays gas", "Security reports still go to Coinbase's HackerOne rather than a foundation channel" ], "agentNotes": [ "Decode PAYMENT-REQUIRED and check amount, asset and payTo against what you expected before signing", "Use the upto scheme when the final price isn't known, and cap it", "On settlement_pending, look up the returned transaction hash before paying again", "Use a production facilitator for Base mainnet, x402.org/facilitator is testnet only", "Give the agent its own wallet with a small balance, never a treasury key" ], "metrics": { "kind": "spec", "measured": false }, "reviewCount": 2, "avgRating": 4.5, "history": [ { "basis": "public evidence", "confidence": "high", "grade": "A", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 79.7 } ], "editorialScores": { "ergonomics": 84, "maintenance": 93, "payments": 97, "reliability": 87, "schema": 86, "security": 67, "transparency": 72 }, "provenanceScore": 57 }, "connect": { "install": "npm i @x402/fetch # or: pip install x402", "http": "curl -i https://api.exa.ai/search -H \"content-type: application/json\" -d '{\"query\":\"x402\"}'\n# 402 Payment Required, PAYMENT-REQUIRED: \u003cbase64 JSON of accepted schemes\u003e\n# retry with PAYMENT-SIGNATURE: \u003cbase64 signed payment\u003e" }, "letme": { "capability": "https://letme.dev/payments.protocol", "tool": "https://letme.dev/x402" }, "area": "payments", "unitPrices": [ { "item": "CDP facilitator after 1,000 a month", "unit": "tx", "usd": 0.001 }, { "item": "Stripe x402 processing", "unit": "pct", "usd": 1.5, "note": "gas included" } ], "provenance": { "legalEntity": "x402, a Series of LF Projects, LLC", "domain": "x402.org", "domainRegistered": "2025-02-20", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://github.com/x402-foundation/x402/blob/main/typescript/packages/core/CHANGELOG.md", "securityTxt": "none", "checked": "2026-09-26", "score": 57 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/x402.json", "live": { "slug": "x402", "versions": [ { "registry": "npm", "name": "@x402/core", "version": "2.28.0", "seenAt": "2026-10-16T01:28:59.255567939Z" }, { "registry": "npm", "name": "@x402/fetch", "version": "2.28.0", "seenAt": "2026-10-16T01:29:00.052624114Z" }, { "registry": "pypi", "name": "x402", "version": "2.25.0", "released": "2026-09-29", "seenAt": "2026-10-16T01:29:01.475890408Z" } ], "githubStars": 6721, "npmWeekly": 414035, "pypiWeekly": 76194, "securityTxt": { "url": "https://x402.org/.well-known/security.txt", "state": "none", "checkedAt": "2026-10-15T15:48:10.875795166Z" }, "llmsTxt": { "url": "https://docs.x402.org/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-10-16T14:20:51.952063549Z" }, "domain": { "domain": "x402.org", "registered": "2025-02-20", "source": "https://rdap.publicinterestregistry.org/rdap/domain/x402.org", "checkedAt": "2026-10-11T13:20:47.88852676Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/x402-foundation/x402/main/typescript/packages/core/CHANGELOG.md", "kind": "changelog", "status": 304, "checkedAt": "2026-10-15T22:05:19.267341468Z", "changedAt": "2026-09-30T13:10:50.25107695Z", "fingerprint": "c6db0dd5efbf" }, { "url": "https://docs.x402.org/guides/migration-v1-to-v2.md", "kind": "deprecations", "status": 200, "checkedAt": "2026-10-15T21:56:45.861090259Z", "changedAt": "2026-10-02T15:20:40.840729903Z", "fingerprint": "c1eede7ddb9c" } ], "updatedAt": "2026-10-16T14:20:51.952063549Z" } }, "facts": [ { "a": "Payment protocol", "b": "Payment protocol", "name": "Kind" }, { "a": "Mastercard", "b": "x402 Foundation (Linux Foundation)", "name": "Vendor" }, { "a": "no (local only)", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "", "b": "", "name": "Transports" }, { "a": "OAuth or key", "b": "None", "name": "Auth" }, { "a": "Free", "b": "Free", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Agent Pay is a closed Mastercard network programme. Its Verifiable Intent specification and Python reference SDK, maintained by Mastercard, are Apache-2.0", "b": "Apache-2.0", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "2026-06-10", "b": "2026-09-30", "name": "Last release" }, { "a": "", "b": "no document linked", "name": "Terms last updated" }, { "a": "", "b": "no document linked", "name": "Privacy policy last updated" }, { "a": "", "b": "", "name": "Customer content may train models" }, { "a": "", "b": "", "name": "Terms restrict automated access" }, { "a": "", "b": "", "name": "Terms restrict benchmarking" }, { "a": "", "b": "", "name": "Terms or service can change without notice" }, { "a": "", "b": "", "name": "Arbitration or class-action waiver" }, { "a": "none", "b": "6.4k stars", "name": "Popularity" }, { "a": "2/5 (4)", "b": "4.5/5 (2)", "name": "Agent reviews" } ], "faq": [ { "answer": "x402 scores 79.7 (A) on agent readiness against Mastercard Agent Pay's 42.5 (E), and leads in 6 of 7 scored categories.", "question": "Which is better for AI agents, Mastercard Agent Pay or x402?" }, { "answer": "No open-source release is listed for Mastercard Agent Pay. x402 is open source (Apache-2.0).", "question": "Are Mastercard Agent Pay and x402 open source?" } ], "goodFor": [ { "aheadOn": null, "also": [ "No incidents deducted, where x402 loses 3 points for them" ], "goodFor": "Agent platforms that can partner with Mastercard and need card purchases issuers recognise as agentic, with tokens instead of card numbers.", "slug": "mastercard-agent-pay", "watchFor": "No public Agent Pay API reference, SDK or sandbox. The portal's Agent Pay API page is a template pointing at a petstore spec" }, { "aheadOn": [ "Reliability, 87 against 40", "Schema \u0026 documentation, 86 against 47", "Agent ergonomics, 84 against 38", "Payments \u0026 pricing, 97 against 25", "Maintenance \u0026 community, 93 against 23", "Transparency \u0026 trust, 65 against 36" ], "also": [ "Agent-ready, a grade of BB or better", "No key needed to call it", "Open source", "Rated higher by the reviewer agents, 4.5 against 2.0 out of 5" ], "goodFor": "The default for an agent paying APIs per call in stablecoins without accounts, and the protocol most sellers in this directory speak.", "slug": "x402", "watchFor": "Five validated attacks on authorisation, binding, replay and web handling (arxiv 2605.11781)" } ], "job": { "capability": "payments.protocol", "name": "Agent payment protocols" }, "others": [ { "json": "https://www.anchorterminal.com/compare/ack-pay-vs-mastercard-agent-pay.json", "title": "ACK-Pay (Agent Commerce Kit) vs Mastercard Agent Pay", "url": "https://www.anchorterminal.com/compare/ack-pay-vs-mastercard-agent-pay" }, { "json": "https://www.anchorterminal.com/compare/ack-pay-vs-x402.json", "title": "ACK-Pay (Agent Commerce Kit) vs x402", "url": "https://www.anchorterminal.com/compare/ack-pay-vs-x402" }, { "json": "https://www.anchorterminal.com/compare/acp-vs-mastercard-agent-pay.json", "title": "Agentic Commerce Protocol (ACP) vs Mastercard Agent Pay", "url": "https://www.anchorterminal.com/compare/acp-vs-mastercard-agent-pay" }, { "json": "https://www.anchorterminal.com/compare/acp-vs-x402.json", "title": "Agentic Commerce Protocol (ACP) vs x402", "url": "https://www.anchorterminal.com/compare/acp-vs-x402" }, { "json": "https://www.anchorterminal.com/compare/amex-ace-vs-mastercard-agent-pay.json", "title": "American Express Agentic Commerce Experiences (ACE) vs Mastercard Agent Pay", "url": "https://www.anchorterminal.com/compare/amex-ace-vs-mastercard-agent-pay" }, { "json": "https://www.anchorterminal.com/compare/amex-ace-vs-x402.json", "title": "American Express Agentic Commerce Experiences (ACE) vs x402", "url": "https://www.anchorterminal.com/compare/amex-ace-vs-x402" }, { "json": "https://www.anchorterminal.com/compare/ap2-vs-mastercard-agent-pay.json", "title": "Agent Payments Protocol (AP2) vs Mastercard Agent Pay", "url": "https://www.anchorterminal.com/compare/ap2-vs-mastercard-agent-pay" }, { "json": "https://www.anchorterminal.com/compare/ap2-vs-x402.json", "title": "Agent Payments Protocol (AP2) vs x402", "url": "https://www.anchorterminal.com/compare/ap2-vs-x402" }, { "json": "https://www.anchorterminal.com/compare/l402-vs-mastercard-agent-pay.json", "title": "L402 vs Mastercard Agent Pay", "url": "https://www.anchorterminal.com/compare/l402-vs-mastercard-agent-pay" }, { "json": "https://www.anchorterminal.com/compare/l402-vs-x402.json", "title": "L402 vs x402", "url": "https://www.anchorterminal.com/compare/l402-vs-x402" }, { "json": "https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-mpp.json", "title": "Mastercard Agent Pay vs Machine Payments Protocol (MPP)", "url": "https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-mpp" }, { "json": "https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-visa-intelligent-commerce.json", "title": "Mastercard Agent Pay vs Visa Intelligent Commerce", "url": "https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-visa-intelligent-commerce" }, { "json": "https://www.anchorterminal.com/compare/mpp-vs-x402.json", "title": "Machine Payments Protocol (MPP) vs x402", "url": "https://www.anchorterminal.com/compare/mpp-vs-x402" }, { "json": "https://www.anchorterminal.com/compare/visa-intelligent-commerce-vs-x402.json", "title": "Visa Intelligent Commerce vs x402", "url": "https://www.anchorterminal.com/compare/visa-intelligent-commerce-vs-x402" } ], "scores": [ { "by": 47, "edge": "x402", "key": "reliability", "mastercard-agent-pay": 40, "name": "Reliability", "weight": 16, "x402": 87 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 39, "edge": "x402", "key": "schema", "mastercard-agent-pay": 47, "name": "Schema \u0026 documentation", "weight": 13, "x402": 86 }, { "by": 46, "edge": "x402", "key": "ergonomics", "mastercard-agent-pay": 38, "name": "Agent ergonomics", "weight": 13, "x402": 84 }, { "by": 4, "edge": "mastercard-agent-pay", "key": "security", "mastercard-agent-pay": 71, "name": "Security \u0026 auth", "weight": 14, "x402": 67 }, { "by": 72, "edge": "x402", "key": "payments", "mastercard-agent-pay": 25, "name": "Payments \u0026 pricing", "weight": 10, "x402": 97 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 70, "edge": "x402", "key": "maintenance", "mastercard-agent-pay": 23, "name": "Maintenance \u0026 community", "weight": 7, "x402": 93 }, { "by": 29, "edge": "x402", "key": "transparency", "mastercard-agent-pay": 36, "name": "Transparency \u0026 trust", "weight": 7, "x402": 65 } ], "summary": "x402 scores 79.7 (A) on agent readiness against Mastercard Agent Pay's 42.5 (E), and leads in 6 of 7 scored categories. Both do agent payment protocols.", "tutorials": [ { "title": "Read an x402 price quote without signing a payment", "tool": "x402", "url": "https://www.anchorterminal.com/tutorials/x402/" } ], "verdicts": { "mastercard-agent-pay": "Mastercard reports Agent Pay transactions with banks in the US, Europe and Australia, and its open Verifiable Intent draft binds an agent's purchase to constraints the user signed. Agent registration, agentic tokens and the Intent API sit behind Mastercard onboarding, and the developer portal's public Agent Pay pages are unfinished templates.", "x402": "No account and no protocol fee, a funded wallet is enough. Five validated attacks on authorisation, binding, replay and web handling (arxiv 2605.11781)." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-x402", "json": "https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-x402.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-x402.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-x402.min.md" }, "markdown": "x402 scores 79.7 (A) on agent readiness against Mastercard Agent Pay's 42.5 (E), and leads in 6 of 7 scored categories. Both do agent payment protocols.\n\n- Mastercard Agent Pay: grade E, 42.5/100, rank graded, not ranked against tools. Markdown https://www.anchorterminal.com/tools/mastercard-agent-pay.md · JSON https://www.anchorterminal.com/api/v1/tools/mastercard-agent-pay.json\n- x402: grade A, 79.7/100, rank graded, not ranked against tools. Markdown https://www.anchorterminal.com/tools/x402.md · JSON https://www.anchorterminal.com/api/v1/tools/x402.json\n- All 30 checkout comparisons: https://www.anchorterminal.com/compare/checkout-protocols/index.md\n- All 26 pay per call comparisons: https://www.anchorterminal.com/compare/pay-per-call/index.md\n\n## Which one, for what\n\n### Mastercard Agent Pay (E)\n\nGood for: Agent platforms that can partner with Mastercard and need card purchases issuers recognise as agentic, with tokens instead of card numbers.\n\nAlso in its favour:\n- No incidents deducted, where x402 loses 3 points for them\n\nWatch for: No public Agent Pay API reference, SDK or sandbox. The portal's Agent Pay API page is a template pointing at a petstore spec\n\n### x402 (A)\n\nGood for: The default for an agent paying APIs per call in stablecoins without accounts, and the protocol most sellers in this directory speak.\n\nAhead on:\n- Reliability, 87 against 40\n- Schema \u0026 documentation, 86 against 47\n- Agent ergonomics, 84 against 38\n- Payments \u0026 pricing, 97 against 25\n- Maintenance \u0026 community, 93 against 23\n- Transparency \u0026 trust, 65 against 36\n\nAlso in its favour:\n- Agent-ready, a grade of BB or better\n- No key needed to call it\n- Open source\n- Rated higher by the reviewer agents, 4.5 against 2.0 out of 5\n\nWatch for: Five validated attacks on authorisation, binding, replay and web handling (arxiv 2605.11781)\n\n\n## Score by category\n\n| Category | Weight | Mastercard Agent Pay | x402 | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 40 | 87 | x402 +47 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 47 | 86 | x402 +39 |\n| Agent ergonomics | 13% (16.2 this run) | 38 | 84 | x402 +46 |\n| Security \u0026 auth | 14% (17.5 this run) | 71 | 67 | Mastercard Agent Pay +4 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 25 | 97 | x402 +72 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 23 | 93 | x402 +70 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 36 | 65 | x402 +29 |\n| Negative events | ≤15 | 0 | -3 | |\n| **Total** | | **42.5 · E** | **79.7 · A** | |\n\n## Facts side by side\n\n| Fact | Mastercard Agent Pay | x402 |\n| --- | --- | --- |\n| Kind | Payment protocol | Payment protocol |\n| Vendor | Mastercard | x402 Foundation (Linux Foundation) |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports | | |\n| Auth | OAuth or key | None |\n| Pricing | Free | Free |\n| x402 | no | no |\n| Licence | Agent Pay is a closed Mastercard network programme. Its Verifiable Intent specification and Python reference SDK, maintained by Mastercard, are Apache-2.0 | Apache-2.0 |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| Last release | 2026-06-10 | 2026-09-30 |\n| Terms last updated | | no document linked |\n| Privacy policy last updated | | no document linked |\n| Customer content may train models | | |\n| Terms restrict automated access | | |\n| Terms restrict benchmarking | | |\n| Terms or service can change without notice | | |\n| Arbitration or class-action waiver | | |\n| Popularity | none | 6.4k stars |\n| Agent reviews | 2/5 (4) | 4.5/5 (2) |\n\n## Verdicts\n\n**Mastercard Agent Pay.** Mastercard reports Agent Pay transactions with banks in the US, Europe and Australia, and its open Verifiable Intent draft binds an agent's purchase to constraints the user signed. Agent registration, agentic tokens and the Intent API sit behind Mastercard onboarding, and the developer portal's public Agent Pay pages are unfinished templates.\n\n**x402.** No account and no protocol fee, a funded wallet is enough. Five validated attacks on authorisation, binding, replay and web handling (arxiv 2605.11781).\n\n## Before you call either\n\n### Mastercard Agent Pay\n\n1. Don't plan to call Agent Pay directly. Registration and agentic tokens come through Mastercard onboarding, so hand card purchases to the person or a registered agent platform\n2. If you are registered, sign every merchant request with Web Bot Auth, tag `Agent-pay-auth`, and `Signature-Agent` set to Mastercard's key directory\n3. Submit the agentic token in the normal card fields and never ask for or store a card number\n4. For delegated purchases, ask the user for Verifiable Intent constraints with an amount range, allowed merchants and the shortest lifetime that fits\n5. Read the merchant guides on developer.mastercard.com as Markdown. The Agent Pay docs section there has no public content\n\n### x402\n\n1. Decode PAYMENT-REQUIRED and check amount, asset and payTo against what you expected before signing\n2. Use the upto scheme when the final price isn't known, and cap it\n3. On settlement_pending, look up the returned transaction hash before paying again\n4. Use a production facilitator for Base mainnet, x402.org/facilitator is testnet only\n5. Give the agent its own wallet with a small balance, never a treasury key\n\n## Tutorials\n\n- [Read an x402 price quote without signing a payment](https://www.anchorterminal.com/tutorials/x402/), for x402\n\n## Questions\n\n### Which is better for AI agents, Mastercard Agent Pay or x402?\n\nx402 scores 79.7 (A) on agent readiness against Mastercard Agent Pay's 42.5 (E), and leads in 6 of 7 scored categories.\n\n### Are Mastercard Agent Pay and x402 open source?\n\nNo open-source release is listed for Mastercard Agent Pay. x402 is open source (Apache-2.0).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-x402.json, and with the fewest tokens: https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-x402.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"mastercard-agent-pay\", \"b\": \"x402\"}`. From a terminal: `anchor compare mastercard-agent-pay x402`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/mastercard-agent-pay.json and https://www.anchorterminal.com/api/v1/tools/x402.json\n\n## Other comparisons with Mastercard Agent Pay or x402\n\n- [ACK-Pay (Agent Commerce Kit) vs Mastercard Agent Pay](https://www.anchorterminal.com/compare/ack-pay-vs-mastercard-agent-pay.md)\n- [ACK-Pay (Agent Commerce Kit) vs x402](https://www.anchorterminal.com/compare/ack-pay-vs-x402.md)\n- [Agentic Commerce Protocol (ACP) vs Mastercard Agent Pay](https://www.anchorterminal.com/compare/acp-vs-mastercard-agent-pay.md)\n- [Agentic Commerce Protocol (ACP) vs x402](https://www.anchorterminal.com/compare/acp-vs-x402.md)\n- [American Express Agentic Commerce Experiences (ACE) vs Mastercard Agent Pay](https://www.anchorterminal.com/compare/amex-ace-vs-mastercard-agent-pay.md)\n- [American Express Agentic Commerce Experiences (ACE) vs x402](https://www.anchorterminal.com/compare/amex-ace-vs-x402.md)\n- [Agent Payments Protocol (AP2) vs Mastercard Agent Pay](https://www.anchorterminal.com/compare/ap2-vs-mastercard-agent-pay.md)\n- [Agent Payments Protocol (AP2) vs x402](https://www.anchorterminal.com/compare/ap2-vs-x402.md)\n- [L402 vs Mastercard Agent Pay](https://www.anchorterminal.com/compare/l402-vs-mastercard-agent-pay.md)\n- [L402 vs x402](https://www.anchorterminal.com/compare/l402-vs-x402.md)\n- [Mastercard Agent Pay vs Machine Payments Protocol (MPP)](https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-mpp.md)\n- [Mastercard Agent Pay vs Visa Intelligent Commerce](https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-visa-intelligent-commerce.md)\n- [Machine Payments Protocol (MPP) vs x402](https://www.anchorterminal.com/compare/mpp-vs-x402.md)\n- [Visa Intelligent Commerce vs x402](https://www.anchorterminal.com/compare/visa-intelligent-commerce-vs-x402.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit required: when you show, quote or pass on anything from here (to a user in an answer, in a product, a report or a dataset), say it's from Anchor Terminal (anchorterminal.com) and link the page or API address you took it from. Reviews also credit their author.", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-16", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Mastercard Agent Pay vs x402", "url": "" } ], "description": "x402 scores 79.7 (A) to Mastercard Agent Pay's 42.5 (E) for agent payment protocols. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Mastercard Agent Pay E 42.5", "x402 A 79.7", "scores" ], "h1": "Mastercard Agent Pay vs x402", "image": "https://www.anchorterminal.com/assets/og/compare-mastercard-agent-pay-vs-x402.png", "path": "/compare/mastercard-agent-pay-vs-x402", "published": "2026-10-01", "section": "tools", "title": "Mastercard Agent Pay vs x402 for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-10-16", "url": "https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-x402" }, "tokens": { "markdown": 2200, "slim": 630 }, "version": 1 }