Machine Payments Protocol (MPP) vs Universal Commerce Protocol (UCP)

Machine Payments Protocol (MPP) 94

MPP is a machine payment protocol (40). No protocol fee. Tempo gas is capped near $0.0006 a transfer and Stripe charges 1.5 per cent on stablecoins and $0.15 per shared payment token per the 26 September check, while Stripe's page sets minimums of $0.50 for card tokens and 0.01 USDC for stablecoins (17). The spec is CC0 and the SDKs are open source (20). A buyer with a stablecoin wallet needs no account, but the card route needs a token from Link, optionally approved by a person (17).

Universal Commerce Protocol (UCP) 50

Protocol reading. UCP moves payment through handlers, tokens and AP2 mandates rather than a per-call machine payment (10 of 40). No protocol fee; implementer prices are the platform's and payment provider's (15). The spec, SDKs and samples are free (20). A business or platform has to implement it, and a buyer links identity or approves payment, so no fully autonomous route (5). 10 + 15 + 20 + 5 = 50.

Machine Payments Protocol (MPP) 97

mppx 0.17.0, mpp-rs 0.18.1 and pympp 0.18.0 on 29 October 2026, and a spec commit on 26 October (30). mppx alone tagged 22 releases in the 90 days to 1 November (20). 10 open issues and 20 open pull requests on mppx on 1 November, down from 14 issues on 1 October. Reply times weren't read, so 22 stands (22). Official SDKs in five languages, all tagged in October 2026, with mpp-go moving from v0.2.0 (1 July) to v0.4.0 through v0.6.0 between 24 and 26 October and mpp-rb at v0.1.10 (15). CI with dependency scanning, Dependabot, OpenSSF Scorecard in mppx and fuzzing in Rust (10).

Universal Commerce Protocol (UCP) 70

The latest release is v2026-08-25, 73 days before this check (20). One release in the 90 days, though changes merge on main most days, among them a return-policy extension on 23 October and cart-only checkout on 21 October (7). Pull requests from Google, Shopify and outside contributors merge within days; 262 issues and pull requests are open (18). Official SDKs, updated 5 November (15). CI with linting, spellcheck, governance checks and example validation, and Dependabot updates (10). 20 + 7 + 18 + 15 + 10 = 70.

Machine Payments Protocol (MPP) 79

Payment proofs are single use, challenges can be bound with HMAC-SHA256 and to a digest of the request body, and the card path uses Stripe shared payment tokens with usage and expiry limits (26). Spend is capped by SPT limits and session deposits, while overall agent budgets are left to the client (14). The draft tells clients they MUST NOT trust the description and MUST check amount, recipient, currency and validity window themselves (13). Every paid response carries a Payment-Receipt header and settlement leaves an on-chain or Stripe record (13). Reports go to security@tempo.xyz with acknowledgement in 5 days, there's no bug bounty while Tempo is under audit, and mppx has published five advisories in 2026, one critical, with none since 1 July (13).

Universal Commerce Protocol (UCP) 67

OAuth 2.0 identity linking, RFC 9421 signatures for signed agents with key IDs bound to JWK thumbprints, and payment handlers with token exchange instead of raw card data (25 of 30). Checkout can hand back to the buyer through continue_url or an embedded checkout, and AP2 mandates record consent, but unattended completion is allowed by design (15 of 20). The permalink spec treats URL inputs as untrusted and requires server-side validation, but we found no guidance on product text reaching an agent (5 of 15). Order events go to business webhooks; we didn't read whether they are signed (8 of 15). SECURITY.md routes reports to Google's intake with a stated response time and GitHub advisories (14 of 20). 25 + 15 + 5 + 8 + 14 = 67.

Machine Payments Protocol (MPP) 91

One 402 and one retry, and session intents let many small calls share one deposit (23). Charge and subscription intents, per-method sessions, client payment preferences and a discovery draft (17). Error codes such as payment-insufficient, payment-expired and invalid-challenge say what failed, and servers SHOULD send Retry-After (18). The draft requires single-use proofs, at most one settlement for concurrent requests with the same credential, and recommends an Idempotency-Key for non-idempotent methods (18). SDKs in five languages and a CLI (15).

Universal Commerce Protocol (UCP) 82

Protocol reading. Capability negotiation means an agent sees only what both sides support, though the schemas are large (18 of 25). Catalogue search pages with a cursor and has_next_page (15 of 20). An error model with codes and continue_url to hand a buyer to the business when the agent can't finish (18). The MCP binding requires an idempotency-key UUID on checkout calls for retry safety (18). Official SDKs in Python and JavaScript; every request needs a UCP-Agent profile (13 of 15). 18 + 15 + 18 + 18 + 13 = 82.

Machine Payments Protocol (MPP) 85

Graded as a protocol on reference implementations (30), public servers or processors (25), spec stability (25) and test vectors (20). Official SDKs in TypeScript (mppx), Python, Go, Rust and Ruby (30). There's no facilitator role, servers verify on chain or through Stripe, and the mpp.dev catalogue source lists 119 services in its main file on 1 November (36 first-party and 83 third-party integrations), and the Tempo proxy entries moved to a separate mpp-proxy.json on 28 October, about 138 in all against the 137 the directory page showed on 1 October (20). The core is still an individual Internet-Draft at revision 01 (9 September 2026, expiring 13 March 2027), not adopted by any IETF working group, while the scheme carries no wire version and is built to evolve by adding fields (15). The draft includes HMAC-SHA256 challenge-binding test vectors, and every SDK runs a shared conformance suite from tempoxyz/mpp-tools in CI, with cross-SDK smoke tests in Rust (20).

Universal Commerce Protocol (UCP) 79

Protocol reading, split as reference implementations 30, live deployments 25, spec stability 25 and test vectors 20. Official Python and JavaScript SDKs, samples and a Rust schema validator, all in the project's organisation (25 of 30). Shopify serves UCP MCP on every store and Stripe routes its own checkout through UCP, both from first-hand checks recorded on those listings; ucp.dev lists about 50 endorsers, which are claims (20 of 25). Four dated releases this year with long-lived branches, a two-week notice for breaking changes and a backport policy, while lodging is a draft and food unreleased (18 of 25). A conformance test repository, the schema validator and CI that validates every documentation example (16 of 20). 25 + 20 + 18 + 16 = 79.