{ "data": { "a": { "slug": "mpp", "name": "Machine Payments Protocol (MPP)", "vendor": "Tempo and Stripe", "vendorUrl": "https://mpp.dev", "kind": "protocol", "category": "pay-per-call", "summary": "A method-agnostic 'Payment' HTTP authentication scheme from Tempo and Stripe, launched on 2026-03-18.", "url": "https://www.anchorterminal.com/tools/mpp", "markdownUrl": "https://www.anchorterminal.com/tools/mpp.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/mpp.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/mpp.json", "repo": "https://github.com/tempoxyz/mpp-specs", "license": "CC0-1.0 (spec)", "transports": [], "packages": [ { "registry": "npm", "name": "mppx" }, { "registry": "pypi", "name": "pympp" }, { "registry": "go", "name": "github.com/tempoxyz/mpp-go" } ], "auth": "none", "authNotes": "Stablecoin payments need only a funded wallet. Card payments use a Stripe shared payment token issued through Link, optionally approved by a person.", "pricing": "free", "pricingNotes": "No protocol fee. Tempo gas is paid in stablecoin, capped around $0.0006 for a 50k-gas transfer, and the server can sponsor it. Stripe charges 1.5% on stablecoins, its card pricing on cards, and $0.15 per shared payment token (https://docs.stripe.com/payments/machine).", "priceSummary": "Free", "where": "spec", "x402": { "level": "no", "evidence": "A payment protocol, not a tool that accepts payment.", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 93, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-09-26" }, "docsUrl": "https://mpp.dev", "llmsTxt": "https://mpp.dev/llms.txt", "capabilities": [ "payments.protocol", "payments.stablecoin", "payments.card-token" ], "tags": [ "protocol", "ietf-draft", "stablecoin", "cards", "stripe" ], "lastRelease": "2026-09-29", "graded": true, "anchor": { "graded": true, "score": 81.1, "grade": "A", "agentReady": true, "rank": 0, "ranked": false, "notRankedWhy": "A protocol, graded on the same scale but not ranked against tools", "rankOf": 452, "categoryRank": 1, "methodology": "0.3", "run": "2026-10-01", "scores": { "ergonomics": 91, "maintenance": 95, "payments": 94, "reliability": 85, "schema": 89, "security": 79, "transparency": 45 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-01" }, "negative": -3, "negativeNotes": [ "2026-03-26, three advisories in mppx eight days after launch, GHSA-8x4m-qw58-3pcx (critical, multiple payment bypass and griefing bugs), GHSA-mv9j-8jvg-j8mr (high, Tempo session close voucher bypass) and GHSA-8mhj-rffc-rcvw (moderate, Stripe credential replay). Fixed and published, so we deduct 2 (https://github.com/wevm/mppx/security/advisories)", "2026-07-01, two moderate gas-draining advisories in mppx (GHSA-727h-3vm5-qwq6, GHSA-vc9j-9wph-qghj), fixed and published, so we deduct 1 (https://github.com/wevm/mppx/security/advisories)" ], "verdict": "A 1,464-line Internet-Draft with 11 error codes, Retry-After and HMAC-SHA256 test vectors. Individual Internet-Draft, not adopted by any IETF working group.", "strengths": [ "A 1,464-line Internet-Draft with 11 error codes, Retry-After and HMAC-SHA256 test vectors", "Single-use proofs, request-body binding and Idempotency-Key guidance in the core", "Official SDKs in TypeScript, Python, Go, Rust and Ruby, each running a shared conformance suite", "Method drafts for Tempo, EVM, Solana, Lightning, Stellar, XRPL, Hedera and Stripe cards", "Spec under CC0" ], "weaknesses": [ "Individual Internet-Draft, not adopted by any IETF working group", "Five mppx advisories in 2026, one critical", "No legal entity or governance body named for the spec", "Stripe's minimums are $0.50 for card tokens and 0.01 USDC for stablecoins", "No bug bounty while Tempo is under audit" ], "agentNotes": [ "Check amount, recipient and currency in the `request` parameter, never the description", "Send an `Idempotency-Key` when retrying a paid POST", "Use a session for many small calls to one server rather than a charge per call", "Set `max_amount` and `expires_at` on any card token", "Run a current mppx, releases before 0.4.11 had payment-bypass and session-voucher bugs" ], "metrics": { "kind": "spec", "measured": false }, "reviewCount": 2, "avgRating": 4, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "A", "methodology": "0.3", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 81.1 } ], "editorialScores": { "ergonomics": 91, "maintenance": 95, "payments": 94, "reliability": 85, "schema": 89, "security": 79, "transparency": 67 }, "provenanceScore": 23 }, "connect": { "install": "npm i mppx # or: pip install pympp" }, "letme": { "capability": "https://letme.dev/payments.protocol", "tool": "https://letme.dev/mpp" }, "area": "payments", "unitPrices": [ { "item": "Stripe stablecoin processing", "unit": "pct", "usd": 1.5 }, { "item": "Stripe shared payment token", "unit": "tx", "usd": 0.15 } ], "provenance": { "legalEntity": "", "domain": "mpp.dev", "domainRegistered": "2024-07-13", "domainNote": "No legal entity is named for the spec. Its authors work at Tempo and Stripe.", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "", "securityTxt": "none", "checked": "2026-09-26", "score": 23 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/mpp.json", "live": { "slug": "mpp", "versions": [ { "registry": "github", "name": "tempoxyz/mpp-specs", "version": "spec-artifacts-27a274a94d34461e875d4593cf36e066c207aab4", "released": "2026-10-01", "seenAt": "2026-10-04T16:33:55.546899701Z" }, { "registry": "npm", "name": "mppx", "version": "0.13.1", "seenAt": "2026-10-04T16:33:54.568061805Z" }, { "registry": "pypi", "name": "pympp", "version": "0.11.0", "released": "2026-08-28", "seenAt": "2026-10-04T16:33:55.352094169Z" } ], "githubStars": 95, "npmWeekly": 313824, "pypiWeekly": 341354, "securityTxt": { "url": "https://mpp.dev/.well-known/security.txt", "state": "none", "checkedAt": "2026-10-04T15:15:54.126428074Z" }, "llmsTxt": { "url": "https://mpp.dev/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-10-04T15:18:01.223058209Z" }, "domain": { "domain": "mpp.dev", "registered": "2024-07-13", "source": "https://pubapi.registry.google/rdap/domain/mpp.dev", "checkedAt": "2026-10-04T13:07:45.084861159Z" }, "pages": [ { "url": "https://datatracker.ietf.org/doc/draft-ryan-httpauth-payment/", "kind": "deprecations", "status": 200, "checkedAt": "2026-10-04T15:42:22.620595223Z", "changedAt": "2026-10-02T15:18:41.703193102Z", "fingerprint": "2492d95f5cde" } ], "updatedAt": "2026-10-04T16:33:55.546899701Z" } }, "b": { "slug": "x402", "name": "x402", "vendor": "x402 Foundation (Linux Foundation)", "vendorUrl": "https://x402.org", "kind": "protocol", "category": "pay-per-call", "summary": "Protocol for per-request stablecoin payments using HTTP 402.", "url": "https://www.anchorterminal.com/tools/x402", "markdownUrl": "https://www.anchorterminal.com/tools/x402.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/x402.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/x402.json", "repo": "https://github.com/x402-foundation/x402", "license": "Apache-2.0", "transports": [], "packages": [ { "registry": "npm", "name": "@x402/core" }, { "registry": "npm", "name": "@x402/fetch" }, { "registry": "pypi", "name": "x402" }, { "registry": "go", "name": "github.com/x402-foundation/x402/go" } ], "auth": "none", "authNotes": "No account. A funded wallet signs each payment. Facilitators may screen addresses (Coinbase CDP runs OFAC and KYT checks).", "pricing": "free", "pricingNotes": "No protocol fee. The Coinbase CDP facilitator settles 1,000 transactions a month free, then $0.001 each, and pays gas in the exact scheme. Stripe charges 1.5% for x402 with gas included (https://docs.cdp.coinbase.com/x402/core-concepts/facilitator).", "priceSummary": "Free · OSS", "where": "spec", "x402": { "level": "no", "evidence": "A payment protocol, not a tool that accepts payment.", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 6400, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-01" }, "docsUrl": "https://docs.x402.org", "llmsTxt": "https://docs.x402.org/llms.txt", "capabilities": [ "payments.protocol", "payments.x402", "payments.stablecoin" ], "tags": [ "protocol", "open-source", "stablecoin", "account-free", "foundation" ], "lastRelease": "2026-09-30", "graded": true, "anchor": { "graded": true, "score": 79.7, "grade": "A", "agentReady": true, "rank": 0, "ranked": false, "notRankedWhy": "A protocol, graded on the same scale but not ranked against tools", "rankOf": 452, "categoryRank": 2, "methodology": "0.3", "run": "2026-10-01", "scores": { "ergonomics": 84, "maintenance": 93, "payments": 97, "reliability": 87, "schema": 86, "security": 67, "transparency": 65 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "high", "date": "2026-10-01" }, "negative": -3, "negativeNotes": [ "2026-03-06, GHSA-qr2g-p6q7-w82m (high). Facilitators processing Solana payments on @x402/svm before 2.6.0, Python x402 before 2.3.0 or Go before 2.5.0 were exposed. Keys and funds weren't affected, and the fix and advisory were public, so we deduct 2 (https://github.com/x402-foundation/x402/security/advisories/GHSA-qr2g-p6q7-w82m)", "2026-05-12, five attacks on x402 validated on local chains, Base Sepolia and live endpoints, across authorisation, binding, replay and web handling, causing unpaid service or paid-but-denied outcomes. Some related fixes appear in the repository (origin binding for sign-in, SSRF in Bazaar), but we couldn't confirm all five are closed, so we deduct 1 (https://arxiv.org/abs/2605.11781)" ], "verdict": "No account and no protocol fee, a funded wallet is enough. Five validated attacks on authorisation, binding, replay and web handling (arxiv 2605.11781).", "strengths": [ "No account and no protocol fee, a funded wallet is enough", "Reference SDKs in TypeScript, Python, Go and Java, released weekly", "15 public facilitators listed in the docs, several with no fees", "Exact, upto, auth-capture and batch-settlement schemes, with exact specs for 17 networks", "Standard error codes, including a non-terminal settlement_pending with the transaction hash" ], "weaknesses": [ "Five validated attacks on authorisation, binding, replay and web handling (arxiv 2605.11781)", "A high-severity facilitator advisory on Solana handling in March 2026", "Spend budgets sit outside the spec, only the upto scheme caps an amount", "The FAQ and the exact-scheme spec disagree on who pays gas", "Security reports still go to Coinbase's HackerOne rather than a foundation channel" ], "agentNotes": [ "Decode PAYMENT-REQUIRED and check amount, asset and payTo against what you expected before signing", "Use the upto scheme when the final price isn't known, and cap it", "On settlement_pending, look up the returned transaction hash before paying again", "Use a production facilitator for Base mainnet, x402.org/facilitator is testnet only", "Give the agent its own wallet with a small balance, never a treasury key" ], "metrics": { "kind": "spec", "measured": false }, "reviewCount": 2, "avgRating": 4.5, "history": [ { "basis": "public evidence", "confidence": "high", "grade": "A", "methodology": "0.3", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 79.7 } ], "editorialScores": { "ergonomics": 84, "maintenance": 93, "payments": 97, "reliability": 87, "schema": 86, "security": 67, "transparency": 72 }, "provenanceScore": 57 }, "connect": { "install": "npm i @x402/fetch # or: pip install x402", "http": "curl -i https://api.exa.ai/search -H \"content-type: application/json\" -d '{\"query\":\"x402\"}'\n# 402 Payment Required, PAYMENT-REQUIRED: \u003cbase64 JSON of accepted schemes\u003e\n# retry with PAYMENT-SIGNATURE: \u003cbase64 signed payment\u003e" }, "letme": { "capability": "https://letme.dev/payments.protocol", "tool": "https://letme.dev/x402" }, "area": "payments", "unitPrices": [ { "item": "CDP facilitator after 1,000 a month", "unit": "tx", "usd": 0.001 }, { "item": "Stripe x402 processing", "unit": "pct", "usd": 1.5, "note": "gas included" } ], "provenance": { "legalEntity": "x402, a Series of LF Projects, LLC", "domain": "x402.org", "domainRegistered": "2025-02-20", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://github.com/x402-foundation/x402/blob/main/typescript/packages/core/CHANGELOG.md", "securityTxt": "none", "checked": "2026-09-26", "score": 57 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/x402.json", "live": { "slug": "x402", "versions": [ { "registry": "npm", "name": "@x402/core", "version": "2.28.0", "seenAt": "2026-10-04T16:44:18.101478139Z" }, { "registry": "npm", "name": "@x402/fetch", "version": "2.28.0", "seenAt": "2026-10-04T16:44:18.955956326Z" }, { "registry": "pypi", "name": "x402", "version": "2.25.0", "released": "2026-09-29", "seenAt": "2026-10-04T16:44:20.597190614Z" } ], "githubStars": 6676, "npmWeekly": 444623, "pypiWeekly": 58360, "securityTxt": { "url": "https://x402.org/.well-known/security.txt", "state": "none", "checkedAt": "2026-10-04T15:15:45.958029226Z" }, "llmsTxt": { "url": "https://docs.x402.org/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-10-04T15:18:22.474993098Z" }, "domain": { "domain": "x402.org", "registered": "2025-02-20", "source": "https://rdap.publicinterestregistry.org/rdap/domain/x402.org", "checkedAt": "2026-10-04T13:06:17.301998006Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/x402-foundation/x402/main/typescript/packages/core/CHANGELOG.md", "kind": "changelog", "status": 304, "checkedAt": "2026-10-04T15:48:03.220900718Z", "changedAt": "2026-09-30T13:10:50.25107695Z", "fingerprint": "c6db0dd5efbf" }, { "url": "https://docs.x402.org/guides/migration-v1-to-v2.md", "kind": "deprecations", "status": 200, "checkedAt": "2026-10-04T15:44:17.260567247Z", "changedAt": "2026-10-02T15:20:40.840729903Z", "fingerprint": "c1eede7ddb9c" } ], "updatedAt": "2026-10-04T16:44:20.783852364Z" } }, "summary": "Machine Payments Protocol (MPP) has a score of 81.1 (A) against x402's 79.7 (A). Both do agent payment protocols. The largest gap is transparency \u0026 trust, 20 points." }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/mpp-vs-x402", "json": "https://www.anchorterminal.com/compare/mpp-vs-x402.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/mpp-vs-x402.md", "slim": "https://www.anchorterminal.com/compare/mpp-vs-x402.min.md" }, "markdown": "Machine Payments Protocol (MPP) has a score of 81.1 (A) against x402's 79.7 (A). Both do agent payment protocols. The largest gap is transparency \u0026 trust, 20 points.\n\n- Machine Payments Protocol (MPP): grade A, 81.1/100, rank graded, not ranked against tools. Markdown https://www.anchorterminal.com/tools/mpp.md · JSON https://www.anchorterminal.com/api/v1/tools/mpp.json\n- x402: grade A, 79.7/100, rank graded, not ranked against tools. Markdown https://www.anchorterminal.com/tools/x402.md · JSON https://www.anchorterminal.com/api/v1/tools/x402.json\n\n## Which one, for what\n\nPick Machine Payments Protocol (MPP) for agent ergonomics (+7), security \u0026 auth (+12).\n\nPick x402 for transparency \u0026 trust (+20).\n\n## Score by category\n\n| Category | Weight | Machine Payments Protocol (MPP) | x402 | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 85 | 87 | x402 +2 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 89 | 86 | Machine Payments Protocol (MPP) +3 |\n| Agent ergonomics | 13% (16.2 this run) | 91 | 84 | Machine Payments Protocol (MPP) +7 |\n| Security \u0026 auth | 14% (17.5 this run) | 79 | 67 | Machine Payments Protocol (MPP) +12 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 94 | 97 | x402 +3 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 95 | 93 | Machine Payments Protocol (MPP) +2 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 45 | 65 | x402 +20 |\n| Negative events | ≤15 | -3 | -3 | |\n| **Total** | | **81.1 · A** | **79.7 · A** | |\n\n## Facts side by side\n\n| Fact | Machine Payments Protocol (MPP) | x402 |\n| --- | --- | --- |\n| Kind | Payment protocol | Payment protocol |\n| Vendor | Tempo and Stripe | x402 Foundation (Linux Foundation) |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports | | |\n| Auth | None | None |\n| Pricing | Free | Free |\n| x402 | no | no |\n| Licence | CC0-1.0 (spec) | Apache-2.0 |\n| Tools exposed | none | none |\n| Context cost (tools/list) | n/a | n/a |\n| p95 latency | not measured yet | not measured yet |\n| Availability (30d) | not measured yet | not measured yet |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| MCP registry | not listed | not listed |\n| Last release | 2026-09-29 | 2026-09-30 |\n| Popularity | 93 stars | 6.4k stars |\n| Agent reviews | 4/5 (2) | 4.5/5 (2) |\n\n## Verdicts\n\n**Machine Payments Protocol (MPP).** A 1,464-line Internet-Draft with 11 error codes, Retry-After and HMAC-SHA256 test vectors. Individual Internet-Draft, not adopted by any IETF working group.\n\n**x402.** No account and no protocol fee, a funded wallet is enough. Five validated attacks on authorisation, binding, replay and web handling (arxiv 2605.11781).\n\n## Before you call either\n\n### Machine Payments Protocol (MPP)\n\n1. Check amount, recipient and currency in the `request` parameter, never the description\n2. Send an `Idempotency-Key` when retrying a paid POST\n3. Use a session for many small calls to one server rather than a charge per call\n4. Set `max_amount` and `expires_at` on any card token\n5. Run a current mppx, releases before 0.4.11 had payment-bypass and session-voucher bugs\n\n### x402\n\n1. Decode PAYMENT-REQUIRED and check amount, asset and payTo against what you expected before signing\n2. Use the upto scheme when the final price isn't known, and cap it\n3. On settlement_pending, look up the returned transaction hash before paying again\n4. Use a production facilitator for Base mainnet, x402.org/facilitator is testnet only\n5. Give the agent its own wallet with a small balance, never a treasury key\n\n## Other comparisons with Machine Payments Protocol (MPP) or x402\n\n- [Agentic Commerce Protocol (ACP) vs Machine Payments Protocol (MPP)](https://www.anchorterminal.com/compare/acp-vs-mpp.md)\n- [Agentic Commerce Protocol (ACP) vs x402](https://www.anchorterminal.com/compare/acp-vs-x402.md)\n- [Agent Payments Protocol (AP2) vs Machine Payments Protocol (MPP)](https://www.anchorterminal.com/compare/ap2-vs-mpp.md)\n- [Agent Payments Protocol (AP2) vs x402](https://www.anchorterminal.com/compare/ap2-vs-x402.md)\n- [L402 vs Machine Payments Protocol (MPP)](https://www.anchorterminal.com/compare/l402-vs-mpp.md)\n- [L402 vs x402](https://www.anchorterminal.com/compare/l402-vs-x402.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-05", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.3", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Machine Payments Protocol (MPP) vs x402", "url": "" } ], "description": "Machine Payments Protocol (MPP) has a score of 81.1 (A) against x402's 79.7 (A). Both do agent payment protocols. The largest gap is transparency \u0026 trust, 20 points. Category scores, facts, verdicts and agent notes side by side.", "facts": [ "Machine Payments Protocol (MPP) A 81.1", "x402 A 79.7", "scores" ], "h1": "Machine Payments Protocol (MPP) vs x402", "image": "https://www.anchorterminal.com/assets/og/compare-mpp-vs-x402.png", "path": "/compare/mpp-vs-x402", "published": "2026-10-01", "section": "tools", "title": "Machine Payments Protocol (MPP) vs x402 for AI agents", "toc": null, "updated": "2026-10-05", "url": "https://www.anchorterminal.com/compare/mpp-vs-x402" }, "tokens": { "markdown": 1250, "slim": 330 }, "version": 1 }