Universal Commerce Protocol (UCP) vs Visa Intelligent Commerce

Universal Commerce Protocol (UCP) 70

The latest release is v2026-08-25, 73 days before this check (20). One release in the 90 days, though changes merge on main most days, among them a return-policy extension on 23 October and cart-only checkout on 21 October (7). Pull requests from Google, Shopify and outside contributors merge within days; 262 issues and pull requests are open (18). Official SDKs, updated 5 November (15). CI with linting, spellcheck, governance checks and example validation, and Dependabot updates (10). 20 + 7 + 18 + 15 + 10 = 70.

Visa Intelligent Commerce 22

The last dated change on the graded surface is 8 June 2026, security fixes to the visa/ai VIC clients, 150 days before 5 November. The release notes last list the VIC Agent APIs in April 2026, and the TAP repository's last commit is 28 October 2025 (10). No TAP change or VIC client change in the 90 days from 7 August, and the release notes weren't re-read on 5 November. The two September 2026 commits to visa/ai touch only the Visa Acceptance skill (0). Dated monthly release notes and a support channel on the Developer Centre, but GitHub issue activity couldn't be read (7 of 25). No official SDK on npm or PyPI. The @visa packages are built from the repository (3 of 15). Neither repository has CI, and visa/ai pins turbo to latest (2 of 10). 22.

Universal Commerce Protocol (UCP) 82

Protocol reading. Capability negotiation means an agent sees only what both sides support, though the schemas are large (18 of 25). Catalogue search pages with a cursor and has_next_page (15 of 20). An error model with codes and continue_url to hand a buyer to the business when the agent can't finish (18). The MCP binding requires an idempotency-key UUID on checkout calls for retry safety (18). Official SDKs in Python and JavaScript; every request needs a UCP-Agent profile (13 of 15). 18 + 15 + 18 + 18 + 13 = 82.

Visa Intelligent Commerce 40

Protocol reading. Six MCP tools in Visa's examples (enrol a card, initiate, update and cancel a purchase instruction, retrieve credentials, confirm events), but each call carries device, assurance and mandate objects, and REST calls need message-level encryption (15 of 25). Little to page or filter in a purchase (5 of 20). TAP says when a merchant should block a request. We found no error codes for the agent APIs, and Visa's sample error handler only extracts a correlation ID (6 of 20). TAP nonces and an 8-minute window stop replays, and credentials are released only against an authenticated instruction, but no idempotency key is documented (10 of 20). TypeScript clients in the repository only and a Python TAP sample. Visa's MCP example needs ten credentials and keys (VIC key and shared secret, external client and app IDs, VTS key and secret, MLE certificate, key and key ID, and the developer's own RSA signing key) plus consumer and enrolment IDs (4 of 15). 40. Per the 16 October check, not re-read on 5 November.

Universal Commerce Protocol (UCP) 90

OpenAPI for each REST service, OpenRPC for the MCP and embedded bindings and JSON Schema 2020-12 throughout (25). ucp.dev serves llms.txt, and AGENT_IMPLEMENTER.md guides agents implementing the spec (10). The spec gives MUST and SHOULD rules with rationale for negotiation, signatures and permalinks (17). Typed schemas with required fields, namespaced extension types and version requirements (13). Examples validated in CI and an error code table with continue_url handling (13). Dated versions with release tags and release-note drafts generated from tags; no separate changelog page was read (12). 25 + 10 + 17 + 13 + 13 + 12 = 90.

Visa Intelligent Commerce 54

No public machine-readable contract. The Acceptance guide links its API reference to an internal spec branch on apihub.visa.com, which our session couldn't reach, TAP has field tables but no JSON Schema, and the visa/ai kit has TypeScript payload builders (8 of 25). llms.txt for the VIC kit at sandbox.mcp.visa.com, a documentation MCP server with one get-docs tool, and the Acceptance guide in Markdown. developer.visa.com has no llms.txt (10). TAP sets out the participants, the three signatures and when a merchant should block a request, and the llms.txt says which of the six operations each workflow uses and in what order (14 of 20). Mandates are typed with a decline threshold amount and currency, an expiry timestamp, a category code and a recurrence, and TAP lists its required signature fields, but most values are strings and the full VIC field list is behind the restricted docs (8 of 15). JSON request and response examples in the guide and the specification, with no error responses or codes documented for the agent APIs (6 of 15). Dated monthly release notes list the VIC Agent APIs in October 2025 and April 2026, and the guide has numbered revisions (25.09.01 pilot, 25.11.01 passkey service), but TAP itself has no version (8 of 15). 54. Per the 16 October check, not re-read on 5 November.

Universal Commerce Protocol (UCP) 79

Protocol reading, split as reference implementations 30, live deployments 25, spec stability 25 and test vectors 20. Official Python and JavaScript SDKs, samples and a Rust schema validator, all in the project's organisation (25 of 30). Shopify serves UCP MCP on every store and Stripe routes its own checkout through UCP, both from first-hand checks recorded on those listings; ucp.dev lists about 50 endorsers, which are claims (20 of 25). Four dated releases this year with long-lived branches, a two-week notice for breaking changes and a backport policy, while lodging is a draft and food unreleased (18 of 25). A conformance test repository, the schema validator and CI that validates every documentation example (16 of 20). 25 + 20 + 18 + 16 = 79.

Visa Intelligent Commerce 45

Protocol reading, split as reference implementations 30, live deployments 25, spec stability 25 and test vectors 20, as for ap2 and acp. Visa's TAP sample (an agent, a CDN proxy, a merchant front and back end and a key registry, six commits, the last on 28 October 2025) and the MIT visa/ai kit with TypeScript MCP and REST clients and a demo agent, none published to a package registry. The VIC MCP server and APIs are hosted by Visa for onboarded partners only, and no status page covers them (17 of 30). Visa says hundreds of agent-initiated transactions had completed by 18 December 2025 and that it has rolled out VIC across a broad set of agents and partners in the United States (29 April 2026). On 20 October 2026 Visa, BILL and Billtrust announced a live pilot in which BILL's payment agent, registered through TAP and the Agentic Directory, pays supplier invoices with tokenised credentials, and Billtrust's supplier portals recognise and admit it through TAP, the first named site verifying TAP that we found. It is a pilot, the Visa Acceptance guide is a pilot release, Intelligent Commerce Connect is in pilot, and no merchant verifying TAP in production was found (17 of 25; 14 on 16 October). The TAP specification carries no version or date, its public key section lists only RSA fields while its examples sign with Ed25519, it doesn't give the URL of Visa's key store, and the terms oblige implementers to adopt each Visa update within six months (8 of 25). No test vectors beyond one signature-base example, and neither repository has tests or CI (3 of 20). The TAP repository and the visa/ai kit were re-read from clones on 5 November with no commit since 28 October 2025 and 30 September 2026. developer.visa.com and developer.visaacceptance.com pages are per the 16 October check, not re-read on 5 November. 45.

Universal Commerce Protocol (UCP) 50

Protocol reading. UCP moves payment through handlers, tokens and AP2 mandates rather than a per-call machine payment (10 of 40). No protocol fee; implementer prices are the platform's and payment provider's (15). The spec, SDKs and samples are free (20). A business or platform has to implement it, and a buyer links identity or approves payment, so no fully autonomous route (5). 10 + 15 + 20 + 5 = 50.

Visa Intelligent Commerce 35

Protocol reading. VIC moves a consumer's Visa card through agent-specific tokens, so an agent can't pay on its own. TAP defines a Browsing IOU for a merchant's 402 response, Visa says it is aligning with x402 and that Intelligent Commerce Connect supports MPP, and Visa's agent skill describes Visa as an MPP card Client Enabler through processors, but none is a per-call payment on Visa's own endpoints (15 of 40). No fee to implement TAP, while Intelligent Commerce prices aren't published and production use needs a Visa Developer agreement (5 of 20). The Visa Developer sandbox is free, but VIC is a restricted product that needs Visa's approval even in sandbox, and whether sign-up asks for a card wasn't stated (15 of 20). A person must sign up, request access and be approved, and the agent must be onboarded to VIC (0). 35. Per the 16 October check, not re-read on 5 November.

Universal Commerce Protocol (UCP) 47

Apache-2.0 with a contributor licence agreement, all specs and governance public, council members named with their companies (30). ucp.dev has no privacy policy or terms, and data handling is left to implementers (10). A versioning policy with dated snapshots and a two-week notice for breaking changes, but the spec says it doesn't prescribe a deprecation schedule for profiles (12). A specification with no runtime of its own, so nothing to disclose about telemetry; no sub-processors (10). 30 + 10 + 12 + 10 = 62.

Visa Intelligent Commerce 60

The TAP specification and sample code are under Visa's Product Terms, a revocable, limited licence conditioned on implementing the latest version in full, with unpermitted modifications assigned to Visa. visa/ai is MIT, and the VIC APIs are under the Developer Centre terms (18 of 30). Visa's global privacy notice and the Developer Centre terms' data protection section apply, and the guide and release notes say consent is recorded for enrolment and personalisation. TAP passes hashed email and phone, IP address and device data to merchants and leaves consents to the implementer, and we found no VIC retention period (15 of 30). The terms let Visa modify or end any product immediately upon written notice and require TAP implementers to adopt updates within six months. No deprecation notices were found (5 of 20). No subprocessor list or data location was found for VIC (5 of 20). 43. Per the 16 October check, not re-read on 5 November.