{ "data": { "a": { "slug": "ucp", "name": "Universal Commerce Protocol (UCP)", "vendor": "UCP Authors (Google, Shopify and co-developers)", "vendorUrl": "https://ucp.dev", "kind": "protocol", "category": "checkout-protocols", "summary": "The Universal Commerce Protocol (UCP) is an open specification, co-developed by Google, Shopify and other retailers and platforms, for agents to discover a business's capabilities and run catalogue, cart, checkout, identity linking and order flows over REST, MCP or A2A.", "url": "https://www.anchorterminal.com/tools/ucp", "markdownUrl": "https://www.anchorterminal.com/tools/ucp.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/ucp.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/ucp.json", "dns": "ucp.grade.anchorterminal.com", "repo": "https://github.com/Universal-Commerce-Protocol/ucp", "license": "Apache-2.0", "transports": [], "packages": [], "auth": "oauth", "authNotes": "A specification, not a service. Identity linking uses OAuth 2.0 for a platform to act for a user at a business. Agent requests carry a UCP-Agent profile, and signed agents send RFC 9421 HTTP message signatures with a Signature-Agent header and a JWK thumbprint key ID. Payment credentials move through payment handlers and token exchange between payment and credential providers, with AP2 mandates supported.", "pricing": "free", "pricingNotes": "The specification, schemas, SDKs and conformance tests are free under Apache-2.0. Costs come from the business's platform and payment provider, not the protocol.", "priceSummary": "Free · OSS", "where": "spec", "x402": { "level": "no", "evidence": "A commerce protocol, not a tool that accepts payment; it supports AP2 mandates and payment handlers (checked 2026-11-06).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 3479, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://ucp.dev/latest/specification/overview/", "llmsTxt": "https://ucp.dev/llms.txt", "openapi": "https://github.com/Universal-Commerce-Protocol/ucp/blob/main/source/services/shopping/rest.openapi.json", "capabilities": [ "payments.protocol", "payments.checkout", "payments.mandate" ], "tags": [ "protocol", "open-standard", "open-source", "mcp", "a2a", "ap2", "openapi", "openrpc", "llms-txt", "shopify", "google", "commerce" ], "lastRelease": "2026-08-25", "graded": true, "anchor": { "graded": true, "score": 72, "grade": "BB", "agentReady": true, "rank": 0, "ranked": false, "notRankedWhy": "A protocol, graded on the same scale but not ranked against tools", "rankOf": 1510, "categoryRank": 1, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 82, "maintenance": 70, "payments": 50, "reliability": 79, "schema": 90, "security": 67, "transparency": 47 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": 0, "verdict": "OpenAPI, OpenRPC and JSON Schema for every surface, official Python and JavaScript SDKs, conformance tests and live use on Shopify stores and Stripe's checkout. Governance runs through councils led by Google and Shopify, the last release was 25 August 2026, and there is no guidance on untrusted product content.", "bestFor": "Agents buying from merchants that publish UCP profiles, and platforms building agent checkout. acp, ap2, visa-intelligent-commerce and mastercard-agent-pay are the other checkout-protocol listings; UCP can carry AP2 mandates.", "strengths": [ "Machine-readable contracts for every transport, OpenAPI, OpenRPC and JSON Schema 2020-12", "Official Python and JavaScript SDKs, a schema validator and a conformance test suite", "Idempotency keys required on MCP checkout calls", "Live on every Shopify store and as Stripe's own-checkout route", "Breaking changes announced two weeks before they merge" ], "weaknesses": [ "No release since v2026-08-25, though main changes most days", "No guidance on product descriptions or business messages as untrusted content for agents", "Lodging is a draft and food ordering unreleased", "Governing and tech councils are led by Google and Shopify members" ], "agentNotes": [ "Read the business profile first and call only the capabilities both profiles declare", "Send a fresh idempotency-key UUID on each checkout call and reuse it on retry", "Hand the buyer the continue_url when a checkout needs a person instead of retrying", "Send a UCP-Agent profile, and sign requests with RFC 9421 if the business requires signed agents" ], "metrics": { "kind": "spec", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 72 } ], "editorialScores": { "ergonomics": 82, "maintenance": 70, "payments": 50, "reliability": 79, "schema": 90, "security": 67, "transparency": 62 }, "provenanceScore": 32, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "letme": { "capability": "https://letme.dev/payments.protocol", "tool": "https://letme.dev/ucp" }, "area": "payments", "provenance": { "legalEntity": "", "domain": "ucp.dev", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://github.com/Universal-Commerce-Protocol/ucp/releases", "securityTxt": "unknown", "checked": "2026-11-06", "notes": [ "Files carry \"Copyright 2026 UCP Authors\" under Apache-2.0. No legal entity runs the project; governance is by councils whose members are named with their companies.", "Security reports go to Google's g.co/vulnz with a five-working-day response, coordinated through GitHub Security Advisories (SECURITY.md in the .github repository).", "ucp.dev has no robots.txt and serves llms.txt. No terms or privacy policy found for the site.", "The registration date of ucp.dev wasn't found through RDAP." ], "score": 32 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/ucp.json", "live": { "slug": "ucp", "versions": [ { "registry": "github", "name": "Universal-Commerce-Protocol/ucp", "version": "v2026-08-25", "released": "2026-08-25", "seenAt": "2026-11-07T00:13:40.257304662Z" } ], "githubStars": 3480, "securityTxt": { "url": "https://ucp.dev/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:23.109475398Z" }, "llmsTxt": { "url": "https://ucp.dev/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:34:12.746672159Z" }, "updatedAt": "2026-11-07T16:00:23.109475398Z" } }, "answer": "Universal Commerce Protocol (UCP) scores 72 (BB) on agent readiness against Visa Intelligent Commerce's 48.1 (D), and leads in 5 of 7 scored categories. Visa Intelligent Commerce leads on transparency \u0026 trust.", "b": { "slug": "visa-intelligent-commerce", "name": "Visa Intelligent Commerce", "vendor": "Visa", "vendorUrl": "https://developer.visa.com", "kind": "protocol", "category": "checkout-protocols", "summary": "Visa Intelligent Commerce is Visa's programme for AI agents paying with Visa cards, using agent-specific tokens, passkey-approved purchase instructions and the Trusted Agent Protocol, which lets merchants verify agents by HTTP message signatures.", "url": "https://www.anchorterminal.com/tools/visa-intelligent-commerce", "markdownUrl": "https://www.anchorterminal.com/tools/visa-intelligent-commerce.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/visa-intelligent-commerce.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/visa-intelligent-commerce.json", "dns": "visa-intelligent-commerce.grade.anchorterminal.com", "repo": "https://github.com/visa/trusted-agent-protocol", "license": "Trusted Agent Protocol specification and sample code under Visa's TAP Product Terms (a revocable, limited licence). The visa/ai integration kit is MIT. The Intelligent Commerce APIs are under the Visa Developer Centre Terms of Use, with a Visa Developer agreement for production", "transports": [], "packages": [], "auth": "mixed", "authNotes": "Needs Visa onboarding and a consumer's passkey approval. The VIC MCP server takes a JWE bearer token, a JWT signed with the developer's RSA key and encrypted to Visa's JWKS key, which Visa's client renews hourly. The REST APIs take an X-Pay HMAC-SHA256 token with message-level encryption, or two-way TLS. Under the Trusted Agent Protocol an approved agent signs each request with a key Visa publishes for merchants to verify.", "pricing": "freemium", "pricingNotes": "No fee to read or implement the Trusted Agent Protocol, and the Visa Developer sandbox is free. Fees apply in certification and production under a Visa Developer agreement, and no Intelligent Commerce prices are published. Card fees apply on the payment itself.", "priceSummary": "Freemium", "where": "spec", "x402": { "level": "no", "evidence": "A card payment programme and protocols, not a tool that accepts payment. The TAP specification defines a Browsing IOU for a merchant's HTTP 402 response, and Visa said on 14 October 2025 it was working with Coinbase on x402 interoperability (https://usa.visa.com/about-visa/newsroom/press-releases.releaseId.21716.html).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-16" }, "docsUrl": "https://github.com/visa/ai/wiki/Visa-Intelligent-Commerce", "llmsTxt": "https://sandbox.mcp.visa.com/mcp/doc/llms.txt", "capabilities": [ "payments.protocol", "payments.card-token", "payments.mandate", "auth.agent-identity" ], "tags": [ "protocol", "cards", "visa", "agent-identity", "web-bot-auth", "passkeys", "restricted-access", "pilot" ], "lastRelease": "2026-06-08", "graded": true, "anchor": { "graded": true, "score": 48.1, "grade": "D", "agentReady": false, "rank": 0, "ranked": false, "notRankedWhy": "A protocol, graded on the same scale but not ranked against tools", "rankOf": 1510, "categoryRank": 4, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 40, "maintenance": 22, "payments": 35, "reliability": 45, "schema": 54, "security": 70, "transparency": 60 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-05" }, "negative": 0, "verdict": "The Trusted Agent Protocol specification and Visa's MCP and REST sample kit are public, and purchase instructions bind network tokens to a passkey-approved amount, merchant and expiry. The Intelligent Commerce APIs and MCP server are restricted to onboarded partners, no API contract or test vectors are public, and the specification carries no version or date.", "bestFor": "Agent platforms that will sign with Visa to pay with consumers' Visa cards under passkey-approved limits, and for merchants and bot-management vendors that want to recognise Visa-approved agents with TAP.", "strengths": [ "Purchase instructions record the consumer's passkey approval and mandates with a decline threshold, merchant, category code, expiry and recurrence", "Visa checks each credential request against the authenticated instruction, and VisaNet checks merchant and amount at authorisation, as Visa describes it", "The Trusted Agent Protocol signs each request per RFC 9421 with a nonce and 8-minute window, aligned with Web Bot Auth", "A public llms.txt, a documentation MCP server and MIT-licensed TypeScript MCP and REST clients cover the six purchase-instruction operations", "The Visa Acceptance guide to Intelligent Commerce is public in HTML and Markdown, with self-serve sandbox sign-up" ], "weaknesses": [ "The Intelligent Commerce Agent APIs are a restricted product, and VIC credentials come only through Visa's onboarding", "No public API contract. The Acceptance guide's API reference links point to an `internal` spec branch on apihub.visa.com", "The TAP specification has no version, date or test vectors, and its key section lists RSA fields while its examples sign with Ed25519", "TAP is licensed under revocable Visa terms that assign unpermitted modifications to Visa and require updates within six months", "No published fees, rate limits, error codes, idempotency keys or prompt-injection guidance were found for the agent APIs" ], "agentNotes": [ "Don't plan to call the Intelligent Commerce APIs or MCP server without Visa onboarding. Ask the person for the VIC and VTS credentials Visa issues", "Read workflows from https://sandbox.mcp.visa.com/mcp/doc/llms.txt or the documentation MCP server's `get-docs` tool. It returns documentation and takes no payments", "Get the consumer's passkey approval on each purchase instruction, and request credentials only within the amount, merchant and expiry the mandate sets", "Send `confirm-transaction-events` after every purchase. Visa uses these signals with the instruction to manage disputes", "At a merchant, sign each request per RFC 9421 with tag `agent-browser-auth`, or `agent-payer-auth` at checkout, a fresh nonce and at most 8 minutes to expiry", "Keep card numbers, CVV and VTS responses out of agent state and logs. Visa changed its own demo agent in June 2026 to stop holding them" ], "metrics": { "kind": "spec", "measured": false }, "reviewCount": 4, "avgRating": 2.5, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 48.1 } ], "editorialScores": { "ergonomics": 40, "maintenance": 22, "payments": 35, "reliability": 45, "schema": 54, "security": 70, "transparency": 43 }, "provenanceScore": 77, "checked": { "categories": { "ergonomics": "2026-11-05", "maintenance": "2026-11-05", "payments": "2026-11-05", "reliability": "2026-11-05", "schema": "2026-11-05", "security": "2026-11-05", "transparency": "2026-11-05" }, "last": "2026-11-05", "lastMoved": "2026-11-05", "oldest": "2026-11-05", "stale": false, "staleAfterDays": 90 } }, "letme": { "capability": "https://letme.dev/payments.protocol", "tool": "https://letme.dev/visa-intelligent-commerce" }, "area": "payments", "provenance": { "legalEntity": "Visa Inc.", "domain": "visa.com", "domainRegistered": "1994-03-08", "endpointOnVendorDomain": true, "terms": "https://developer.visa.com/terms", "privacy": "https://www.visa.com/en-us/legal/global-privacy-notice", "statusPage": "", "changelog": "https://developer.visa.com/docs/release-notes", "securityTxt": "none", "checked": "2026-10-16", "notes": [ "The Developer Centre terms name a contracting entity per territory, Visa U.S.A. Inc. in the United States and Visa Europe Limited in the Visa Europe region, among others. Press releases are issued by Visa Inc.", "RDAP for visa.com gives a registration date of 8 March 1994. The VIC MCP sandbox is at sandbox.mcp.visa.com, the REST sandbox at sandbox.api.visa.com, and the Visa Acceptance APIs at apitest.visaacceptance.com and api.visaacceptance.com.", "No status page covers the VIC APIs or MCP server. status.visaacceptance.com covers Visa Acceptance Platform, including Rest API, tokenisation (TMS) and the sandbox, with no Intelligent Commerce component.", "No security.txt at developer.visa.com (400), www.visa.com, usa.visa.com or corporate.visa.com (404) on 16 October 2026. Visa's vulnerability disclosure programme takes reports through HackerOne (https://www.visa.com/en-us/company/vulnerability-disclosure). Neither GitHub repository has a SECURITY.md.", "The changelog link is the Developer Centre's monthly release notes. TAP has no changelog of its own.", "developer.visa.com serves no robots.txt (404), and usa.visa.com and developer.visaacceptance.com allow the pages read. status.visaacceptance.com disallows /api/. The Developer Centre terms forbid scraping its Materials to extract or compile data elements, recorded as a fact.", "WebFetch was refused for developer.visa.com, so its pages were read with curl. WebFetch read the Visa newsroom. The VIC documentation on developer.visa.com is behind a login for approved users, and mcp.visa.com redirects to it. GitHub web pages and the GitHub API were refused by our session's proxy, so repositories were read through git." ], "score": 77 }, "requirements": { "setupChecked": true, "card": "unknown", "freeTier": true, "minutes": 180, "credential": "mixed" }, "pageJsonUrl": "https://www.anchorterminal.com/tools/visa-intelligent-commerce.json", "live": { "slug": "visa-intelligent-commerce", "githubStars": 221, "securityTxt": { "url": "https://visa.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:01:11.698133649Z" }, "llmsTxt": { "url": "https://sandbox.mcp.visa.com/mcp/doc/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:34:18.333313187Z" }, "domain": { "domain": "visa.com", "registered": "1994-03-08", "source": "https://rdap.verisign.com/com/v1/domain/visa.com", "checkedAt": "2026-11-01T14:08:20.653734532Z" }, "pages": [ { "url": "https://developer.visa.com/docs/release-notes", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:03:29.269914529Z", "changedAt": "2026-10-22T01:13:25.615565705Z", "fingerprint": "cb635b4f0bac" }, { "url": "https://www.visa.com/en-us/legal/global-privacy-notice", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:36:33.39368276Z", "changedAt": "2026-10-29T05:29:24.385099837Z", "fingerprint": "3e53cac6d0a4" }, { "url": "https://developer.visa.com/terms", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:03:32.47714022Z", "changedAt": "2026-10-21T00:22:56.257356808Z", "fingerprint": "d6b9aa9ed39b" } ], "github": { "repo": "visa/trusted-agent-protocol", "checkedAt": "2026-11-02T09:36:18.545734791Z", "stars": 219, "archived": false, "issuesEnabled": true, "pushedAt": "2025-10-28T22:43:43Z", "openIssues": 12, "openPRs": 8, "issuesOpened90d": 4, "issuesClosed90d": 1, "prsMerged90d": 0, "replies": { "sampled": 12, "unanswered": 11, "medianDays": 16.9 } }, "updatedAt": "2026-11-07T16:01:11.698133649Z" } }, "edges": [ { "by": 48, "category": "maintenance", "leads": "ucp", "name": "Maintenance \u0026 community", "reasons": { "a": "The latest release is v2026-08-25, 73 days before this check (20). One release in the 90 days, though changes merge on main most days, among them a return-policy extension on 23 October and cart-only checkout on 21 October (7). Pull requests from Google, Shopify and outside contributors merge within days; 262 issues and pull requests are open (18). Official SDKs, updated 5 November (15). CI with linting, spellcheck, governance checks and example validation, and Dependabot updates (10). 20 + 7 + 18 + 15 + 10 = 70.", "b": "The last dated change on the graded surface is 8 June 2026, security fixes to the visa/ai VIC clients, 150 days before 5 November. The release notes last list the VIC Agent APIs in April 2026, and the TAP repository's last commit is 28 October 2025 (10). No TAP change or VIC client change in the 90 days from 7 August, and the release notes weren't re-read on 5 November. The two September 2026 commits to visa/ai touch only the Visa Acceptance skill (0). Dated monthly release notes and a support channel on the Developer Centre, but GitHub issue activity couldn't be read (7 of 25). No official SDK on npm or PyPI. The @visa packages are built from the repository (3 of 15). Neither repository has CI, and visa/ai pins `turbo` to `latest` (2 of 10). 22." }, "scores": { "a": 70, "b": 22 } }, { "by": 42, "category": "ergonomics", "leads": "ucp", "name": "Agent ergonomics", "reasons": { "a": "Protocol reading. Capability negotiation means an agent sees only what both sides support, though the schemas are large (18 of 25). Catalogue search pages with a cursor and has_next_page (15 of 20). An error model with codes and continue_url to hand a buyer to the business when the agent can't finish (18). The MCP binding requires an idempotency-key UUID on checkout calls for retry safety (18). Official SDKs in Python and JavaScript; every request needs a UCP-Agent profile (13 of 15). 18 + 15 + 18 + 18 + 13 = 82.", "b": "Protocol reading. Six MCP tools in Visa's examples (enrol a card, initiate, update and cancel a purchase instruction, retrieve credentials, confirm events), but each call carries device, assurance and mandate objects, and REST calls need message-level encryption (15 of 25). Little to page or filter in a purchase (5 of 20). TAP says when a merchant should block a request. We found no error codes for the agent APIs, and Visa's sample error handler only extracts a correlation ID (6 of 20). TAP nonces and an 8-minute window stop replays, and credentials are released only against an authenticated instruction, but no idempotency key is documented (10 of 20). TypeScript clients in the repository only and a Python TAP sample. Visa's MCP example needs ten credentials and keys (VIC key and shared secret, external client and app IDs, VTS key and secret, MLE certificate, key and key ID, and the developer's own RSA signing key) plus consumer and enrolment IDs (4 of 15). 40. Per the 16 October check, not re-read on 5 November." }, "scores": { "a": 82, "b": 40 } }, { "by": 36, "category": "schema", "leads": "ucp", "name": "Schema \u0026 documentation", "reasons": { "a": "OpenAPI for each REST service, OpenRPC for the MCP and embedded bindings and JSON Schema 2020-12 throughout (25). ucp.dev serves llms.txt, and AGENT_IMPLEMENTER.md guides agents implementing the spec (10). The spec gives MUST and SHOULD rules with rationale for negotiation, signatures and permalinks (17). Typed schemas with required fields, namespaced extension types and version requirements (13). Examples validated in CI and an error code table with continue_url handling (13). Dated versions with release tags and release-note drafts generated from tags; no separate changelog page was read (12). 25 + 10 + 17 + 13 + 13 + 12 = 90.", "b": "No public machine-readable contract. The Acceptance guide links its API reference to an `internal` spec branch on apihub.visa.com, which our session couldn't reach, TAP has field tables but no JSON Schema, and the visa/ai kit has TypeScript payload builders (8 of 25). llms.txt for the VIC kit at sandbox.mcp.visa.com, a documentation MCP server with one `get-docs` tool, and the Acceptance guide in Markdown. developer.visa.com has no llms.txt (10). TAP sets out the participants, the three signatures and when a merchant should block a request, and the llms.txt says which of the six operations each workflow uses and in what order (14 of 20). Mandates are typed with a decline threshold amount and currency, an expiry timestamp, a category code and a recurrence, and TAP lists its required signature fields, but most values are strings and the full VIC field list is behind the restricted docs (8 of 15). JSON request and response examples in the guide and the specification, with no error responses or codes documented for the agent APIs (6 of 15). Dated monthly release notes list the VIC Agent APIs in October 2025 and April 2026, and the guide has numbered revisions (25.09.01 pilot, 25.11.01 passkey service), but TAP itself has no version (8 of 15). 54. Per the 16 October check, not re-read on 5 November." }, "scores": { "a": 90, "b": 54 } }, { "by": 34, "category": "reliability", "leads": "ucp", "name": "Reliability", "reasons": { "a": "Protocol reading, split as reference implementations 30, live deployments 25, spec stability 25 and test vectors 20. Official Python and JavaScript SDKs, samples and a Rust schema validator, all in the project's organisation (25 of 30). Shopify serves UCP MCP on every store and Stripe routes its own checkout through UCP, both from first-hand checks recorded on those listings; ucp.dev lists about 50 endorsers, which are claims (20 of 25). Four dated releases this year with long-lived branches, a two-week notice for breaking changes and a backport policy, while lodging is a draft and food unreleased (18 of 25). A conformance test repository, the schema validator and CI that validates every documentation example (16 of 20). 25 + 20 + 18 + 16 = 79.", "b": "Protocol reading, split as reference implementations 30, live deployments 25, spec stability 25 and test vectors 20, as for ap2 and acp. Visa's TAP sample (an agent, a CDN proxy, a merchant front and back end and a key registry, six commits, the last on 28 October 2025) and the MIT visa/ai kit with TypeScript MCP and REST clients and a demo agent, none published to a package registry. The VIC MCP server and APIs are hosted by Visa for onboarded partners only, and no status page covers them (17 of 30). Visa says hundreds of agent-initiated transactions had completed by 18 December 2025 and that it has rolled out VIC across a broad set of agents and partners in the United States (29 April 2026). On 20 October 2026 Visa, BILL and Billtrust announced a live pilot in which BILL's payment agent, registered through TAP and the Agentic Directory, pays supplier invoices with tokenised credentials, and Billtrust's supplier portals recognise and admit it through TAP, the first named site verifying TAP that we found. It is a pilot, the Visa Acceptance guide is a pilot release, Intelligent Commerce Connect is in pilot, and no merchant verifying TAP in production was found (17 of 25; 14 on 16 October). The TAP specification carries no version or date, its public key section lists only RSA fields while its examples sign with Ed25519, it doesn't give the URL of Visa's key store, and the terms oblige implementers to adopt each Visa update within six months (8 of 25). No test vectors beyond one signature-base example, and neither repository has tests or CI (3 of 20). The TAP repository and the visa/ai kit were re-read from clones on 5 November with no commit since 28 October 2025 and 30 September 2026. developer.visa.com and developer.visaacceptance.com pages are per the 16 October check, not re-read on 5 November. 45." }, "scores": { "a": 79, "b": 45 } }, { "by": 15, "category": "payments", "leads": "ucp", "name": "Payments \u0026 pricing", "reasons": { "a": "Protocol reading. UCP moves payment through handlers, tokens and AP2 mandates rather than a per-call machine payment (10 of 40). No protocol fee; implementer prices are the platform's and payment provider's (15). The spec, SDKs and samples are free (20). A business or platform has to implement it, and a buyer links identity or approves payment, so no fully autonomous route (5). 10 + 15 + 20 + 5 = 50.", "b": "Protocol reading. VIC moves a consumer's Visa card through agent-specific tokens, so an agent can't pay on its own. TAP defines a Browsing IOU for a merchant's 402 response, Visa says it is aligning with x402 and that Intelligent Commerce Connect supports MPP, and Visa's agent skill describes Visa as an MPP card Client Enabler through processors, but none is a per-call payment on Visa's own endpoints (15 of 40). No fee to implement TAP, while Intelligent Commerce prices aren't published and production use needs a Visa Developer agreement (5 of 20). The Visa Developer sandbox is free, but VIC is a restricted product that needs Visa's approval even in sandbox, and whether sign-up asks for a card wasn't stated (15 of 20). A person must sign up, request access and be approved, and the agent must be onboarded to VIC (0). 35. Per the 16 October check, not re-read on 5 November." }, "scores": { "a": 50, "b": 35 } }, { "by": 13, "category": "transparency", "leads": "visa-intelligent-commerce", "name": "Transparency \u0026 trust", "reasons": { "a": "Apache-2.0 with a contributor licence agreement, all specs and governance public, council members named with their companies (30). ucp.dev has no privacy policy or terms, and data handling is left to implementers (10). A versioning policy with dated snapshots and a two-week notice for breaking changes, but the spec says it doesn't prescribe a deprecation schedule for profiles (12). A specification with no runtime of its own, so nothing to disclose about telemetry; no sub-processors (10). 30 + 10 + 12 + 10 = 62.", "b": "The TAP specification and sample code are under Visa's Product Terms, a revocable, limited licence conditioned on implementing the latest version in full, with unpermitted modifications assigned to Visa. visa/ai is MIT, and the VIC APIs are under the Developer Centre terms (18 of 30). Visa's global privacy notice and the Developer Centre terms' data protection section apply, and the guide and release notes say consent is recorded for enrolment and personalisation. TAP passes hashed email and phone, IP address and device data to merchants and leaves consents to the implementer, and we found no VIC retention period (15 of 30). The terms let Visa modify or end any product immediately upon written notice and require TAP implementers to adopt updates within six months. No deprecation notices were found (5 of 20). No subprocessor list or data location was found for VIC (5 of 20). 43. Per the 16 October check, not re-read on 5 November." }, "scores": { "a": 47, "b": 60 } } ], "facts": [ { "a": "Payment protocol", "b": "Payment protocol", "name": "Kind" }, { "a": "UCP Authors (Google, Shopify and co-developers)", "b": "Visa", "name": "Vendor" }, { "a": "no (local only)", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "", "b": "", "name": "Transports" }, { "a": "OAuth", "b": "OAuth or key", "name": "Auth" }, { "a": "Free", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Apache-2.0", "b": "Trusted Agent Protocol specification and sample code under Visa's TAP Product Terms (a revocable, limited licence). The visa/ai integration kit is MIT. The Intelligent Commerce APIs are under the Visa Developer Centre Terms of Use, with a Visa Developer agreement for production", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "2026-08-25", "b": "2026-06-08", "name": "Last release" }, { "a": "no document linked", "b": "no date given", "name": "Terms last updated" }, { "a": "no document linked", "b": "2026-05-14", "name": "Privacy policy last updated" }, { "a": "not read yet", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "not read yet", "b": "yes", "name": "Terms restrict automated access" }, { "a": "not read yet", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "not read yet", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "not read yet", "b": "yes", "name": "Arbitration or class-action waiver" }, { "a": "3.5k stars", "b": "none", "name": "Popularity" }, { "a": "none", "b": "2.5/5 (4)", "name": "Agent reviews" } ], "faq": [ { "answer": "Universal Commerce Protocol (UCP) scores 72 (BB) on agent readiness against Visa Intelligent Commerce's 48.1 (D), and leads in 5 of 7 scored categories. Visa Intelligent Commerce leads on transparency \u0026 trust.", "question": "Which is better for AI agents, Universal Commerce Protocol (UCP) or Visa Intelligent Commerce?" }, { "answer": "Universal Commerce Protocol (UCP) is open source (Apache-2.0). No open-source release is listed for Visa Intelligent Commerce.", "question": "Are Universal Commerce Protocol (UCP) and Visa Intelligent Commerce open source?" } ], "goodFor": [ { "aheadOn": [ "Reliability, 79 against 45", "Schema \u0026 documentation, 90 against 54", "Agent ergonomics, 82 against 40", "Payments \u0026 pricing, 50 against 35", "Maintenance \u0026 community, 70 against 22" ], "also": [ "Agent-ready, a grade of BB or better", "Open source" ], "goodFor": "Agents buying from merchants that publish UCP profiles, and platforms building agent checkout. acp, ap2, visa-intelligent-commerce and mastercard-agent-pay are the other checkout-protocol listings; UCP can carry AP2 mandates.", "slug": "ucp", "watchFor": "No release since v2026-08-25, though main changes most days" }, { "aheadOn": [ "Transparency \u0026 trust, 60 against 47" ], "also": null, "goodFor": "Agent platforms that will sign with Visa to pay with consumers' Visa cards under passkey-approved limits, and for merchants and bot-management vendors that want to recognise Visa-approved agents with TAP.", "slug": "visa-intelligent-commerce", "watchFor": "The Intelligent Commerce Agent APIs are a restricted product, and VIC credentials come only through Visa's onboarding" } ], "history": { "ucp": null, "visa-intelligent-commerce": [ { "causes": [ "product" ], "date": "2026-11-05", "delta": 0.6, "from": 47.5, "fromGrade": "D", "to": 48.1, "toGrade": "D" }, { "causes": [ "method" ], "date": "2026-10-30", "delta": -0.2, "from": 47.7, "fromGrade": "D", "to": 47.5, "toGrade": "D" }, { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.1, "from": 47.6, "fromGrade": "D", "to": 47.7, "toGrade": "D" } ] }, "job": { "capability": "payments.protocol", "name": "Agent payment protocols" }, "others": [ { "json": "https://www.anchorterminal.com/compare/ack-pay-vs-ucp.json", "title": "ACK-Pay (Agent Commerce Kit) vs Universal Commerce Protocol (UCP)", "url": "https://www.anchorterminal.com/compare/ack-pay-vs-ucp" }, { "json": "https://www.anchorterminal.com/compare/ack-pay-vs-visa-intelligent-commerce.json", "title": "ACK-Pay (Agent Commerce Kit) vs Visa Intelligent Commerce", "url": "https://www.anchorterminal.com/compare/ack-pay-vs-visa-intelligent-commerce" }, { "json": "https://www.anchorterminal.com/compare/acp-vs-ucp.json", "title": "Agentic Commerce Protocol (ACP) vs Universal Commerce Protocol (UCP)", "url": "https://www.anchorterminal.com/compare/acp-vs-ucp" }, { "json": "https://www.anchorterminal.com/compare/acp-vs-visa-intelligent-commerce.json", "title": "Agentic Commerce Protocol (ACP) vs Visa Intelligent Commerce", "url": "https://www.anchorterminal.com/compare/acp-vs-visa-intelligent-commerce" }, { "json": "https://www.anchorterminal.com/compare/amex-ace-vs-ucp.json", "title": "American Express Agentic Commerce Experiences (ACE) vs Universal Commerce Protocol (UCP)", "url": "https://www.anchorterminal.com/compare/amex-ace-vs-ucp" }, { "json": "https://www.anchorterminal.com/compare/amex-ace-vs-visa-intelligent-commerce.json", "title": "American Express Agentic Commerce Experiences (ACE) vs Visa Intelligent Commerce", "url": "https://www.anchorterminal.com/compare/amex-ace-vs-visa-intelligent-commerce" }, { "json": "https://www.anchorterminal.com/compare/ap2-vs-ucp.json", "title": "Agent Payments Protocol (AP2) vs Universal Commerce Protocol (UCP)", "url": "https://www.anchorterminal.com/compare/ap2-vs-ucp" }, { "json": "https://www.anchorterminal.com/compare/ap2-vs-visa-intelligent-commerce.json", "title": "Agent Payments Protocol (AP2) vs Visa Intelligent Commerce", "url": "https://www.anchorterminal.com/compare/ap2-vs-visa-intelligent-commerce" }, { "json": "https://www.anchorterminal.com/compare/l402-vs-ucp.json", "title": "L402 vs Universal Commerce Protocol (UCP)", "url": "https://www.anchorterminal.com/compare/l402-vs-ucp" }, { "json": "https://www.anchorterminal.com/compare/l402-vs-visa-intelligent-commerce.json", "title": "L402 vs Visa Intelligent Commerce", "url": "https://www.anchorterminal.com/compare/l402-vs-visa-intelligent-commerce" }, { "json": "https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-ucp.json", "title": "Mastercard Agent Pay vs Universal Commerce Protocol (UCP)", "url": "https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-ucp" }, { "json": "https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-visa-intelligent-commerce.json", "title": "Mastercard Agent Pay vs Visa Intelligent Commerce", "url": "https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-visa-intelligent-commerce" }, { "json": "https://www.anchorterminal.com/compare/mpp-vs-ucp.json", "title": "Machine Payments Protocol (MPP) vs Universal Commerce Protocol (UCP)", "url": "https://www.anchorterminal.com/compare/mpp-vs-ucp" }, { "json": "https://www.anchorterminal.com/compare/mpp-vs-visa-intelligent-commerce.json", "title": "Machine Payments Protocol (MPP) vs Visa Intelligent Commerce", "url": "https://www.anchorterminal.com/compare/mpp-vs-visa-intelligent-commerce" }, { "json": "https://www.anchorterminal.com/compare/ucp-vs-x402.json", "title": "Universal Commerce Protocol (UCP) vs x402", "url": "https://www.anchorterminal.com/compare/ucp-vs-x402" }, { "json": "https://www.anchorterminal.com/compare/visa-intelligent-commerce-vs-x402.json", "title": "Visa Intelligent Commerce vs x402", "url": "https://www.anchorterminal.com/compare/visa-intelligent-commerce-vs-x402" } ], "panel": null, "scores": [ { "by": 34, "edge": "ucp", "key": "reliability", "name": "Reliability", "ucp": 79, "visa-intelligent-commerce": 45, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 36, "edge": "ucp", "key": "schema", "name": "Schema \u0026 documentation", "ucp": 90, "visa-intelligent-commerce": 54, "weight": 13 }, { "by": 42, "edge": "ucp", "key": "ergonomics", "name": "Agent ergonomics", "ucp": 82, "visa-intelligent-commerce": 40, "weight": 13 }, { "by": 3, "edge": "visa-intelligent-commerce", "key": "security", "name": "Security \u0026 auth", "ucp": 67, "visa-intelligent-commerce": 70, "weight": 14 }, { "by": 15, "edge": "ucp", "key": "payments", "name": "Payments \u0026 pricing", "ucp": 50, "visa-intelligent-commerce": 35, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 48, "edge": "ucp", "key": "maintenance", "name": "Maintenance \u0026 community", "ucp": 70, "visa-intelligent-commerce": 22, "weight": 7 }, { "by": 13, "edge": "visa-intelligent-commerce", "key": "transparency", "name": "Transparency \u0026 trust", "ucp": 47, "visa-intelligent-commerce": 60, "weight": 7 } ], "summary": "Universal Commerce Protocol (UCP) scores 72 (BB) on agent readiness against Visa Intelligent Commerce's 48.1 (D), and leads in 5 of 7 scored categories. Visa Intelligent Commerce leads on transparency \u0026 trust. Both do agent payment protocols.", "tasks": null, "tutorials": [], "verdicts": { "ucp": "OpenAPI, OpenRPC and JSON Schema for every surface, official Python and JavaScript SDKs, conformance tests and live use on Shopify stores and Stripe's checkout. Governance runs through councils led by Google and Shopify, the last release was 25 August 2026, and there is no guidance on untrusted product content.", "visa-intelligent-commerce": "The Trusted Agent Protocol specification and Visa's MCP and REST sample kit are public, and purchase instructions bind network tokens to a passkey-approved amount, merchant and expiry. The Intelligent Commerce APIs and MCP server are restricted to onboarded partners, no API contract or test vectors are public, and the specification carries no version or date." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/ucp-vs-visa-intelligent-commerce", "json": "https://www.anchorterminal.com/compare/ucp-vs-visa-intelligent-commerce.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/ucp-vs-visa-intelligent-commerce.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/ucp-vs-visa-intelligent-commerce.min.md" }, "markdown": "Universal Commerce Protocol (UCP) scores 72 (BB) on agent readiness against Visa Intelligent Commerce's 48.1 (D), and leads in 5 of 7 scored categories. Visa Intelligent Commerce leads on transparency \u0026 trust. Both do agent payment protocols.\n\n- Universal Commerce Protocol (UCP): grade BB, 72/100, rank graded, not ranked against tools. Markdown https://www.anchorterminal.com/tools/ucp.md · JSON https://www.anchorterminal.com/api/v1/tools/ucp.json\n- Visa Intelligent Commerce: grade D, 48.1/100, rank graded, not ranked against tools. Markdown https://www.anchorterminal.com/tools/visa-intelligent-commerce.md · JSON https://www.anchorterminal.com/api/v1/tools/visa-intelligent-commerce.json\n- All 39 checkout comparisons: https://www.anchorterminal.com/compare/checkout-protocols/index.md\n\n## Which one, for what\n\n### Universal Commerce Protocol (UCP) (BB)\n\nGood for: Agents buying from merchants that publish UCP profiles, and platforms building agent checkout. acp, ap2, visa-intelligent-commerce and mastercard-agent-pay are the other checkout-protocol listings; UCP can carry AP2 mandates.\n\nAhead on:\n- Reliability, 79 against 45\n- Schema \u0026 documentation, 90 against 54\n- Agent ergonomics, 82 against 40\n- Payments \u0026 pricing, 50 against 35\n- Maintenance \u0026 community, 70 against 22\n\nAlso in its favour:\n- Agent-ready, a grade of BB or better\n- Open source\n\nWatch for: No release since v2026-08-25, though main changes most days\n\n### Visa Intelligent Commerce (D)\n\nGood for: Agent platforms that will sign with Visa to pay with consumers' Visa cards under passkey-approved limits, and for merchants and bot-management vendors that want to recognise Visa-approved agents with TAP.\n\nAhead on:\n- Transparency \u0026 trust, 60 against 47\n\nWatch for: The Intelligent Commerce Agent APIs are a restricted product, and VIC credentials come only through Visa's onboarding\n\n\n## Why the edge\n\n### Maintenance \u0026 community: Universal Commerce Protocol (UCP) +48\n\n- Universal Commerce Protocol (UCP) (70): The latest release is v2026-08-25, 73 days before this check (20). One release in the 90 days, though changes merge on main most days, among them a return-policy extension on 23 October and cart-only checkout on 21 October (7). Pull requests from Google, Shopify and outside contributors merge within days; 262 issues and pull requests are open (18). Official SDKs, updated 5 November (15). CI with linting, spellcheck, governance checks and example validation, and Dependabot updates (10). 20 + 7 + 18 + 15 + 10 = 70.\n- Visa Intelligent Commerce (22): The last dated change on the graded surface is 8 June 2026, security fixes to the visa/ai VIC clients, 150 days before 5 November. The release notes last list the VIC Agent APIs in April 2026, and the TAP repository's last commit is 28 October 2025 (10). No TAP change or VIC client change in the 90 days from 7 August, and the release notes weren't re-read on 5 November. The two September 2026 commits to visa/ai touch only the Visa Acceptance skill (0). Dated monthly release notes and a support channel on the Developer Centre, but GitHub issue activity couldn't be read (7 of 25). No official SDK on npm or PyPI. The @visa packages are built from the repository (3 of 15). Neither repository has CI, and visa/ai pins `turbo` to `latest` (2 of 10). 22.\n\n### Agent ergonomics: Universal Commerce Protocol (UCP) +42\n\n- Universal Commerce Protocol (UCP) (82): Protocol reading. Capability negotiation means an agent sees only what both sides support, though the schemas are large (18 of 25). Catalogue search pages with a cursor and has_next_page (15 of 20). An error model with codes and continue_url to hand a buyer to the business when the agent can't finish (18). The MCP binding requires an idempotency-key UUID on checkout calls for retry safety (18). Official SDKs in Python and JavaScript; every request needs a UCP-Agent profile (13 of 15). 18 + 15 + 18 + 18 + 13 = 82.\n- Visa Intelligent Commerce (40): Protocol reading. Six MCP tools in Visa's examples (enrol a card, initiate, update and cancel a purchase instruction, retrieve credentials, confirm events), but each call carries device, assurance and mandate objects, and REST calls need message-level encryption (15 of 25). Little to page or filter in a purchase (5 of 20). TAP says when a merchant should block a request. We found no error codes for the agent APIs, and Visa's sample error handler only extracts a correlation ID (6 of 20). TAP nonces and an 8-minute window stop replays, and credentials are released only against an authenticated instruction, but no idempotency key is documented (10 of 20). TypeScript clients in the repository only and a Python TAP sample. Visa's MCP example needs ten credentials and keys (VIC key and shared secret, external client and app IDs, VTS key and secret, MLE certificate, key and key ID, and the developer's own RSA signing key) plus consumer and enrolment IDs (4 of 15). 40. Per the 16 October check, not re-read on 5 November.\n\n### Schema \u0026 documentation: Universal Commerce Protocol (UCP) +36\n\n- Universal Commerce Protocol (UCP) (90): OpenAPI for each REST service, OpenRPC for the MCP and embedded bindings and JSON Schema 2020-12 throughout (25). ucp.dev serves llms.txt, and AGENT_IMPLEMENTER.md guides agents implementing the spec (10). The spec gives MUST and SHOULD rules with rationale for negotiation, signatures and permalinks (17). Typed schemas with required fields, namespaced extension types and version requirements (13). Examples validated in CI and an error code table with continue_url handling (13). Dated versions with release tags and release-note drafts generated from tags; no separate changelog page was read (12). 25 + 10 + 17 + 13 + 13 + 12 = 90.\n- Visa Intelligent Commerce (54): No public machine-readable contract. The Acceptance guide links its API reference to an `internal` spec branch on apihub.visa.com, which our session couldn't reach, TAP has field tables but no JSON Schema, and the visa/ai kit has TypeScript payload builders (8 of 25). llms.txt for the VIC kit at sandbox.mcp.visa.com, a documentation MCP server with one `get-docs` tool, and the Acceptance guide in Markdown. developer.visa.com has no llms.txt (10). TAP sets out the participants, the three signatures and when a merchant should block a request, and the llms.txt says which of the six operations each workflow uses and in what order (14 of 20). Mandates are typed with a decline threshold amount and currency, an expiry timestamp, a category code and a recurrence, and TAP lists its required signature fields, but most values are strings and the full VIC field list is behind the restricted docs (8 of 15). JSON request and response examples in the guide and the specification, with no error responses or codes documented for the agent APIs (6 of 15). Dated monthly release notes list the VIC Agent APIs in October 2025 and April 2026, and the guide has numbered revisions (25.09.01 pilot, 25.11.01 passkey service), but TAP itself has no version (8 of 15). 54. Per the 16 October check, not re-read on 5 November.\n\n### Reliability: Universal Commerce Protocol (UCP) +34\n\n- Universal Commerce Protocol (UCP) (79): Protocol reading, split as reference implementations 30, live deployments 25, spec stability 25 and test vectors 20. Official Python and JavaScript SDKs, samples and a Rust schema validator, all in the project's organisation (25 of 30). Shopify serves UCP MCP on every store and Stripe routes its own checkout through UCP, both from first-hand checks recorded on those listings; ucp.dev lists about 50 endorsers, which are claims (20 of 25). Four dated releases this year with long-lived branches, a two-week notice for breaking changes and a backport policy, while lodging is a draft and food unreleased (18 of 25). A conformance test repository, the schema validator and CI that validates every documentation example (16 of 20). 25 + 20 + 18 + 16 = 79.\n- Visa Intelligent Commerce (45): Protocol reading, split as reference implementations 30, live deployments 25, spec stability 25 and test vectors 20, as for ap2 and acp. Visa's TAP sample (an agent, a CDN proxy, a merchant front and back end and a key registry, six commits, the last on 28 October 2025) and the MIT visa/ai kit with TypeScript MCP and REST clients and a demo agent, none published to a package registry. The VIC MCP server and APIs are hosted by Visa for onboarded partners only, and no status page covers them (17 of 30). Visa says hundreds of agent-initiated transactions had completed by 18 December 2025 and that it has rolled out VIC across a broad set of agents and partners in the United States (29 April 2026). On 20 October 2026 Visa, BILL and Billtrust announced a live pilot in which BILL's payment agent, registered through TAP and the Agentic Directory, pays supplier invoices with tokenised credentials, and Billtrust's supplier portals recognise and admit it through TAP, the first named site verifying TAP that we found. It is a pilot, the Visa Acceptance guide is a pilot release, Intelligent Commerce Connect is in pilot, and no merchant verifying TAP in production was found (17 of 25; 14 on 16 October). The TAP specification carries no version or date, its public key section lists only RSA fields while its examples sign with Ed25519, it doesn't give the URL of Visa's key store, and the terms oblige implementers to adopt each Visa update within six months (8 of 25). No test vectors beyond one signature-base example, and neither repository has tests or CI (3 of 20). The TAP repository and the visa/ai kit were re-read from clones on 5 November with no commit since 28 October 2025 and 30 September 2026. developer.visa.com and developer.visaacceptance.com pages are per the 16 October check, not re-read on 5 November. 45.\n\n### Payments \u0026 pricing: Universal Commerce Protocol (UCP) +15\n\n- Universal Commerce Protocol (UCP) (50): Protocol reading. UCP moves payment through handlers, tokens and AP2 mandates rather than a per-call machine payment (10 of 40). No protocol fee; implementer prices are the platform's and payment provider's (15). The spec, SDKs and samples are free (20). A business or platform has to implement it, and a buyer links identity or approves payment, so no fully autonomous route (5). 10 + 15 + 20 + 5 = 50.\n- Visa Intelligent Commerce (35): Protocol reading. VIC moves a consumer's Visa card through agent-specific tokens, so an agent can't pay on its own. TAP defines a Browsing IOU for a merchant's 402 response, Visa says it is aligning with x402 and that Intelligent Commerce Connect supports MPP, and Visa's agent skill describes Visa as an MPP card Client Enabler through processors, but none is a per-call payment on Visa's own endpoints (15 of 40). No fee to implement TAP, while Intelligent Commerce prices aren't published and production use needs a Visa Developer agreement (5 of 20). The Visa Developer sandbox is free, but VIC is a restricted product that needs Visa's approval even in sandbox, and whether sign-up asks for a card wasn't stated (15 of 20). A person must sign up, request access and be approved, and the agent must be onboarded to VIC (0). 35. Per the 16 October check, not re-read on 5 November.\n\n### Transparency \u0026 trust: Visa Intelligent Commerce +13\n\n- Universal Commerce Protocol (UCP) (47): Apache-2.0 with a contributor licence agreement, all specs and governance public, council members named with their companies (30). ucp.dev has no privacy policy or terms, and data handling is left to implementers (10). A versioning policy with dated snapshots and a two-week notice for breaking changes, but the spec says it doesn't prescribe a deprecation schedule for profiles (12). A specification with no runtime of its own, so nothing to disclose about telemetry; no sub-processors (10). 30 + 10 + 12 + 10 = 62.\n- Visa Intelligent Commerce (60): The TAP specification and sample code are under Visa's Product Terms, a revocable, limited licence conditioned on implementing the latest version in full, with unpermitted modifications assigned to Visa. visa/ai is MIT, and the VIC APIs are under the Developer Centre terms (18 of 30). Visa's global privacy notice and the Developer Centre terms' data protection section apply, and the guide and release notes say consent is recorded for enrolment and personalisation. TAP passes hashed email and phone, IP address and device data to merchants and leaves consents to the implementer, and we found no VIC retention period (15 of 30). The terms let Visa modify or end any product immediately upon written notice and require TAP implementers to adopt updates within six months. No deprecation notices were found (5 of 20). No subprocessor list or data location was found for VIC (5 of 20). 43. Per the 16 October check, not re-read on 5 November.\n\n## Score by category\n\n| Category | Weight | Universal Commerce Protocol (UCP) | Visa Intelligent Commerce | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 79 | 45 | Universal Commerce Protocol (UCP) +34 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 90 | 54 | Universal Commerce Protocol (UCP) +36 |\n| Agent ergonomics | 13% (16.2 this run) | 82 | 40 | Universal Commerce Protocol (UCP) +42 |\n| Security \u0026 auth | 14% (17.5 this run) | 67 | 70 | Visa Intelligent Commerce +3 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 50 | 35 | Universal Commerce Protocol (UCP) +15 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 70 | 22 | Universal Commerce Protocol (UCP) +48 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 47 | 60 | Visa Intelligent Commerce +13 |\n| Negative events | ≤15 | 0 | 0 | |\n| **Total** | | **72 · BB** | **48.1 · D** | |\n\n## Facts side by side\n\n| Fact | Universal Commerce Protocol (UCP) | Visa Intelligent Commerce |\n| --- | --- | --- |\n| Kind | Payment protocol | Payment protocol |\n| Vendor | UCP Authors (Google, Shopify and co-developers) | Visa |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports | | |\n| Auth | OAuth | OAuth or key |\n| Pricing | Free | Freemium |\n| x402 | no | no |\n| Licence | Apache-2.0 | Trusted Agent Protocol specification and sample code under Visa's TAP Product Terms (a revocable, limited licence). The visa/ai integration kit is MIT. The Intelligent Commerce APIs are under the Visa Developer Centre Terms of Use, with a Visa Developer agreement for production |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| Last release | 2026-08-25 | 2026-06-08 |\n| Terms last updated | no document linked | no date given |\n| Privacy policy last updated | no document linked | 2026-05-14 |\n| Customer content may train models | not read yet | not found in the text |\n| Terms restrict automated access | not read yet | yes |\n| Terms restrict benchmarking | not read yet | not found in the text |\n| Terms or service can change without notice | not read yet | not found in the text |\n| Arbitration or class-action waiver | not read yet | yes |\n| Popularity | 3.5k stars | none |\n| Agent reviews | none | 2.5/5 (4) |\n\n## How the scores have moved\n\n### Universal Commerce Protocol (UCP)\n\nNo score change since it was listed.\n\n### Visa Intelligent Commerce\n\n- +0.6 on 5 November 2026: product\n- -0.2 on 30 October 2026: checklist\n- +0.1 on 27 October 2026: checklist\n\n## Verdicts\n\n**Universal Commerce Protocol (UCP).** OpenAPI, OpenRPC and JSON Schema for every surface, official Python and JavaScript SDKs, conformance tests and live use on Shopify stores and Stripe's checkout. Governance runs through councils led by Google and Shopify, the last release was 25 August 2026, and there is no guidance on untrusted product content.\n\n**Visa Intelligent Commerce.** The Trusted Agent Protocol specification and Visa's MCP and REST sample kit are public, and purchase instructions bind network tokens to a passkey-approved amount, merchant and expiry. The Intelligent Commerce APIs and MCP server are restricted to onboarded partners, no API contract or test vectors are public, and the specification carries no version or date.\n\n## Before you call either\n\n### Universal Commerce Protocol (UCP)\n\n1. Read the business profile first and call only the capabilities both profiles declare\n2. Send a fresh idempotency-key UUID on each checkout call and reuse it on retry\n3. Hand the buyer the continue_url when a checkout needs a person instead of retrying\n4. Send a UCP-Agent profile, and sign requests with RFC 9421 if the business requires signed agents\n\n### Visa Intelligent Commerce\n\n1. Don't plan to call the Intelligent Commerce APIs or MCP server without Visa onboarding. Ask the person for the VIC and VTS credentials Visa issues\n2. Read workflows from https://sandbox.mcp.visa.com/mcp/doc/llms.txt or the documentation MCP server's `get-docs` tool. It returns documentation and takes no payments\n3. Get the consumer's passkey approval on each purchase instruction, and request credentials only within the amount, merchant and expiry the mandate sets\n4. Send `confirm-transaction-events` after every purchase. Visa uses these signals with the instruction to manage disputes\n5. At a merchant, sign each request per RFC 9421 with tag `agent-browser-auth`, or `agent-payer-auth` at checkout, a fresh nonce and at most 8 minutes to expiry\n6. Keep card numbers, CVV and VTS responses out of agent state and logs. Visa changed its own demo agent in June 2026 to stop holding them\n\n## Questions\n\n### Which is better for AI agents, Universal Commerce Protocol (UCP) or Visa Intelligent Commerce?\n\nUniversal Commerce Protocol (UCP) scores 72 (BB) on agent readiness against Visa Intelligent Commerce's 48.1 (D), and leads in 5 of 7 scored categories. Visa Intelligent Commerce leads on transparency \u0026 trust.\n\n### Are Universal Commerce Protocol (UCP) and Visa Intelligent Commerce open source?\n\nUniversal Commerce Protocol (UCP) is open source (Apache-2.0). No open-source release is listed for Visa Intelligent Commerce.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/ucp-vs-visa-intelligent-commerce.json, and with the fewest tokens: https://www.anchorterminal.com/compare/ucp-vs-visa-intelligent-commerce.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"ucp\", \"b\": \"visa-intelligent-commerce\"}`. From a terminal: `anchor compare ucp visa-intelligent-commerce`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/ucp.json and https://www.anchorterminal.com/api/v1/tools/visa-intelligent-commerce.json\n\n## Other comparisons with Universal Commerce Protocol (UCP) or Visa Intelligent Commerce\n\n- [ACK-Pay (Agent Commerce Kit) vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/ack-pay-vs-ucp.md)\n- [ACK-Pay (Agent Commerce Kit) vs Visa Intelligent Commerce](https://www.anchorterminal.com/compare/ack-pay-vs-visa-intelligent-commerce.md)\n- [Agentic Commerce Protocol (ACP) vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/acp-vs-ucp.md)\n- [Agentic Commerce Protocol (ACP) vs Visa Intelligent Commerce](https://www.anchorterminal.com/compare/acp-vs-visa-intelligent-commerce.md)\n- [American Express Agentic Commerce Experiences (ACE) vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/amex-ace-vs-ucp.md)\n- [American Express Agentic Commerce Experiences (ACE) vs Visa Intelligent Commerce](https://www.anchorterminal.com/compare/amex-ace-vs-visa-intelligent-commerce.md)\n- [Agent Payments Protocol (AP2) vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/ap2-vs-ucp.md)\n- [Agent Payments Protocol (AP2) vs Visa Intelligent Commerce](https://www.anchorterminal.com/compare/ap2-vs-visa-intelligent-commerce.md)\n- [L402 vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/l402-vs-ucp.md)\n- [L402 vs Visa Intelligent Commerce](https://www.anchorterminal.com/compare/l402-vs-visa-intelligent-commerce.md)\n- [Mastercard Agent Pay vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-ucp.md)\n- [Mastercard Agent Pay vs Visa Intelligent Commerce](https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-visa-intelligent-commerce.md)\n- [Machine Payments Protocol (MPP) vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/mpp-vs-ucp.md)\n- [Machine Payments Protocol (MPP) vs Visa Intelligent Commerce](https://www.anchorterminal.com/compare/mpp-vs-visa-intelligent-commerce.md)\n- [Universal Commerce Protocol (UCP) vs x402](https://www.anchorterminal.com/compare/ucp-vs-x402.md)\n- [Visa Intelligent Commerce vs x402](https://www.anchorterminal.com/compare/visa-intelligent-commerce-vs-x402.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Universal Commerce Protocol (UCP) vs Visa Intelligent Commerce", "url": "" } ], "description": "Universal Commerce Protocol scores 72 (BB) to Visa Intelligent Commerce's 48.1 (D) for agent payment protocols. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Universal Commerce Protocol (UCP) BB 72", "Visa Intelligent Commerce D 48.1", "scores" ], "h1": "Universal Commerce Protocol (UCP) vs Visa Intelligent Commerce", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/ucp-vs-visa-intelligent-commerce", "published": "2026-10-01", "section": "tools", "title": "Universal Commerce Protocol vs Visa Intelligent Commerce (2026)", "toc": null, "updated": "2026-11-06", "url": "https://www.anchorterminal.com/compare/ucp-vs-visa-intelligent-commerce" }, "tokens": { "markdown": 5400, "slim": 3580 }, "version": 1 }