Universal Commerce Protocol (UCP) vs x402

Universal Commerce Protocol (UCP) 50

Protocol reading. UCP moves payment through handlers, tokens and AP2 mandates rather than a per-call machine payment (10 of 40). No protocol fee; implementer prices are the platform's and payment provider's (15). The spec, SDKs and samples are free (20). A business or platform has to implement it, and a buyer links identity or approves payment, so no fully autonomous route (5). 10 + 15 + 20 + 5 = 50.

x402 97

x402 is a machine payment protocol (40). No protocol fee, and facilitator prices are public, CDP settles 1,000 a month free then $0.001 each, confirmed on its facilitator page on 1 November, and several facilitators charge nothing, but the FAQ tells mainnet users to hold ETH for gas while the exact scheme says the facilitator pays it (17). Free to implement under Apache-2.0, with a free testnet facilitator (20). A buyer needs only a funded wallet and no account (20).

Universal Commerce Protocol (UCP) 70

The latest release is v2026-08-25, 73 days before this check (20). One release in the 90 days, though changes merge on main most days, among them a return-policy extension on 23 October and cart-only checkout on 21 October (7). Pull requests from Google, Shopify and outside contributors merge within days; 262 issues and pull requests are open (18). Official SDKs, updated 5 November (15). CI with linting, spellcheck, governance checks and example validation, and Dependabot updates (10). 20 + 7 + 18 + 15 + 10 = 70.

x402 93

Releases on 28 October 2026, TypeScript and Go at 2.29.0 and Python at 2.26.0 (30). Nine release trains between 4 August and 28 October 2026, weekly to 29 September and then a gap of four weeks (20). Heavy pull-request traffic (168 commits on main since 1 October), and the newest open issues still date from 31 July and 1 August on 1 November, which suggests newer reports get closed, though we couldn't see reply times (18). Current official SDKs in TypeScript, Python, Go and Java (15). CI per language, lint, package-lock checks and end-to-end tests (10).

Universal Commerce Protocol (UCP) 47

Apache-2.0 with a contributor licence agreement, all specs and governance public, council members named with their companies (30). ucp.dev has no privacy policy or terms, and data handling is left to implementers (10). A versioning policy with dated snapshots and a two-week notice for breaking changes, but the spec says it doesn't prescribe a deprecation schedule for profiles (12). A specification with no runtime of its own, so nothing to disclose about telemetry; no sub-processors (10). 30 + 10 + 12 + 10 = 62.

x402 69

Spec and SDKs under Apache-2.0 (30). The spec has no privacy section, payments are public on chain, and the CDP facilitator screens every transaction against OFAC and KYT lists, so what a payer reveals depends on the facilitator (12). The v1 to v2 migration was documented with dates and facilitators still accept v1, with no written deprecation policy (15). Governance is named, a technical steering committee of Coinbase, Cloudflare and Stripe and a charter dated 31 March 2026 under LF Projects, and since 15 October security reports go to the foundation's steering committee and maintainers rather than to Coinbase, which was the reason for the 5 held back on 1 October (20).

Universal Commerce Protocol (UCP) 79

Protocol reading, split as reference implementations 30, live deployments 25, spec stability 25 and test vectors 20. Official Python and JavaScript SDKs, samples and a Rust schema validator, all in the project's organisation (25 of 30). Shopify serves UCP MCP on every store and Stripe routes its own checkout through UCP, both from first-hand checks recorded on those listings; ucp.dev lists about 50 endorsers, which are claims (20 of 25). Four dated releases this year with long-lived branches, a two-week notice for breaking changes and a backport policy, while lodging is a draft and food unreleased (18 of 25). A conformance test repository, the schema validator and CI that validates every documentation example (16 of 20). 25 + 20 + 18 + 16 = 79.

x402 87

Graded as a protocol on reference implementations (30), public facilitators (25), spec stability (25) and test suites (20). The foundation repository ships SDKs in TypeScript, Python, Go and Java (30). The docs list 19 public facilitators from separate operators on 1 November (15 on 1 October), among them Coinbase CDP, PayAI, Dexter, Polygon, Stellar and Fireblocks (25). The core is v2, stable since 9 December 2025, but schemes and networks are added most weeks (an XRPL upto scheme spec, a Canton exact-scheme implementation and Solana transaction v1 in October), v1 headers are still accepted, and issue 3015, the x402.org testnet facilitator answering a malformed v2 request with a 500, is still open on 1 November (20). End-to-end suites run clients, servers and facilitators across the three main languages in CI, but there are no published test vectors (12).