{ "data": { "a": { "slug": "ucp", "name": "Universal Commerce Protocol (UCP)", "vendor": "UCP Authors (Google, Shopify and co-developers)", "vendorUrl": "https://ucp.dev", "kind": "protocol", "category": "checkout-protocols", "summary": "The Universal Commerce Protocol (UCP) is an open specification, co-developed by Google, Shopify and other retailers and platforms, for agents to discover a business's capabilities and run catalogue, cart, checkout, identity linking and order flows over REST, MCP or A2A.", "url": "https://www.anchorterminal.com/tools/ucp", "markdownUrl": "https://www.anchorterminal.com/tools/ucp.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/ucp.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/ucp.json", "dns": "ucp.grade.anchorterminal.com", "repo": "https://github.com/Universal-Commerce-Protocol/ucp", "license": "Apache-2.0", "transports": [], "packages": [], "auth": "oauth", "authNotes": "A specification, not a service. Identity linking uses OAuth 2.0 for a platform to act for a user at a business. Agent requests carry a UCP-Agent profile, and signed agents send RFC 9421 HTTP message signatures with a Signature-Agent header and a JWK thumbprint key ID. Payment credentials move through payment handlers and token exchange between payment and credential providers, with AP2 mandates supported.", "pricing": "free", "pricingNotes": "The specification, schemas, SDKs and conformance tests are free under Apache-2.0. Costs come from the business's platform and payment provider, not the protocol.", "priceSummary": "Free · OSS", "where": "spec", "x402": { "level": "no", "evidence": "A commerce protocol, not a tool that accepts payment; it supports AP2 mandates and payment handlers (checked 2026-11-06).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 3479, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://ucp.dev/latest/specification/overview/", "llmsTxt": "https://ucp.dev/llms.txt", "openapi": "https://github.com/Universal-Commerce-Protocol/ucp/blob/main/source/services/shopping/rest.openapi.json", "capabilities": [ "payments.protocol", "payments.checkout", "payments.mandate" ], "tags": [ "protocol", "open-standard", "open-source", "mcp", "a2a", "ap2", "openapi", "openrpc", "llms-txt", "shopify", "google", "commerce" ], "lastRelease": "2026-08-25", "graded": true, "anchor": { "graded": true, "score": 72, "grade": "BB", "agentReady": true, "rank": 0, "ranked": false, "notRankedWhy": "A protocol, graded on the same scale but not ranked against tools", "rankOf": 1510, "categoryRank": 1, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 82, "maintenance": 70, "payments": 50, "reliability": 79, "schema": 90, "security": 67, "transparency": 47 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": 0, "verdict": "OpenAPI, OpenRPC and JSON Schema for every surface, official Python and JavaScript SDKs, conformance tests and live use on Shopify stores and Stripe's checkout. Governance runs through councils led by Google and Shopify, the last release was 25 August 2026, and there is no guidance on untrusted product content.", "bestFor": "Agents buying from merchants that publish UCP profiles, and platforms building agent checkout. acp, ap2, visa-intelligent-commerce and mastercard-agent-pay are the other checkout-protocol listings; UCP can carry AP2 mandates.", "strengths": [ "Machine-readable contracts for every transport, OpenAPI, OpenRPC and JSON Schema 2020-12", "Official Python and JavaScript SDKs, a schema validator and a conformance test suite", "Idempotency keys required on MCP checkout calls", "Live on every Shopify store and as Stripe's own-checkout route", "Breaking changes announced two weeks before they merge" ], "weaknesses": [ "No release since v2026-08-25, though main changes most days", "No guidance on product descriptions or business messages as untrusted content for agents", "Lodging is a draft and food ordering unreleased", "Governing and tech councils are led by Google and Shopify members" ], "agentNotes": [ "Read the business profile first and call only the capabilities both profiles declare", "Send a fresh idempotency-key UUID on each checkout call and reuse it on retry", "Hand the buyer the continue_url when a checkout needs a person instead of retrying", "Send a UCP-Agent profile, and sign requests with RFC 9421 if the business requires signed agents" ], "metrics": { "kind": "spec", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 72 } ], "editorialScores": { "ergonomics": 82, "maintenance": 70, "payments": 50, "reliability": 79, "schema": 90, "security": 67, "transparency": 62 }, "provenanceScore": 32, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "letme": { "capability": "https://letme.dev/payments.protocol", "tool": "https://letme.dev/ucp" }, "area": "payments", "provenance": { "legalEntity": "", "domain": "ucp.dev", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://github.com/Universal-Commerce-Protocol/ucp/releases", "securityTxt": "unknown", "checked": "2026-11-06", "notes": [ "Files carry \"Copyright 2026 UCP Authors\" under Apache-2.0. No legal entity runs the project; governance is by councils whose members are named with their companies.", "Security reports go to Google's g.co/vulnz with a five-working-day response, coordinated through GitHub Security Advisories (SECURITY.md in the .github repository).", "ucp.dev has no robots.txt and serves llms.txt. No terms or privacy policy found for the site.", "The registration date of ucp.dev wasn't found through RDAP." ], "score": 32 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/ucp.json", "live": { "slug": "ucp", "versions": [ { "registry": "github", "name": "Universal-Commerce-Protocol/ucp", "version": "v2026-08-25", "released": "2026-08-25", "seenAt": "2026-11-07T00:13:40.257304662Z" } ], "githubStars": 3480, "securityTxt": { "url": "https://ucp.dev/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:23.109475398Z" }, "llmsTxt": { "url": "https://ucp.dev/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:34:12.746672159Z" }, "updatedAt": "2026-11-07T16:00:23.109475398Z" } }, "answer": "x402 scores 79.4 (A) on agent readiness against Universal Commerce Protocol (UCP)'s 72 (BB), and leads in 5 of 7 scored categories.", "b": { "slug": "x402", "name": "x402", "vendor": "x402 Foundation (Linux Foundation)", "vendorUrl": "https://x402.org", "kind": "protocol", "category": "pay-per-call", "summary": "Protocol for per-request stablecoin payments using HTTP 402.", "url": "https://www.anchorterminal.com/tools/x402", "markdownUrl": "https://www.anchorterminal.com/tools/x402.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/x402.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/x402.json", "dns": "x402.grade.anchorterminal.com", "repo": "https://github.com/x402-foundation/x402", "license": "Apache-2.0", "transports": [], "packages": [ { "registry": "npm", "name": "@x402/core" }, { "registry": "npm", "name": "@x402/fetch" }, { "registry": "pypi", "name": "x402" }, { "registry": "go", "name": "github.com/x402-foundation/x402/go" } ], "auth": "none", "authNotes": "No account. A funded wallet signs each payment. Facilitators may screen addresses (Coinbase CDP runs OFAC and KYT checks).", "pricing": "free", "pricingNotes": "No protocol fee. The Coinbase CDP facilitator settles 1,000 transactions a month free, then $0.001 each, and pays gas in the exact scheme. Stripe charges 1.5% for x402 with gas included (https://docs.cdp.coinbase.com/x402/core-concepts/facilitator).", "priceSummary": "Free · OSS", "where": "spec", "x402": { "level": "no", "evidence": "A payment protocol, not a tool that accepts payment.", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 6700, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-01" }, "docsUrl": "https://docs.x402.org", "llmsTxt": "https://docs.x402.org/llms.txt", "capabilities": [ "payments.protocol", "payments.x402", "payments.stablecoin" ], "tags": [ "protocol", "open-source", "stablecoin", "account-free", "foundation" ], "lastRelease": "2026-10-28", "graded": true, "anchor": { "graded": true, "score": 79.4, "grade": "A", "agentReady": true, "rank": 0, "ranked": false, "notRankedWhy": "A protocol, graded on the same scale but not ranked against tools", "rankOf": 1510, "categoryRank": 2, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 84, "maintenance": 93, "payments": 97, "reliability": 87, "schema": 86, "security": 63, "transparency": 69 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "high", "date": "2026-11-01" }, "negative": -3, "negativeNotes": [ "2026-03-06, GHSA-qr2g-p6q7-w82m (high). Facilitators processing Solana payments on @x402/svm before 2.6.0, Python x402 before 2.3.0 or Go before 2.5.0 were exposed. Keys and funds weren't affected, and the fix and advisory were public, so we deduct 2 (https://github.com/x402-foundation/x402/security/advisories/GHSA-qr2g-p6q7-w82m)", "2026-05-12, five attacks on x402 validated on local chains, Base Sepolia and live endpoints, across authorisation, binding, replay and web handling, causing unpaid service or paid-but-denied outcomes. Some related fixes appear in the repository (origin binding for sign-in, SSRF in Bazaar), but we couldn't confirm all five are closed, so we deduct 1 (https://arxiv.org/abs/2605.11781)" ], "verdict": "No account and no protocol fee, a funded wallet is enough. Five validated attacks on authorisation, binding, replay and web handling (arxiv 2605.11781), and no bug bounty since October 2026.", "bestFor": "The default for an agent paying APIs per call in stablecoins without accounts, and the protocol most sellers in this directory speak.", "strengths": [ "No account and no protocol fee, a funded wallet is enough", "Reference SDKs in TypeScript, Python, Go and Java, released about weekly", "19 public facilitators listed in the docs, several with no fees", "Exact, upto, auth-capture and batch-settlement schemes, with exact specs for 17 networks", "Standard error codes, including a non-terminal settlement_pending with the transaction hash" ], "weaknesses": [ "Five validated attacks on authorisation, binding, replay and web handling (arxiv 2605.11781)", "A high-severity facilitator advisory on Solana handling in March 2026", "Spend budgets sit outside the spec, only the upto scheme caps an amount", "The FAQ and the exact-scheme spec disagree on who pays gas", "No bug bounty since 15 October 2026, and private reports go through the x402 Slack workspace with no security address" ], "agentNotes": [ "Decode PAYMENT-REQUIRED and check amount, asset and payTo against what you expected before signing", "Use the upto scheme when the final price isn't known, and cap it. The SDK clients cap each payment at $1 unless `spendControls` raises it", "On settlement_pending, look up the returned transaction hash before paying again", "Use a production facilitator for Base mainnet, x402.org/facilitator is testnet only", "Give the agent its own wallet with a small balance, never a treasury key" ], "metrics": { "kind": "spec", "measured": false }, "reviewCount": 2, "avgRating": 4.5, "history": [ { "basis": "public evidence", "confidence": "high", "grade": "A", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 79.4 } ], "editorialScores": { "ergonomics": 84, "maintenance": 93, "payments": 97, "reliability": 87, "schema": 86, "security": 63, "transparency": 77 }, "provenanceScore": 60, "checked": { "categories": { "ergonomics": "2026-11-01", "maintenance": "2026-11-01", "payments": "2026-11-01", "reliability": "2026-11-01", "schema": "2026-11-01", "security": "2026-11-01", "transparency": "2026-11-01" }, "last": "2026-11-01", "lastMoved": "2026-11-01", "oldest": "2026-11-01", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm i @x402/fetch # or: pip install x402", "http": "curl -i https://api.exa.ai/search -H \"content-type: application/json\" -d '{\"query\":\"x402\"}'\n# 402 Payment Required, PAYMENT-REQUIRED: \u003cbase64 JSON of accepted schemes\u003e\n# retry with PAYMENT-SIGNATURE: \u003cbase64 signed payment\u003e" }, "letme": { "capability": "https://letme.dev/payments.protocol", "tool": "https://letme.dev/x402" }, "area": "payments", "unitPrices": [ { "item": "CDP facilitator after 1,000 a month", "unit": "tx", "usd": 0.001 }, { "item": "Stripe x402 processing", "unit": "pct", "usd": 1.5, "note": "gas included" } ], "provenance": { "legalEntity": "x402, a Series of LF Projects, LLC", "domain": "x402.org", "domainRegistered": "2025-02-20", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "https://github.com/x402-foundation/x402/blob/main/typescript/packages/core/CHANGELOG.md", "securityTxt": "none", "checked": "2026-09-26", "score": 60 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/x402.json", "live": { "slug": "x402", "versions": [ { "registry": "npm", "name": "@x402/core", "version": "2.30.0", "seenAt": "2026-11-07T00:18:10.318025004Z" }, { "registry": "npm", "name": "@x402/fetch", "version": "2.30.0", "seenAt": "2026-11-07T00:18:11.208664677Z" }, { "registry": "pypi", "name": "x402", "version": "2.27.0", "released": "2026-11-04", "seenAt": "2026-11-07T00:18:12.53109382Z" } ], "githubStars": 6788, "npmWeekly": 540410, "pypiWeekly": 76444, "securityTxt": { "url": "https://x402.org/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T15:59:30.173600203Z" }, "llmsTxt": { "url": "https://docs.x402.org/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:34:24.599932123Z" }, "domain": { "domain": "x402.org", "registered": "2025-02-20", "source": "https://rdap.publicinterestregistry.org/rdap/domain/x402.org", "checkedAt": "2026-11-01T14:09:20.789878255Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/x402-foundation/x402/main/typescript/packages/core/CHANGELOG.md", "kind": "changelog", "status": 304, "checkedAt": "2026-11-07T14:24:09.031758834Z", "changedAt": "2026-11-05T13:07:52.533751494Z", "fingerprint": "cd6e705da9ef" }, { "url": "https://docs.x402.org/guides/migration-v1-to-v2.md", "kind": "deprecations", "status": 200, "checkedAt": "2026-11-07T14:08:47.770598488Z", "changedAt": "2026-10-31T06:11:46.693045434Z", "fingerprint": "1ce5106f00aa" } ], "github": { "repo": "x402-foundation/x402", "checkedAt": "2026-11-02T09:39:26.72684913Z", "stars": 6777, "archived": false, "issuesEnabled": true, "pushedAt": "2026-11-02T08:03:22Z", "openIssues": 387, "openPRs": 362, "issuesOpened90d": 272, "issuesClosed90d": 106, "prsMerged90d": 384, "ci": { "branch": "main", "runs": 50, "success": 50, "failure": 0, "other": 0, "latest": "success", "latestAt": "2026-11-02T08:03:34Z" }, "advisories": [ { "ghsa": "GHSA-qr2g-p6q7-w82m", "severity": "high", "published": "2026-03-06T18:48:16Z" }, { "ghsa": "GHSA-3j63-5h8p-gf7c", "severity": "high", "published": "2025-08-20T18:55:29Z" } ], "replies": { "sampled": 25, "unanswered": 16, "medianDays": 0.8 } }, "updatedAt": "2026-11-07T15:59:30.173600203Z" } }, "edges": [ { "by": 47, "category": "payments", "leads": "x402", "name": "Payments \u0026 pricing", "reasons": { "a": "Protocol reading. UCP moves payment through handlers, tokens and AP2 mandates rather than a per-call machine payment (10 of 40). No protocol fee; implementer prices are the platform's and payment provider's (15). The spec, SDKs and samples are free (20). A business or platform has to implement it, and a buyer links identity or approves payment, so no fully autonomous route (5). 10 + 15 + 20 + 5 = 50.", "b": "x402 is a machine payment protocol (40). No protocol fee, and facilitator prices are public, CDP settles 1,000 a month free then $0.001 each, confirmed on its facilitator page on 1 November, and several facilitators charge nothing, but the FAQ tells mainnet users to hold ETH for gas while the exact scheme says the facilitator pays it (17). Free to implement under Apache-2.0, with a free testnet facilitator (20). A buyer needs only a funded wallet and no account (20)." }, "scores": { "a": 50, "b": 97 } }, { "by": 23, "category": "maintenance", "leads": "x402", "name": "Maintenance \u0026 community", "reasons": { "a": "The latest release is v2026-08-25, 73 days before this check (20). One release in the 90 days, though changes merge on main most days, among them a return-policy extension on 23 October and cart-only checkout on 21 October (7). Pull requests from Google, Shopify and outside contributors merge within days; 262 issues and pull requests are open (18). Official SDKs, updated 5 November (15). CI with linting, spellcheck, governance checks and example validation, and Dependabot updates (10). 20 + 7 + 18 + 15 + 10 = 70.", "b": "Releases on 28 October 2026, TypeScript and Go at 2.29.0 and Python at 2.26.0 (30). Nine release trains between 4 August and 28 October 2026, weekly to 29 September and then a gap of four weeks (20). Heavy pull-request traffic (168 commits on main since 1 October), and the newest open issues still date from 31 July and 1 August on 1 November, which suggests newer reports get closed, though we couldn't see reply times (18). Current official SDKs in TypeScript, Python, Go and Java (15). CI per language, lint, package-lock checks and end-to-end tests (10)." }, "scores": { "a": 70, "b": 93 } }, { "by": 22, "category": "transparency", "leads": "x402", "name": "Transparency \u0026 trust", "reasons": { "a": "Apache-2.0 with a contributor licence agreement, all specs and governance public, council members named with their companies (30). ucp.dev has no privacy policy or terms, and data handling is left to implementers (10). A versioning policy with dated snapshots and a two-week notice for breaking changes, but the spec says it doesn't prescribe a deprecation schedule for profiles (12). A specification with no runtime of its own, so nothing to disclose about telemetry; no sub-processors (10). 30 + 10 + 12 + 10 = 62.", "b": "Spec and SDKs under Apache-2.0 (30). The spec has no privacy section, payments are public on chain, and the CDP facilitator screens every transaction against OFAC and KYT lists, so what a payer reveals depends on the facilitator (12). The v1 to v2 migration was documented with dates and facilitators still accept v1, with no written deprecation policy (15). Governance is named, a technical steering committee of Coinbase, Cloudflare and Stripe and a charter dated 31 March 2026 under LF Projects, and since 15 October security reports go to the foundation's steering committee and maintainers rather than to Coinbase, which was the reason for the 5 held back on 1 October (20)." }, "scores": { "a": 47, "b": 69 } }, { "by": 8, "category": "reliability", "leads": "x402", "name": "Reliability", "reasons": { "a": "Protocol reading, split as reference implementations 30, live deployments 25, spec stability 25 and test vectors 20. Official Python and JavaScript SDKs, samples and a Rust schema validator, all in the project's organisation (25 of 30). Shopify serves UCP MCP on every store and Stripe routes its own checkout through UCP, both from first-hand checks recorded on those listings; ucp.dev lists about 50 endorsers, which are claims (20 of 25). Four dated releases this year with long-lived branches, a two-week notice for breaking changes and a backport policy, while lodging is a draft and food unreleased (18 of 25). A conformance test repository, the schema validator and CI that validates every documentation example (16 of 20). 25 + 20 + 18 + 16 = 79.", "b": "Graded as a protocol on reference implementations (30), public facilitators (25), spec stability (25) and test suites (20). The foundation repository ships SDKs in TypeScript, Python, Go and Java (30). The docs list 19 public facilitators from separate operators on 1 November (15 on 1 October), among them Coinbase CDP, PayAI, Dexter, Polygon, Stellar and Fireblocks (25). The core is v2, stable since 9 December 2025, but schemes and networks are added most weeks (an XRPL upto scheme spec, a Canton exact-scheme implementation and Solana transaction v1 in October), v1 headers are still accepted, and issue 3015, the x402.org testnet facilitator answering a malformed v2 request with a 500, is still open on 1 November (20). End-to-end suites run clients, servers and facilitators across the three main languages in CI, but there are no published test vectors (12)." }, "scores": { "a": 79, "b": 87 } } ], "facts": [ { "a": "Payment protocol", "b": "Payment protocol", "name": "Kind" }, { "a": "UCP Authors (Google, Shopify and co-developers)", "b": "x402 Foundation (Linux Foundation)", "name": "Vendor" }, { "a": "no (local only)", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "", "b": "", "name": "Transports" }, { "a": "OAuth", "b": "None", "name": "Auth" }, { "a": "Free", "b": "Free", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Apache-2.0", "b": "Apache-2.0", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "2026-08-25", "b": "2026-10-28", "name": "Last release" }, { "a": "no document linked", "b": "no document linked", "name": "Terms last updated" }, { "a": "no document linked", "b": "no document linked", "name": "Privacy policy last updated" }, { "a": "3.5k stars", "b": "6.7k stars", "name": "Popularity" }, { "a": "none", "b": "4.5/5 (2)", "name": "Agent reviews" } ], "faq": [ { "answer": "x402 scores 79.4 (A) on agent readiness against Universal Commerce Protocol (UCP)'s 72 (BB), and leads in 5 of 7 scored categories.", "question": "Which is better for AI agents, Universal Commerce Protocol (UCP) or x402?" }, { "answer": "Yes. Universal Commerce Protocol (UCP) is open source (Apache-2.0). x402 is open source (Apache-2.0).", "question": "Are Universal Commerce Protocol (UCP) and x402 open source?" } ], "goodFor": [ { "aheadOn": null, "also": [ "No incidents deducted, where x402 loses 3 points for them" ], "goodFor": "Agents buying from merchants that publish UCP profiles, and platforms building agent checkout. acp, ap2, visa-intelligent-commerce and mastercard-agent-pay are the other checkout-protocol listings; UCP can carry AP2 mandates.", "slug": "ucp", "watchFor": "No release since v2026-08-25, though main changes most days" }, { "aheadOn": [ "Reliability, 87 against 79", "Payments \u0026 pricing, 97 against 50", "Maintenance \u0026 community, 93 against 70", "Transparency \u0026 trust, 69 against 47" ], "also": [ "No key needed to call it" ], "goodFor": "The default for an agent paying APIs per call in stablecoins without accounts, and the protocol most sellers in this directory speak.", "slug": "x402", "watchFor": "Five validated attacks on authorisation, binding, replay and web handling (arxiv 2605.11781)" } ], "history": { "ucp": null, "x402": [ { "causes": [ "security", "company" ], "date": "2026-11-01", "delta": -0.4, "from": 79.8, "fromGrade": "A", "to": 79.4, "toGrade": "A" }, { "causes": [ "correction" ], "date": "2026-10-28", "delta": -0.2, "from": 80, "fromGrade": "A", "to": 79.8, "toGrade": "A" }, { "causes": [ "evidence" ], "date": "2026-10-28", "delta": 0.2, "from": 79.8, "fromGrade": "A", "to": 80, "toGrade": "A" } ] }, "job": { "capability": "payments.protocol", "name": "Agent payment protocols" }, "others": [ { "json": "https://www.anchorterminal.com/compare/ack-pay-vs-ucp.json", "title": "ACK-Pay (Agent Commerce Kit) vs Universal Commerce Protocol (UCP)", "url": "https://www.anchorterminal.com/compare/ack-pay-vs-ucp" }, { "json": "https://www.anchorterminal.com/compare/ack-pay-vs-x402.json", "title": "ACK-Pay (Agent Commerce Kit) vs x402", "url": "https://www.anchorterminal.com/compare/ack-pay-vs-x402" }, { "json": "https://www.anchorterminal.com/compare/acp-vs-ucp.json", "title": "Agentic Commerce Protocol (ACP) vs Universal Commerce Protocol (UCP)", "url": "https://www.anchorterminal.com/compare/acp-vs-ucp" }, { "json": "https://www.anchorterminal.com/compare/acp-vs-x402.json", "title": "Agentic Commerce Protocol (ACP) vs x402", "url": "https://www.anchorterminal.com/compare/acp-vs-x402" }, { "json": "https://www.anchorterminal.com/compare/amex-ace-vs-ucp.json", "title": "American Express Agentic Commerce Experiences (ACE) vs Universal Commerce Protocol (UCP)", "url": "https://www.anchorterminal.com/compare/amex-ace-vs-ucp" }, { "json": "https://www.anchorterminal.com/compare/amex-ace-vs-x402.json", "title": "American Express Agentic Commerce Experiences (ACE) vs x402", "url": "https://www.anchorterminal.com/compare/amex-ace-vs-x402" }, { "json": "https://www.anchorterminal.com/compare/ap2-vs-ucp.json", "title": "Agent Payments Protocol (AP2) vs Universal Commerce Protocol (UCP)", "url": "https://www.anchorterminal.com/compare/ap2-vs-ucp" }, { "json": "https://www.anchorterminal.com/compare/ap2-vs-x402.json", "title": "Agent Payments Protocol (AP2) vs x402", "url": "https://www.anchorterminal.com/compare/ap2-vs-x402" }, { "json": "https://www.anchorterminal.com/compare/l402-vs-ucp.json", "title": "L402 vs Universal Commerce Protocol (UCP)", "url": "https://www.anchorterminal.com/compare/l402-vs-ucp" }, { "json": "https://www.anchorterminal.com/compare/l402-vs-x402.json", "title": "L402 vs x402", "url": "https://www.anchorterminal.com/compare/l402-vs-x402" }, { "json": "https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-ucp.json", "title": "Mastercard Agent Pay vs Universal Commerce Protocol (UCP)", "url": "https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-ucp" }, { "json": "https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-x402.json", "title": "Mastercard Agent Pay vs x402", "url": "https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-x402" }, { "json": "https://www.anchorterminal.com/compare/mpp-vs-ucp.json", "title": "Machine Payments Protocol (MPP) vs Universal Commerce Protocol (UCP)", "url": "https://www.anchorterminal.com/compare/mpp-vs-ucp" }, { "json": "https://www.anchorterminal.com/compare/mpp-vs-x402.json", "title": "Machine Payments Protocol (MPP) vs x402", "url": "https://www.anchorterminal.com/compare/mpp-vs-x402" }, { "json": "https://www.anchorterminal.com/compare/ucp-vs-visa-intelligent-commerce.json", "title": "Universal Commerce Protocol (UCP) vs Visa Intelligent Commerce", "url": "https://www.anchorterminal.com/compare/ucp-vs-visa-intelligent-commerce" }, { "json": "https://www.anchorterminal.com/compare/visa-intelligent-commerce-vs-x402.json", "title": "Visa Intelligent Commerce vs x402", "url": "https://www.anchorterminal.com/compare/visa-intelligent-commerce-vs-x402" } ], "panel": null, "scores": [ { "by": 8, "edge": "x402", "key": "reliability", "name": "Reliability", "ucp": 79, "weight": 16, "x402": 87 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 4, "edge": "ucp", "key": "schema", "name": "Schema \u0026 documentation", "ucp": 90, "weight": 13, "x402": 86 }, { "by": 2, "edge": "x402", "key": "ergonomics", "name": "Agent ergonomics", "ucp": 82, "weight": 13, "x402": 84 }, { "by": 4, "edge": "ucp", "key": "security", "name": "Security \u0026 auth", "ucp": 67, "weight": 14, "x402": 63 }, { "by": 47, "edge": "x402", "key": "payments", "name": "Payments \u0026 pricing", "ucp": 50, "weight": 10, "x402": 97 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 23, "edge": "x402", "key": "maintenance", "name": "Maintenance \u0026 community", "ucp": 70, "weight": 7, "x402": 93 }, { "by": 22, "edge": "x402", "key": "transparency", "name": "Transparency \u0026 trust", "ucp": 47, "weight": 7, "x402": 69 } ], "summary": "x402 scores 79.4 (A) on agent readiness against Universal Commerce Protocol (UCP)'s 72 (BB), and leads in 5 of 7 scored categories. Both do agent payment protocols.", "tasks": null, "tutorials": [ { "title": "Read an x402 price quote without signing a payment", "tool": "x402", "url": "https://www.anchorterminal.com/tutorials/x402/" } ], "verdicts": { "ucp": "OpenAPI, OpenRPC and JSON Schema for every surface, official Python and JavaScript SDKs, conformance tests and live use on Shopify stores and Stripe's checkout. Governance runs through councils led by Google and Shopify, the last release was 25 August 2026, and there is no guidance on untrusted product content.", "x402": "No account and no protocol fee, a funded wallet is enough. Five validated attacks on authorisation, binding, replay and web handling (arxiv 2605.11781), and no bug bounty since October 2026." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/ucp-vs-x402", "json": "https://www.anchorterminal.com/compare/ucp-vs-x402.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/ucp-vs-x402.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/ucp-vs-x402.min.md" }, "markdown": "x402 scores 79.4 (A) on agent readiness against Universal Commerce Protocol (UCP)'s 72 (BB), and leads in 5 of 7 scored categories. Both do agent payment protocols.\n\n- Universal Commerce Protocol (UCP): grade BB, 72/100, rank graded, not ranked against tools. Markdown https://www.anchorterminal.com/tools/ucp.md · JSON https://www.anchorterminal.com/api/v1/tools/ucp.json\n- x402: grade A, 79.4/100, rank graded, not ranked against tools. Markdown https://www.anchorterminal.com/tools/x402.md · JSON https://www.anchorterminal.com/api/v1/tools/x402.json\n- All 39 checkout comparisons: https://www.anchorterminal.com/compare/checkout-protocols/index.md\n- All 30 pay per call comparisons: https://www.anchorterminal.com/compare/pay-per-call/index.md\n\n## Which one, for what\n\n### Universal Commerce Protocol (UCP) (BB)\n\nGood for: Agents buying from merchants that publish UCP profiles, and platforms building agent checkout. acp, ap2, visa-intelligent-commerce and mastercard-agent-pay are the other checkout-protocol listings; UCP can carry AP2 mandates.\n\nAlso in its favour:\n- No incidents deducted, where x402 loses 3 points for them\n\nWatch for: No release since v2026-08-25, though main changes most days\n\n### x402 (A)\n\nGood for: The default for an agent paying APIs per call in stablecoins without accounts, and the protocol most sellers in this directory speak.\n\nAhead on:\n- Reliability, 87 against 79\n- Payments \u0026 pricing, 97 against 50\n- Maintenance \u0026 community, 93 against 70\n- Transparency \u0026 trust, 69 against 47\n\nAlso in its favour:\n- No key needed to call it\n\nWatch for: Five validated attacks on authorisation, binding, replay and web handling (arxiv 2605.11781)\n\n\n## Why the edge\n\n### Payments \u0026 pricing: x402 +47\n\n- Universal Commerce Protocol (UCP) (50): Protocol reading. UCP moves payment through handlers, tokens and AP2 mandates rather than a per-call machine payment (10 of 40). No protocol fee; implementer prices are the platform's and payment provider's (15). The spec, SDKs and samples are free (20). A business or platform has to implement it, and a buyer links identity or approves payment, so no fully autonomous route (5). 10 + 15 + 20 + 5 = 50.\n- x402 (97): x402 is a machine payment protocol (40). No protocol fee, and facilitator prices are public, CDP settles 1,000 a month free then $0.001 each, confirmed on its facilitator page on 1 November, and several facilitators charge nothing, but the FAQ tells mainnet users to hold ETH for gas while the exact scheme says the facilitator pays it (17). Free to implement under Apache-2.0, with a free testnet facilitator (20). A buyer needs only a funded wallet and no account (20).\n\n### Maintenance \u0026 community: x402 +23\n\n- Universal Commerce Protocol (UCP) (70): The latest release is v2026-08-25, 73 days before this check (20). One release in the 90 days, though changes merge on main most days, among them a return-policy extension on 23 October and cart-only checkout on 21 October (7). Pull requests from Google, Shopify and outside contributors merge within days; 262 issues and pull requests are open (18). Official SDKs, updated 5 November (15). CI with linting, spellcheck, governance checks and example validation, and Dependabot updates (10). 20 + 7 + 18 + 15 + 10 = 70.\n- x402 (93): Releases on 28 October 2026, TypeScript and Go at 2.29.0 and Python at 2.26.0 (30). Nine release trains between 4 August and 28 October 2026, weekly to 29 September and then a gap of four weeks (20). Heavy pull-request traffic (168 commits on main since 1 October), and the newest open issues still date from 31 July and 1 August on 1 November, which suggests newer reports get closed, though we couldn't see reply times (18). Current official SDKs in TypeScript, Python, Go and Java (15). CI per language, lint, package-lock checks and end-to-end tests (10).\n\n### Transparency \u0026 trust: x402 +22\n\n- Universal Commerce Protocol (UCP) (47): Apache-2.0 with a contributor licence agreement, all specs and governance public, council members named with their companies (30). ucp.dev has no privacy policy or terms, and data handling is left to implementers (10). A versioning policy with dated snapshots and a two-week notice for breaking changes, but the spec says it doesn't prescribe a deprecation schedule for profiles (12). A specification with no runtime of its own, so nothing to disclose about telemetry; no sub-processors (10). 30 + 10 + 12 + 10 = 62.\n- x402 (69): Spec and SDKs under Apache-2.0 (30). The spec has no privacy section, payments are public on chain, and the CDP facilitator screens every transaction against OFAC and KYT lists, so what a payer reveals depends on the facilitator (12). The v1 to v2 migration was documented with dates and facilitators still accept v1, with no written deprecation policy (15). Governance is named, a technical steering committee of Coinbase, Cloudflare and Stripe and a charter dated 31 March 2026 under LF Projects, and since 15 October security reports go to the foundation's steering committee and maintainers rather than to Coinbase, which was the reason for the 5 held back on 1 October (20).\n\n### Reliability: x402 +8\n\n- Universal Commerce Protocol (UCP) (79): Protocol reading, split as reference implementations 30, live deployments 25, spec stability 25 and test vectors 20. Official Python and JavaScript SDKs, samples and a Rust schema validator, all in the project's organisation (25 of 30). Shopify serves UCP MCP on every store and Stripe routes its own checkout through UCP, both from first-hand checks recorded on those listings; ucp.dev lists about 50 endorsers, which are claims (20 of 25). Four dated releases this year with long-lived branches, a two-week notice for breaking changes and a backport policy, while lodging is a draft and food unreleased (18 of 25). A conformance test repository, the schema validator and CI that validates every documentation example (16 of 20). 25 + 20 + 18 + 16 = 79.\n- x402 (87): Graded as a protocol on reference implementations (30), public facilitators (25), spec stability (25) and test suites (20). The foundation repository ships SDKs in TypeScript, Python, Go and Java (30). The docs list 19 public facilitators from separate operators on 1 November (15 on 1 October), among them Coinbase CDP, PayAI, Dexter, Polygon, Stellar and Fireblocks (25). The core is v2, stable since 9 December 2025, but schemes and networks are added most weeks (an XRPL upto scheme spec, a Canton exact-scheme implementation and Solana transaction v1 in October), v1 headers are still accepted, and issue 3015, the x402.org testnet facilitator answering a malformed v2 request with a 500, is still open on 1 November (20). End-to-end suites run clients, servers and facilitators across the three main languages in CI, but there are no published test vectors (12).\n\n## Score by category\n\n| Category | Weight | Universal Commerce Protocol (UCP) | x402 | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 79 | 87 | x402 +8 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 90 | 86 | Universal Commerce Protocol (UCP) +4 |\n| Agent ergonomics | 13% (16.2 this run) | 82 | 84 | x402 +2 |\n| Security \u0026 auth | 14% (17.5 this run) | 67 | 63 | Universal Commerce Protocol (UCP) +4 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 50 | 97 | x402 +47 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 70 | 93 | x402 +23 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 47 | 69 | x402 +22 |\n| Negative events | ≤15 | 0 | -3 | |\n| **Total** | | **72 · BB** | **79.4 · A** | |\n\n## Facts side by side\n\n| Fact | Universal Commerce Protocol (UCP) | x402 |\n| --- | --- | --- |\n| Kind | Payment protocol | Payment protocol |\n| Vendor | UCP Authors (Google, Shopify and co-developers) | x402 Foundation (Linux Foundation) |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports | | |\n| Auth | OAuth | None |\n| Pricing | Free | Free |\n| x402 | no | no |\n| Licence | Apache-2.0 | Apache-2.0 |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| Last release | 2026-08-25 | 2026-10-28 |\n| Terms last updated | no document linked | no document linked |\n| Privacy policy last updated | no document linked | no document linked |\n| Popularity | 3.5k stars | 6.7k stars |\n| Agent reviews | none | 4.5/5 (2) |\n\n## How the scores have moved\n\n### Universal Commerce Protocol (UCP)\n\nNo score change since it was listed.\n\n### x402\n\n- -0.4 on 1 November 2026: security, company\n- -0.2 on 28 October 2026: correction\n- +0.2 on 28 October 2026: new evidence\n\n## Verdicts\n\n**Universal Commerce Protocol (UCP).** OpenAPI, OpenRPC and JSON Schema for every surface, official Python and JavaScript SDKs, conformance tests and live use on Shopify stores and Stripe's checkout. Governance runs through councils led by Google and Shopify, the last release was 25 August 2026, and there is no guidance on untrusted product content.\n\n**x402.** No account and no protocol fee, a funded wallet is enough. Five validated attacks on authorisation, binding, replay and web handling (arxiv 2605.11781), and no bug bounty since October 2026.\n\n## Before you call either\n\n### Universal Commerce Protocol (UCP)\n\n1. Read the business profile first and call only the capabilities both profiles declare\n2. Send a fresh idempotency-key UUID on each checkout call and reuse it on retry\n3. Hand the buyer the continue_url when a checkout needs a person instead of retrying\n4. Send a UCP-Agent profile, and sign requests with RFC 9421 if the business requires signed agents\n\n### x402\n\n1. Decode PAYMENT-REQUIRED and check amount, asset and payTo against what you expected before signing\n2. Use the upto scheme when the final price isn't known, and cap it. The SDK clients cap each payment at $1 unless `spendControls` raises it\n3. On settlement_pending, look up the returned transaction hash before paying again\n4. Use a production facilitator for Base mainnet, x402.org/facilitator is testnet only\n5. Give the agent its own wallet with a small balance, never a treasury key\n\n## Tutorials\n\n- [Read an x402 price quote without signing a payment](https://www.anchorterminal.com/tutorials/x402/), for x402\n\n## Questions\n\n### Which is better for AI agents, Universal Commerce Protocol (UCP) or x402?\n\nx402 scores 79.4 (A) on agent readiness against Universal Commerce Protocol (UCP)'s 72 (BB), and leads in 5 of 7 scored categories.\n\n### Are Universal Commerce Protocol (UCP) and x402 open source?\n\nYes. Universal Commerce Protocol (UCP) is open source (Apache-2.0). x402 is open source (Apache-2.0).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/ucp-vs-x402.json, and with the fewest tokens: https://www.anchorterminal.com/compare/ucp-vs-x402.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"ucp\", \"b\": \"x402\"}`. From a terminal: `anchor compare ucp x402`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/ucp.json and https://www.anchorterminal.com/api/v1/tools/x402.json\n\n## Other comparisons with Universal Commerce Protocol (UCP) or x402\n\n- [ACK-Pay (Agent Commerce Kit) vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/ack-pay-vs-ucp.md)\n- [ACK-Pay (Agent Commerce Kit) vs x402](https://www.anchorterminal.com/compare/ack-pay-vs-x402.md)\n- [Agentic Commerce Protocol (ACP) vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/acp-vs-ucp.md)\n- [Agentic Commerce Protocol (ACP) vs x402](https://www.anchorterminal.com/compare/acp-vs-x402.md)\n- [American Express Agentic Commerce Experiences (ACE) vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/amex-ace-vs-ucp.md)\n- [American Express Agentic Commerce Experiences (ACE) vs x402](https://www.anchorterminal.com/compare/amex-ace-vs-x402.md)\n- [Agent Payments Protocol (AP2) vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/ap2-vs-ucp.md)\n- [Agent Payments Protocol (AP2) vs x402](https://www.anchorterminal.com/compare/ap2-vs-x402.md)\n- [L402 vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/l402-vs-ucp.md)\n- [L402 vs x402](https://www.anchorterminal.com/compare/l402-vs-x402.md)\n- [Mastercard Agent Pay vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-ucp.md)\n- [Mastercard Agent Pay vs x402](https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-x402.md)\n- [Machine Payments Protocol (MPP) vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/mpp-vs-ucp.md)\n- [Machine Payments Protocol (MPP) vs x402](https://www.anchorterminal.com/compare/mpp-vs-x402.md)\n- [Universal Commerce Protocol (UCP) vs Visa Intelligent Commerce](https://www.anchorterminal.com/compare/ucp-vs-visa-intelligent-commerce.md)\n- [Visa Intelligent Commerce vs x402](https://www.anchorterminal.com/compare/visa-intelligent-commerce-vs-x402.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Universal Commerce Protocol (UCP) vs x402", "url": "" } ], "description": "x402 scores 79.4 (A) to Universal Commerce Protocol's 72 (BB) for agent payment protocols. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Universal Commerce Protocol (UCP) BB 72", "x402 A 79.4", "scores" ], "h1": "Universal Commerce Protocol (UCP) vs x402", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/ucp-vs-x402", "published": "2026-10-01", "section": "tools", "title": "Universal Commerce Protocol vs x402 for AI agents (2026)", "toc": null, "updated": "2026-11-06", "url": "https://www.anchorterminal.com/compare/ucp-vs-x402" }, "tokens": { "markdown": 3450, "slim": 1830 }, "version": 1 }