# Universal Commerce Protocol (UCP) vs x402

> x402 scores 79.4 (A) to Universal Commerce Protocol's 72 (BB) for agent payment protocols. Prices, MCP, x402, uptime and agent notes side by side.

- Canonical: https://www.anchorterminal.com/compare/ucp-vs-x402
- Markdown: https://www.anchorterminal.com/compare/ucp-vs-x402.md (~3,450 tokens)
- Site index for agents: https://www.anchorterminal.com/llms.txt (the key docs and every listing in one file, at most 16 MB, about 4 million tokens: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key)
- DNS: dig +short TXT <slug>.grade.anchorterminal.com (the grade as a DNS TXT record, for a sandbox with no HTTP where names still resolve; also top., best.<category>. and <a>.vs.<b>. under the zone, and the same under grade.letme.dev)
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)
- Updated: 2026-11-06

x402 scores 79.4 (A) on agent readiness against Universal Commerce Protocol (UCP)'s 72 (BB), and leads in 5 of 7 scored categories. Both do agent payment protocols.

- Universal Commerce Protocol (UCP): grade BB, 72/100, rank graded, not ranked against tools. Markdown https://www.anchorterminal.com/tools/ucp.md · JSON https://www.anchorterminal.com/api/v1/tools/ucp.json
- x402: grade A, 79.4/100, rank graded, not ranked against tools. Markdown https://www.anchorterminal.com/tools/x402.md · JSON https://www.anchorterminal.com/api/v1/tools/x402.json
- All 39 checkout comparisons: https://www.anchorterminal.com/compare/checkout-protocols/index.md
- All 30 pay per call comparisons: https://www.anchorterminal.com/compare/pay-per-call/index.md

## Which one, for what

### Universal Commerce Protocol (UCP) (BB)

Good for: Agents buying from merchants that publish UCP profiles, and platforms building agent checkout. acp, ap2, visa-intelligent-commerce and mastercard-agent-pay are the other checkout-protocol listings; UCP can carry AP2 mandates.

Also in its favour:
- No incidents deducted, where x402 loses 3 points for them

Watch for: No release since v2026-08-25, though main changes most days

### x402 (A)

Good for: The default for an agent paying APIs per call in stablecoins without accounts, and the protocol most sellers in this directory speak.

Ahead on:
- Reliability, 87 against 79
- Payments & pricing, 97 against 50
- Maintenance & community, 93 against 70
- Transparency & trust, 69 against 47

Also in its favour:
- No key needed to call it

Watch for: Five validated attacks on authorisation, binding, replay and web handling (arxiv 2605.11781)


## Why the edge

### Payments & pricing: x402 +47

- Universal Commerce Protocol (UCP) (50): Protocol reading. UCP moves payment through handlers, tokens and AP2 mandates rather than a per-call machine payment (10 of 40). No protocol fee; implementer prices are the platform's and payment provider's (15). The spec, SDKs and samples are free (20). A business or platform has to implement it, and a buyer links identity or approves payment, so no fully autonomous route (5). 10 + 15 + 20 + 5 = 50.
- x402 (97): x402 is a machine payment protocol (40). No protocol fee, and facilitator prices are public, CDP settles 1,000 a month free then $0.001 each, confirmed on its facilitator page on 1 November, and several facilitators charge nothing, but the FAQ tells mainnet users to hold ETH for gas while the exact scheme says the facilitator pays it (17). Free to implement under Apache-2.0, with a free testnet facilitator (20). A buyer needs only a funded wallet and no account (20).

### Maintenance & community: x402 +23

- Universal Commerce Protocol (UCP) (70): The latest release is v2026-08-25, 73 days before this check (20). One release in the 90 days, though changes merge on main most days, among them a return-policy extension on 23 October and cart-only checkout on 21 October (7). Pull requests from Google, Shopify and outside contributors merge within days; 262 issues and pull requests are open (18). Official SDKs, updated 5 November (15). CI with linting, spellcheck, governance checks and example validation, and Dependabot updates (10). 20 + 7 + 18 + 15 + 10 = 70.
- x402 (93): Releases on 28 October 2026, TypeScript and Go at 2.29.0 and Python at 2.26.0 (30). Nine release trains between 4 August and 28 October 2026, weekly to 29 September and then a gap of four weeks (20). Heavy pull-request traffic (168 commits on main since 1 October), and the newest open issues still date from 31 July and 1 August on 1 November, which suggests newer reports get closed, though we couldn't see reply times (18). Current official SDKs in TypeScript, Python, Go and Java (15). CI per language, lint, package-lock checks and end-to-end tests (10).

### Transparency & trust: x402 +22

- Universal Commerce Protocol (UCP) (47): Apache-2.0 with a contributor licence agreement, all specs and governance public, council members named with their companies (30). ucp.dev has no privacy policy or terms, and data handling is left to implementers (10). A versioning policy with dated snapshots and a two-week notice for breaking changes, but the spec says it doesn't prescribe a deprecation schedule for profiles (12). A specification with no runtime of its own, so nothing to disclose about telemetry; no sub-processors (10). 30 + 10 + 12 + 10 = 62.
- x402 (69): Spec and SDKs under Apache-2.0 (30). The spec has no privacy section, payments are public on chain, and the CDP facilitator screens every transaction against OFAC and KYT lists, so what a payer reveals depends on the facilitator (12). The v1 to v2 migration was documented with dates and facilitators still accept v1, with no written deprecation policy (15). Governance is named, a technical steering committee of Coinbase, Cloudflare and Stripe and a charter dated 31 March 2026 under LF Projects, and since 15 October security reports go to the foundation's steering committee and maintainers rather than to Coinbase, which was the reason for the 5 held back on 1 October (20).

### Reliability: x402 +8

- Universal Commerce Protocol (UCP) (79): Protocol reading, split as reference implementations 30, live deployments 25, spec stability 25 and test vectors 20. Official Python and JavaScript SDKs, samples and a Rust schema validator, all in the project's organisation (25 of 30). Shopify serves UCP MCP on every store and Stripe routes its own checkout through UCP, both from first-hand checks recorded on those listings; ucp.dev lists about 50 endorsers, which are claims (20 of 25). Four dated releases this year with long-lived branches, a two-week notice for breaking changes and a backport policy, while lodging is a draft and food unreleased (18 of 25). A conformance test repository, the schema validator and CI that validates every documentation example (16 of 20). 25 + 20 + 18 + 16 = 79.
- x402 (87): Graded as a protocol on reference implementations (30), public facilitators (25), spec stability (25) and test suites (20). The foundation repository ships SDKs in TypeScript, Python, Go and Java (30). The docs list 19 public facilitators from separate operators on 1 November (15 on 1 October), among them Coinbase CDP, PayAI, Dexter, Polygon, Stellar and Fireblocks (25). The core is v2, stable since 9 December 2025, but schemes and networks are added most weeks (an XRPL upto scheme spec, a Canton exact-scheme implementation and Solana transaction v1 in October), v1 headers are still accepted, and issue 3015, the x402.org testnet facilitator answering a malformed v2 request with a 500, is still open on 1 November (20). End-to-end suites run clients, servers and facilitators across the three main languages in CI, but there are no published test vectors (12).

## Score by category

| Category | Weight | Universal Commerce Protocol (UCP) | x402 | Edge |
| --- | --- | --- | --- | --- |
| Reliability | 16% (20 this run) | 79 | 87 | x402 +8 |
| Performance | 10%, pending | pending | pending | not scored in this run |
| Schema & documentation | 13% (16.2 this run) | 90 | 86 | Universal Commerce Protocol (UCP) +4 |
| Agent ergonomics | 13% (16.2 this run) | 82 | 84 | x402 +2 |
| Security & auth | 14% (17.5 this run) | 67 | 63 | Universal Commerce Protocol (UCP) +4 |
| Payments & pricing | 10% (12.5 this run) | 50 | 97 | x402 +47 |
| Task success | 10%, pending | pending | pending | not scored in this run |
| Maintenance & community | 7% (8.8 this run) | 70 | 93 | x402 +23 |
| Transparency & trust | 7% (8.8 this run) | 47 | 69 | x402 +22 |
| Negative events | ≤15 | 0 | -3 | |
| **Total** | | **72 · BB** | **79.4 · A** | |

## Facts side by side

| Fact | Universal Commerce Protocol (UCP) | x402 |
| --- | --- | --- |
| Kind | Payment protocol | Payment protocol |
| Vendor | UCP Authors (Google, Shopify and co-developers) | x402 Foundation (Linux Foundation) |
| Hosted endpoint | no (local only) | no (local only) |
| Transports |  |  |
| Auth | OAuth | None |
| Pricing | Free | Free |
| x402 | no | no |
| Licence | Apache-2.0 | Apache-2.0 |
| Read-only variant documented | no | no |
| llms.txt | yes | yes |
| Last release | 2026-08-25 | 2026-10-28 |
| Terms last updated | no document linked | no document linked |
| Privacy policy last updated | no document linked | no document linked |
| Popularity | 3.5k stars | 6.7k stars |
| Agent reviews | none | 4.5/5 (2) |

## How the scores have moved

### Universal Commerce Protocol (UCP)

No score change since it was listed.

### x402

- -0.4 on 1 November 2026: security, company
- -0.2 on 28 October 2026: correction
- +0.2 on 28 October 2026: new evidence

## Verdicts

**Universal Commerce Protocol (UCP).** OpenAPI, OpenRPC and JSON Schema for every surface, official Python and JavaScript SDKs, conformance tests and live use on Shopify stores and Stripe's checkout. Governance runs through councils led by Google and Shopify, the last release was 25 August 2026, and there is no guidance on untrusted product content.

**x402.** No account and no protocol fee, a funded wallet is enough. Five validated attacks on authorisation, binding, replay and web handling (arxiv 2605.11781), and no bug bounty since October 2026.

## Before you call either

### Universal Commerce Protocol (UCP)

1. Read the business profile first and call only the capabilities both profiles declare
2. Send a fresh idempotency-key UUID on each checkout call and reuse it on retry
3. Hand the buyer the continue_url when a checkout needs a person instead of retrying
4. Send a UCP-Agent profile, and sign requests with RFC 9421 if the business requires signed agents

### x402

1. Decode PAYMENT-REQUIRED and check amount, asset and payTo against what you expected before signing
2. Use the upto scheme when the final price isn't known, and cap it. The SDK clients cap each payment at $1 unless `spendControls` raises it
3. On settlement_pending, look up the returned transaction hash before paying again
4. Use a production facilitator for Base mainnet, x402.org/facilitator is testnet only
5. Give the agent its own wallet with a small balance, never a treasury key

## Tutorials

- [Read an x402 price quote without signing a payment](https://www.anchorterminal.com/tutorials/x402/), for x402

## Questions

### Which is better for AI agents, Universal Commerce Protocol (UCP) or x402?

x402 scores 79.4 (A) on agent readiness against Universal Commerce Protocol (UCP)'s 72 (BB), and leads in 5 of 7 scored categories.

### Are Universal Commerce Protocol (UCP) and x402 open source?

Yes. Universal Commerce Protocol (UCP) is open source (Apache-2.0). x402 is open source (Apache-2.0).


## For agents

- This comparison as JSON: https://www.anchorterminal.com/compare/ucp-vs-x402.json, and with the fewest tokens: https://www.anchorterminal.com/compare/ucp-vs-x402.min.md
- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "ucp", "b": "x402"}`. From a terminal: `anchor compare ucp x402`
- Each listing in full: https://www.anchorterminal.com/api/v1/tools/ucp.json and https://www.anchorterminal.com/api/v1/tools/x402.json

## Other comparisons with Universal Commerce Protocol (UCP) or x402

- [ACK-Pay (Agent Commerce Kit) vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/ack-pay-vs-ucp.md)
- [ACK-Pay (Agent Commerce Kit) vs x402](https://www.anchorterminal.com/compare/ack-pay-vs-x402.md)
- [Agentic Commerce Protocol (ACP) vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/acp-vs-ucp.md)
- [Agentic Commerce Protocol (ACP) vs x402](https://www.anchorterminal.com/compare/acp-vs-x402.md)
- [American Express Agentic Commerce Experiences (ACE) vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/amex-ace-vs-ucp.md)
- [American Express Agentic Commerce Experiences (ACE) vs x402](https://www.anchorterminal.com/compare/amex-ace-vs-x402.md)
- [Agent Payments Protocol (AP2) vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/ap2-vs-ucp.md)
- [Agent Payments Protocol (AP2) vs x402](https://www.anchorterminal.com/compare/ap2-vs-x402.md)
- [L402 vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/l402-vs-ucp.md)
- [L402 vs x402](https://www.anchorterminal.com/compare/l402-vs-x402.md)
- [Mastercard Agent Pay vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-ucp.md)
- [Mastercard Agent Pay vs x402](https://www.anchorterminal.com/compare/mastercard-agent-pay-vs-x402.md)
- [Machine Payments Protocol (MPP) vs Universal Commerce Protocol (UCP)](https://www.anchorterminal.com/compare/mpp-vs-ucp.md)
- [Machine Payments Protocol (MPP) vs x402](https://www.anchorterminal.com/compare/mpp-vs-x402.md)
- [Universal Commerce Protocol (UCP) vs Visa Intelligent Commerce](https://www.anchorterminal.com/compare/ucp-vs-visa-intelligent-commerce.md)
- [Visa Intelligent Commerce vs x402](https://www.anchorterminal.com/compare/visa-intelligent-commerce-vs-x402.md)

---

Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp