Key Takeaways
- Agentic commerce protocols are layers, not competitors — MCP, A2A, AP2, UCP/ACP, and a trust layer stack into five floors.
- As of April 2026 MCP, A2A, AP2, and UCP all sit under Linux Foundation governance; ACP pivoted to discovery in March.
- The real question isn't which to pick — it's which layer, where, with whom, and stacking is the answer.
Stop Picking Protocols — Start Stacking Them
Agentic commerce in 2026 looks nothing like it did a year ago. Anthropic quietly shipped MCP in November 2024. Google followed with A2A in April 2025, then AP2 in September, then UCP at NRF in January 2026. In March 2026, OpenAI and Stripe's ACP announced a major pivot. And that's just the headliners — circling them are Visa TAP/VIC, Mastercard Verifiable Intent, Web Bot Auth, and ERC-8004.
Most ecommerce operators freeze at this point. "Which one should I pick?" But that framing is already wrong. These protocols aren't competing. They sit on different layers. This article maps eight major protocols onto a single diagram and shows which layer each one occupies, so you can see which to implement where. For deep dives on individual protocols, see What is MCP, A2A Protocol Explained, and AP2 Deep Dive.
The Protocol Map — Five Layers
Agentic commerce has a "vertical" axis, a "horizontal" axis, and a trust layer wrapping around them. Stacked top to bottom:
| Layer | Purpose | Primary protocols |
|---|---|---|
| Identity / Trust | Is this agent real, who authorized it | Web Bot Auth, Visa TAP, Mastercard Verifiable Intent, ERC-8004 |
| Payment authorization | Who pays, when, how much, for what — cryptographically bound | AP2 (Mandates) |
| Commerce workflow | Discovery, cart, checkout, inventory, order lifecycle | UCP, ACP |
| Agent-to-agent | Agents from different vendors talking to each other | A2A |
| Tool / Data access | Agents reaching into business systems and external data | MCP |
Hold this map in your head and the "are they competing?" debate mostly dissolves. MCP and A2A are on different floors. AP2 and UCP are on different floors. UCP and ACP are the only pair that genuinely compete for the same real estate.
MCP — The Vertical Plumbing
MCP (Model Context Protocol) was released by Anthropic in November 2024. It's a standard way for AI agents to connect to external tools, databases, and APIs. If you need a metaphor, it's "USB-C for AI" — vertical plumbing from the model down to its tools.
As of April 2026, MCP server downloads have crossed 97 million cumulatively, with over 5,000 servers in the official registry. In December 2025, Anthropic donated MCP to the AI Agent Interoperability Foundation (AAIF) under the Linux Foundation, moving it to neutral governance. OpenAI, Google DeepMind, and Microsoft have all adopted it. MCP is now the de-facto standard for "how an AI calls a tool."
For ecommerce operators, MCP is the reason an AI agent can read Shopify inventory, run a Stripe charge, and write customer data back to Klaviyo — all through a unified interface. Implementation details live in our MCP server implementation guide.
A2A — The Horizontal Bus
A2A (Agent-to-Agent Protocol) was announced by Google at Cloud Next in April 2025. Where MCP handles the vertical "model → tools" axis, A2A is the horizontal protocol for agents to discover each other, negotiate, and hand off tasks — as peers.
By April 2026, A2A has 150+ participating organizations, and Google donated it to the Linux Foundation in June 2025. The early-2026 v1.0 release added Signed Agent Cards and multi-tenancy, finally making it production-grade. In August 2025, IBM's ACP (Agent Communication Protocol — unrelated to OpenAI's ACP) merged into A2A, effectively eliminating the main alternative.
The relationship with MCP in one line: A2A is the electrical trunk between agents, MCP is the plumbing each agent runs to its own toolbox. They don't compete. Google's own docs have a dedicated A2A and MCP page framing them as complementary.
AP2 — Cryptographically Binding Payment
You can't let agents buy things unchecked. AP2 (Agent Payments Protocol) was designed to solve exactly that problem. It was announced in September 2025, led by Google Cloud with 60+ launch partners including Coinbase.
AP2's core concept is the Mandate — a cryptographically signed authorization ticket. There are three kinds: Intent Mandate ("red sneakers, under $200"), Cart Mandate ("yes, this cart is correct"), and Payment Mandate ("execute with this payment method"). Together they leave a tamper-evident trail between user intent and payment execution that can be verified after the fact.
Crucially, AP2 is implemented as a formal extension to A2A, declared through the extensions field on an Agent Card. Google didn't invent a new stack — they layered business logic on top of the existing A2A layer. See our AP2 deep dive for the full story.
UCP and ACP — The One Layer With a Real Choice
This is where it gets interesting. UCP and ACP are the only pair that genuinely sit on the same floor.
UCP — The Distributed Model
UCP (Universal Commerce Protocol) was co-announced by Google and Shopify at NRF 2026 in January. It's a commerce-layer protocol tying product catalog, cart, checkout, inventory, fulfillment, and order management to a single schema. Launch partners include Wayfair, Revolut, Salesforce, commercetools, and Talon.One.
UCP's design principle is that product data stays in the merchant's domain. Agents send requests to the merchant; the merchant returns inventory and price from its own systems. There's no central upload. When commercetools rolled out UCP early, they disclosed that UCP-routed checkout costs ran about 3.2% of transaction value.
ACP — The Pivot to Discovery
ACP (Agentic Commerce Protocol) was announced by OpenAI and Stripe in September 2025, powering "Instant Checkout" inside ChatGPT. But in March 2026, it took a sharp turn. Only about 12 Shopify merchants had actually enabled Instant Checkout, and OpenAI announced it was narrowing ACP's role to product discovery. ACP-routed checkout costs settled around 7.2%, which became a real wedge against UCP.
UCP vs ACP at a Glance
| Dimension | UCP | ACP |
|---|---|---|
| Announced | Jan 2026 (NRF) | Sep 2025 |
| Led by | Google + Shopify | OpenAI + Stripe |
| Model | Distributed — product stays at merchant | Centralized (original) → pivoted to discovery |
| Checkout cost | ~3.2% | ~7.2% |
| Current scope | Discovery + checkout | Discovery only |
| Governance | Donated to Linux Foundation | Not donated |
As of April 2026, the commerce workflow layer is consolidating around UCP. ACP hasn't vanished — it still works for the narrower discovery use case inside ChatGPT — but the full-stack checkout ambition is effectively parked. Our UCP vs ACP comparison goes deeper.
The Identity / Trust Layer — Four Answers, No Winner Yet
The top layer — "is this agent real, did the user actually authorize this?" — has no single winner yet. Four answers are currently in play.
Web Bot Auth is Cloudflare's IETF proposal for verifying the legitimacy of bot traffic. It combines HTTP Message Signatures with RFC-based key distribution, so a site can confirm that traffic really came from the agent it claims to be. Cloudflare turned it on at their edge in March 2026.
Visa TAP (Trusted Agent Protocol) and its umbrella concept VIC (Visa Intelligent Commerce) are the card-network answer. Visa extends existing EMV 3-D Secure and authentication infrastructure to add network-backed trust signals to agent-initiated transactions.
Mastercard Verifiable Intent takes a different tack: tokenize the user's intent itself rather than the agent. Card issuers can then factor "what the user meant to buy" into fraud detection.
ERC-8004 comes from the crypto side — an on-chain standard for agent identity. Designed to pair with on-chain settlement, it's being pushed by Skyfire and others.
This layer is pre-consolidation. A second round of shakeout is likely between late 2026 and 2027. Ecommerce operators don't need to bet on all four, but the time to start preparing at least one is now.
Eight Protocols Side by Side
| Protocol | Layer | Launched | Lead | Governance | Status (Apr 2026) |
|---|---|---|---|---|---|
| MCP | Tool access | Nov 2024 | Anthropic | LF AAIF | 97M downloads, 5,000+ servers |
| A2A | Agent-to-agent | Apr 2025 | LF | 150+ orgs, v1.0 | |
| AP2 | Payment auth | Sep 2025 | A2A extension | 60+ partners | |
| UCP | Commerce WF | Jan 2026 | Google + Shopify | LF | Discovery + checkout |
| ACP | Commerce WF | Sep 2025 | OpenAI + Stripe | Not donated | Narrowed to discovery |
| Visa TAP / VIC | Trust | May 2025 | Visa | Proprietary | Rolling out at major PSPs |
| MC Verifiable Intent | Trust | Feb 2026 | Mastercard | Proprietary | Pilot |
| Web Bot Auth | Trust | Nov 2025 | Cloudflare / IETF | IETF Draft | Standardization in progress |
A Decision Frame for Ecommerce Operators
Using the map above, here's where to start depending on your role.
If you're a Shopify merchant, UCP adoption is the first move — Shopify is driving most of the rollout for you automatically. Stand up one MCP server so your internal AI assistants can read inventory and write orders. AP2 is still preparation-stage; watch Visa TAP and Mastercard's moves on a six-month cadence before committing.
If you're a SaaS platform — headless CMS, OMS, PIM — UCP + MCP is the top priority. UCP exposes your commerce data to agents; MCP lets existing customers plug you into their business AIs. You can't meet agent-era integration requirements without both. A2A enters the picture when you need to connect to peer SaaS agents.
If you're a payment provider / PSP, AP2 and the trust layer (Visa TAP, Mastercard Verifiable Intent, Web Bot Auth) are the things to watch. Which standard wins behind the scenes of card payments will shape the business. 2026 is typically information-gathering and implementation prep; 2027 is production rollout.
If you're a marketplace, UCP for discoverability plus an MCP server for seller-side management is the cleanest combination. The centralized structure of a marketplace actually maps reasonably well onto ACP's original model, but UCP is the safer long-term bet.
Conclusion — Stacking, Not Choosing
If you take one thing away, make it this. Agentic commerce in 2026 isn't a "pick a protocol" problem — it's a "which layer, where" problem. MCP and A2A are complementary, AP2 is an extension of A2A, and the only real contest is between UCP and ACP — which is now tilting decisively toward UCP. The identity layer is still wide open.
Once this map is in your head, every new protocol announcement becomes easy to classify — just ask which of the five floors it belongs to. That alone resolves most of the noise.
For deeper reading, this article connects to what is agentic commerce, What is MCP, A2A Protocol Explained, AP2 deep dive, UCP vs ACP comparison, and agentic AI protocol taxonomy. No matter where you start, returning to this five-layer map keeps the whole landscape coherent.
