Changelog

Weekly automated review. Changes this run:

• Stripe MPP (status change, beta → live): Stripe's official changelog lists "Accept payments on x402 and Machine Payments Protocol (MPP)" as General availability. SPT availability expanded to all US states and internationally (previously "US, Canada, and select European countries"). Stablecoin payments available in 30+ countries. October 2026 added session-based streaming payments (pre-authorize a max, pay per unit of work in sub-cent increments) and dynamic pricing as public previews. Status updated from beta to live.
• Visa TAP B2B Pilot — BILL + Billtrust (new deployment, pilot): Visa, BILL, and Billtrust launched the first live pilot for trusted AI agents to complete approved B2B invoice payments end-to-end through supplier portals. BILL's Payment Agent is registered via Visa's Trusted Agent Protocol and Agentic Directory, uses tokenized credentials, and replaces manual portal logins and CAPTCHAs. Announced October 20; currently processing real transactions.
• Mastercard AP4M (protocol update): Mastercard opened Early Access to Agent Pay for Machines at Cloudflare Connect on October 20, providing first buyer/seller-side APIs, toolkit, sandbox, and developer documentation. Demonstrated live with 9 payments across 2 merchants (AIsa and Cloudflare AI Gateway) on a single approved budget, settled via Coinbase, Base, and BVNK. Pilot partners include Cloudflare, Ant International, AIsa, Base, BVNK, Coinbase, and Hype. Still in pilot and not commercially available.

Also noted this week:

• Stripe Treasury for agents (October 21): Stripe launched Treasury for agents (public preview), letting AI agents check balances, pay invoices, transfer funds, and convert currencies via Stripe's MCP server, with human approval for money movement. A product feature, not a new protocol.
• x402 SDK security vulnerabilities (October 22–23): Security firm V12 disclosed 25 vulnerabilities in the x402 SDKs, including 3 critical flaws (unlimited payment signing, Solana no-token-payment bypass, cross-site login signing). All 3 critical issues were fixed in August 18 releases, but the x402 Foundation published no security advisory; npm audit and PyPI show no warnings. Developers should upgrade to @x402/core 2.28.0+ (TypeScript), v2.28.0 (Go), 2.25.0 (Python).
• EMVCo Agentic Payments Framework (Q3 2026 newsletter, Oct 9): EMVCo's draft framework introducing "Intent Services" for card-based agentic payments completed public comment on September 30. It is a conceptual framework, not a specification (no APIs, message formats, or conformance requirements). EMVCo may develop KYA and Agentic Transaction Indicators next.

Weekly automated review. Changes this run:

• Ankr x402 Payments on Monad (new deployment, live): Ankr launched pay-per-request blockchain infrastructure on Monad mainnet on October 15. AI agents can access RPC data (decoded transactions, event logs, balances, contract metadata, token prices) and MCP-compatible agent tools, paying per call in USDC via the x402 v2 protocol with no account or API key. Uses Ankr's open TORPC spec and Monad's x402 facilitator for settlement.
• Stripe MPP (protocol update): Re-verified Stripe's machine-payments documentation. MPP now supports stablecoin settlement on Solana (USDC) in addition to Tempo (USDC.e); x402 remains on Base. SPTs are available to businesses in the US, Canada, and select European countries; stablecoin payments are available in 30+ countries. API version remains preview. Updated rails, settlement description, and deployment chains. Status kept at beta.

Also noted this week:

• Privy + Ripple XRPL wallets (October 13): Privy partnered with Ripple to bring programmable agent wallets to the XRP Ledger with x402 payment support. T54 operates a mainnet x402 facilitator on XRPL. Not added as a deployment (wallet infrastructure partnership, not a specific pay-per-request service).
• OKTO Agentic Pix (October 19): OKTO launched Agentic Pix in Brazil — an AI agent completes Pix transactions inside chat conversations via OKTO's Biometric Pix rail. Not a tracked protocol (product built on Brazil's existing Pix infrastructure).
• Circle CPN Managed Payments for agentic payments (October 19): Circle blogged about using CPN Managed Payments to accept agent payments in USDC, with per-merchant sub-accounts and fiat settlement. Extends Circle's existing infrastructure rather than introducing a new protocol.
• Mastercard Agent Pay Trust Framework intelligence services (October 8–9): Mastercard expanded Agent Pay with a probability score for identifying agent-initiated transactions and behavioral/fraud signals. Covered in W42; no additional protocol changes.

Weekly automated review. Changes this run:

• AWS Bedrock AgentCore Payments (new deployment, live): AWS's fully managed agent payment service, GA since August 18, supports x402 and MPP with Coinbase/Stripe Privy wallets and infrastructure-enforced spending limits. An October 8 case study documents Incarna paying BlockRun for per-inference model calls on Base with sub-cent USDC settlements.
• Crossmint Agent Commerce Toolkit (new deployment, live): A multi-protocol agent checkout orchestrator launched October 8, combining PCI-compliant card vaulting, Visa Intelligent Commerce and Mastercard Agent Pay tokenized credentials, and routing through UCP, Shop Pay, or browser automation per transaction. Classified under AP4M for consistency with the AgentCard entry but spans multiple tracked protocols.
• P3P (status change): Pine Labs P3P now supports card transactions in addition to UPI rails. The quickstart documentation lists Cards as "Available now" alongside UPI ReservePay and One Time Mandate, with stablecoin support on the roadmap.

Also noted this week:

• Hedera Agent Accounts announced October 8 — programmable, non-custodial spending accounts on Hedera with on-chain spending rules and x402 compatibility. Testnet planned Q4 2026; mainnet targeted Q2 2027. Not added as a deployment (not yet live).
• LangChain Restock (October 8): a sample Slack agent making real purchases via Stripe Link and MPP, demonstrating the hosted-agent-pays-with-budget pattern.
• Google Merchant Center UCP integration hub rolling out in the US (reported October 6–7), letting merchants onboard to UCP-powered checkout for AI Mode and Gemini.
• x402 reached 191.9M cumulative on-chain settlements and $41.9M stablecoin volume across 12 chains and 18 facilitators (per agenteconomy.to, October 12). A full security analysis of the x402 protocol appeared at USENIX Security 2026 (October 8).

Weekly automated review. Changes this run:

• ACP (draft updated): Fleshed out with verified sources (OpenAI blog, Stripe newsroom, Stripe blog, GitHub repo), howItWorks describing the checkout session lifecycle and Shared Payment Tokens, tradeoffs, and security notes. Still draft — human review needed before promoting.
• UCP (draft updated): Fleshed out with verified sources (Google blog, GitHub spec repo, ucp.dev), howItWorks covering the full shopping journey (catalog, cart, identity linking, checkout, order management), tradeoffs, and security notes. Updated specUrl to ucp.dev. Still draft — human review needed before promoting.

Also noted this week:

• A2A x402 extension v0.2 published September 22 by Google (google-agentic-commerce/a2a-x402), formalizing pay-per-call monetization for A2A agents via x402 payment flows. Not a new protocol but a significant interop milestone between two tracked protocols.
• Google auto-enrolled eligible Shopify merchants in UCP native checkout for AI Mode and Gemini (September 22), inverting the opt-in model for hundreds of thousands of merchants.
• Meta Muse shopping integrations: Shopify enabled Shop Pay agentic checkout across all Shopify stores for Meta's Muse AI agent (September 21–22); PayPal followed with Muse checkout support across its global merchant network (September 24). These integrations use platform-specific checkout (Shop Pay, PayPal, Stripe Link) rather than a tracked protocol.

Weekly automated review. Changes this run:

• ACP (new, draft): OpenAI & Stripe's Agentic Commerce Protocol — an open checkout-session standard for AI agent–driven consumer purchases. Powers ChatGPT Instant Checkout; adopted by Etsy, Target, Sephora, and others. Beta since September 2025. Added as draft pending full human review of protocol details.
• UCP (new, draft): Google's Universal Commerce Protocol — an open standard for agentic commerce across the full shopping journey (discovery, cart, checkout, post-purchase). Co-developed with Shopify, Target, Walmart, and endorsed by 20+ partners. Live since January 2026. Added as draft pending full human review.
• Circle x402 Facilitator on Arc (new deployment, live): Circle's hosted x402 Facilitator Service launched with Arc mainnet on September 16, enabling USDC agent payments across Arc, Base, and Polygon through a single integration with no relayer keys or gas wallets.
• Alchemy AgentCard + Mastercard (new deployment, live): Alchemy integrated Mastercard Agent Pay into AgentCard on September 17, letting AI agents make purchases anywhere Mastercard is accepted using one-time-use tokenized credentials with Verifiable Intent support.

Also noted: Coinbase x402 facilitator on Solana shipped three improvements on Sep 17 — upto payment scheme now live, verify latency cut 66% to 75 ms, settle latency down 20% to 900 ms, and automatic SDK retry for pending settlements.

Weekly automated review. Changes this run:

• AMP (new, live): Ant International's Agentic Mobile Protocol — an open-source payment protocol for mobile interfaces (wallets, super apps, wearables). Launched April 2026; global rollout across 10 Alipay+ wallets (1.5B user accounts) and 7 acquirers (Adyen, Checkout.com, Fiserv, Global Payments, Nuvei, Worldline) announced September 11. Features KYA agent identity, Agent Trust Rating, AgentSafePay merchant guarantee, and nano-grade A2A settlement. Ant International, Mastercard, and Visa began KYA interoperability collaboration through BuildFin.ai (MAS).
• X Pay (new deployment, live): X-Pay Technologies' x402 gateway went live on Base mainnet September 11, settling real USDC per-request with no account or API key required.
• Mastercard Agent Connect (new deployment, live): A single-integration merchant solution launched September 9, linking AI agents to product catalogues and secure checkout via Agent Pay / Verifiable Intent. Launching first in the US with Samsung, Trip.com, Global Payments, Nexi, Worldline, and others.
• NPCI UAP (draft updated): NPCI deferred the expected UAP launch at Global Fintech Fest (Sep 8–11) pending regulatory review. NPCI's chairman publicly described the protocol work for the first time at GFF on Sep 10, stating agents may read intent but authentication and settlement must remain deterministic.
• Visa TAP re-verified: added Visa EU July 2 press release confirming live agent-executed transactions with 31 named European issuers and 4 merchants.
• Mastercard AP4M re-verified: Agent Connect confirms AP4M expansion; added The Paypers source.

Weekly automated review. Changes this run:

• Visa TAP (new, live): Visa's Trusted Agent Protocol — a cryptographic trust framework (RFC 9421 HTTP Message Signatures) for agentic commerce on the Visa network. Announced October 2025 with Cloudflare; live in Europe with 30+ issuers since July 2026. Developer docs and GitHub samples verified.
• AP4M (upgraded, draft → live): Mastercard Agent Pay for Machines — fleshed out from draft with howItWorks, tradeoffs, security notes, and a verified third-party source. Primary Mastercard URLs still block automated fetchers; verified via Electronic Payments International.
• Polygon x402 (new deployment, live): Polygon x402 v2 facilitators on mainnet and Amoy testnet, with Coinbase CDP gas sponsorship. Live since March 2026.
• NPCI UAP (new, draft): NPCI's Unified Agent Protocol — a reported national framework for agentic UPI payments, expected at Global Fintech Fest (Sep 8–11, 2026). Added as draft pending official confirmation.

Weekly automated review. Changes this run:

• x402: governance transferred to the vendor-neutral x402 Foundation under the Linux Foundation (announced April 2026, operationally active July 2026 with 40 members). Protocol V2 introduced CAIP-2 network identifiers, scoped packages, and new header names. Sources and summary updated.
• AP2: v0.2 released April 2026 with Human-Not-Present autonomous payment flows. Google donated AP2 and the Verifiable Intent framework (co-developed with Mastercard) to the FIDO Alliance. Mandate model reorganized from three types to two (Checkout + Payment, each Open or Closed). Sources updated.
• MPP: corrected co-authorship to Stripe and Tempo; added open spec at mpp.dev and Stripe blog announcement. Still early access/beta.
• P3P (new, live): Pine Labs Payment Protocol — India's first agentic payment protocol on UPI. Uses HTTP 402, UPI mandate infrastructure, and a Grantex identity layer. Live with Gullak since June 2026.
• AP4M (new, draft): Mastercard Agent Pay for Machines — machine-to-machine payment service launched June 2026 with 30+ partners. Added as draft because the primary Mastercard source URLs could not be confirmed to return HTTP 200 from automated fetchers.

Initial registry published with x402, A2A, AP2, and Stripe MPP as verified entries, plus draft scaffolds pending verification. All non-draft claims carry sources and a verification date.

Verified two former drafts against primary sources: ERC-4337 (account-abstraction custody primitive, now live) and A402 (a research-stage architecture, now proposed). ZeroClick was reclassified from a draft protocol to a real deployment, since it is a storefront/proxy built on x402 and MPP rather than a new rail.

Recorded Stripe's machine-payments surface (MPP, with x402 support) and CoinGecko's pay-per-call market-data endpoints priced in USDC.

Added the Agent Payments Protocol (AP2) as a payment-authorization layer and clarified that A2A is agent-communication only — payments ride on top via other protocols. Logged the PayPal-with-Google AP2 pilot.

Seeded x402 (HTTP-402 stablecoin payments) as a live payment-execution protocol, along with Coinbase Agent.market, Cloudflare's Agents SDK gateway, and the Circle Wallets reference workflow.