Short answer: agentic commerce is a purchase where an AI agent — not a human clicking through a browser — does the finding, the cart-building and often the paying, acting on a person’s standing instruction rather than their live clicks. “Order trail-running shoes under $150 that arrive Friday” replaces browsing a category page. The plumbing that makes this work is a stack of open protocols shipped over the past year, each owned by a different company and each solving one narrow piece of the problem. Here’s what each one actually does, read from its own specification rather than the marketing copy around it.

The stack, piece by piece

MCP (Model Context Protocol) — how an agent reaches your tools and data. Released by Anthropic, MCP’s own documentation describes it as “an open-source standard for connecting AI applications to external systems,” comparing it to “a USB-C port for AI applications” — one standard connector instead of a bespoke integration per tool. The protocol’s first versioned specification is dated 2024-11-05; the current version, per the same spec repository, is 2026-07-28. MCP itself defines no commerce concepts — no cart, no checkout, no payment — it’s the wire format an agent uses to call a server’s tools at all, commerce or otherwise.

ACP (Agentic Commerce Protocol) — the checkout itself. ACP is, per its own repository description, “an interaction model and open standard for connecting buyers, their AI agents, and businesses to complete purchases seamlessly.” It’s jointly maintained by OpenAI and Stripe as founding maintainers, first released 2025-09-29, and defines two core APIs: a Checkout API for the cart-to-order flow and a Delegate Payment API for exchanging a payment token without handing the agent raw card data. It’s the protocol behind ChatGPT’s in-chat checkout.

UCP (Universal Commerce Protocol) — the shared vocabulary between agent, merchant and processor. UCP’s repository describes it as “an open standard enabling interoperability between various commerce entities to facilitate seamless commerce integrations,” spanning four functional areas: checkout (cart and tax), identity linking (OAuth 2.0), order lifecycle (webhooks), and payment token exchange. It’s the protocol Shopify migrated its Storefront MCP cart tools to — see our read of its August 2026 update for a concrete case of the gap between what a protocol lists as a capability and what it actually covers.

AP2 (Agent Payments Protocol) — proof the agent is authorized to pay. Where ACP and UCP move goods and money, AP2 answers the question underneath both: how does a bank or card network know an autonomous agent, not a human at a keyboard, was actually authorized to spend? Google’s AP2 specification states the problem directly: today’s payment rails “were not designed for a future where autonomous, non-human agents act on a user’s behalf,” which “creates ambiguity around transaction liability.” Its fix is a chain of cryptographically signed Mandates — Intent, Cart, and Payment — that create what the spec calls “verifiable digital proof of a user’s intent,” so a disputed charge has signed evidence instead of an agent’s word. AP2 is explicitly designed as “an extension for emerging agent-to-agent (A2A), model-context protocols (MCP), and Universal Commerce Protocol (UCP)” — a payments layer that sits underneath the others rather than a fifth, competing checkout flow. It also defines two transaction modes worth knowing: “Human Present” (a person approves the specific cart before it’s charged) and “Human Not Present” (a person pre-approves conditions — “buy these shoes when the price drops below $100” — and the agent transacts later on its own).

How the pieces actually fit together

None of these four compete with each other; they stack. A realistic flow: an agent uses MCP to call a merchant’s tools and read the catalog, assembles a cart through ACP or UCP depending on which the merchant runs, and AP2 mandates travel underneath to prove to the card network that the human actually authorized this specific purchase. A merchant doesn’t have to pick one — Stripe, Shopify, Google and the card networks are each backing a different piece of the same stack, and a store’s checkout can plausibly need to speak more than one of them within the same year.

What none of these protocols guarantee, on their own, is that an agent can actually complete a purchase on a given store. Shipping a conformant endpoint is necessary but not sufficient — see our teardown of why agents abandon a checkout for the concrete, checkable failures that sit on top of correct protocol support.

FAQ

Is agentic commerce the same thing as an AI chatbot recommending a product?

No. A chatbot citing or describing your product only proves the discovery layer works — the model read your content. Agentic commerce is the transaction layer underneath that: an agent that can build a cart, present a payment method, and complete a checkout without a human clicking through your site.

Do I need to support all four protocols to sell through AI agents?

Not immediately. MCP is the substrate almost everything else assumes; ACP and UCP are alternative checkout implementations backed by different platforms, so which one you need depends on where you sell (ChatGPT/Stripe favors ACP, Shopify has migrated to UCP); AP2 sits underneath either as the payment-authorization layer and matters most once real money starts moving through an agent rather than a human.

Who actually controls these protocols?

Each has a different owner: MCP is Anthropic’s, now with broad ecosystem adoption across Claude, ChatGPT, VS Code and others; ACP is jointly governed by OpenAI and Stripe; UCP originated at Google with retail partners including Shopify, Etsy and Walmart; AP2 is a Google-led open specification designed to extend, not replace, the others. None of the four is a single-vendor lock-in by design — all four repositories are published under permissive open-source licenses.

Sources

Every one of these protocols assumes a store’s product data, price and checkout are already machine-readable enough to speak to — which is exactly the transaction-readiness gap AgentReady’s scan is built to catch.