ACP vs UCP vs AP2 vs MCP: agentic commerce protocols explained

What is an agentic commerce protocol?

An agentic commerce protocol is a shared specification that lets an AI agent find products, check out, or pay on a buyer's behalf with a store it has no custom integration with. The four names that come up most are ACP, UCP, AP2, and MCP. They overlap less than they seem: each covers a different layer of the purchase, and some are designed to work together.

ACP vs UCP vs AP2 vs MCP at a glance

What is ACP?

The Agentic Commerce Protocol (ACP) is the protocol OpenAI uses for Instant Checkout in ChatGPT. Stripe and OpenAI developed it, and agenticcommerce.dev publishes it as open source under Apache 2.0.

According to OpenAI's key concepts, a merchant implements three flows:

• A product feed so ChatGPT can index the catalog.
• The Agentic Checkout Spec: REST endpoints such as Copy to clipboardPOST /checkout_sessions that ChatGPT calls to create, update, and complete a checkout.
• The Delegated Payment Spec, where a payment provider issues a scoped one-time token. Stripe's Shared Payment Token is the first implementation.

OpenAI is not the merchant of record. The store charges the payment on its own stack and owns refunds.

What is UCP?

The Universal Commerce Protocol (UCP) is an open standard for agents to discover, buy, and track orders across merchants. Google uses it for agentic checkout in AI Mode in Google Search and Gemini, as its UCP page describes.

ucp.dev lists capabilities for catalog, cart, checkout, identity linking (for example, OAuth 2.0 account linking), and orders. UCP runs over REST and JSON-RPC, with built-in support for AP2, A2A, and MCP. Google's page says the merchant remains the merchant of record and can reuse Merchant Center shopping feeds.

What is AP2?

The Agent Payments Protocol (AP2) is an open protocol for proving that a buyer authorized a payment an agent makes. ap2-protocol.org describes it as an extension for the Agent2Agent (A2A) protocol and UCP.

AP2 uses verifiable digital credentials called mandates. A checkout mandate records what the user approved for a purchase. A payment mandate authorizes a specific amount for that checkout, and goes to the credential provider and payment processor. AP2 does not define a catalog or a checkout flow on its own.

What is MCP?

The Model Context Protocol (MCP) is an open-source standard for connecting AI applications to external data and tools. A store can expose tools such as product search or cart creation through an MCP server, and any MCP client can call them.

MCP has no commerce rules of its own. UCP and ACP both offer MCP as a transport, so MCP is often the wire a commerce protocol travels on rather than an alternative to one.

How do the protocols fit together?

The protocols stack by layer rather than compete one-to-one:

• Discovery: an ACP product feed, UCP catalog capability, or MCP tools that search the catalog.
• Checkout: ACP checkout sessions or the UCP checkout capability.
• Payment: the ACP Delegated Payment Spec, or AP2 mandates under UCP.
• Transport: REST, MCP, or A2A carries the calls.

A store that wants to sell in both ChatGPT and Google AI Mode implements ACP and UCP side by side. Both map onto the same cart, order, and payment logic in the backend.

Where does Medusa fit for each protocol?

Medusa is an open-source commerce platform whose cart, order, and payment modules can sit behind any of these protocols. For ACP, Medusa has an official guide with example code that builds the feed, the checkout session routes, and order webhooks. The guide's feed upload step is a stub you complete after OpenAI approval.

UCP and AP2 have no Medusa guide yet, so you build them as custom API routes and workflows. The Medusa MCP server on Medusa Cloud is read-only and serves store operators, not shopping agents.

When is Medusa not the right choice?

• You want agent checkout channels managed for you with no code. Shopify documents UCP-based agent tools for its merchants on shopify.dev.
• You have no developer to implement and maintain protocol endpoints.