Security audit
Security checks for vulnerabilities and agentic risk
This is a non-executable guide, but it asks for payment and signing credentials and includes runnable examples against live commerce and payment APIs.
Install only if you want a guide that includes live commerce integration examples. Do not provide production Stripe keys, signing keys, OAuth tokens, wallet credentials, or merchant credentials just to read it. If you test the code, use sandbox accounts, fake data, tightly scoped test keys, and review each endpoint before running any snippet.
def acp_transaction() -> bool:
"""Simulate a complete ACP checkout transaction."""
# Create checkout session
session = requests.post(
"https://api.stripe.com/v1/acp/checkout/sessions",
json={
"product_id": "prod_benchmark_001",ACP_API = "https://api.stripe.com/v1/acp"
# Register a product in the ACP catalog
product = requests.post(f"{ACP_API}/products", json={
"name": "Code Review Agent",
"description": "Automated code review with security analysis",
"price": {"amount": 500, "currency": "usd"}, # $5.00}, headers={"Authorization": "Bearer sk_live_xxx"})
# Agent-side: initiate checkout
session = requests.post(f"{ACP_API}/checkout/sessions", json={
"product_id": product.json()["id"],
"buyer_agent_id": "agent-buyer-123",
"success_url": "https://myagent.example.com/success",MPP_API = "https://api.visa.com/mpp/v1"
# Provision a virtual card for the agent
vcn = requests.post(f"{MPP_API}/virtual-cards", json={
"agent_id": "agent-procurement-001",
"funding_source": "card_fund_src_abc123",
"spending_limit": {"amount": 10000, "currency": "USD", "period": "monthly"},}, headers={"Authorization": "Bearer visa_api_key"})
# Generate a one-time payment token
token = requests.post(f"{MPP_API}/tokens", json={
"virtual_card_id": vcn.json()["id"],
"amount": 25.00,
"currency": "USD",UCP_API = "https://api.ucp-protocol.org/v1"
# Register a service in the UCP registry
service = requests.post(f"{UCP_API}/services", json={
"agent_id": "ucp:agent:data-analysis-001",
"name": "Financial Data Analysis",
"capabilities": ["time_series_analysis", "anomaly_detection", "forecasting"],}, headers={"Authorization": "Bearer ucp_key_xxx"})
# Initiate a payment using the cheapest available rail
payment = requests.post(f"{UCP_API}/payments", json={
"service_id": service.json()["id"],
"buyer_agent_id": "ucp:agent:buyer-456",
"amount": "2.50",VISA_TAP_API = "https://api.visa.com/tap/v1"
# Register an agent and receive a cryptographic identity
agent_identity = requests.post(f"{VISA_TAP_API}/agents", json={
"organization_id": "org_acme_corp_123",
"agent_name": "procurement-agent-001",
"authorization_scope": {signing_key = agent_identity.json()["signing_key"]
# Make a payment with cryptographic agent attestation
payment = requests.post(f"{VISA_TAP_API}/payments", json={
"agent_id": agent_id,
"attestation": sign_transaction(signing_key, {
"amount": 150.00,AP2_API = "https://agentpayments.googleapis.com/v1"
# Step 1: User creates a spending mandate for their agent
mandate = requests.post(f"{AP2_API}/mandates", json={
"user_id": "user:google:jane.doe@gmail.com",
"agent_id": "agent:acme:shopping-assistant-001",
"scope": {mandate_signature = mandate.json()["cryptographic_signature"]
# Step 2: Agent executes a payment using the mandate
payment = requests.post(f"{AP2_API}/payments", json={
"mandate_id": mandate_id,
"mandate_signature": mandate_signature,
"agent_id": "agent:acme:shopping-assistant-001",ACP_API = "https://api.stripe.com/v1/acp" # Reference implementation
# Publish a product catalog
catalog = requests.post(f"{ACP_API}/catalogs", json={
"merchant_id": "merchant_code_review_co",
"products": [
{}, headers={"Authorization": "Bearer sk_live_xxx"})
# Agent creates a cart and checks out
cart = requests.post(f"{ACP_API}/carts", json={
"catalog_id": catalog.json()["id"],
"items": [
{"product_id": "prod_security_audit", "quantity": 1,}, headers={"Authorization": "Bearer sk_live_xxx"})
# Initiate checkout
checkout = requests.post(f"{ACP_API}/checkout", json={
"cart_id": cart.json()["id"],
"payment_method": "card",
"return_url": "https://agent-buyer.example.com/callback",PAYPAL_AR_API = "https://api.paypal.com/v2/agent-ready"
# Enable Agent Ready for an existing PayPal merchant
config = requests.post(f"{PAYPAL_AR_API}/merchants/configure", json={
"merchant_id": "paypal_merchant_xyz",
"supported_protocols": ["x402", "openai_acp", "google_ap2", "visa_tap"],
"auto_accept_agents": True,UCP_API = "https://commerce.googleapis.com/ucp/v1"
# Syndicate a product catalog (merchant-side)
catalog = requests.post(f"{UCP_API}/catalogs/sync", json={
"merchant_id": "shopify:my-store-123",
"sync_source": "shopify", # Also supports: "manual", "etsy", "custom"
"filters": {}, headers={"Authorization": "Bearer merchant_oauth_token"})
# Agent searches for products across UCP-connected merchants
search = requests.post(f"{UCP_API}/products/search", json={
"query": "noise-canceling wireless headphones",
"filters": {
"price_range": {"min": "50.00", "max": "150.00", "currency": "USD"},# merchant_id, images, structured_attributes, reviews_summary
# Agent creates an order
order = requests.post(f"{UCP_API}/orders", json={
"agent_id": "agent:acme:shopping-assistant-001",
"items": [
{return False # Should have gotten 402
# Step 2: Pay through facilitator (simulated)
pay_resp = requests.post(f"{FACILITATOR}/pay", json={
"amount": "0.005",
"address": resp.headers["X-PAYMENT-ADDRESS"],
})def acp_transaction() -> bool:
"""Simulate a complete ACP checkout transaction."""
# Create checkout session
session = requests.post(
"https://api.stripe.com/v1/acp/checkout/sessions",
json={
"product_id": "prod_benchmark_001",Eleven competing protocols now claim to be the standard for agent commerce: x402, ACP (Agentic Commerce Protocol), AP2 (Agent Payments Protocol), MPP (Machine Payment Protocol), TAP (Trusted Agent Protocol), UCP (Universal Commerce Protocol), MCP (Model Context Protocol), Google's A2A, Visa TAP (Trusted Agent Protocol), Google AP2 (Agent Payments Protocol), OpenAI ACP (Agentic Commerce Protocol), PayPal Agent Ready, and Google UCP (Universal Commerce Protocol). Q1 2026 detonated what was already a crowded field -- five major protocols launched in a single quarter, backed by Google, OpenAI, Visa, PayPal, Shopify, Walmart, and dozens of other heavyweights. If you are building an agent commerce system in 2026, this is the most consequential architectural decision you will make. Pick wrong and you are locked into a dying standard with a shrinking ecosystem, incompatible partners, and migration costs that compound with every month of development. Pick right and you inherit network effects -- more counterparties, better tooling, cheaper integrations, and a protocol governance body that evolves in your direction. Pick poorly enough and you rewrite your entire commerce layer eighteen months from now, which is what happened to teams that went all-in on SOAP in 2005 or GraphQL subscriptions in 2019. The problem is that no comprehensive comparison exists. You will find marketing pages from each protocol's backers, blog posts that compare two protocols at a time, and Twitter threads with strong opinions and no benchmarks. What you will not find is a single document that evaluates all protocols against the same criteria, with real latency measurements, cost calculations, migration path analysis, and production-tested code for hedging your bets across multiple protocols simultaneously. This guide provides exactly that. It includes a feature-by-feature comparison matrix, benchmark data from test deployments against live endpoints, step-by-step migration paths between the most comm ...[truncated 25 chars]
No suspicious patterns detected.