Cross-cutting
Library
Specifications, repositories, documentation, talks and research papers for all eight protocols in one searchable list.
261 resources and 171 publications (16 of them grey literature: reports and white papers without peer review, marked with a dashed tag). Every publication was checked against DataCite, Crossref, DOI resolution, arXiv or the publisher page; see the methodology. Exports include only the entries that match the current filters.
432 of 432 entries match.
Matching entries
402Pilot: An x402 Decision Layer for Autonomous Agent Micropayments (external link)
Frames the buyer side of x402 as a decision problem, selecting among payable providers under a finite wallet with feedback only on chosen purchases, and proposes 402Pilot, a protocol-agnostic decision layer instantiated with a payment-aware discounted contextual Thompson-sampling policy. On the 402Pilot-Bench replay benchmark (823 tasks, five provider pipelines, three market regimes) it keeps service quality while spending 39 to 43 percent of the wallet.
A dataset of early blockchain-registered AI agents on Ethereum (external link)
Describes a structured dataset of 10,000 ERC-8004 agents registered on Ethereum mainnet within a defined block range, combining on-chain identity records, minting and transfer events, reputation summaries and feedback records with resolved off-chain metadata, collected through Web3 RPC queries. The companion data are deposited on Harvard Dataverse under DOI 10.7910/DVN/HJZW8Q (a dataset DOI, which the arXiv record lists in place of a paper DOI).
A Decision-Centered Reference Architecture for Trustworthy Agentic Commerce (external link)
A design-science study proposing a protocol-agnostic merchant-side architecture for agentic commerce built around a canonical decision envelope, protected dependency and result hashes, Ed25519 or HMAC authentication, live-request rebinding, a generated-claim gate and eleven semantic invariants, evaluated on an open-source JavaScript implementation with eight scenarios and five ablations; the author lists production security and interoperability as not established.
A Developer's Guide to Trustless AI Agent Identity (external link)
The three registries for builders.
A Finger on the Scale: Covert Policy Steering through Agentic Skills (external link)
Treats reusable agent skills as externalized policies and presents SkillShift, a supply-chain attack that keeps a skill's declared task and output interface while covertly steering decisions toward an undisclosed objective. In agentic commerce and dependency selection it achieved attacker-favored selection rates of 81.33 and 63.33 percent with no utility loss, transferred across backends, and evaded the evaluated scanners.
A Formal Analysis of Agent Payment Protocols (external link)
Cross-protocol formal models.
A Formal Analysis of Agent Payment Protocols (external link)
Models x402, MPP, ACP and AP2, not Agent Pay; useful context.
A Formal Analysis of Agent Payment Protocols (external link)
Tamarin models of ACP, x402, MPP and AP2.
A Formal Analysis of Agent Payment Protocols (external link)
Tamarin models including MPP.
A Formal Analysis of Agent Payment Protocols (external link)
Builds Tamarin models of x402, MPP, ACP and AP2 from their specifications, schemas and reference code using one shared abstraction of the agent payment lifecycle, then asks source-backed verification questions to expose missing bindings and cross-stage correspondences, which it consolidates into 18 security principles. Across 86 verification cases it reproduces 46 known or calibration cases, reports 40 new formal-consistency findings, and validates ten of them against x402 implementations with proofs of concept.
A2ABreak: Systematic Security Analysis of the A2A Protocol (external link)
Extracts a verified finite-state machine (37 states and 76 transitions from 929 formalized statements) from the A2A specification with LLM assistance and reasons over it to find 11 protocol-level vulnerabilities exploitable by specification-compliant adversaries, including cross-client context injection, credential harvesting through identity loss in multi-hop delegation chains, and exfiltration through unattested capability claims.
A402: Binding Cryptocurrency Payments to Service Execution for Agentic Commerce (external link)
Proposes A402, a payment architecture that binds cryptocurrency payments to service execution through Atomic Service Channels and TEE-assisted adaptor signatures, so that payment finalizes only if the requested service is executed and delivered, with a TEE-based liquidity vault aggregating channel settlements on chain. Evaluated against x402 on Bitcoin and Ethereum integrations.
Accountable yet Anonymous AI Agents - Split-Knowledge Binding in National Agent-Identity Layer in China (external link)
Documents a national agent-identity system in China, scheduled for public launch in Q3 2026, in which an agent is bound to a verified legal principal that is not disclosed to business-layer participants and can be re-identified only by compelling two separate government agencies, a mechanism the authors call split-knowledge binding and describe as institutional rather than cryptographic. The paper is a pre-launch v1 and promises post-launch measurements.
ACP changelog folder (external link)
What each dated version changed.
ACP governance (external link)
TSC, SEPs, working groups and the founders' veto.
ACP MCP binding (external link)
Five MCP tools mapped to the checkout operations.
ACP: Shared Payment Tokens, Link Wallets, Agent Checkout (external link)
Merchant surfaces and endpoints.
Adyen agentic payments with UCP (external link)
UCP tokenization handler bound to session and merchant.
Agent Authorization (external link)
Open and closed mandates, delegation models, OpenID4VP, verification order and the four error codes.
Agent Pay for Machines (AP4M) (external link)
The stablecoin side of AP4M. Returns HTTP 403 to automated clients.
Agent-to-Agent Finance: Blockchain Payments and Trust Infrastructure for Autonomous AI Agents (external link)
A chapter-length treatment of agent-to-agent finance as a layer of machine-mediated financial interaction in which agents discover counterparties, express intent, pay and generate auditable evidence, drawing on blockchain agent-to-agent payment work, ERC-8004 registries, provenance-based wallets and official evidence on AI adoption in finance. Its central design question is bounded autonomy.
Agent0 subgraphs live (external link)
Subgraphs on Base, BNB Chain, Ethereum, Monad and Polygon.
agent0-ts repository (external link)
Source of the npm agent0-sdk package.
Agentic AI and Consumer Protection (external link)
An issue paper (published 2026-07-16) asking whether EU consumer law, built on the assumption that a human makes the final purchase decision, is ready for AI shopping agents, and proposing how to adapt it. It is part of CERRE's Regulatory Lab series, which received input from members including Apple, Booking.com and Microsoft.
Agentic AI in Payments: Establishing Interoperable Trust and Control (external link)
A working paper (cover dated September 2026, written by contributors from GLEIF, Curvy Protocol, zERC20, Terminal 3 and an independent expert) arguing that existing law can allocate liability for agent payments but practical proof of delegated authority is missing. It proposes Agent Mandate Credentials anchored in the verifiable LEI to show which organization stands behind an agent and what it may do.
Agentic commerce and the battleground for new payments infrastructure (external link)
Cross-protocol view by central bank staff.
Agentic commerce and the battleground for new payments infrastructure (external link)
Cross-protocol view from central bank staff.
Agentic commerce and the battleground for new payments infrastructure (external link)
A Bank of England staff blog post (2026-05-21) on how agentic commerce could reshape payment design, stressing that deployers stay legally responsible for their agents and asking how existing frameworks apply to card, account-to-account and tokenized rails. Views are the author's, not the Bank's.
Agentic commerce and the battleground for payments infrastructure (external link)
Cross-protocol view including AP2.
Agentic commerce and the battleground for payments infrastructure (external link)
Long-form view that covers ERC-8004 among the payment protocols.
Agentic commerce and the battleground for payments infrastructure (external link)
Places ACP among UCP, AP2, x402 and ERC-8004.
Agentic Commerce Bench: Measuring Fraud Detection for Agents That Spend Money (external link)
Presents a fraud taxonomy for agents with spend authority organized by five observation levels, a benchmark of twenty fraud classes built from production aggregates (1,647 service operations and 1,068 settlements), and gordonguard, an open-source detector stack. Calibrated detectors flag 6.5 percent of clean traffic and leave eight classes at chance, and a median payment of $0.007 makes one human review 143 times costlier than the payment it checks.
Agentic commerce liability is still being written (external link)
No liability shift for agent transactions yet.
Agentic commerce liability is still being written (external link)
An acquirer's analysis (2026-07-30) noting that Visa, Mastercard and American Express have all launched frameworks for agent transactions while the question of who bears the loss in a dispute remains largely open.
Agentic Commerce World: An Auditable and Verifiable Environment for Vibe Commerce (external link)
ACWorld is an environment in which independently controlled buyer and merchant agents transact through a Vibe Commerce Protocol that validates each action before updating shared state and records the interactions for audit. Its benchmark has a 200-task capability track and a 60-task large-catalog track over 785,022 listings; ten models score 65.9 to 85.6 percent and 56.1 to 91.4 percent, and process-level evidence catches errors that final state misses.
Agentic payment protocols compared (external link)
Layer comparison of x402, AP2, MPP and ACP.
Agentic Payment Protocols Compared (external link)
x402, AP2, MPP and ACP by layer.
Agentic Payment Protocols Compared (external link)
x402, AP2, MPP and ACP by layer.
Agentic Payments from the Ground Up: What the Onchain Data Tells Us (external link)
A joint report (summary page last updated 2026-07-14) that splits agentic commerce into agent purchases on behalf of people and small machine-to-machine payments, and measures x402 at about $15.0 million adjusted volume over 109.6 million transactions and MPP at about $25,000 over 115,000 transactions, using Artemis data as of 2026-04-21.
Agentic Settlement Protocol: An Application Profile for Refundable, Delayed-Fulfilment Agent Commerce on Stablecoin Rails (external link)
Proposes the Agentic Settlement Protocol, an application profile over on-chain authorize-and-capture escrow for purchases whose fulfillment is confirmed off-chain, with a three-deadline hold model, a fulfillment-verification ladder, engine-authoritative partial refunds with per-seller exposure controls, and a normative interface that includes an x402 scheme and a vault ABI; it is a design paper instantiated on the XDC Network, with evaluation deferred to follow-up work. The arXiv author metadata splits the first author's name into two single-word entries; it is recorded here as one name, as it appears on the abstract page.
AI Agents in Payments: Applications, Risks and Regulations (external link)
Defines agentic payments as transactions started and completed by AI agents, sets out how they work across retail, e-commerce and decentralized finance, and classifies their technical, legal and societal risks, including liability gaps and regulatory non-compliance.
AI Agents with Decentralized Identifiers and Verifiable Credentials (external link)
Presents a conceptual framework and prototype in which each agent holds a ledger-anchored W3C Decentralized Identifier and third-party-issued Verifiable Credentials, so agents can authenticate and establish cross-domain trust at the start of a dialogue. Evaluation shows feasibility but also limits when the agent's LLM alone controls the security procedures. The arXiv preprint is dated 2025; the ICAART proceedings appeared in 2026.
AI Identity: Standards, Gaps, and Research Directions for AI Agents (external link)
Defines AI identity as the continuous relationship between what an agent is declared to be and what it is observed to do, compares human and AI identity on substrate, persistence, verifiability and legal standing, evaluates current technical and regulatory documents against agent identity requirements, and identifies five structural gaps including recursive delegation accountability and agent identity integrity.
AID-Guard: Stateful Authorization for Delegated Agent Effects (external link)
AID-Guard closes the gap between authorization at admission and the provider effect that follows: it revalidates the approved request and provider state at commit, holds one reservation under ambiguity, and releases a successor only after a terminal result or a certified no-effect, so one approval yields at most one effect across retries and recovery. A prototype was tested against Stripe and Resend provider contracts, with all 210 Stripe trials matching predeclared outcomes.
AIP: Agent Identity Protocol for Verifiable Delegation Across MCP and A2A (external link)
Introduces Invocation-Bound Capability Tokens, an append-only token chain that fuses identity, attenuated authorization and provenance binding, in a compact JWT mode and a chained Biscuit mode with Datalog policies for multi-hop delegation across MCP, A2A and HTTP. Python and Rust implementations add sub-millisecond overhead, and all 600 adversarial attempts were rejected.
An improved sessions experience (external link)
Session v2 gas table: best case 72.1 percent lower, one case 79.4 percent higher.
Announcements (releases and councils) (external link)
Dated log of releases and tech council formation.
AP2 JSON Schemas (external link)
Source for every field table on this page.
AP2 Python SDK README (external link)
MandateClient and ReceiptClient; installed from source, not from PyPI.
AP2 repository (external link)
Specification in docs/ap2/, JSON Schemas, the Python SDK and samples in Python, Go and Android. Compare tags v0.1.0 and v0.2.0.
AP2 v0.2 specification (external link)
Roles, modes, verification rules and dispute evidence. Read this first.
AP2 vs ACP vs x402 (external link)
Reconciliation gap between the protocols.
APEX: Agent Payment Execution with Policy for Autonomous Agent API Access (external link)
APEX adapts HTTP 402-style payment gating to UPI-like real-time fiat rails with a challenge-settle-consume lifecycle, HMAC-signed short-lived tokens, idempotent settlement and policy-governed spend approval; in six scenarios policy enforcement cut spending by 27.3% while blocking all replay and invalid-token attempts.
APort Vault: Benchmarking AI Agent Payment Authorization with the Open Agent Passport (external link)
Replays 4,371 human-written attacks from a capture-the-flag event against a live payment agent across 14 models, five policy levels and two tracks, with and without a deterministic pre-action check implementing the author's Open Agent Passport specification. Transfers to recipients the passport did not permit occurred 140 times in 76,842 model-alone evaluations and zero times in 69,297 behind the layer, while 25,370 legitimate payments still executed.
Attesting Outputs and Delegation Ancestry in Multi-Agent AI Systems (external link)
Designs deployer-side attestations so that, after an incident in a multi-agent workflow, a verifier can tell which deployer released given output bytes and whether each cross-deployer delegation was authorized. It compares a signed linked list, a Merkle chain and a co-signed DAG, and only the co-signed DAG rejects a forged parent link after a child key is compromised.
Authority-Inference Separation in Agentic Finance: First-Line Control, Blockchain Enforcement, and Replayable Assurance (external link)
Develops Authority-Inference Separation, an architecture in which an agent's proposed financial action gains temporary executable authority only after a deterministic control plane validates registered identity, accountable ownership, mandate lineage, policy version and exact economic semantics, with blockchain enforcing granted authority and recording evidence. A 48-fixture prototype rejected all 36 synthetic authorization attacks, and a test of 1,700 Base transactions tied to public x402 facilitator addresses shows that public ledgers evidence settlement but not mandate, accountability or delivery.
Authorization Architectures for Tool-Using AI Agents (external link)
A structured narrative review of 89 sources from 2023 to 2026 on authorization for tool-using agents, organized around a principal hierarchy (human, operator, orchestrator, sub-agent, tool endpoint) and five layers: identity and credential lifecycle, multi-hop delegation and scope propagation, runtime enforcement at policy enforcement points, prompt injection as authorization bypass, and auditability. It derives seven structural requirements and a four-layer reference architecture.
BazaarBench: Delegation Safety in Decentralized C2C Marketplaces Run by LLM Agents (external link)
A simulated consumer-to-consumer marketplace with 100 agents, eBay-derived inventories and reputation-based trust, scoring six failure types across five transaction stages over 357,608 model calls. All five tested models promise the same item to multiple buyers, and under adversarial instructions the share of committed sales completed despite unavailable items or overstated condition rises from 15.4 to 33.4 percent, with most extra earnings coming from goods the sellers never held.
Before the Tool Call: Deterministic Pre-Action Authorization for Autonomous AI Agents (external link)
Characterizes the pre-action authorization problem, enforcing policy on a tool call before it executes, and presents the Open Agent Passport, an open specification and implementation that intercepts tool calls, evaluates a declarative policy and emits signed audit records at a median of 53 ms. In a live adversarial testbed with 4,437 decisions, social engineering succeeded 74.6% of the time under a permissive policy and 0% across 879 attempts under a restrictive one.
Benchmarking Web Agent Safety under E-commerce Deceptive Interfaces (external link)
Introduces WebDecept, a plugin that injects seven deceptive interface patterns (targeted advertisements, domain redirection, shopping manipulation and others) into existing web environments, and evaluates multimodal web agents under them. Agents were highly susceptible to several classes of deception and prompt-based constraints were often insufficient.