x402 Crushes AP2 and ACP: A Data-Driven Comparison of AI Payment Protocols

Title

x402 Crushes AP2 and ACP: A Data-Driven Comparison of AI Payment Protocols

Meta Description

x402's five official npm packages hit nearly 500K weekly downloads, while AP2 and ACP have no verifiable official packages. This article compares GitHub activity, download volume, and spec gaps across four AI payment protocols, revealing the budget and approval blind spots in agentic payments.

Article Content

When AI agents spend money on behalf of humans, what protocol settles the transaction underneath? Four contenders—x402, AP2, ACP, and L402—are fighting for this position. Opinions are everywhere, but almost nobody has laid the public data side by side for comparison. The PinkWallet team did exactly that on October 13, 2026: scraping GitHub activity, npm/PyPI download counts, MCP Registry server counts, and going through each specification line by line to compare how they define budgets and approvals. The results point to a rather lopsided landscape.

Data Table: Real Usage Across Four Protocols

Protocol	GitHub Stars	Contributors	90-Day Commits	Official npm Weekly Downloads	Official PyPI Monthly Downloads	MCP Servers	Partners
x402	6,715	334	278	494,987	204,765	222	15
AP2	3,226	19	0	n/a	n/a	3	n/a
ACP	1,571	26	1	n/a	n/a	3	n/a
L402	91	8	0	n/a	n/a	5	3

The meaning of "n/a" in the table needs clarification: it doesn't mean zero downloads, but rather that no official published package can be confirmed to exist. x402's npm figure comes from the sum of five official packages in its monorepo (x402, x402-fetch, x402-axios, x402-express, x402-next), with the core package x402 alone accounting for 467,272. ACP's MCP Registry count was manually verified: a bare search for "ACP" returns 10 results, but 7 of them are unrelated tools that happen to share the ACP abbreviation (an AI social network, a cost-policy tool called "Agentic Control Plane," a coding agent bridge, an ACPI table tool, etc.). Only 3 actually belong to the Agentic Commerce Protocol integration.

x402 is a payment protocol open-sourced by Coinbase in May 2025. It revives the 402 Payment Required status code that HTTP had long reserved but never actually implemented, allowing APIs or content services to attach a payment requirement when returning a 402, and clients retry the request after completing payment in cryptocurrency (mainly USDC on Base and other L2 networks). Its design goal is to make machine-to-machine micropayments require no account, no subscription, and no human intervention—naturally suited to pay-per-use, log-style billing scenarios. The reason it dominates npm downloads is largely that it's the only one of the four that simultaneously provides an official SDK, middleware (wrappers for Express, Next.js, and other frameworks), and an MCP server implementation—making it the cheapest for developers to integrate. Understanding this is key to understanding why its usage numbers are an order of magnitude higher than the other contenders.

MCP (Model Context Protocol) is an open protocol released by Anthropic in late 2024 to let AI models connect to external tools and data sources in a standardized way; the MCP Registry is a community-maintained server index. How many servers a payment protocol has in the MCP Registry reflects how directly it's integrated into AI agent toolchains, not just how often human developers call it manually. This is exactly why the table lists MCP server count as a separate metric: official npm package downloads measure traditional software integration, while MCP server count measures whether it has truly entered the agent runtime. Looking at both together tells you whether a protocol is still stuck at the documentation and spec level or has been packaged into a plug-and-play capability for agents.

Five Signals Worth Noting

The Usage Gap Is an Order of Magnitude

x402 isn't just leading—it leads by an order of magnitude on every metric that measures real usage. Its five official packages total 495K npm downloads per week, 205K monthly PyPI downloads, and 222 MCP servers built on top of it. AP2 and ACP have no confirmable official packages. Stars reflect attention; download counts reflect whether developers are actually running the code—and the latter is the core of this story.

AP2 and L402 Have Zero Commits in the Last 90 Days

AP2's spec repository (google-agentic-commerce/AP2) last saw a push on June 17, 2026. This doesn't necessarily mean the protocol is dead—Google may be iterating elsewhere—but as a public activity signal, it's flat. ACP had only 1 commit in the same window.

Neither AP2 nor ACP Has an Installable Official SDK

AP2's code directory contains a Python pyproject.toml, but it was never published to PyPI under Google's control (the package occupying the ap2 name on PyPI points to an unrelated repository). ACP's package name @agentic-commerce-protocol/specification returns a 404 on the npm registry. If you want to build on either of these protocols today, you can only hand-implement from the spec.

"ACP" Is Nearly Useless as a Search Term

This is a methodology reminder, not a criticism of the protocol: a bare GitHub search for "ACP" returns 47,243 results, the vast majority unrelated to Stripe/OpenAI's commerce protocol. You have to switch to the exact phrase "agentic commerce protocol" to get a usable count of 989 repositories, and the 10 MCP Registry results also need to be read manually one by one. If you're researching this space yourself, budget time for this.

L402 Is the Oldest but Smallest, and Has a Fork Problem

L402 is the oldest protocol here (2020) and is now the smallest on every GitHub metric: 91 stars, 8 contributors, zero commits in 90 days. It also has a "split-brain" problem—there's a second repository with more stars (l402-protocol/l402, 227 stars) that claims to be a new continuation of the same spec. PinkWallet measured the origin repository lightninglabs/L402 as the canonical one; the honest statement is that L402's combined footprint is likely larger than reported, just split across two places.

The One Line More Important Than Any Number

The research team read through all four specifications, looking for one specific thing: does the protocol define continuous spending budgets, payee rules, or human approval steps—not just authorization for a single transaction?

x402's spec answers this directly in its scope section:

"Out of Scope: This specification does not include: ... Client-side budget management"

AP2 comes closest of the three: it defines signed "Mandates" that can carry a per-item price cap and distinguishes between "human present" and "human not present" flows. But a Mandate authorizes a shopping cart, not a continuous allowance. ACP defines checkout sessions between agents, merchants, and payment processors, with no mention of budgets at all. L402's HTTP 402 challenge/response flow for per-use API payments likewise has no concept of budget or approval.

The practical implication: when you decide whether to give an AI agent a wallet, none of these protocols will stop it from spending more than you expect, paying a payee you haven't approved, or continuing without human confirmation. They all assume someone upstream has already made that decision. This is a concrete, documentable gap—not a vague "we need more guardrails" complaint.

The distinction between "single-transaction authorization" and "continuous spending budget" is key to understanding the entire payment authorization system. Traditional credit card or API key authorization is essentially an allow-or-deny on one specific request; but when an agent operates autonomously, it needs to initiate multiple payments in succession without human confirmation for each one. This requires the system to maintain an allowance state that spans time and transactions, along with payee whitelists and amount caps. The scope and token expiration mechanisms in OAuth 2.0, and the "merchant category code + per-transaction limit" in the card system, follow this line of thinking—but they all assume a human is in the authorization loop. All four protocols currently only handle "should this one transaction go through," leaving "how much can be spent in total over this period, and to whom" for an upstream system to solve. This is precisely the substance of the gap pointed out in this article.

Pink's Position

Another disclosure is needed: the author works at Pink Agentic AI Payments, an MCP server that checks each agent's budget, payee rules, and human approval pending status before executing a payment. It's exactly the layer these specifications explicitly exclude, for payments initiated through Pink's own MCP server. To be clear: Pink currently does not integrate with x402, AP2, ACP, or L402. If you want to see what the budget/approval layer actually looks like, there's a public sandbox using test currency.

Reproduce It Yourself or Submit Corrections

Every number in the article is a row in tracker.csv, with source_url and method columns, so you can verify it. collect.py reproduces the GitHub/npm/PyPI/MCP Registry metrics (the GitHub token is optional, used to avoid rate limiting):

export GITHUB_TOKEN=ghp_xxx
python3 collect.py > tracker_rerun.csv

If a protocol maintainer finds data that's wrong or outdated, they can submit an issue with public sources, and the team commits to correcting within 7 days.

One-line Summary

PinkWallet's data comparison shows x402 leads AP2/ACP/L402 by an order of magnitude in real usage, but none of the four protocols define a budget or approval layer.

Paragraph Summary

On October 13, 2026, the PinkWallet team released a report comparing four AI agent payment protocols—x402, AP2, ACP, and L402—gathering public data including GitHub activity, npm/PyPI downloads, and MCP Registry server counts. Results show x402 leads by an order of magnitude on every real-usage metric: its five official npm packages total 494,987 weekly downloads, 204,765 monthly PyPI downloads, and 222 MCP servers; while AP2 and ACP have no confirmable official packages, and AP2 and L402 have zero commits in the last 90 days. More critically, after reading all four specifications, the team found that none defines continuous spending budgets, payee rules, or human approval steps—x402 even explicitly lists client-side budget management as out of scope. This means these protocols all assume guardrails exist upstream, while this layer is currently a blank—and Pink is aiming precisely at that gap.