diff --git a/.github/assets/map.png b/.github/assets/map.png index 60fcf1b..80affb8 100644 Binary files a/.github/assets/map.png and b/.github/assets/map.png differ diff --git a/README.md b/README.md index b5ba2fb..c1242a9 100644 --- a/README.md +++ b/README.md @@ -22,7 +22,7 @@ Agents are the new browsers. Since mid-2025 a dozen open standards have appeared Read it left to right as an agent's visit: find what's offered, use the site, prove who it is, shop, then pay. Orange means real traffic today, plain means early use, and hatched means a draft. -The map: twelve standards in five columns (Find, Act, Identity, Shop, Pay). Web Bot Auth, UCP, ACP and x402 are orange for real traffic; Poppy is hatched as a draft; the rest are early use. +The map: twelve standards in five columns (Find, Act, Identity, Shop, Pay). Web Bot Auth, UCP, ACP and x402 are orange for real traffic; the rest are early use. ## The standards diff --git a/content/guide.json b/content/guide.json index 383411d..4754278 100644 --- a/content/guide.json +++ b/content/guide.json @@ -7,7 +7,7 @@ { "situation": "You have lots of structured content people and agents want to query", "standards": ["nlweb"] }, { "situation": "Your bot visits other sites, or you need to verify bots on yours", "standards": ["web-bot-auth"] }, { "situation": "You want agents to create accounts on your service without a sign-up form", "standards": ["auth-md"] }, - { "situation": "Customers' own agents should sign in and act on their accounts", "standards": ["poppy"], "note": "Track it; Draft 0.1 is from October 9, 2026." }, + { "situation": "Customers' own agents should sign in and act on their accounts", "standards": ["poppy"], "note": "Track it; Draft 0.1 is from October 9, 2026, and 0.2 is in progress." }, { "situation": "You sell goods and want any AI assistant to browse, cart and check out", "standards": ["ucp"] }, { "situation": "You want your products shown in ChatGPT", "standards": ["acp"] }, { "situation": "An agent pays and you need proof a person approved those exact terms", "standards": ["ap2"] }, diff --git a/content/home.json b/content/home.json index 1a7e52d..159379a 100644 --- a/content/home.json +++ b/content/home.json @@ -16,7 +16,7 @@ "patterns": [ { "title": "Platforms move faster than standards bodies.", - "body": "The standards with real traffic are the ones a big platform switched on: Shopify accounts for most of UCP's 15,000+ verified storefronts and puts WebMCP tools on every standard storefront; Visa and Mastercard build on Web Bot Auth; OpenAI pipes ACP feeds into ChatGPT. The drafts with the most impressive partner lists are often the ones with no known deployments." + "body": "The standards with real traffic are the ones a big platform switched on: Shopify accounts for most of the roughly 17,800 stores an independent tracker verified for UCP and puts WebMCP tools on every Liquid storefront; Visa and Mastercard build on Web Bot Auth; OpenAI pipes ACP feeds into ChatGPT. The drafts with the most impressive partner lists are often the ones with the fewest deployments." }, { "title": "Partner lists aren't adoption, and transaction counts aren't commerce.", diff --git a/content/standards/acp.md b/content/standards/acp.md index 7197df4..256f72f 100644 --- a/content/standards/acp.md +++ b/content/standards/acp.md @@ -10,7 +10,7 @@ phrase: Products (and checkout) into ChatGPT analogy: A catalogue mailed straight to your personal shopper, with an optional order form attached. looks_like: Product feeds + checkout endpoints when_to_use: When you want your products shown in ChatGPT, especially if you already use Stripe. -backers: OpenAI + Stripe +backers: OpenAI + Stripe, with Meta on the steering committee reality_check: In production for discovery. The headline feature that launched ACP, buying inside ChatGPT, is exactly the part that was scaled back. links: - label: Specification (GitHub) @@ -24,7 +24,7 @@ related: note: A payment layer that can sit underneath. - id: x402 note: Payment rails like MPP and x402 can sit underneath. -last_verified: "2026-10-11" +last_verified: "2026-10-19" --- ## How it works @@ -35,6 +35,6 @@ Today its main job is discovery: merchants push feeds and promotions so ChatGPT ## Who's behind it -OpenAI and Stripe launched it on September 29, 2025, alongside "Instant Checkout" in ChatGPT. [The spec is still labeled beta](https://github.com/agentic-commerce-protocol/agentic-commerce-protocol); its latest stable version is dated April 17, 2026. +OpenAI and Stripe launched it on September 29, 2025, alongside "Instant Checkout" in ChatGPT. [The spec is still labeled beta](https://github.com/agentic-commerce-protocol/agentic-commerce-protocol); its latest stable version is dated April 17, 2026. [Meta joined its steering committee](https://github.com/agentic-commerce-protocol/agentic-commerce-protocol/blob/main/docs/governance.md) on April 24, 2026; OpenAI and Stripe remain the founding maintainers. On March 24, 2026 OpenAI said it was [expanding ACP to support product discovery](https://openai.com/index/powering-product-discovery-in-chatgpt/), naming Target, Sephora, Nordstrom, Lowe's, Best Buy, The Home Depot and Wayfair as integrated, while checkout moved back to the merchant's side. diff --git a/content/standards/ai-catalog.md b/content/standards/ai-catalog.md index c6e3524..7f9a4a6 100644 --- a/content/standards/ai-catalog.md +++ b/content/standards/ai-catalog.md @@ -4,27 +4,27 @@ full_name: AI Catalog job: find order: 2 status: early -status_note: Draft; MCP Server Cards point to it; small real use +status_note: Draft; MCP Server Cards (final) point to it; small real use tagline: site's AI list phrase: A site's list of its AI offerings analogy: Your site's table of contents for AI. looks_like: /.well-known/ai-catalog.json when_to_use: When you publish that same list for MCP Server Cards and older tools. Serve one file at both addresses. backers: Linux Foundation working group (MCP and A2A communities) -reality_check: Early, with experimental catalogs at GitHub, Buildkite and Hugging Face. The fix is easy, serve the same file at both `ai-catalog.json` and `ard.json`. +reality_check: Early, with live catalogs at GitHub, Buildkite and Hugging Face. ARD tools look for `ard.json` first and may skip the old address, so serve the same file at both `ai-catalog.json` and `ard.json`. links: - label: ai-catalog.io url: https://ai-catalog.io/ - label: Working repository url: https://github.com/Agent-Card/ai-catalog - - label: MCP Server Cards proposal + - label: MCP Server Cards (final) url: https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2127 related: - id: ard note: ARD calls ai-catalog its predecessor. ai-catalog sees itself as the lightweight publishing format; it was split off, not retired. - id: nlweb note: A catalog can list an NLWeb endpoint. -last_verified: "2026-10-11" +last_verified: "2026-10-19" --- ## How it works @@ -37,4 +37,4 @@ A restaurant that works with a booking provider and a jobs provider can list bot It's developed in a [Linux Foundation working repository](https://github.com/Agent-Card/ai-catalog) (started October 2025) with members from the MCP and A2A communities, and published at [ai-catalog.io](https://ai-catalog.io/). Even the group's name is inconsistent: ai-catalog.io calls it the "Agent Card Working Group," while Google thanks the "AI Catalog Working Group." -Its biggest recent boost: [MCP's "Server Cards" proposal](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2127) points discovery at `ai-catalog.json` (reported as finalized October 6, 2026, though one implementer still saw it in review). ARD calls ai-catalog its predecessor, but ai-catalog sees itself as a lightweight publishing format that stays separate: it was split off, not retired. +Its biggest recent boost: [MCP's "Server Cards" proposal](https://github.com/modelcontextprotocol/modelcontextprotocol/pull/2127) points discovery at `ai-catalog.json`; it was [marked final](https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/seps/2127-mcp-server-cards.md) on October 6, 2026. ARD calls ai-catalog its predecessor, but ai-catalog sees itself as a lightweight publishing format that stays separate, loosely linked to ARD for now: it was split off, not retired. diff --git a/content/standards/ap2.md b/content/standards/ap2.md index ed4373f..ed92d6a 100644 --- a/content/standards/ap2.md +++ b/content/standards/ap2.md @@ -26,21 +26,20 @@ related: note: AP2 authorizes a payment; it can settle through x402. - id: mpp note: Another way to actually move the money. -last_verified: "2026-10-11" +last_verified: "2026-10-19" --- ## How it works -When an agent pays, the bank and merchant need answers to "did a real person agree to this?" and "who's liable if it goes wrong?" AP2 answers with *mandates*, tamper-proof signed records of your instructions: +When an agent pays, the bank and merchant need answers to "did a real person agree to this?" and "who's liable if it goes wrong?" AP2 answers with *mandates*, tamper-proof signed records of your instructions. [Version 0.2](https://ap2-protocol.org/) has two kinds: -- An **intent mandate** captures what you asked for ("concert tickets, under $200, this week"). -- A **cart mandate** locks the exact items and price. -- A **payment mandate** tells the card network an agent was involved. +- A **checkout mandate** covers what you buy. While it is *open*, it holds your limits ("concert tickets, under $200, this week"). Once *closed*, it locks the exact items and price the merchant signed. +- A **payment mandate** covers how you pay: first your budget and card, then the exact amount. It goes to the card network and bank, which are also told an agent was involved. -Version 0.2 adds "Human Not Present" purchases: you pre-sign the rules, and the agent buys later when conditions are met, say when tickets go on sale at 3 a.m. It works with cards, bank transfers and stablecoins. AP2 authorizes payments; it doesn't process them. +Version 0.2 adds "Human Not Present" purchases: you pre-sign the rules, and the agent buys later when conditions are met, say when tickets go on sale at 3 a.m. Today it supports cards. Bank transfers and digital currencies are on the roadmap, and a sample shows payment through x402. AP2 authorizes payments; it doesn't process them. ## Who's behind it Google announced it on September 16, 2025 with more than 60 organizations, including American Express, Coinbase, Mastercard, PayPal and Salesforce. On April 28, 2026 Google [released v0.2](https://github.com/google-agentic-commerce/AP2) and [handed AP2 to the FIDO Alliance](https://blog.google/products-and-platforms/platforms/google-pay/agent-payments-protocol-fido-alliance/) (the group behind passkeys), which [formed working groups](https://fidoalliance.org/fido-alliance-to-develop-standards-for-trusted-ai-agent-interactions/) chaired by members from Google, OpenAI, CVS Health, Visa and Mastercard. -Mastercard's Verifiable Intent, a similar auditable record of what a user approved, co-developed with Google, went to FIDO at the same time. FIDO's work is only months old, so v0.2 isn't yet a FIDO-approved standard. +Mastercard's Verifiable Intent, a similar auditable record of what a user approved, co-developed with Google, went to FIDO at the same time. In September 2026 FIDO put the AP2 and Verifiable Intent specs in a public repository for review, and [aims to merge them](https://www.w3.org/2026/09/ecommerce-agents/slides/Jean_Luc_Di_Manno_FIDO.pdf) and publish a first FIDO version in mid-2027. Until then, v0.2 isn't a FIDO-approved standard. diff --git a/content/standards/ard.md b/content/standards/ard.md index a2c9c6a..ab5901a 100644 --- a/content/standards/ard.md +++ b/content/standards/ard.md @@ -11,18 +11,18 @@ analogy: A search engine for agent tools. looks_like: /.well-known/ard.json when_to_use: When you offer APIs, MCP servers or agents and want agent search registries to find them. backers: Google-led authors (Google, Hugging Face, R.V. Guha) -reality_check: Early. [Hugging Face runs a public registry](https://huggingface.co/blog/agentic-resource-discovery-launch), but one independent check in June found that none of the named contributor companies served a catalog yet. +reality_check: Early. [Hugging Face runs a public registry](https://huggingface.co/blog/agentic-resource-discovery-launch), and Hugging Face and GitHub now publish catalogs, though GitHub's is only at the older `ai-catalog.json` address. According to [an independent sweep in September 2026](https://github.com/Agent-Card/ai-catalog/issues/115), only 24 of 102 publishers could be found at `ard.json`; the other 78 used only `ai-catalog.json`. links: - label: Specification (v0.91) url: https://agenticresourcediscovery.org/spec/ - label: Google's announcement url: https://developers.googleblog.com/announcing-the-agentic-resource-discovery-specification/ - - label: Hugging Face registry + - label: Hugging Face registry launch url: https://huggingface.co/blog/agentic-resource-discovery-launch related: - id: ai-catalog note: Its predecessor, now the publishing format. ARD is the discovery format. Serve the same file at both addresses. -last_verified: "2026-10-11" +last_verified: "2026-10-19" --- ## How it works @@ -33,6 +33,6 @@ Separate "registries" collect these files and answer plain-language searches. Sa ## Who's behind it -[Google announced ARD](https://developers.googleblog.com/announcing-the-agentic-resource-discovery-specification/) on June 17, 2026. The [current version is v0.91](https://agenticresourcediscovery.org/spec/), a "Proposal" dated August 26, 2026, from authors at Google and Hugging Face plus R.V. Guha (the creator of RSS and Schema.org). +[Google announced ARD](https://developers.googleblog.com/announcing-the-agentic-resource-discovery-specification/) on June 17, 2026. The [current version is v0.91](https://agenticresourcediscovery.org/spec/), a "Proposal" dated August 26, 2026, from authors at Google and Hugging Face plus R.V. Guha (who helped create RSS and Schema.org). -It tells agents to look for `ard.json` first and treats the older `ai-catalog.json` address as its predecessor. On July 9, 2026 the two formally split into a *publishing* format (ai-catalog) and a *discovery* format (ARD). The file name changed within a few months, so early tutorials already show the old address. +It tells agents to look for `ard.json` first and treats the older `ai-catalog.json` address as its predecessor. At a meeting on July 9, 2026 the two groups agreed to keep them [loosely linked, at least for now](https://github.com/ards-project/ard-spec/blob/main/adr/0010-ard-and-ai-catalog-loose-coupling.md): ai-catalog is the *publishing* format and ARD is the *discovery* format. The ARD project recorded this as a formal decision on October 11, 2026. The file name changed within a few months, so early tutorials already show the old address. diff --git a/content/standards/auth-md.md b/content/standards/auth-md.md index c9b1d15..24422cc 100644 --- a/content/standards/auth-md.md +++ b/content/standards/auth-md.md @@ -23,7 +23,7 @@ related: note: Poppy signs in existing customers. auth.md signs up new ones. - id: web-bot-auth note: Web Bot Auth proves which bot is asking. auth.md creates the account it acts for. -last_verified: "2026-10-11" +last_verified: "2026-10-19" --- ## How it works @@ -33,14 +33,14 @@ When your agent needs a service you've never used, it hits a wall built to keep Ask a coding agent to add web scraping to your app, and it calls the scraping service, gets "401: who are you?" plus a pointer to the service's login details and auth.md file, then signs you up one of three ways: - **Vouched for:** the company running the agent signs a short-lived pass saying "this is a verified user" and registration finishes on its own. -- **By email:** you type a 6-digit code on the service's own page. +- **By email:** the agent gives you a short code and a link. You sign in on the service's own page and type the code. - **Anonymously:** the agent starts with limited access and you "claim" the account later. Either way, it ends with a normal, short-lived, revocable OAuth token tied to you. ## Who's behind it -[WorkOS](https://workos.com/auth-md), an identity company, published it as an [open, MIT-licensed spec](https://github.com/workos/auth.md) on May 21, 2026 and shipped [six versions in three weeks](https://github.com/workos/auth.md/blob/main/CHANGELOG.md), reaching v0.6.0 on June 10. It isn't with any standards body; [WorkOS's own recap](https://workos.com/blog/agent-registration-with-auth-md) calls it "a spec, not an IETF-ratified standard." It's built from existing parts: OAuth's login-discovery files, and a vouching token ("ID-JAG") that is itself a draft in the IETF's OAuth working group. +[WorkOS](https://workos.com/auth-md), an identity company, published it as an [open, MIT-licensed spec](https://github.com/workos/auth.md) on May 21, 2026 and shipped [six versions in three weeks](https://github.com/workos/auth.md/blob/main/CHANGELOG.md), reaching v0.6.0 on June 10. It isn't with any standards body; [WorkOS's own recap](https://workos.com/blog/mcp-night-4-recap-auth-md-agentic-registration) calls it "a spec, not an IETF-ratified standard." It's built from existing parts: OAuth's login-discovery files, and a vouching token ("ID-JAG") that is itself a draft in the IETF's OAuth working group. On August 4, 2026 WorkOS [built it into AuthKit](https://workos.com/changelog/agent-registration), its sign-in product, so AuthKit customers can turn it on from the dashboard. WorkOS lists 15 adopters, and implementations vary a lot: [Neon](https://neon.com/auth.md) lets an agent spin up a temporary database the person claims within 72 hours; [Cloudinary](https://cloudinary.com/auth.md) does the same with a temporary media cloud claimable within 24 hours; [monday.com](https://monday.com/auth.md) has the agent solve a captcha and then creates the account; [Firecrawl](https://www.firecrawl.dev/auth.md) only accepts identities vouched for by WorkOS; Cloudflare and Resend said "not yet" at last check. Several follow the idea more than the exact spec. diff --git a/content/standards/mpp.md b/content/standards/mpp.md index ed8fd78..855141c 100644 --- a/content/standards/mpp.md +++ b/content/standards/mpp.md @@ -13,26 +13,26 @@ when_to_use: When agents pay per call or by the minute and you want cards and st backers: Stripe + Tempo reality_check: Early use, live on Tempo. Unlike x402, no neutral foundation owns it; it's written and maintained by two companies with a commercial stake. links: - - label: mpp.dev - url: https://mpp.dev/ - label: IETF draft (-01) url: https://datatracker.ietf.org/doc/draft-httpauth-payment/01/ + - label: mpp.dev + url: https://mpp.dev/ related: - id: x402 note: MPP now accepts x402's simplest payment flow, so the two are more compatible than competing. - id: ap2 note: AP2 records what a person approved; MPP moves the money. -last_verified: "2026-10-11" +last_verified: "2026-10-19" --- ## How it works Paying for an online service usually means signing up, getting a key and setting up billing, which an autonomous agent can't easily do. MPP uses the web's long-unused "402 Payment Required" code: the server replies "this costs 2 cents, here's how to pay," the client pays, and the server returns the result plus a receipt. -It supports one-off charges, subscriptions and streaming pay-as-you-go "sessions," with stablecoins on Stripe's Tempo blockchain or ordinary cards through Stripe. Picture a research agent paying a fraction of a cent per article from a paywalled archive and settling the total when it finishes. +It supports one-off charges, subscriptions and streaming pay-as-you-go "sessions," with stablecoins on the Tempo blockchain or ordinary cards through Stripe. Picture a research agent paying a fraction of a cent per article from a paywalled archive and settling the total when it finishes. ## Who's behind it [Stripe and Tempo launched it](https://mpp.dev/) on March 18, 2026, the same day Tempo's payments blockchain went live. Its core spec is an IETF Internet-Draft ([draft-httpauth-payment-01](https://datatracker.ietf.org/doc/draft-httpauth-payment/01/), September 9, 2026), but an *individual* one: the IETF lists it as having no formal standing, and no working group has taken it on. -The ecosystem is growing (Circle drafted a USDC payment method), and MPP now accepts x402's simplest payment flow from the same toolkit. +The ecosystem is growing: Circle drafted a [USDC payment method](https://paymentauth.org/draft-usdc-charge-00.html) and Visa drafted a [card method](https://paymentauth.org/draft-card-charge-00.html). MPP now accepts x402's simplest payment flow from the same toolkit. diff --git a/content/standards/nlweb.md b/content/standards/nlweb.md index f73223a..465fb0e 100644 --- a/content/standards/nlweb.md +++ b/content/standards/nlweb.md @@ -12,11 +12,13 @@ when_to_use: When you have lots of structured content and want people and agents backers: Microsoft (R.V. Guha) reality_check: Early. Nobody publishes a deployment count, partly because NLWeb has no fixed address to crawl. links: + - label: Specification (v0.55) + url: https://nlweb.ai/docs/specification - label: Source code url: https://github.com/nlweb-ai/NLWeb - label: Microsoft's announcement url: https://news.microsoft.com/source/features/company-news/introducing-nlweb-bringing-conversational-interfaces-directly-to-the-web/ - - label: Cloudflare one-click setup + - label: Cloudflare setup url: https://developers.cloudflare.com/ai-search/how-to/nlweb - label: W3C community group url: https://www.w3.org/community/nlweb @@ -25,14 +27,14 @@ related: note: WebMCP works inside the browser page. NLWeb is an endpoint on your server. - id: ai-catalog note: An AI catalog (or ARD file) can list your NLWeb endpoint. -last_verified: "2026-10-11" +last_verified: "2026-10-19" --- ## How it works Most websites already describe their content in structured ways (Schema.org tags, RSS feeds), yet you can still only search them with keywords. NLWeb indexes that structured data and adds an "ask" endpoint: type "vegetarian recipes under 30 minutes without nuts" and get answers drawn only from that site. -Every NLWeb site is also an MCP server, so AI agents can ask the same questions through a standard plug. [Cloudflare offers a one-click "NLWeb Website" option](https://developers.cloudflare.com/ai-search/how-to/nlweb) that crawls your site and sets up an `/ask` page for people and an `/mcp` endpoint for agents. +Every NLWeb site is also an MCP server, so AI agents can ask the same questions through a standard plug. [Cloudflare offers an "NLWeb Website" option](https://developers.cloudflare.com/ai-search/how-to/nlweb), in public preview, that crawls your site and sets up an `/ask` page for people and an `/mcp` endpoint for agents. ## Who's behind it diff --git a/content/standards/poppy.md b/content/standards/poppy.md index 1f857bc..7a1c08a 100644 --- a/content/standards/poppy.md +++ b/content/standards/poppy.md @@ -3,46 +3,48 @@ name: Poppy full_name: Personal Agent Protocol (PAP) job: identity order: 2 -status: draft -status_note: Draft 0.1 (Oct 9, 2026); no known deployments +status: early +status_note: Draft 0.1 (Oct 9, 2026), 0.2 in progress; a few small deployments tagline: acts as you phrase: Your agent signs in to a company as you analogy: A valet key for your personal agent. looks_like: /.well-known/poppy.json when_to_use: When customers' own agents should sign in and act on their accounts. Track it; it's a fresh draft. -backers: Sierra + Meta; 6 launch and 35 design partners -reality_check: A draft first published October 9, 2026. Impressive partners, but no company is publicly known to serve a working `poppy.json` yet. +backers: Sierra + Meta; 7 launch and 35 design partners +reality_check: A draft first published October 9, 2026. A few small companies serve a `poppy.json`, including [Salespeak](https://salespeak.ai/agent-endpoint/), [Lorikeet](https://www.lorikeetcx.ai/blog/personal-agent-protocol) and [Ticket Fairy](https://www.ticketfairy.com/.well-known/poppy.json), most for signed-out chats only. None of the launch partners does yet. links: - label: Specification (Draft 0.1) + url: https://personalagentprotocol.org/docs/0.1/spec + - label: Draft 0.2 (in progress) url: https://personalagentprotocol.org/docs/spec - - label: Open topics - url: https://personalagentprotocol.org/docs/open-topics - - label: Sierra's blog - url: https://sierra.ai/blog + - label: Path to 1.0 (open topics) + url: https://personalagentprotocol.org/docs/path-to-1 + - label: Sierra's Draft 0.1 post + url: https://sierra.ai/blog/poppy - label: Plain-language guide (poppy.ax) url: https://poppy.ax related: - id: web-bot-auth - note: Web Bot Auth proves the bot's identity. Poppy says whom it acts for. + note: Web Bot Auth proves which bot is calling. Poppy also says whom it acts for and what it may do. - id: auth-md note: Poppy signs in existing customers. auth.md signs up new ones. - id: ucp note: Poppy leaves shopping to UCP and ACP, and may overlap with UCP on sign-in. - id: ap2 - note: Payments are not covered yet. Payment consent is left to AP2. -last_verified: "2026-10-11" + note: Payments are not covered yet. Until they are, payment consent needs another protocol, such as AP2. +last_verified: "2026-10-19" --- ## How it works It lets the agent act for you at a company, with only the permissions you gave it, without opening the boot or the glovebox. Right now an AI agent acting for you has two bad options: pretend to be you in a browser, or not get in at all. -Poppy gives the company a file at `/.well-known/poppy.json` that says how agents can start a session, how you sign in, and which web pages, APIs and company agent are available. Sign-in uses OAuth, the familiar "Sign in with..." approval screen: you approve on the company's own page, on another device with a code, or (if the company allows it) the agent signs in for you. +Poppy gives the company a file at `/.well-known/poppy.json` that says how agents can start a session, how you sign in, and which web pages, APIs and company agent are available. Sign-in uses OAuth, the familiar "Sign in with..." approval screen: you approve on the company's own page, on another device with a code, or (if the company allows it) the agent signs in for you. An agent can also start signed out, as a guest. Permissions are simple scopes like "read" and "write," plus custom ones such as "manage saved addresses." You also get a different anonymous ID at each company, so companies can't match you with each other. In the launch demo, Meta's Muse agent found Rocket Mortgage's agent and, with the user's permission, completed a mortgage pre-approval. ## Who's behind it -[Sierra](https://sierra.ai/blog) (led by Bret Taylor and Clay Bavor) and Meta announced it on October 6, 2026, with Genesys, Instinct, Rocket, Shopify, Stripe and Walmart as partners, then [published Draft 0.1](https://personalagentprotocol.org/docs/spec) on October 9 with 35 design partners (reported to include OpenAI, Visa, Mastercard and PayPal). +[Sierra](https://sierra.ai/blog) (led by Bret Taylor and Clay Bavor) and Meta announced it on October 6, 2026. [Sierra published Draft 0.1](https://sierra.ai/blog/poppy) on October 9 with seven launch partners (Genesys, Instinct, NiCE, Rocket, Shopify, Stripe and Walmart) and 35 more design partners, including OpenAI, Visa, Mastercard and PayPal. [Draft 0.2](https://personalagentprotocol.org/docs/changelog) is in progress, with no publication date yet. -The spec warns that any part can change, even in ways that break compatibility, and [lists payments as not yet covered](https://personalagentprotocol.org/docs/open-topics). A reference implementation is promised within about a month. It reuses OAuth, OpenAPI and MCP rather than replacing them. +The spec warns that any part can change, even in ways that break compatibility, and [lists payments as not yet covered](https://personalagentprotocol.org/docs/path-to-1). A reference implementation was promised within about a month of October 9 and isn't out yet. An implementation kit for companies was added on October 17. It reuses OAuth, OpenAPI and MCP rather than replacing them. diff --git a/content/standards/ucp.md b/content/standards/ucp.md index 7cb36eb..bcc634a 100644 --- a/content/standards/ucp.md +++ b/content/standards/ucp.md @@ -11,9 +11,11 @@ analogy: A universal power socket for shopping. Any assistant plugs into any sto looks_like: /.well-known/ucp when_to_use: When you sell goods and want any AI assistant to browse, cart and check out. backers: Google + Shopify, with governing and tech councils -reality_check: In production, and the most real of the twelve. An independent checker counts more than 15,000 verified storefronts, mostly through Shopify. One catch, the August release made 17 breaking changes, so "supports UCP" doesn't tell you which version. +reality_check: In production, and the most real of the twelve. According to an independent tracker, [UCP Checker](https://ucpchecker.com/blog/state-of-agentic-commerce-september-2026), about 17,800 stores had a working UCP profile on September 22, 2026, about 60% of them on Shopify and most of the rest on Wix. One catch is that the [August release](https://github.com/Universal-Commerce-Protocol/ucp/releases/tag/v2026-08-25) lists 11 groups of breaking changes, and about four in ten stores still declare the April version, so "supports UCP" doesn't tell you which version. links: - - label: ucp.dev + - label: Specification (ucp.dev) + url: https://ucp.dev/ + - label: Announcements url: https://ucp.dev/documentation/announcements/ - label: Release v2026-08-25 url: https://github.com/Universal-Commerce-Protocol/ucp/releases/tag/v2026-08-25 @@ -24,7 +26,7 @@ related: note: AP2 plugs in for payment consent; UCP's latest release has an AP2 extension. - id: poppy note: May overlap with UCP on sign-in. -last_verified: "2026-10-11" +last_verified: "2026-10-19" --- ## How it works @@ -35,6 +37,6 @@ Ask Google's AI Mode for waterproof hiking boots under $150, and it compares sev ## Who's behind it -[Google launched it with Shopify](https://ucp.dev/documentation/announcements/) on January 11, 2026, co-developed with Etsy, Wayfair, Target and Walmart. A Governing Council has Google and Shopify as permanent members, and Stripe joined on April 28; a technical council added Amazon, Meta, Microsoft, Salesforce and Stripe in April, and industry councils for food, lodging and payments followed over the summer. A council seat isn't a storefront: Amazon being at the table doesn't mean Amazon sells through UCP. +[Google launched it with Shopify](https://blog.google/products/ads-commerce/agentic-commerce-ai-tools-protocol-retailers-platforms/) on January 11, 2026, co-developed with Etsy, Wayfair, Target and Walmart. A Governing Council has Google and Shopify as permanent members, and Stripe joined on April 28; a technical council added Amazon, Meta, Microsoft, Salesforce and Stripe in April, and [industry councils](https://ucp.dev/documentation/announcements/) for food, lodging and payments followed between July and September. A council seat isn't a storefront: Amazon being at the table doesn't mean Amazon sells through UCP. -The current release, [v2026-08-25](https://github.com/Universal-Commerce-Protocol/ucp/releases/tag/v2026-08-25), added support for more industries and stronger card security. +The current release, [v2026-08-25](https://github.com/Universal-Commerce-Protocol/ucp/releases/tag/v2026-08-25), reorganized the spec so it can grow beyond shopping into food and lodging. It also added grocery features and an extra card check, called 3DS2, where the card's bank confirms the buyer. A first draft for hotel booking followed on September 25, 2026. diff --git a/content/standards/web-bot-auth.md b/content/standards/web-bot-auth.md index 802ab11..347ad83 100644 --- a/content/standards/web-bot-auth.md +++ b/content/standards/web-bot-auth.md @@ -22,8 +22,8 @@ related: - id: auth-md note: auth.md signs up a new user for the agent; Web Bot Auth only proves which bot is asking. - id: x402 - note: Cloudflare pairs them for pay-per-crawl. -last_verified: "2026-10-11" + note: Cloudflare plans to use them together for pay-per-crawl. +last_verified: "2026-10-19" --- ## How it works @@ -38,4 +38,4 @@ It answers *which agent* is visiting, not *whom it represents*; that's Poppy's a Cloudflare proposed it in May 2025. On September 1, 2026 the IETF's webbotauth working group [adopted it as an official working-group draft](https://datatracker.ietf.org/doc/draft-ietf-webbotauth-httpsig-protocol/), written by authors from Cloudflare and Google; it's the group's only adopted document. It's still a draft, not an RFC: adoption isn't approval. -[Visa's Trusted Agent Protocol and Mastercard's Agent Pay build on it](https://blog.cloudflare.com/secure-agentic-commerce/), adding a tag that says whether the agent is browsing or buying, and observers report OpenAI, Cloudflare and DuckDuckGo signing requests today. The next revision is expected to change how the key directory is referenced, so early implementations may need updates. +[Visa's Trusted Agent Protocol and Mastercard's Agent Pay build on it](https://blog.cloudflare.com/secure-agentic-commerce/), adding a tag that says whether the agent is browsing or buying, and observers report OpenAI, Cloudflare and DuckDuckGo signing requests today. The working-group draft has already changed how a request points to its key directory, but [Cloudflare's own checker](https://developers.cloudflare.com/bots/reference/bot-verification/web-bot-auth/) still expects the older format (as of October 8, 2026), so early implementations may need updates. diff --git a/content/standards/webmcp.md b/content/standards/webmcp.md index dcbf84d..a743150 100644 --- a/content/standards/webmcp.md +++ b/content/standards/webmcp.md @@ -3,7 +3,7 @@ name: WebMCP job: act order: 1 status: early -status_note: Draft (Oct 9, 2026); Chrome and Edge trials; live in ChatGPT desktop and Shopify +status_note: Draft (Oct 16, 2026); Chrome and Edge trials; live in ChatGPT desktop and Shopify tagline: page tools phrase: A page hands typed tools to the agent in your browser analogy: A labeled menu of actions for the agent in your browser. @@ -12,7 +12,7 @@ when_to_use: When agents use your site in people's browsers. Add tools to your k backers: W3C Web ML community group; Microsoft and Google editors reality_check: Early use with two big real-world users, ChatGPT's desktop browser and Shopify, while Chrome and Edge are still in trials. links: - - label: Draft (Oct 9, 2026) + - label: Draft (Oct 16, 2026) url: https://webmachinelearning.github.io/webmcp/ - label: Chrome docs url: https://developer.chrome.com/docs/ai/webmcp @@ -22,25 +22,25 @@ related: - id: nlweb note: NLWeb is an endpoint on your server. WebMCP works inside the browser page. - id: ucp - note: Shopify puts WebMCP tools on every standard storefront, next to its UCP support. -last_verified: "2026-10-11" + note: Shopify puts WebMCP tools on every Liquid storefront, next to its UCP support. +last_verified: "2026-10-19" --- ## How it works More and more AI assistants work inside your browser, clicking and typing on the page for you. Today they mostly do it by looking: reading the page's code or a screenshot, guessing which box is "departure date," and hoping the "Book" button didn't move in last week's redesign. -WebMCP lets the site say it plainly. A page registers "tools" in JavaScript (`document.modelContext.registerTool()`) with a name, a plain-English description, the fields it expects and the function that does the work, or tags an existing form with two attributes, `toolname` and `tooldescription`. On a hair-salon site, the agent stops hunting for the calendar widget and calls `book_appointment` with a date, time and service. It all happens in your own tab and signed-in session, so you can watch and step in. +WebMCP lets the site say it plainly. A page registers "tools" in JavaScript (`document.modelContext.registerTool()`) with a name, a plain-English description, the fields it expects and the function that does the work. Chrome also lets a site tag an existing form with two attributes, `toolname` and `tooldescription`, but the draft dropped that form option on October 8, 2026, so JavaScript tools are the safer choice. On a hair-salon site, the agent stops hunting for the calendar widget and calls `book_appointment` with a date, time and service. It all happens in your own tab and signed-in session, so you can watch and step in. -One caveat: a page's tool descriptions are text the AI reads, so a malicious site can try to trick the agent, and Chrome says the defence is the agent's job. +One caveat: a page's tool descriptions are text the AI reads, so a malicious site can try to trick the agent. [Chrome says agents must defend against this](https://developer.chrome.com/docs/agents/security), and [gives sites hints to flag untrusted text](https://developer.chrome.com/docs/ai/webmcp/secure-tools). ## Who's behind it -Microsoft and Google proposed it together in August 2025; the W3C's Web Machine Learning community group took it up that September, with editors from both companies. The current text is a [draft dated October 9, 2026](https://webmachinelearning.github.io/webmcp/) that says plainly it is "not a W3C Standard." +Microsoft and Google proposed it together in August 2025; the W3C's Web Machine Learning community group took it up that September, with editors from both companies. The current text is a [draft dated October 16, 2026](https://webmachinelearning.github.io/webmcp/) that says plainly it is "not a W3C Standard." -[Chrome has been testing it](https://developer.chrome.com/docs/ai/webmcp) in a time-limited "origin trial" (Chrome 149-156) since May 2026; on September 28 [Google asked to extend the trial](http://www.mail-archive.com/blink-dev@chromium.org/msg17568.html) to Chrome 162 because feedback is still changing the API, so there's no ship date. [Edge runs its own trial](https://developer.microsoft.com/en-us/microsoft-edge/origin-trials/trials/0b76fe60-b266-458e-a285-04e375c0c31a) (since Edge 150, through March 30, 2027) and calls it "ready for testing." +[Chrome has been testing it](https://developer.chrome.com/docs/ai/webmcp) in a time-limited "origin trial" (Chrome 149-156) since May 2026; on September 28 [Google asked to extend the trial](http://www.mail-archive.com/blink-dev@chromium.org/msg17568.html) to Chrome 162 because feedback is still changing the API, so there's no ship date. [Edge runs its own trial](https://developer.microsoft.com/en-us/microsoft-edge/origin-trials/trials/0b76fe60-b266-458e-a285-04e375c0c31a) (through March 30, 2027) and [calls it "ready for testing."](https://blogs.windows.com/msedgedev/2026/09/21/new-in-edge-for-developers-create-better-components-and-make-your-site-agent-ready/) -[ChatGPT's desktop browser calls these "site tools"](https://help.openai.com/en/articles/20001423-using-site-tools-in-the-chatgpt-desktop-app) automatically, and [Shopify puts WebMCP tools on every standard storefront](https://shopify.dev/docs/api/web-mcp), including a [checkout tool that only completes after the buyer confirms](https://shopify.dev/docs/agents/carts-and-checkout/checkout-webmcp). [Safari's team opposes it](https://github.com/WebKit/standards-positions/issues/670) and [Firefox is neutral](https://github.com/mozilla/standards-positions/issues/1412). +[ChatGPT's desktop browser calls these "site tools"](https://help.openai.com/en/articles/20001423-using-site-tools-in-the-chatgpt-desktop-app) automatically, and [Shopify puts WebMCP tools on every Liquid storefront](https://shopify.dev/docs/api/web-mcp) (Hydrogen stores can turn them on), including a [checkout tool that agents may only call after the buyer approves the order and total](https://shopify.dev/docs/agents/carts-and-checkout/checkout-webmcp). [Safari's team opposes it](https://github.com/WebKit/standards-positions/issues/670) and [Firefox is neutral](https://github.com/mozilla/standards-positions/issues/1412). ## Neighbours diff --git a/content/standards/x402.md b/content/standards/x402.md index 687d2af..ac26dfd 100644 --- a/content/standards/x402.md +++ b/content/standards/x402.md @@ -10,8 +10,10 @@ analogy: A parking meter on every web page. Drop in a few cents and the gate ope looks_like: 402 Payment Required when_to_use: When you charge per API request in stablecoins, with no accounts or sign-up. backers: Coinbase, now the x402 Foundation (Linux Foundation) -reality_check: In production, but small. Cumulative counts range from about 100 million to more than 200 million transactions, but [CoinDesk (March 11, 2026)](https://www.coindesk.com/markets/2026/03/11/coinbase-backed-ai-payments-protocol-wants-to-fix-micropayment-but-demand-is-just-not-there-yet) found about $28,000 a day of real payments, averaging about 20 cents, with roughly half judged artificial. Cloudflare's "billion 402 responses a day" counts payment *requests*, not payments. Count dollars, not transactions. +reality_check: In production, but small. [TRM Labs (September 9, 2026)](https://www.trmlabs.com/trm-tech-blog/whos-actually-paying-measuring-ai-agent-payments-onchain) counted 198.9 million settlements worth $52.7 million since May 2025. After removing self-payments and similar flows, about $25.6 million looked like real commerce, and only 0.6% to 7.5% of that seemed to come from AI agents. Earlier, [CoinDesk (March 11, 2026)](https://www.coindesk.com/markets/2026/03/11/coinbase-backed-ai-payments-protocol-wants-to-fix-micropayment-but-demand-is-just-not-there-yet) found about $28,000 a day of real payments, averaging about 20 cents. [Cloudflare's "billion 402 responses a day"](https://blog.cloudflare.com/x402/) counts payment *requests*, not payments. Count dollars, not transactions. links: + - label: Specification (V2) + url: https://github.com/x402-foundation/x402/blob/main/specs/x402-specification-v2.md - label: x402 V2 launch url: https://x402.org/x402-v2-launch/ - label: x402 Foundation launch @@ -22,8 +24,8 @@ related: - id: ap2 note: AP2 can settle through x402. - id: web-bot-auth - note: Cloudflare pairs them for pay-per-crawl. -last_verified: "2026-10-11" + note: Cloudflare plans to use them together for pay-per-crawl. +last_verified: "2026-10-19" --- ## How it works @@ -34,4 +36,4 @@ Picture an agent paying a weather API a cent per lookup, or a crawler paying a p ## Who's behind it -Coinbase created it, and [version 2 shipped on December 11, 2025](https://x402.org/x402-v2-launch/). The Linux Foundation announced an x402 Foundation on April 2, 2026 and [made it operational on July 14](https://www.linuxfoundation.org/press/linux-foundation-announces-operational-launch-of-x402-foundation-to-standardize-internet-native-payments-for-ai-agents-and-applications) with 40 members; the 17 premier members include AWS, Google, Visa, Mastercard, American Express, Stripe, Shopify, Cloudflare, Coinbase and Circle, the broadest coalition of any agent-payment standard. +Coinbase created it, and [version 2 shipped on December 11, 2025](https://x402.org/x402-v2-launch/). The Linux Foundation announced an x402 Foundation on April 2, 2026 and [made it operational on July 14](https://www.linuxfoundation.org/press/linux-foundation-announces-operational-launch-of-x402-foundation-to-standardize-internet-native-payments-for-ai-agents-and-applications) with 40 members. It now [lists 57](https://www.x402.org/members); the 19 premier members include AWS, Google, Visa, Mastercard, American Express, PayPal, Stripe, Shopify, Cloudflare, Coinbase and Circle, the broadest coalition of any agent-payment standard.