x402's official npm packages get 494,987 downloads a week combined (the sum of its five official packages), while AP2 and ACP, the two other protocols racing to become AI-agent payment plumbing, have no official package we could confirm: a gap we measured while building Pink Agentic AI Payments. We publish this as PinkWallet, the company behind Pink; Pink currently runs as a public sandbox with test money and does not integrate with x402, AP2, ACP or L402 today. This post reports numbers; where Pink fits into the picture is one section near the end, flagged clearly.
Three protocols are competing to be the plumbing for AI agents paying for things: x402 (Coinbase, now the x402 Foundation), AP2 (Google's Agent Payments Protocol), and ACP (Stripe and OpenAI's Agentic Commerce Protocol). L402 (Lightning Labs) is the oldest of the bunch, a useful baseline since it predates the "agentic" framing by five years.
Everyone has an opinion about which one wins. Nobody seems to have pulled the public numbers side by side. So on 2026-10-13 we did: GitHub activity, npm/PyPI downloads, MCP Registry server counts, and what each spec actually says about budgets and approval. Full methodology, raw CSV, and a re-runnable script: agent-payment-protocols-tracker.
The table
| Protocol | GitHub stars | Contributors | Commits (90d) | Official npm downloads/week | Official PyPI downloads/month | MCP Registry servers | Facilitators/partners listed |
|---|---|---|---|---|---|---|---|
| x402 | 6,715 | 334 | 278 | 494,987 | 204,765 | 222 | 15 |
| AP2 | 3,226 | 19 | 0 | n/a | n/a | 3 | n/a |
| ACP | 1,571 | 26 | 1 | n/a | n/a | 3 | n/a |
| L402 | 91 | 8 | 0 | n/a | n/a | 5 | 3 |
"n/a" means we could not confirm an official package exists, not that downloads were zero. x402's npm figure is the sum of five official packages in its monorepo (x402, x402-fetch, x402-axios, x402-express, x402-next); the core x402 package alone accounts for 467,272 of that. ACP's MCP Registry count is the manually verified one: the raw search for "ACP" returns 10 distinct server names, but 7 of those are unrelated tools that happen to also abbreviate to "ACP" (an AI social network, a cost-policy tool called "Agentic Control Plane", a coding-agent bridge, an ACPI-tables tool, and so on). Only 3 are genuine Agentic Commerce Protocol integrations: 2 explicitly Stripe/OpenAI-branded, plus one new PayPal-settled ACP checkout sandbox.
Five things that stood out
1. x402 isn't just ahead, it's ahead by an order of magnitude on every metric that measures actual usage. 494,987 npm downloads a week across its five official packages (467,272 of that on the core package alone), 204,765 PyPI downloads a month, 222 MCP servers built on it. AP2 and ACP have zero official packages we could find. Stars are one thing (attention), but downloads are developers actually running the code, and that gap is the real story.
2. AP2 and L402 have had zero commits to their default branch in 90 days. AP2's spec repo (google-agentic-commerce/AP2) last pushed 2026-06-17. That doesn't necessarily mean the protocol is dead, Google could be iterating elsewhere, but as a public signal of active development, it's flat. ACP had exactly 1 commit in the same window.
3. Neither AP2 nor ACP has shipped an official SDK you can npm install or pip install. AP2's code directory has a Python pyproject.toml but it's never been published to PyPI under Google's control (a package squatting the name ap2 on PyPI points to an unrelated repo). ACP's package name (@agentic-commerce-protocol/specification) returns a 404 on the npm registry. If you want to build against either protocol today, you're implementing the spec by hand.
4. "ACP" as a search term is almost unusable without manual cleanup. This is a methodology note, not a protocol criticism: a bare GitHub repo search for "ACP" returns 47,243 hits, nearly all unrelated to Stripe/OpenAI's commerce protocol. We had to switch to the exact phrase "agentic commerce protocol" to get a usable 989-repo count, and manually read all 10 MCP Registry hits to find the 3 real ones. If you're researching this space yourself, budget time for this.
5. L402 is the oldest protocol here (2020) and now the smallest by every GitHub metric: 91 stars, 8 contributors, 0 commits in 90 days. It also has a split-brain problem: there's a second, higher-starred repo (l402-protocol/l402, 227 stars) that calls itself a newer continuation of the same spec. We measured the originating lightninglabs/L402 repo as canonical; the honest answer is L402's combined footprint is probably somewhat larger than what we report, split across two homes.
The line that matters more than any of the numbers
We read all three specs (plus L402) looking for one specific thing: does the protocol define a standing spending budget, a payee rule, or a human-approval step, as opposed to a one-off per-transaction authorization? x402's own spec answers this directly, in its scope section:
"Out of Scope: This specification does not include: ... Client-side budget management"
AP2 comes closest of the three: it defines signed "Mandates" that can carry a per-transaction price ceiling, and it distinguishes "human present" from "human not present" flows. But a Mandate authorizes one cart, not a continuing allowance. ACP defines checkout sessions between an agent, a merchant and a payment processor, nothing about budgets. L402's HTTP 402 challenge/response flow for per-request API payments has no budget or approval concept either.
Here's why that matters practically: if you're the one deciding whether to hand an AI agent a wallet, none of these protocols will stop it from spending more than you intended, paying a payee you didn't approve, or going ahead without a human checking first. They all assume something upstream of the protocol already decided that. That's a real, specific gap, not a vague "needs more guardrails" complaint, and it's documented with exact quotes and sources (not just this one, from x402, AP2, ACP and L402) in WHAT_NONE_DECIDE.md in the repo.
Where Pink fits
This is the part where I disclose fully, again: I work on Pink Agentic AI Payments, an MCP server that checks per-agent budgets, payee rules and human-approval holds before a payment executes. It's the layer these specs explicitly leave out, for payments an agent makes through Pink's own MCP server. To be clear: Pink does not plug into x402, AP2, ACP or L402 today. If you want to see what that budget/approval layer looks like in practice, there's a public sandbox with test money: agentic-sandbox.pinkwallet.com.
Rerun it or correct it
Every number in this post is a row in tracker.csv with a source_url and method column, so you can check our work. collect.py reproduces the GitHub/npm/PyPI/MCP-Registry metrics (GitHub token optional, needed to avoid rate limits):
export GITHUB_TOKEN=ghp_xxx
python3 collect.py > tracker_rerun.csv
If you maintain one of these protocols and a number here is wrong or stale, open an issue with a public source using the correction template and we'll fix it within 7 days.
Full report: github.com/Pink-Agentic-Payments/agent-payment-protocols-tracker
Top comments (1)
Publishing the tracker with source URLs and a correction template is the part that deserves more attention than the numbers, because protocol adoption comparisons usually rot into marketing the moment they leave the vendor's site. The gap between 495K weekly npm downloads and zero official packages for AP2 and ACP reads clearly in practice: teams are not adopting a protocol, they are adopting a vendor's SDK that implements it, and vendor SDKs come with vendor opinions about settlement and reconciliation. The client-side budget management exclusion is also worth lingering on, since that is exactly the layer where compliance teams will demand evidence when an agent spends beyond its mandate.