PayPal Agentic Commerce vs Visa Intelligent Commerce

Cart

1. ai-native userMy agent can create and update a cart or order draft through a documented protocol call

   weight 3 · round to PayPal Agentic Commerce
   PayPal Agentic Commerce✓fullclaimed8/10

   PayPal documents a concrete, callable cart protocol: POST /merchant-cart createcart to create a cart from a PayPalCart object and getcart to retrieve/update cart status, validation issues, and totals, explicitly invoked by AI agents/PayPal Shopping Cart during checkout; the agent toolkit also exposes create_order and related order-management tools callable by AI agents via MCP/LangChain/etc. Missing for 10: no independent hands-on developer report confirming a live end-to-end agent-driven cart creation/update flow beyond PayPal's own docs, and cart update (vs. only create/get) isn't explicitly documented as a separate call.

   • [claimed-docs] “Creates a new cart with the provided PayPalCart object. This is called by PayPal Shopping Cart when an AI agent or customer initiates a chec…”
   • [claimed-docs] “Retrieves the current state of a cart. Used by PayPal Shopping Cart to check cart status, validation issues, and current totals.”
   • [claimed-docs] “Cart execution is a reverse API the merchant hosts: POST /merchant-cart "Creates a new cart with the provided PayPalCart object. This is cal…”
   • [claimed-docs] “The companion read endpoint keeps agent-side cart state fresh: get cart "Retrieves the current state of a cart. Used by PayPal Shopping Cart…”
   • [claimed-docs] “Post-purchase operations are first-class agent tools: refunds via create_refund / get_refund (a "refund for a captured payment", where "If n…”
   • [claimed-docs] “"PayPal's agent toolkit supports the integration of PayPal APIs into AI agent workflows using" Amazon Bedrock, CrewAI, LangChain, MCP, OpenA…”

   proof ↗⚑ flag

   Visa Intelligent Commerce~partialclaimed6/10

   Visa's REST APIs document creating a purchase-intent (POST /acp/v1/instructions) with mandate fields (amount, merchant, description) that functions like an order/cart draft, and revocation of that intent is documented as a follow-on call — but there is no explicit 'update/modify draft' endpoint, only initiate and cancel actions on the instruction/mandate object. Missing for 10: a documented update/modify-in-place endpoint for an existing cart/order object, and clearer mapping of Visa's 'instruction' concept to a literal cart/order draft rather than a payment-intent mandate.

   • [claimed-docs] “Spend caps live in the purchase-intent mandate: Initiate a Purchase Intent (POST /acp/v1/instructions) exists "to verify that your agent is …”
   • [claimed-docs] “Credentials are scoped to an authenticated instruction: retrieval is POST /acp/v1/instructions/{instructionID}/credentials, and the request …”
   • [claimed-docs] “Capture consumer consent, set spending limits, and manage mandates for agent-initiated payments.”

   proof ↗⚑ flag

Checkout

1. ai-native userMy agent can complete a purchase end-to-end — checkout session, delegated payment credential, confirmed order

   weight 3 · round to Visa Intelligent Commerce
   PayPal Agentic Commerce~partialprobed6/10

   Docs describe a real end-to-end path: agent-initiated checkout session (ACP requestCheckout / UCP checkout-session), a delegated one-time-use payment credential (Braintree nonce / Google Pay token), and order confirmation flowing into the merchant's existing order system, backed by a cart API and agent toolkit tools (create_order, pay_order). However this is gated behind Braintree accounts, PayPal's form-based approval, Google's separate merchant enablement, and Store Sync's narrow scope (US, physical goods only) — all from first-party docs with no independent or hands-on confirmation of a completed purchase. Missing for 10: independent/hands-on evidence of an actual completed agent purchase, broader (non-gated) merchant eligibility, and real-world confirmation beyond sandbox/spec descriptions.

   • [claimed-docs] “The ACP path is an in-ChatGPT checkout build: "Implement an MCP server with the `complete_checkout` tool to receive tokens", "Call `requestC…”
   • [claimed-docs] “The UCP path targets Google surfaces: "This enables AI-powered checkout experiences through Google AI Mode (Gemini), where Google Pay return…”
   • [claimed-docs] “Store Sync is the full-catalog path, "enabling AI agents to discover your products, create and manage shopping carts, and complete purchases…”
   • [claimed-docs] “Cart execution is a reverse API the merchant hosts: POST /merchant-cart "Creates a new cart with the provided PayPalCart object. This is cal…”
   • [claimed-docs] “Post-purchase operations are first-class agent tools: refunds via create_refund / get_refund (a "refund for a captured payment", where "If n…”
   • [claimed-docs] “Access to PayPal's agentic commerce services is form-gated, not self-serve: merchants must complete a form "to contact the AI team at PayPal…”
   • [probe] “PROBE runtime (recorded 2026-09-14): PayPal's remote MCP server is live — a keyless JSON-RPC initialize POST to https://mcp.paypal.com/mcp a…”

   proof ↗⚑ flag

   Visa Intelligent Commerce✓fullclaimed8/10

   Visa's docs describe the full agent-checkout pipeline with concrete REST endpoints: card enrollment/tokenization (POST /acp/v1/tokens), a purchase-intent mandate with spend caps and expiry (POST /acp/v1/instructions), scoped delegated credential retrieval tied to merchant/amount (POST /acp/v1/instructions/{id}/credentials), passkey-based instruction authentication, and authorization-time enforcement plus payment outcome confirmation — covering checkout session, delegated credential, and confirmed order end-to-end. Missing for 10: independent/hands-on evidence of a completed real-world transaction (all evidence is first-party docs) and the product page's own maturity caveat that it is 'in the process of development and deployment'.

   • [claimed-docs] “Agent-scoped credentials are the core primitive: "Provisioning and life cycle management of agent-specific payment tokens that can be used b…”
   • [claimed-docs] “Human approval is passkey-anchored end to end: provisioning includes "step up verification of the cardholder as well as setting up a Passkey…”
   • [claimed-docs] “Spend caps live in the purchase-intent mandate: Initiate a Purchase Intent (POST /acp/v1/instructions) exists "to verify that your agent is …”
   • [claimed-docs] “"Your agents can enroll a customer's card for tokenization during the customer's account registration or when the customer begins a new purc…”
   • [claimed-docs] “Credentials are scoped to an authenticated instruction: retrieval is POST /acp/v1/instructions/{instructionID}/credentials, and the request …”
   • [claimed-docs] “Confirm payment outcomes and trigger post-purchase actions in real-time.”
   • [claimed-docs] “Controls to ensure that the agent’s purchasing actions and the related authorizations align with the user’s authenticated instruction”

   proof ↗⚑ flag

Embedded surfaces

1. merchantBuyers can complete purchases of my products inside chat and assistant surfaces (ChatGPT, Claude, Gemini, Copilot and peers)

   weight 2 · round to PayPal Agentic Commerce
   PayPal Agentic Commerce~partialprobed6/10

   PayPal offers real infrastructure for in-chat checkout: ACP for ChatGPT (via Braintree delegated tokens), UCP for Google AI Mode/Gemini (via Google Pay tokens), and Store Sync for broader catalog/agent discovery, plus an MCP server and agent toolkit. However, coverage is fragmented and gated — Store Sync is US-only, physical-goods-only, and access is form-gated with manual onboarding; ACP/UCP require an existing Braintree relationship or separate Google merchant registration; no evidence of Claude or Copilot checkout support is present. Missing for 10: broader platform coverage beyond ChatGPT/Google (Claude, Copilot), self-serve enablement without form gating, and independent/hands-on confirmation of live buyer transactions completing in-chat.

   • [claimed-docs] “"Agent Ready helps Braintree merchants accept payments from AI shopping assistants across major platforms, including ChatGPT, Google AI Mode…”
   • [claimed-docs] “The ACP path is an in-ChatGPT checkout build: "Implement an MCP server with the `complete_checkout` tool to receive tokens", "Call `requestC…”
   • [claimed-docs] “The UCP path targets Google surfaces: "This enables AI-powered checkout experiences through Google AI Mode (Gemini), where Google Pay return…”
   • [claimed-docs] “Store Sync is the full-catalog path, "enabling AI agents to discover your products, create and manage shopping carts, and complete purchases…”
   • [claimed-docs] “Access to PayPal's agentic commerce services is form-gated, not self-serve: merchants must complete a form "to contact the AI team at PayPal…”
   • [claimed-docs] “Catalog publishing is feed-file based: "PayPal supports 3 feed specifications", including the Google Product Feed ("you can reuse it to powe…”
   • [probe] “PROBE runtime (recorded 2026-09-14): PayPal's remote MCP server is live — a keyless JSON-RPC initialize POST to https://mcp.paypal.com/mcp a…”

   proof ↗⚑ flag

   Visa Intelligent Commerce~partialprobed5/10

   Visa Intelligent Commerce provides the underlying payment rails for agent-initiated purchases (tokenization, mandate/consent controls, passkey step-up auth, Trusted Agent Protocol, and an MCP server for developers to plug into agentic experiences), which is the necessary plumbing for buyers to check out via AI agents. However, the evidence never names or demonstrates live integration with specific chat/assistant surfaces like ChatGPT, Claude, Gemini, or Copilot — it's generic 'agent' infrastructure plus a community-noted MCP server, with the core product itself flagged as still 'in the process of development and deployment.' Missing for 10: explicit evidence of shipped integrations or launch partnerships with ChatGPT/Claude/Gemini/Copilot, and independent confirmation that merchants can actually complete checkout flows inside those named surfaces today.

   • [claimed-docs] “Developers can now connect to Visa Intelligent Commerce APIs through the MCP Server, making it faster and easier for builders to bring intel…”
   • [claimed-docs] “the toolkit helps developers and non-technical users to work with AI agents using plain language — no coding required.”
   • [claimed-docs] “Agent-scoped credentials are the core primitive: "Provisioning and life cycle management of agent-specific payment tokens that can be used b…”
   • [claimed-docs] “Spend caps live in the purchase-intent mandate: Initiate a Purchase Intent (POST /acp/v1/instructions) exists "to verify that your agent is …”
   • [claimed-docs] “"Your agents can enroll a customer's card for tokenization during the customer's account registration or when the customer begins a new purc…”
   • [claimed-docs] “Credentials are scoped to an authenticated instruction: retrieval is POST /acp/v1/instructions/{instructionID}/credentials, and the request …”
   • [probe] “PROBE runtime (recorded 2026-09-14): Visa's developer gateway is live and credential-gated exactly as documented — a keyless GET to https://…”

   proof ↗⚑ flag

Protocol conformance

1. developerBuild against a versioned commerce protocol with a published schema and conformance or validation tooling

   weight 2 · round to Visa Intelligent Commerce
   PayPal Agentic Commerce~partialclaimed4/10

   PayPal does version its agentic-commerce cart API (v1 createcart/getcart) and provides catalog-feed validation tooling for Store Sync ('a validated product catalog file' against Google/OpenAI ACP feed specs), and it interoperates with external versioned protocols (ACP, UCP). But there's no evidence of a published, standalone schema (e.g., OpenAPI/JSON Schema) for PayPal's own agentic-commerce protocol nor a formal conformance/test suite for developers to validate protocol implementations beyond feed-file field checks. Missing for 10: published protocol schema/spec document, dedicated conformance or validation test suite for the cart/checkout API (not just catalog feed format), and independent evidence of developers using such tooling.

   • [claimed-docs] “Creates a new cart with the provided PayPalCart object. This is called by PayPal Shopping Cart when an AI agent or customer initiates a chec…”
   • [claimed-docs] “Retrieves the current state of a cart. Used by PayPal Shopping Cart to check cart status, validation issues, and current totals.”
   • [claimed-docs] “Catalog publishing is feed-file based: "PayPal supports 3 feed specifications", including the Google Product Feed ("you can reuse it to powe…”
   • [claimed-docs] “Cart execution is a reverse API the merchant hosts: POST /merchant-cart "Creates a new cart with the provided PayPalCart object. This is cal…”
   • [claimed-docs] “The companion read endpoint keeps agent-side cart state fresh: get cart "Retrieves the current state of a cart. Used by PayPal Shopping Cart…”

   proof ↗⚑ flag

   Visa Intelligent Commerce~partialclaimed5/10

   Visa publishes detailed REST API docs (endpoints, required fields, sample payloads) for Intelligent Commerce and a public spec with reference implementation for the Trusted Agent Protocol (RFC 9421 signatures, JWKS verification), plus a sandbox for testing. However, there's no evidence of a single unified 'commerce protocol' with an explicit version number, a published machine-readable schema (e.g. OpenAPI/JSON Schema spec file), or dedicated conformance/validation tooling beyond the sandbox and a reference implementation repo. missing for 10: explicit protocol versioning scheme, downloadable/published schema (OpenAPI or similar), dedicated conformance-test suite or validator tool, independent developer corroboration of building against the spec.

   • [claimed-docs] “Spend caps live in the purchase-intent mandate: Initiate a Purchase Intent (POST /acp/v1/instructions) exists "to verify that your agent is …”
   • [claimed-docs] “"Your agents can enroll a customer's card for tokenization during the customer's account registration or when the customer begins a new purc…”
   • [claimed-docs] “Credentials are scoped to an authenticated instruction: retrieval is POST /acp/v1/instructions/{instructionID}/credentials, and the request …”
   • [claimed-docs] “The Trusted Agent Protocol's agent recognition signature is HTTP Message Signatures "defined by RCF 9421" (typo in original), "aligned with …”
   • [claimed-docs] “The TAP spec is public with a runnable reference implementation: "Establishing a universal standard of trust between AI agents and merchants…”
   • [claimed-docs] “Merchant-side onboarding starts with a self-serve "Intelligent Commerce Sandbox Sign up" form (Organization ID, company, contact details, te…”
   • [claimed-docs] “including the cryptographic standards (RFC9421), required message signature fields, and the process for validating an agent's intent.”

   proof ↗⚑ flag

Service discovery

1. ai-native userMy agent can discover payable services and APIs through a published directory or discovery index

   weight 2 · round drawn
   PayPal Agentic Commerce~partialprobed5/10

   PayPal provides discovery mechanisms — Store Sync product-catalog feeds (Google Product Feed / OpenAI ACP Product Feed) that let AI agents 'discover your products' and a live MCP server discoverable via RFC 9728 well-known metadata — but there is no published cross-merchant directory or marketplace index of payable services/APIs; discovery is scoped to a single merchant's catalog after form-gated onboarding, and Store Sync itself is limited to US physical goods only. missing for 10: a cross-merchant/public discovery index of payable services or APIs, evidence of self-serve (non form-gated) discoverability, and support beyond US physical goods.

   • [claimed-docs] “It connects your product catalog and commerce API with PayPal's agentic commerce services, enabling AI agents to discover your products, cre…”
   • [claimed-docs] “Store Sync is the full-catalog path, "enabling AI agents to discover your products, create and manage shopping carts, and complete purchases…”
   • [claimed-docs] “Catalog publishing is feed-file based: "PayPal supports 3 feed specifications", including the Google Product Feed ("you can reuse it to powe…”
   • [claimed-docs] “Access to PayPal's agentic commerce services is form-gated, not self-serve: merchants must complete a form "to contact the AI team at PayPal…”
   • [probe] “PROBE runtime (recorded 2026-09-14): PayPal's remote MCP server is live — a keyless JSON-RPC initialize POST to https://mcp.paypal.com/mcp a…”
   • [probe] “official MCP server documented at https://developer.paypal.com/ai-tools/mcp-server”

   proof ↗⚑ flag

   Visa Intelligent Commerce~partialprobed5/10

   Visa provides discovery surfaces for its own developer APIs — an official MCP server (visa-intelligent-commerce-docs-8, probe-2), a public npm package (visa-ic-probe-rt-2), and a machine-readable llms.txt index (visa-intelligent-commerce-probe-1) — which let an agent discover and call its payment/commerce endpoints. However this is discovery of Visa's own API surface, not a broader directory/index of third-party payable services or merchants that an agent could browse; the TAP agent-registry is for verifying agent identity, not for service discovery. Missing for 10: a published directory/marketplace of payable third-party services, evidence of cross-vendor service discovery, independent confirmation the MCP/llms.txt are used for live service discovery rather than just docs.

   • [claimed-docs] “Developers can now connect to Visa Intelligent Commerce APIs through the MCP Server, making it faster and easier for builders to bring intel…”
   • [probe] “PROBE llms.txt: HTTP 200 at https://developer.visaacceptance.com/llms.txt # VisaAcceptance Developer Center > This developer documentation …”
   • [probe] “official MCP server documented at https://github.com/visaacceptance/agent-toolkit”
   • [probe] “PROBE runtime (recorded 2026-09-14): Visa's developer gateway is live and credential-gated exactly as documented — a keyless GET to https://…”

   proof ↗⚑ flag

Agent access

1. ai-native userPoint an agent at llms.txt or agent-oriented docs

   weight 2 · round drawn
   PayPal Agentic Commerce✓fullprobed9/10

   There's a confirmed live llms.txt at developer.paypal.com/llms.txt (HTTP 200) plus per-page .md agent-readable docs (e.g. agent-ready/overview.md), and the docs are explicitly agent-oriented (MCP server, agent toolkit, ACP/UCP guides) that an AI agent could consume directly. Missing for 10: no independent third-party report of an agent actually consuming llms.txt successfully in the wild, just first-party probes.

   • [probe] “PROBE llms.txt: HTTP 200 at https://developer.paypal.com/llms.txt # PayPal Developer Documentation > PayPal's developer documentation for i…”
   • [probe] “PROBE docs-md: HTTP 200 at https://developer.paypal.com/agent-ready/overview.md # Agent Ready overview (/agent-ready/overview) Agent Read…”
   • [probe] “official MCP server documented at https://developer.paypal.com/ai-tools/mcp-server”
   • [probe] “PROBE runtime (recorded 2026-09-14): PayPal's remote MCP server is live — a keyless JSON-RPC initialize POST to https://mcp.paypal.com/mcp a…”

   proof ↗⚑ flag

   Visa Intelligent Commerce✓fullprobed9/10

   A probe confirms llms.txt returns HTTP 200 with structured content at developer.visaacceptance.com/llms.txt, and Visa also publishes an official MCP server (agent-toolkit) confirmed live on npm, giving agents both a machine-readable docs entry point and a programmatic tool interface. Missing for 10: independent third-party confirmation that agents actually consume llms.txt successfully in practice beyond the HTTP probe.

   • [probe] “PROBE llms.txt: HTTP 200 at https://developer.visaacceptance.com/llms.txt # VisaAcceptance Developer Center > This developer documentation …”
   • [probe] “official MCP server documented at https://github.com/visaacceptance/agent-toolkit”
   • [probe] “PROBE runtime (recorded 2026-09-14): Visa's developer gateway is live and credential-gated exactly as documented — a keyless GET to https://…”
   • [claimed-docs] “Developers can now connect to Visa Intelligent Commerce APIs through the MCP Server, making it faster and easier for builders to bring intel…”
   • [claimed-docs] “It offers a specialized set of tools designed to help you manage invoices, create payment links, and perform other Visa Acceptance-related o…”

   proof ↗⚑ flag

2. ai-native userRun the product headlessly / in CI for automation

   weight 2 · round drawn
   PayPal Agentic Commerce~partialprobed6/10

   PayPal's agent toolkit (npm/PyPI packages) and REST APIs, plus the sandbox environment, can be scripted headlessly and invoked from CI pipelines via SDKs (LangChain, CrewAI, OpenAI Agents SDK, MCP) without a UI; webhooks and sandbox credentials support automated testing. However the remote MCP server requires interactive OAuth/PKCE authorization flow (dynamic client registration, bearer auth), which complicates pure headless/CI use, and there's no explicit CI/automation guide or example pipeline in the evidence. missing for 10: documented headless auth flow for CI (service-account/client-credentials for MCP), explicit CI/automation examples, and independent confirmation of unattended operation.

   • [claimed-docs] “"PayPal's agent toolkit supports the integration of PayPal APIs into AI agent workflows using" Amazon Bedrock, CrewAI, LangChain, MCP, OpenA…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the PayPal Agent Toolkit resolves on the public npm registry (npm view @paypal/agent-toolkit → 1.11.0, …”
   • [claimed-docs] “The PayPal sandbox "is a self-contained, virtual testing environment that simulates the live PayPal production environment" — "a shielded sp…”
   • [probe] “PROBE runtime (recorded 2026-09-14): PayPal's remote MCP server is live — a keyless JSON-RPC initialize POST to https://mcp.paypal.com/mcp a…”
   • [claimed-docs] “The developer portal's REST API getting-started page anchors the agent surface: "REST APIs, including orders, payments, subscriptions, invoi…”

   proof ↗⚑ flag

   Visa Intelligent Commerce~partialprobed6/10

   The product is fundamentally API/protocol-driven (REST endpoints for tokens, instructions, credentials) with a published MCP server and npm-distributed agent-toolkit, plus a self-serve sandbox for test transactions — all of which are inherently headless and scriptable without a UI. However, there is no explicit documentation or example of CI/CD pipeline integration, automated test harnesses, or non-interactive credential/authentication flows (since the design requires passkey/step-up human authentication at key points), which limits true unattended automation. Missing for 10: explicit CI/CD pipeline examples, documentation on running fully unattended (given passkey step-up requirements), automated test suite integration guidance.

   • [claimed-docs] “Spend caps live in the purchase-intent mandate: Initiate a Purchase Intent (POST /acp/v1/instructions) exists "to verify that your agent is …”
   • [claimed-docs] “"Your agents can enroll a customer's card for tokenization during the customer's account registration or when the customer begins a new purc…”
   • [claimed-docs] “Credentials are scoped to an authenticated instruction: retrieval is POST /acp/v1/instructions/{instructionID}/credentials, and the request …”
   • [claimed-docs] “Developers can now connect to Visa Intelligent Commerce APIs through the MCP Server, making it faster and easier for builders to bring intel…”
   • [probe] “official MCP server documented at https://github.com/visaacceptance/agent-toolkit”
   • [probe] “PROBE runtime (recorded 2026-09-14): Visa's developer gateway is live and credential-gated exactly as documented — a keyless GET to https://…”
   • [claimed-docs] “Merchant-side onboarding starts with a self-serve "Intelligent Commerce Sandbox Sign up" form (Organization ID, company, contact details, te…”

   proof ↗⚑ flag

3. ai-native userConnect an agent via an official MCP server

   weight 3 · round to PayPal Agentic Commerce
   PayPal Agentic Commerce✓fullprobed8/10

   PayPal documents and runtime-probes an official MCP server (developer.paypal.com/ai-tools/mcp-server) plus a published agent-toolkit npm/PyPI package explicitly listing MCP as a supported integration, and a live probe confirms the remote MCP endpoint (mcp.paypal.com/mcp) responds with proper OAuth-protected-resource metadata. missing for 10: independent/community hands-on confirmation of a successful end-to-end MCP client connection (beyond PayPal's own docs and the auth-handshake probe), and clearer documentation of the full tool list exposed over MCP.

   • [claimed-docs] “PayPal built an MCP server that lets merchants use natural language with their favorite MCP clients. This helps users complete business task…”
   • [probe] “official MCP server documented at https://developer.paypal.com/ai-tools/mcp-server”
   • [probe] “PROBE runtime (recorded 2026-09-14): PayPal's remote MCP server is live — a keyless JSON-RPC initialize POST to https://mcp.paypal.com/mcp a…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the PayPal Agent Toolkit resolves on the public npm registry (npm view @paypal/agent-toolkit → 1.11.0, …”
   • [claimed-docs] “"PayPal's agent toolkit supports the integration of PayPal APIs into AI agent workflows using" Amazon Bedrock, CrewAI, LangChain, MCP, OpenA…”

   proof ↗⚑ flag

   Visa Intelligent Commerce✓fullprobed7/10

   Visa explicitly ships an official MCP server (visaacceptance/agent-toolkit, published on npm as @visaacceptance/mcp) that lets developers/agents connect to Visa Intelligent Commerce APIs for payment-enabled operations like invoices and payment links, corroborated by a runtime probe confirming the npm package exists with Visa-staff maintainers. Missing for 10: independent hands-on usage reports/reviews of the MCP server beyond Visa's own announcement and npm registry check, and more detail on the full tool surface exposed via MCP.

   • [claimed-docs] “Developers can now connect to Visa Intelligent Commerce APIs through the MCP Server, making it faster and easier for builders to bring intel…”
   • [claimed-docs] “the toolkit helps developers and non-technical users to work with AI agents using plain language — no coding required.”
   • [claimed-docs] “It offers a specialized set of tools designed to help you manage invoices, create payment links, and perform other Visa Acceptance-related o…”
   • [probe] “official MCP server documented at https://github.com/visaacceptance/agent-toolkit”
   • [probe] “PROBE runtime (recorded 2026-09-14): Visa's developer gateway is live and credential-gated exactly as documented — a keyless GET to https://…”

   proof ↗⚑ flag

4. ai-native userUse an official CLI

   weight 2 · round drawn
   PayPal Agentic Commerce—none0/10

   The evidence pack documents PayPal's Agent Toolkit, MCP server, REST APIs, and SDKs, but nowhere mentions an official command-line interface (CLI) tool for developers or AI-native users to interact with PayPal's agentic commerce services. Since PayPal is a developer-facing platform with APIs and SDKs, a CLI would be a plausible product offering, but none is evidenced here.

   ⚑ flag

   Visa Intelligent Commerce—none0/10

   Evidence shows an MCP server and an npm-published 'agent-toolkit' with tool bindings, but nothing describes an official CLI binary or command-line interface for AI-native users to interact with Visa Intelligent Commerce.

   • [claimed-docs] “Developers can now connect to Visa Intelligent Commerce APIs through the MCP Server, making it faster and easier for builders to bring intel…”
   • [claimed-docs] “It offers a specialized set of tools designed to help you manage invoices, create payment links, and perform other Visa Acceptance-related o…”
   • [probe] “official MCP server documented at https://github.com/visaacceptance/agent-toolkit”
   • [probe] “PROBE runtime (recorded 2026-09-14): Visa's developer gateway is live and credential-gated exactly as documented — a keyless GET to https://…”

   proof ↗⚑ flag

5. ai-native userDrive the product through a documented public API

   weight 3 · round to PayPal Agentic Commerce
   PayPal Agentic Commerce✓fullprobed9/10

   PayPal publishes extensive, concrete developer documentation (REST API reference, Agent Toolkit, MCP server, agentic-commerce cart API, Store Sync, ACP/UCP guides) with runtime confirmation of a live MCP endpoint and published npm/PyPI SDK packages, giving AI-native developers a genuinely documented public API surface to build against. Missing for 10: some flows are form-gated/partner-gated (Braintree, Store Sync approval) rather than fully self-serve, slightly limiting pure API-driven access.

   • [claimed-docs] “PayPal's agent toolkit supports the integration of PayPal APIs into AI agent workflows using Amazon Bedrock, CrewAI, LangChain, Model Contex…”
   • [claimed-docs] “PayPal built an MCP server that lets merchants use natural language with their favorite MCP clients. This helps users complete business task…”
   • [claimed-docs] “Creates a new cart with the provided PayPalCart object. This is called by PayPal Shopping Cart when an AI agent or customer initiates a chec…”
   • [claimed-docs] “Retrieves the current state of a cart. Used by PayPal Shopping Cart to check cart status, validation issues, and current totals.”
   • [claimed-docs] “"PayPal's agent toolkit supports the integration of PayPal APIs into AI agent workflows using" Amazon Bedrock, CrewAI, LangChain, MCP, OpenA…”
   • [probe] “PROBE runtime (recorded 2026-09-14): PayPal's remote MCP server is live — a keyless JSON-RPC initialize POST to https://mcp.paypal.com/mcp a…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the PayPal Agent Toolkit resolves on the public npm registry (npm view @paypal/agent-toolkit → 1.11.0, …”
   • [claimed-docs] “The developer portal's REST API getting-started page anchors the agent surface: "REST APIs, including orders, payments, subscriptions, invoi…”
   • [claimed-docs] “The PayPal sandbox "is a self-contained, virtual testing environment that simulates the live PayPal production environment" — "a shielded sp…”

   proof ↗⚑ flag

   Visa Intelligent Commerce✓fullprobed8/10

   Visa publishes a documented REST API (POST /acp/v1/instructions, /acp/v1/tokens, /acp/v1/instructions/{id}/credentials) with field-level specs, sandbox sign-up, and an official MCP server/agent-toolkit for AI-native access, corroborated by npm registry presence and a live gateway probe. missing for 10: independent third-party developer confirmation of building against the API and broader SDK/language coverage beyond the documented endpoints.

   • [claimed-docs] “Spend caps live in the purchase-intent mandate: Initiate a Purchase Intent (POST /acp/v1/instructions) exists "to verify that your agent is …”
   • [claimed-docs] “"Your agents can enroll a customer's card for tokenization during the customer's account registration or when the customer begins a new purc…”
   • [claimed-docs] “Credentials are scoped to an authenticated instruction: retrieval is POST /acp/v1/instructions/{instructionID}/credentials, and the request …”
   • [claimed-docs] “Developers can now connect to Visa Intelligent Commerce APIs through the MCP Server, making it faster and easier for builders to bring intel…”
   • [probe] “official MCP server documented at https://github.com/visaacceptance/agent-toolkit”
   • [probe] “PROBE runtime (recorded 2026-09-14): Visa's developer gateway is live and credential-gated exactly as documented — a keyless GET to https://…”
   • [claimed-docs] “Merchant-side onboarding starts with a self-serve "Intelligent Commerce Sandbox Sign up" form (Organization ID, company, contact details, te…”

   proof ↗⚑ flag

6. ai-native userIssue scoped/least-privilege API credentials for an agent

   weight 2 · round to Visa Intelligent Commerce
   PayPal Agentic Commerce~partialprobed4/10

   There's no explicit 'issue a scoped API key/token for an agent' feature for the general Agent Toolkit or REST API surface, but agent-specific payment tokens are documented as scoped/least-privilege by design — the ACP delegated token is 'bound to your merchant ID and includes amount and time restrictions that you can configure,' and the MCP server enforces OAuth with PKCE and dynamic client registration rather than static keys. This shows some least-privilege credentialing pattern for agent checkout flows but not a general-purpose scoped-credential system for arbitrary agent API access. Missing for 10: documented scope/permission tiers (e.g., read-only vs write) for the Agent Toolkit or REST OAuth tokens, and any self-serve UI/API to mint restricted credentials per agent.

   • [claimed-docs] “The ACP path is an in-ChatGPT checkout build: "Implement an MCP server with the `complete_checkout` tool to receive tokens", "Call `requestC…”
   • [probe] “PROBE runtime (recorded 2026-09-14): PayPal's remote MCP server is live — a keyless JSON-RPC initialize POST to https://mcp.paypal.com/mcp a…”
   • [claimed-docs] “Cart execution is a reverse API the merchant hosts: POST /merchant-cart "Creates a new cart with the provided PayPalCart object. This is cal…”

   proof ↗⚑ flag

   Visa Intelligent Commerce~partialcommunity7/10

   Visa Intelligent Commerce issues agent-specific payment tokens/credentials scoped by merchant name, amount, and decline thresholds via mandates, gated behind passkey-authenticated user instructions (visa-ic-supp-1, visa-ic-supp-3, visa-ic-supp-5, visa-ic-supp-2). This is a concrete least-privilege credential model for payments, but it is payment-specific rather than a general API-credential scoping mechanism, and the platform page itself carries a maturity caveat ('in the process of development and deployment') plus community skepticism that standardized agent identity/permission scoping is still immature (visa-intelligent-commerce-comm-1). Missing for 10: evidence of granular scoping beyond amount/merchant (e.g., category-level or time-window least privilege), independent/production validation of the scoping enforcement, and confirmation the maturity caveat has been resolved.

   • [claimed-docs] “Agent-scoped credentials are the core primitive: "Provisioning and life cycle management of agent-specific payment tokens that can be used b…”
   • [claimed-docs] “Human approval is passkey-anchored end to end: provisioning includes "step up verification of the cardholder as well as setting up a Passkey…”
   • [claimed-docs] “Spend caps live in the purchase-intent mandate: Initiate a Purchase Intent (POST /acp/v1/instructions) exists "to verify that your agent is …”
   • [claimed-docs] “Credentials are scoped to an authenticated instruction: retrieval is POST /acp/v1/instructions/{instructionID}/credentials, and the request …”
   • [community] “The Visa/Mastercard announcements are interesting but feel premature. The missing piece is standardized agent identity and capability declar…”

   proof ↗⚑ flag

7. ai-native userBuild against official SDKs

   weight 2 · round drawn
   PayPal Agentic Commerce✓fullprobed8/10

   PayPal publishes an official Agent Toolkit SDK (npm/PyPI, versioned and actively published) integrating with MCP, OpenAI Agents SDK, LangChain, CrewAI, Vercel AI SDK, and Bedrock, plus documented pre-built functions for orders, invoices, subscriptions, refunds, disputes, and catalog management, backed by REST API docs, sandbox testing, and webhooks. This is corroborated by runtime probes confirming the toolkit is live on public registries and the MCP server is reachable. Missing for 10: independent third-party developer reviews/case studies of building against these SDKs beyond PayPal's own docs and registry probes.

   • [claimed-docs] “PayPal's agent toolkit supports the integration of PayPal APIs into AI agent workflows using Amazon Bedrock, CrewAI, LangChain, Model Contex…”
   • [claimed-docs] “PayPal built an MCP server that lets merchants use natural language with their favorite MCP clients. This helps users complete business task…”
   • [claimed-docs] “Integrate with PayPal APIs to access orders, invoices, subscriptions, shipment tracking, transaction details, and dispute management through…”
   • [claimed-docs] “"PayPal's agent toolkit supports the integration of PayPal APIs into AI agent workflows using" Amazon Bedrock, CrewAI, LangChain, MCP, OpenA…”
   • [claimed-docs] “Post-purchase operations are first-class agent tools: refunds via create_refund / get_refund (a "refund for a captured payment", where "If n…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the PayPal Agent Toolkit resolves on the public npm registry (npm view @paypal/agent-toolkit → 1.11.0, …”
   • [probe] “PROBE runtime (recorded 2026-09-14): PayPal's remote MCP server is live — a keyless JSON-RPC initialize POST to https://mcp.paypal.com/mcp a…”
   • [claimed-docs] “The PayPal sandbox "is a self-contained, virtual testing environment that simulates the live PayPal production environment" — "a shielded sp…”
   • [claimed-docs] “The developer portal's REST API getting-started page anchors the agent surface: "REST APIs, including orders, payments, subscriptions, invoi…”
   • [github] “create_order: Create an order in PayPal system based on provided details”

   proof ↗⚑ flag

   Visa Intelligent Commerce✓fullprobed8/10

   Visa documents official REST APIs (with concrete endpoints for enrollment, credential retrieval, purchase-intent mandates), an official MCP server (published on npm as @visaacceptance/mcp with a GitHub repo), and an open-source Trusted Agent Protocol reference implementation, giving AI-native developers multiple official SDK/tooling surfaces to build against. Missing for 10: dedicated language-specific SDKs (Python/Node/Java client libraries) beyond the MCP/toolkit and REST docs, and independent third-party corroboration of SDK developer experience.

   • [claimed-docs] “Developers can now connect to Visa Intelligent Commerce APIs through the MCP Server, making it faster and easier for builders to bring intel…”
   • [claimed-docs] “It offers a specialized set of tools designed to help you manage invoices, create payment links, and perform other Visa Acceptance-related o…”
   • [probe] “official MCP server documented at https://github.com/visaacceptance/agent-toolkit”
   • [probe] “PROBE runtime (recorded 2026-09-14): Visa's developer gateway is live and credential-gated exactly as documented — a keyless GET to https://…”
   • [claimed-docs] “Spend caps live in the purchase-intent mandate: Initiate a Purchase Intent (POST /acp/v1/instructions) exists "to verify that your agent is …”
   • [claimed-docs] “Credentials are scoped to an authenticated instruction: retrieval is POST /acp/v1/instructions/{instructionID}/credentials, and the request …”
   • [claimed-docs] “The TAP spec is public with a runnable reference implementation: "Establishing a universal standard of trust between AI agents and merchants…”

   proof ↗⚑ flag

8. ai-native userSubscribe to events via webhooks

   weight 2 · round to PayPal Agentic Commerce
   PayPal Agentic Commerce✓fullclaimed7/10

   PayPal's webhook API is explicitly documented: merchants can subscribe up to 10 webhook URLs per app, scoped to specific event types, with durable retry (25 attempts over 3 days) and signature verification guidance — enabling event-driven, agentic integrations. Missing for 10: explicit agentic-commerce-specific event types (e.g., cart/order events tied to AI checkout flows) and independent/hands-on corroboration beyond first-party docs.

   • [claimed-docs] “"Webhooks are HTTPS posts from PayPal to an endpoint on your server whenever the corresponding event type occurs" — "Up to 10 webhook URLs m…”
   • [claimed-docs] “The developer portal's REST API getting-started page anchors the agent surface: "REST APIs, including orders, payments, subscriptions, invoi…”

   proof ↗⚑ flag

   Visa Intelligent Commerce—none0/10

   The evidence pack describes payment instructions, tokenization, mandates, and the Trusted Agent Protocol, but nowhere documents a webhook subscription mechanism for AI agents to receive event notifications. The closest mention, 'Confirm payment outcomes and trigger post-purchase actions in real-time' (visa-intelligent-commerce-docs-5), does not specify webhooks or any pub/sub API.

   ⚑ flag

Agentic features

1. ai-native userGet AI-generated insights and suggestions from my data inside the product

   weight 2 · round drawn
   PayPal Agentic Commerce—none0/10

   Evidence documents PayPal's agentic commerce stack (Agent Ready, Store Sync, cart APIs, agent toolkit, MCP server) purely as infrastructure enabling AI agents to browse catalogs, create carts, and complete transactions on a merchant's behalf — none of it shows PayPal analyzing a user's/merchant's own data to surface AI-generated insights or suggestions inside the product (e.g., analytics dashboards, business recommendations). The dispute/order/refund tools are action endpoints for agents to execute tasks, not insight-generation features.

   • [claimed-docs] “"PayPal's agent toolkit supports the integration of PayPal APIs into AI agent workflows using" Amazon Bedrock, CrewAI, LangChain, MCP, OpenA…”
   • [claimed-docs] “Post-purchase operations are first-class agent tools: refunds via create_refund / get_refund (a "refund for a captured payment", where "If n…”
   • [claimed-docs] “PayPal built an MCP server that lets merchants use natural language with their favorite MCP clients. This helps users complete business task…”

   proof ↗⚑ flag

   Visa Intelligent Commerce—none0/10

   Visa Intelligent Commerce's evidence is entirely about enabling agent-initiated payments (tokens, mandates, passkeys, credential scoping, trusted agent protocol) — there is no mention of surfacing AI-generated insights or suggestions derived from a user's data within the product. While a payments platform could plausibly offer spending insights, none are documented here.

   ⚑ flag

2. ai-native userSet up automations that run autonomously in the background

   weight 2 · round to PayPal Agentic Commerce
   PayPal Agentic Commerce~partialprobed6/10

   PayPal provides the building blocks for background automation — an agent toolkit with pre-built functions (orders, refunds, disputes, subscriptions) usable in LangChain/CrewAI/Bedrock workflows, an MCP server for natural-language triggered actions, and webhooks that fire asynchronously with retry logic — enabling autonomous background agent workflows. However, PayPal's own docs explicitly recommend keeping 'human oversight in areas where personal judgment matters most,' and much of the deeper commerce automation (Store Sync, agentic commerce services) is gated behind manual application forms rather than self-serve autonomous setup. Missing for 10: evidence of a fully autonomous, unattended scheduling/orchestration layer, independent confirmation of agents running unattended in production, and self-serve (non-form-gated) enablement.

   • [claimed-docs] “"PayPal's agent toolkit supports the integration of PayPal APIs into AI agent workflows using" Amazon Bedrock, CrewAI, LangChain, MCP, OpenA…”
   • [claimed-docs] “"Webhooks are HTTPS posts from PayPal to an endpoint on your server whenever the corresponding event type occurs" — "Up to 10 webhook URLs m…”
   • [probe] “PROBE runtime (recorded 2026-09-14): PayPal's remote MCP server is live — a keyless JSON-RPC initialize POST to https://mcp.paypal.com/mcp a…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the PayPal Agent Toolkit resolves on the public npm registry (npm view @paypal/agent-toolkit → 1.11.0, …”
   • [claimed-docs] “Post-purchase operations are first-class agent tools: refunds via create_refund / get_refund (a "refund for a captured payment", where "If n…”
   • [claimed-docs] “Access to PayPal's agentic commerce services is form-gated, not self-serve: merchants must complete a form "to contact the AI team at PayPal…”

   proof ↗⚑ flag

   Visa Intelligent Commerce~partialclaimed5/10

   Visa Intelligent Commerce provides the payment-authorization infrastructure (mandates, spend caps, tokens, passkey-anchored consent) that enables agents to transact autonomously within user-set limits, and the purchase-intent mandate mechanism (decline thresholds, effectiveUntilTime) supports background/recurring authorization without per-transaction human sign-off. However, this is a payments-rail product, not an automation/scheduling platform — there's no evidence of the product itself offering a UI or API for users to configure recurring/background 'automations' (e.g., scheduled tasks, triggers, workflows) beyond the payment-instruction mandate; that capability lives in whatever agent/orchestrator integrates with Visa's APIs. missing for 10: first-party evidence of an automation/scheduling interface for background-running tasks, independent hands-on confirmation of autonomous mandate execution in production, and clarity on how recurring (not just one-off) purchase intents are managed.

   • [claimed-docs] “Spend caps live in the purchase-intent mandate: Initiate a Purchase Intent (POST /acp/v1/instructions) exists "to verify that your agent is …”
   • [claimed-docs] “Human approval is passkey-anchored end to end: provisioning includes "step up verification of the cardholder as well as setting up a Passkey…”
   • [claimed-docs] “Capture consumer consent, set spending limits, and manage mandates for agent-initiated payments.”
   • [claimed-docs] “Agent-scoped credentials are the core primitive: "Provisioning and life cycle management of agent-specific payment tokens that can be used b…”

   proof ↗⚑ flag

3. ai-native userOperate the product with natural-language commands

   weight 2 · round drawn
   PayPal Agentic Commerce~partialprobed6/10

   PayPal supports natural-language operation via its MCP server and agent toolkit (LangChain, OpenAI Agents SDK, CrewAI, etc.), letting AI agents issue commands for orders, refunds, disputes, and shopping carts in conversational form, and a runtime probe confirms the MCP endpoint is live. However, the 'user' operating this isn't typically an end consumer speaking to PayPal directly — most flows are merchant-hosted or gated behind Braintree/Google/form approval, and the natural-language surface is mediated through third-party chat assistants (ChatGPT, Gemini) or developer-built agents rather than a native PayPal NL interface. missing for 10: independent/hands-on evidence of an end user directly issuing free-form natural-language commands to PayPal itself (not via a third-party chat assistant or developer-built agent), and confirmation the MCP server/agent toolkit works smoothly without heavy setup/gating.

   • [claimed-docs] “PayPal built an MCP server that lets merchants use natural language with their favorite MCP clients. This helps users complete business task…”
   • [claimed-docs] “"PayPal's agent toolkit supports the integration of PayPal APIs into AI agent workflows using" Amazon Bedrock, CrewAI, LangChain, MCP, OpenA…”
   • [claimed-docs] “Post-purchase operations are first-class agent tools: refunds via create_refund / get_refund (a "refund for a captured payment", where "If n…”
   • [probe] “PROBE runtime (recorded 2026-09-14): PayPal's remote MCP server is live — a keyless JSON-RPC initialize POST to https://mcp.paypal.com/mcp a…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the PayPal Agent Toolkit resolves on the public npm registry (npm view @paypal/agent-toolkit → 1.11.0, …”
   • [claimed-docs] “"Agent Ready helps Braintree merchants accept payments from AI shopping assistants across major platforms, including ChatGPT, Google AI Mode…”
   • [claimed-docs] “Access to PayPal's agentic commerce services is form-gated, not self-serve: merchants must complete a form "to contact the AI team at PayPal…”

   proof ↗⚑ flag

   Visa Intelligent Commerce~partialprobed6/10

   The Visa Acceptance Agent Toolkit (MCP server) is documented as letting 'developers and non-technical users work with AI agents using plain language — no coding required,' and probes confirm the toolkit is a real, published npm package with an MCP server rather than just a marketing claim. However, natural-language operation is really mediated through AI agents (e.g., Claude/ChatGPT) calling the toolkit's tools, not a native NL interface Visa itself ships, and there's no independent hands-on report of a user issuing plain-language commands successfully. Missing for 10: independent/hands-on demonstration of NL command usage, and clarity on how much of the NL experience is Visa-built vs. reliant on third-party agent UIs.

   • [claimed-docs] “the toolkit helps developers and non-technical users to work with AI agents using plain language — no coding required.”
   • [claimed-docs] “It offers a specialized set of tools designed to help you manage invoices, create payment links, and perform other Visa Acceptance-related o…”
   • [claimed-docs] “Developers can now connect to Visa Intelligent Commerce APIs through the MCP Server, making it faster and easier for builders to bring intel…”
   • [probe] “official MCP server documented at https://github.com/visaacceptance/agent-toolkit”
   • [probe] “PROBE runtime (recorded 2026-09-14): Visa's developer gateway is live and credential-gated exactly as documented — a keyless GET to https://…”

   proof ↗⚑ flag

Api quality

1. ai-native userExplore an interactive API reference with runnable examples

   weight 2 · round drawn
   PayPal Agentic Commerce—none0/10

   Evidence shows static API reference pages (createcart, getcart) and REST API docs, plus a sandbox environment for testing, but nothing describing an interactive reference with embedded runnable/try-it-out examples (e.g., live code execution in docs, Swagger-style console). Missing for 10: any mention of an interactive API console, embedded runnable code snippets, or in-docs request execution.

   • [claimed-docs] “Creates a new cart with the provided PayPalCart object. This is called by PayPal Shopping Cart when an AI agent or customer initiates a chec…”
   • [claimed-docs] “Retrieves the current state of a cart. Used by PayPal Shopping Cart to check cart status, validation issues, and current totals.”
   • [claimed-docs] “The developer portal's REST API getting-started page anchors the agent surface: "REST APIs, including orders, payments, subscriptions, invoi…”
   • [claimed-docs] “The PayPal sandbox "is a self-contained, virtual testing environment that simulates the live PayPal production environment" — "a shielded sp…”

   proof ↗⚑ flag

   Visa Intelligent Commerce—none0/10

   Evidence shows detailed REST endpoint documentation with sample JSON payloads (mandates, enroll-card, retrieve-credentials) and a separate sandbox signup form for sending test transactions, but nothing describes an interactive API reference (e.g., a Swagger/Postman-style 'try it' console) where examples can be run directly from the docs page. missing for 10: an interactive/try-it-now console embedded in API docs, evidence of one-click runnable code samples, any UI screenshot or independent report of in-docs execution.

   • [claimed-docs] “Spend caps live in the purchase-intent mandate: Initiate a Purchase Intent (POST /acp/v1/instructions) exists "to verify that your agent is …”
   • [claimed-docs] “"Your agents can enroll a customer's card for tokenization during the customer's account registration or when the customer begins a new purc…”
   • [claimed-docs] “Credentials are scoped to an authenticated instruction: retrieval is POST /acp/v1/instructions/{instructionID}/credentials, and the request …”
   • [claimed-docs] “Merchant-side onboarding starts with a self-serve "Intelligent Commerce Sandbox Sign up" form (Organization ID, company, contact details, te…”
   • [probe] “PROBE llms.txt: HTTP 200 at https://developer.visaacceptance.com/llms.txt # VisaAcceptance Developer Center > This developer documentation …”

   proof ↗⚑ flag

2. ai-native userDownload a machine-readable API spec (OpenAPI or equivalent)

   weight 2 · round to Visa Intelligent Commerce
   PayPal Agentic Commerce—none0/10

   The evidence pack documents REST API references, SDKs, webhooks, and endpoint descriptions (e.g., createcart/getcart docs), but nowhere mentions a downloadable OpenAPI/Swagger file or other machine-readable spec artifact for the agentic-commerce or general PayPal APIs. This axis is clearly applicable to an API-based commerce product, but no evidence shows PayPal exposing such a spec for download.

   • [claimed-docs] “The developer portal's REST API getting-started page anchors the agent surface: "REST APIs, including orders, payments, subscriptions, invoi…”
   • [claimed-docs] “Cart execution is a reverse API the merchant hosts: POST /merchant-cart "Creates a new cart with the provided PayPalCart object. This is cal…”
   • [claimed-docs] “The companion read endpoint keeps agent-side cart state fresh: get cart "Retrieves the current state of a cart. Used by PayPal Shopping Cart…”

   proof ↗⚑ flag

   Visa Intelligent Commerce~partialprobed6/10

   Visa documents concrete REST endpoints (e.g., POST /acp/v1/instructions, /acp/v1/tokens, /acp/v1/instructions/{id}/credentials) with detailed field-level specs, an MCP server, and an llms.txt-served developer portal, indicating machine-readable interfaces exist, but no evidence explicitly confirms a downloadable OpenAPI/Swagger spec file. missing for 10: an explicit OpenAPI/Swagger JSON or YAML artifact, a documented download link or spec generation endpoint, independent confirmation the spec is machine-parseable rather than just REST prose docs.

   • [claimed-docs] “Spend caps live in the purchase-intent mandate: Initiate a Purchase Intent (POST /acp/v1/instructions) exists "to verify that your agent is …”
   • [claimed-docs] “"Your agents can enroll a customer's card for tokenization during the customer's account registration or when the customer begins a new purc…”
   • [claimed-docs] “Credentials are scoped to an authenticated instruction: retrieval is POST /acp/v1/instructions/{instructionID}/credentials, and the request …”
   • [probe] “PROBE llms.txt: HTTP 200 at https://developer.visaacceptance.com/llms.txt # VisaAcceptance Developer Center > This developer documentation …”
   • [claimed-docs] “Developers can now connect to Visa Intelligent Commerce APIs through the MCP Server, making it faster and easier for builders to bring intel…”

   proof ↗⚑ flag

3. ai-native userTest against a sandbox environment without touching production data

   weight 1 · round drawn
   PayPal Agentic Commerce✓fullclaimed8/10

   PayPal documents a dedicated sandbox that mirrors production, allowing developers/agents to test agent-toolkit tools, cart API, and checkout flows without touching live accounts, and confirms the same REST rails (Orders, cart API) run against sandbox credentials. Missing for 10: no independent/hands-on verification of sandbox parity for agentic-commerce-specific flows (cart API, ACP/UCP checkout) and no explicit documentation of sandbox mode for the MCP server or agent toolkit specifically.

   • [claimed-docs] “The PayPal sandbox "is a self-contained, virtual testing environment that simulates the live PayPal production environment" — "a shielded sp…”
   • [claimed-docs] “The developer portal's REST API getting-started page anchors the agent surface: "REST APIs, including orders, payments, subscriptions, invoi…”
   • [claimed-docs] “Cart execution is a reverse API the merchant hosts: POST /merchant-cart "Creates a new cart with the provided PayPalCart object. This is cal…”
   • [claimed-docs] “"PayPal's agent toolkit supports the integration of PayPal APIs into AI agent workflows using" Amazon Bedrock, CrewAI, LangChain, MCP, OpenA…”

   proof ↗⚑ flag

   Visa Intelligent Commerce✓fullclaimed8/10

   Visa documents a dedicated sandbox: a self-serve 'Intelligent Commerce Sandbox Sign up' form that lets developers 'send test transactions,' separate test endpoints (https://apitest.visaacceptance.com vs production https://api.visaacceptance.com), and explicit fee terms stating 'Free to use in Sandbox. Contact Visa for fees in Production.' This directly satisfies testing without touching production data or paying production fees. Missing for 10: independent/hands-on confirmation that the sandbox behaves as documented (no third-party report of actually using it), and no detail on sandbox data reset/isolation guarantees.

   • [claimed-docs] “Merchant-side onboarding starts with a self-serve "Intelligent Commerce Sandbox Sign up" form (Organization ID, company, contact details, te…”
   • [claimed-docs] “Fees, verbatim from FEES & TERMS: "Free to use in Sandbox. Contact Visa for fees in Production." On refunds/disputes the docs stop at eviden…”
   • [claimed-docs] “"Your agents can enroll a customer's card for tokenization during the customer's account registration or when the customer begins a new purc…”

   proof ↗⚑ flag

4. ai-native userRely on versioned APIs with a documented deprecation policy

   weight 2 · round to Visa Intelligent Commerce
   PayPal Agentic Commerce—none0/10

   The evidence pack documents PayPal's agentic-commerce APIs (createcart, getcart, agent toolkit, REST APIs) including a versioned path like /v1/createcart, but nowhere is there any documented deprecation policy, versioning strategy, or backward-compatibility commitment for AI agents to rely on. The axis is clearly applicable (PayPal is an API-first commerce platform) but no supporting evidence exists.

   • [claimed-docs] “Creates a new cart with the provided PayPalCart object. This is called by PayPal Shopping Cart when an AI agent or customer initiates a chec…”
   • [claimed-docs] “Retrieves the current state of a cart. Used by PayPal Shopping Cart to check cart status, validation issues, and current totals.”
   • [claimed-docs] “The developer portal's REST API getting-started page anchors the agent surface: "REST APIs, including orders, payments, subscriptions, invoi…”

   proof ↗⚑ flag

   Visa Intelligent Commerce~partialclaimed3/10

   API endpoints show explicit versioning (e.g., POST /acp/v1/instructions, /acp/v1/tokens) indicating a versioning scheme, but no evidence anywhere in the pack documents a deprecation policy, sunset timeline, or version-lifecycle commitment for these APIs. missing for 10: documented deprecation/versioning policy, migration guidance between versions, changelog or version-lifecycle commitments.

   • [claimed-docs] “Spend caps live in the purchase-intent mandate: Initiate a Purchase Intent (POST /acp/v1/instructions) exists "to verify that your agent is …”
   • [claimed-docs] “"Your agents can enroll a customer's card for tokenization during the customer's account registration or when the customer begins a new purc…”
   • [claimed-docs] “Credentials are scoped to an authenticated instruction: retrieval is POST /acp/v1/instructions/{instructionID}/credentials, and the request …”

   proof ↗⚑ flag

1. ai-native userPerform bulk operations across many items at once

   weight 2 · round drawn
   PayPal Agentic Commerce—none0/10

   The evidence shows only single-item agent tools (create_order, create_refund, get_dispute, etc.) and a one-time bulk catalog feed upload for merchant setup, but no documented bulk/batch operation capability (e.g., batch refunds, batch order processing, multi-item transaction endpoints) that an AI agent could invoke across many items at once.

   • [claimed-docs] “Post-purchase operations are first-class agent tools: refunds via create_refund / get_refund (a "refund for a captured payment", where "If n…”
   • [claimed-docs] “"PayPal's agent toolkit supports the integration of PayPal APIs into AI agent workflows using" Amazon Bedrock, CrewAI, LangChain, MCP, OpenA…”
   • [claimed-docs] “Catalog publishing is feed-file based: "PayPal supports 3 feed specifications", including the Google Product Feed ("you can reuse it to powe…”

   proof ↗⚑ flag

   Visa Intelligent Commerce—none0/10

   The evidence describes per-transaction flows (single card enrollment, single purchase-intent mandate, single credential retrieval, single invoice/payment link creation) with no mention of batch or bulk APIs for processing many items/transactions at once. While bulk operations are a plausible axis for a commerce/payments platform, there is no documentation of batch enrollment, bulk credential issuance, or multi-item transaction processing.

   • [claimed-docs] “It offers a specialized set of tools designed to help you manage invoices, create payment links, and perform other Visa Acceptance-related o…”
   • [claimed-docs] “Spend caps live in the purchase-intent mandate: Initiate a Purchase Intent (POST /acp/v1/instructions) exists "to verify that your agent is …”
   • [claimed-docs] “"Your agents can enroll a customer's card for tokenization during the customer's account registration or when the customer begins a new purc…”
   • [claimed-docs] “Credentials are scoped to an authenticated instruction: retrieval is POST /acp/v1/instructions/{instructionID}/credentials, and the request …”

   proof ↗⚑ flag

2. ai-native userDefine rules that trigger actions automatically on events

   weight 3 · round to Visa Intelligent Commerce
   PayPal Agentic Commerce—none0/10

   Evidence shows PayPal offers webhooks (event notifications) and an agent toolkit with individual API tools, but nothing resembling a rules engine where a user defines 'if event X then action Y' automation — webhooks merely deliver raw event notifications that require the merchant to write custom code to act on, not a rule-definition interface. Missing for 10: any rule-builder/automation-trigger UI or API, conditional logic definition, and evidence of automatic action execution tied to rules rather than manual webhook handling.

   • [claimed-docs] “"Webhooks are HTTPS posts from PayPal to an endpoint on your server whenever the corresponding event type occurs" — "Up to 10 webhook URLs m…”

   proof ↗⚑ flag

   Visa Intelligent Commerce~partialclaimed5/10

   Visa Intelligent Commerce lets users set mandate-based rules such as decline thresholds, expiry times, and consumer prompts that constrain agent-initiated purchases, and documents automatic post-purchase actions triggered on payment confirmation events. This is rule-based automation but scoped narrowly to payment authorization and consent, not a general event-trigger-action framework a user can freely define. missing for 10: broader event types beyond payment confirmation, arbitrary custom action definitions beyond spend caps and expiry, independent evidence of the rule engine executing complex conditional logic

   • [claimed-docs] “Confirm payment outcomes and trigger post-purchase actions in real-time.”
   • [claimed-docs] “Human approval is passkey-anchored end to end: provisioning includes "step up verification of the cardholder as well as setting up a Passkey…”
   • [claimed-docs] “Spend caps live in the purchase-intent mandate: Initiate a Purchase Intent (POST /acp/v1/instructions) exists "to verify that your agent is …”

   proof ↗⚑ flag

3. ai-native userVersion, review, and roll back my automations

   weight 1 · round to Visa Intelligent Commerce
   PayPal Agentic Commerce—none0/10

   The evidence pack covers payment protocols, catalog sync, agent toolkit tools, and webhooks, but nothing addresses versioning, reviewing, or rolling back agent-configured automations themselves — no changelog, audit history, or rollback mechanism for automation workflows is documented.

   ⚑ flag

   Visa Intelligent Commerce~partialclaimed3/10

   Visa Intelligent Commerce lets users set mandate parameters (spend caps, expiry) and cancel a purchase intent, which is a rudimentary form of rollback, but there is no evidence of version history, change review, or restoring prior automation states. missing for 10: versioning/history of mandate changes, review/audit UI for past automation edits, rollback beyond simple cancellation.

   • [claimed-docs] “Spend caps live in the purchase-intent mandate: Initiate a Purchase Intent (POST /acp/v1/instructions) exists "to verify that your agent is …”
   • [claimed-docs] “Human approval is passkey-anchored end to end: provisioning includes "step up verification of the cardholder as well as setting up a Passkey…”

   proof ↗⚑ flag

Fees transparency

1. merchantThe fees for agent-originated transactions are published — I can price agentic channels without asking sales

   weight 2 · round to PayPal Agentic Commerce
   PayPal Agentic Commerce~partialclaimed5/10

   Evidence shows agent-originated transactions run through existing Braintree/PayPal Checkout rails and thus inherit the standard published US commercial fee schedule (2.99–4.99% + fixed fee), so merchants aren't quoted a hidden or sales-negotiated rate for the payment processing itself. However, the same evidence explicitly states 'No separate agentic/AI-channel fee schedule is published,' and access to Agent Ready/Store Sync/ACS is gated behind a sales-contact form, leaving open whether any additional platform or enablement fee applies to the agentic channel — so a merchant cannot fully price the agentic channel without engaging sales for onboarding. Missing for 10: an explicit agentic-channel fee page or fee line item, and self-serve (non-form-gated) enrollment that would let a merchant confirm total costs without sales contact.

   • [claimed-docs] “The published US commercial rates that agent-initiated orders inherit: "PayPal Checkout" and "PayPal Guest Checkout" at "3.49% +" fixed fee,…”
   • [claimed-docs] “Access to PayPal's agentic commerce services is form-gated, not self-serve: merchants must complete a form "to contact the AI team at PayPal…”
   • [claimed-docs] “Store Sync is the full-catalog path, "enabling AI agents to discover your products, create and manage shopping carts, and complete purchases…”

   proof ↗⚑ flag

   Visa Intelligent Commerce—none0/10

   Visa's own documentation states fees are 'Free to use in Sandbox. Contact Visa for fees in Production' — meaning production pricing is explicitly not published and requires contacting Visa directly, the opposite of the story's ask for a self-serve published rate card.

   • [claimed-docs] “Fees, verbatim from FEES & TERMS: "Free to use in Sandbox. Contact Visa for fees in Production." On refunds/disputes the docs stop at eviden…”

   proof ↗⚑ flag

Payouts

1. merchantAgent-originated payments settle through documented payout and reporting flows, reconcilable like any other channel

   weight 1 · round to PayPal Agentic Commerce
   PayPal Agentic Commerce~partialclaimed6/10

   Agent-originated orders flow into the merchant's existing order management, payment, refund/dispute, and webhook systems (create_order, refund/dispute tools, webhooks with signature verification, existing Orders v2/Braintree rails), and docs explicitly state Store Sync orders arrive 'just as it would from any other channel,' suggesting standard reconciliation. However, there is no dedicated agentic-channel reporting/settlement documentation, no separate transaction tagging or reconciliation report distinguishing agent-originated payments, and fee schedules show no distinct line item for agent transactions, making channel-level reconciliation an inference rather than a documented flow. missing for 10: dedicated agent-channel reporting/settlement statements, explicit reconciliation tooling or transaction tags identifying agent-originated payments, independent merchant confirmation of clean reconciliation in production.

   • [claimed-docs] “Store Sync is the full-catalog path, "enabling AI agents to discover your products, create and manage shopping carts, and complete purchases…”
   • [claimed-docs] “Post-purchase operations are first-class agent tools: refunds via create_refund / get_refund (a "refund for a captured payment", where "If n…”
   • [claimed-docs] “"Webhooks are HTTPS posts from PayPal to an endpoint on your server whenever the corresponding event type occurs" — "Up to 10 webhook URLs m…”
   • [claimed-docs] “The published US commercial rates that agent-initiated orders inherit: "PayPal Checkout" and "PayPal Guest Checkout" at "3.49% +" fixed fee,…”
   • [claimed-docs] “The developer portal's REST API getting-started page anchors the agent surface: "REST APIs, including orders, payments, subscriptions, invoi…”
   • [claimed-docs] “Cart execution is a reverse API the merchant hosts: POST /merchant-cart "Creates a new cart with the provided PayPalCart object. This is cal…”

   proof ↗⚑ flag

   Visa Intelligent Commerce~partialclaimed4/10

   Visa Intelligent Commerce documents authorization, tokenization, mandates, and dispute-relevant 'commerce signals' capture, and notes settlement/IOU concepts in TAP, but there is no documented merchant payout/settlement schedule, reconciliation file/report format, or statement-level breakdown distinguishing agent-originated transactions from other channels — it's treated as a standard card-rail authorization with evidence signals for disputes, not a distinct reconciliable payout flow. missing for 10: documented payout/settlement cadence, merchant reconciliation reports or statement descriptors specific to agent transactions, dispute/chargeback API (vs. just evidence capture), independent merchant confirmation of reconciling agent payments like other channels.

   • [claimed-docs] “Spend caps live in the purchase-intent mandate: Initiate a Purchase Intent (POST /acp/v1/instructions) exists "to verify that your agent is …”
   • [claimed-docs] “Credentials are scoped to an authenticated instruction: retrieval is POST /acp/v1/instructions/{instructionID}/credentials, and the request …”
   • [claimed-docs] “TAP's signed Agentic Payment Container adapts to the merchant's rail: for guest-checkout key entry it carries a credential hash — "If the ha…”
   • [claimed-docs] “Fees, verbatim from FEES & TERMS: "Free to use in Sandbox. Contact Visa for fees in Production." On refunds/disputes the docs stop at eviden…”

   proof ↗⚑ flag

Attribution analytics

1. merchantOrders are attributed to the originating agent and I can report on or filter transactions by agent

   weight 2 · round to Visa Intelligent Commerce
   PayPal Agentic Commerce—none0/10

   Evidence covers agent-initiated checkout flows (ACP/UCP/Store Sync/cart API/agent toolkit) but nowhere describes orders being tagged with an originating-agent identifier, nor any merchant dashboard/report/filter capability by agent; in fact Store Sync docs state orders arrive 'just as it would from any other channel,' suggesting no special agent attribution.

   • [claimed-docs] “Store Sync is the full-catalog path, "enabling AI agents to discover your products, create and manage shopping carts, and complete purchases…”
   • [claimed-docs] “Cart execution is a reverse API the merchant hosts: POST /merchant-cart "Creates a new cart with the provided PayPalCart object. This is cal…”
   • [claimed-docs] “The companion read endpoint keeps agent-side cart state fresh: get cart "Retrieves the current state of a cart. Used by PayPal Shopping Cart…”

   proof ↗⚑ flag

   Visa Intelligent Commerce~partialclaimed4/10

   Visa Intelligent Commerce provides agent-scoped tokens, TAP signatures identifying an agent per interaction, and commerce-signal capture for dispute resolution, which implies some technical basis for attributing a transaction to an agent, but there is no documented merchant-facing reporting/dashboard feature or API to filter or report transactions specifically by agent identity. missing for 10: a merchant reporting/analytics dashboard or API endpoint that lets merchants filter/query transactions by agent identifier, explicit documentation of agent-ID fields surfaced in settlement/reporting data, and independent evidence merchants actually use this for reporting.

   • [claimed-docs] “The Trusted Agent Protocol's agent recognition signature is HTTP Message Signatures "defined by RCF 9421" (typo in original), "aligned with …”
   • [claimed-docs] “The TAP spec is public with a runnable reference implementation: "Establishing a universal standard of trust between AI agents and merchants…”
   • [claimed-docs] “Fees, verbatim from FEES & TERMS: "Free to use in Sandbox. Contact Visa for fees in Production." On refunds/disputes the docs stop at eviden…”
   • [claimed-docs] “Agent-scoped credentials are the core primitive: "Provisioning and life cycle management of agent-specific payment tokens that can be used b…”

   proof ↗⚑ flag

Onboarding to agents

1. merchantI have a documented self-serve path to start accepting agent traffic — enable a setting, sign an agreement, or publish an endpoint

   weight 3 · round to Visa Intelligent Commerce
   PayPal Agentic Commerce~partialclaimed5/10

   There is documented onboarding material (Agent Ready guides, Store Sync docs, catalog feed specs), but the path is explicitly gated rather than self-serve: PayPal's own docs state that agentic commerce services access is 'form-gated, not self-serve' requiring a form submission and manual follow-up from PayPal's AI team, Store Sync eligibility requires an existing Braintree/Orders v2 account plus the same approval gate, and the UCP/Google Pay path requires separate 'merchant registration with Google. Contact Google for enablement.' Agent Ready itself assumes an existing Braintree merchant relationship rather than a simple toggle or self-issued agreement. Missing for 10: a true no-approval self-serve enablement (setting flip, standard clickthrough agreement, or endpoint publish without a contact-form/manual review step), and confirmation of approval turnaround time.

   • [claimed-docs] “Access to PayPal's agentic commerce services is form-gated, not self-serve: merchants must complete a form "to contact the AI team at PayPal…”
   • [claimed-docs] “"Agent Ready helps Braintree merchants accept payments from AI shopping assistants across major platforms, including ChatGPT, Google AI Mode…”
   • [claimed-docs] “The UCP path targets Google surfaces: "This enables AI-powered checkout experiences through Google AI Mode (Gemini), where Google Pay return…”
   • [claimed-docs] “Store Sync is the full-catalog path, "enabling AI agents to discover your products, create and manage shopping carts, and complete purchases…”
   • [claimed-docs] “Catalog publishing is feed-file based: "PayPal supports 3 feed specifications", including the Google Product Feed ("you can reuse it to powe…”

   proof ↗⚑ flag

   Visa Intelligent Commerce~partialclaimed7/10

   Visa documents a genuine self-serve onboarding flow: a public 'Intelligent Commerce Sandbox Sign up' form with terms acceptance that immediately unlocks test transactions (visa-ic-supp-10), plus an open, publishable Trusted Agent Protocol reference implementation merchants can deploy to declare/verify agent traffic (visa-ic-supp-9, visa-intelligent-commerce-gh-1/2). However, production enablement is explicitly gated — 'Contact Visa for fees in Production' (visa-ic-supp-8) — meaning the fully self-serve path only covers sandbox/dev, not live acceptance. Missing for 10: a documented self-serve production activation step (no sales contact), and independent merchant confirmation that the sandbox-to-production path works without manual Visa involvement.

   • [claimed-docs] “Merchant-side onboarding starts with a self-serve "Intelligent Commerce Sandbox Sign up" form (Organization ID, company, contact details, te…”
   • [claimed-docs] “The TAP spec is public with a runnable reference implementation: "Establishing a universal standard of trust between AI agents and merchants…”
   • [github] “By presenting a secure digital signature with every interaction, a merchant can verify that an agent is legitimate and has the user's permis…”
   • [github] “This allows you to confidently welcome agent-driven commerce while protecting your site from harmful bots.”
   • [claimed-docs] “Fees, verbatim from FEES & TERMS: "Free to use in Sandbox. Contact Visa for fees in Production." On refunds/disputes the docs stop at eviden…”

   proof ↗⚑ flag

Traffic controls

1. merchantRate-limit, allow, or deny specific agents and agent platforms accessing my catalog and checkout

   weight 2 · round to Visa Intelligent Commerce
   PayPal Agentic Commerce—none0/10

   Evidence shows PayPal gates agentic-commerce access at the platform/onboarding level (Braintree account, Google UCP registration, PayPal AI-team approval form) and gives merchants brand/communication control, but nothing describes merchant-configurable rate limits or per-agent/per-platform allow/deny controls over catalog or checkout access.

   • [claimed-docs] “"Agent Ready helps Braintree merchants accept payments from AI shopping assistants across major platforms, including ChatGPT, Google AI Mode…”
   • [claimed-docs] “Access to PayPal's agentic commerce services is form-gated, not self-serve: merchants must complete a form "to contact the AI team at PayPal…”
   • [claimed-docs] “Store Sync is the full-catalog path, "enabling AI agents to discover your products, create and manage shopping carts, and complete purchases…”

   proof ↗⚑ flag

   Visa Intelligent Commerce~partialclaimed5/10

   Trusted Agent Protocol gives merchants a way to cryptographically verify agent legitimacy, distinguish credentialed agents from anonymous bots via an agent-registry, and reject stale/replayed signed requests, which supports an allow/deny posture at checkout. However there is no documented merchant-facing control for rate-limiting specific agents or blocking by agent platform/brand — the evidence is about identity verification and anti-bot protection, not policy-based throttling or platform-level allow/deny lists. missing for 10: explicit rate-limiting mechanism, per-platform allow/deny configuration UI or API, documented throttling/quota controls.

   • [github] “By presenting a secure digital signature with every interaction, a merchant can verify that an agent is legitimate and has the user's permis…”
   • [github] “This allows you to confidently welcome agent-driven commerce while protecting your site from harmful bots.”
   • [claimed-docs] “The Trusted Agent Protocol's agent recognition signature is HTTP Message Signatures "defined by RCF 9421" (typo in original), "aligned with …”
   • [claimed-docs] “The TAP spec is public with a runnable reference implementation: "Establishing a universal standard of trust between AI agents and merchants…”

   proof ↗⚑ flag

1. ai-native userRead the product's source under an open license

   weight 2 · round to Visa Intelligent Commerce
   PayPal Agentic Commerce—none0/10

   PayPal's agentic commerce services (Store Sync, ACP/UCP integrations, agent toolkit) are proprietary hosted APIs and closed-source integrations; the agent-toolkit SDK is published on npm/PyPI but no evidence indicates an open-source license for its source, and core commerce services (Store Sync, cart API, MCP server backend) are entirely closed, gated behind forms and merchant accounts. No evidence pack item shows an open-license repository for the product's source.

   ⚑ flag

   Visa Intelligent Commerce~partialprobed4/10

   Visa Intelligent Commerce itself (the core enrollment/token/mandate platform) is a closed, proprietary financial service with no source release, but the related Trusted Agent Protocol spec and reference implementation, plus the agent-toolkit, are published openly on GitHub with a runnable sample ecosystem (agent-registry, cdn-proxy, merchant-backend, tap-agent). This only covers peripheral protocol/toolkit components, not the core Intelligent Commerce platform's own source. Missing for 10: an explicit open-source license grant for the core Intelligent Commerce platform itself, not just the TAP spec/toolkit sidecars.

   • [probe] “PROBE runtime (recorded 2026-09-14): the Trusted Agent Protocol is published in the open — https://raw.githubusercontent.com/visa/trusted-ag…”
   • [claimed-docs] “The TAP spec is public with a runnable reference implementation: "Establishing a universal standard of trust between AI agents and merchants…”
   • [github] “By presenting a secure digital signature with every interaction, a merchant can verify that an agent is legitimate and has the user's permis…”
   • [claimed-docs] “It offers a specialized set of tools designed to help you manage invoices, create payment links, and perform other Visa Acceptance-related o…”

   proof ↗⚑ flag

Order events

1. developerMy agent or backend can subscribe to order lifecycle events — created, updated, fulfilled, canceled — pushed programmatically

   weight 3 · round to PayPal Agentic Commerce
   PayPal Agentic Commerce~partialclaimed5/10

   PayPal's generic webhooks system (developer.paypal.com/api/webhooks/overview) lets a merchant subscribe up to 10 URLs to specific event types, with durable retry (up to 25 attempts/3 days) and signature verification — and the agent-toolkit/cart API run on the same REST/order rails, so this infrastructure would carry order events. However, no evidence pack item explicitly names order-lifecycle event types (ORDER.CREATED/UPDATED/CANCELLED/fulfilled) tied to the agentic-commerce cart or Store Sync flows — those docs describe merchant-hosted reverse endpoints (createcart/getcart) rather than push-based lifecycle events for agents. Missing for 10: explicit order-lifecycle event-type list for agentic commerce, confirmation that Store Sync/cart orders emit standard webhook events, and any hands-on/independent proof of an agent successfully subscribing to these events.

   • [claimed-docs] “"Webhooks are HTTPS posts from PayPal to an endpoint on your server whenever the corresponding event type occurs" — "Up to 10 webhook URLs m…”
   • [claimed-docs] “The developer portal's REST API getting-started page anchors the agent surface: "REST APIs, including orders, payments, subscriptions, invoi…”
   • [claimed-docs] “Cart execution is a reverse API the merchant hosts: POST /merchant-cart "Creates a new cart with the provided PayPalCart object. This is cal…”
   • [claimed-docs] “The companion read endpoint keeps agent-side cart state fresh: get cart "Retrieves the current state of a cart. Used by PayPal Shopping Cart…”

   proof ↗⚑ flag

   Visa Intelligent Commerce—none0/10

   Evidence covers card enrollment, credential/token retrieval, purchase-intent mandates, and Trusted Agent Protocol signing, but no documentation of a webhook or event-subscription API for order lifecycle states (created/updated/fulfilled/canceled) pushed to developer systems — only a vague mention of confirming payment outcomes and triggering post-purchase actions, without any subscription mechanism.

   • [claimed-docs] “Confirm payment outcomes and trigger post-purchase actions in real-time.”
   • [claimed-docs] “Spend caps live in the purchase-intent mandate: Initiate a Purchase Intent (POST /acp/v1/instructions) exists "to verify that your agent is …”
   • [claimed-docs] “Fees, verbatim from FEES & TERMS: "Free to use in Sandbox. Contact Visa for fees in Production." On refunds/disputes the docs stop at eviden…”

   proof ↗⚑ flag

Post purchase status

1. ai-native userMy agent can query the status and tracking of an order it placed, after the purchase

   weight 2 · round to PayPal Agentic Commerce
   PayPal Agentic Commerce~partialprobed6/10

   PayPal's agent toolkit and REST surface explicitly advertise agent access to 'orders...shipment tracking, transaction details' for post-purchase queries, and the agent-tools page lists concrete order-related functions (create_order, pay_order, create_shipment) alongside webhooks for order events. However, no specific 'get_order_status' or 'track_shipment' tool call is named or demonstrated end-to-end, so the tracking-query capability is asserted at a high level rather than shown working. Missing for 10: an explicitly named order-status/tracking query tool/function, and independent or hands-on confirmation that an agent can actually retrieve tracking info post-purchase.

   • [claimed-docs] “Integrate with PayPal APIs to access orders, invoices, subscriptions, shipment tracking, transaction details, and dispute management through…”
   • [claimed-docs] “"PayPal's agent toolkit supports the integration of PayPal APIs into AI agent workflows using" Amazon Bedrock, CrewAI, LangChain, MCP, OpenA…”
   • [claimed-docs] “Post-purchase operations are first-class agent tools: refunds via create_refund / get_refund (a "refund for a captured payment", where "If n…”
   • [claimed-docs] “"Webhooks are HTTPS posts from PayPal to an endpoint on your server whenever the corresponding event type occurs" — "Up to 10 webhook URLs m…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the PayPal Agent Toolkit resolves on the public npm registry (npm view @paypal/agent-toolkit → 1.11.0, …”

   proof ↗⚑ flag

   Visa Intelligent Commerce—none0/10

   Visa Intelligent Commerce's documented post-purchase capabilities cover confirming payment outcomes, triggering post-purchase actions, and collecting signals for dispute resolution, but there is no evidence of an API or capability letting an agent query order status or shipment/tracking information after a purchase — that is fulfillment/logistics data outside Visa's payment-rail scope as documented. missing for 10: any order-status/tracking query endpoint, evidence of integration with merchant fulfillment/tracking data, or documentation describing post-purchase order lifecycle visibility for agents.

   • [claimed-docs] “Confirm payment outcomes and trigger post-purchase actions in real-time.”
   • [claimed-docs] “Fees, verbatim from FEES & TERMS: "Free to use in Sandbox. Contact Visa for fees in Production." On refunds/disputes the docs stop at eviden…”

   proof ↗⚑ flag

Delegated credentials

1. ai-native userHand my agent a scoped, limited-use payment credential — amount limits, expiry, merchant restrictions — instead of a raw card number

   weight 3 · round to Visa Intelligent Commerce
   PayPal Agentic Commerce~partialclaimed6/10

   PayPal's ACP/UCP flows use Braintree single-use payment tokens/nonces that are explicitly described as 'bound to your merchant ID and includes amount and time restrictions that you can configure' — a genuine scoped, limited-use credential rather than a raw card number, and Google's UCP path similarly returns a tokenized, single-use credential. However this is merchant-side infrastructure (tokens generated by the merchant's Braintree integration for a specific checkout), not a consumer/end-user-controlled credential that an AI-native user personally hands to their own agent with self-set amount/expiry/merchant limits; there's no evidence of a user-facing wallet-style scoped credential issuance flow. missing for 10: end-user-facing UI/API for a consumer to mint their own scoped credential (set their own amount cap, expiry, merchant allowlist) independent of a specific merchant checkout session, and independent/hands-on confirmation of these restriction configs working in practice.

   • [claimed-docs] “The ACP path is an in-ChatGPT checkout build: "Implement an MCP server with the `complete_checkout` tool to receive tokens", "Call `requestC…”
   • [claimed-docs] “The UCP path targets Google surfaces: "This enables AI-powered checkout experiences through Google AI Mode (Gemini), where Google Pay return…”
   • [claimed-docs] “Cart execution is a reverse API the merchant hosts: POST /merchant-cart "Creates a new cart with the provided PayPalCart object. This is cal…”

   proof ↗⚑ flag

   Visa Intelligent Commerce✓fullclaimed9/10

   Extensive first-party docs describe exactly this: agent-specific pass-through payment tokens, purchase-intent mandates with declineThreshold amount/currency and effectiveUntilTime expiry, and credential retrieval requests scoped to a specific merchantName/merchant descriptor and amount — all gated behind passkey-authenticated user instructions. This directly matches 'scoped, limited-use credential with amount limits, expiry, merchant restrictions instead of raw card number.' missing for 10: independent third-party (non-Visa) hands-on confirmation that these scoped credentials work end-to-end in production rather than sandbox, since the product itself carries a documented maturity caveat.

   • [claimed-docs] “Agent-scoped credentials are the core primitive: "Provisioning and life cycle management of agent-specific payment tokens that can be used b…”
   • [claimed-docs] “Human approval is passkey-anchored end to end: provisioning includes "step up verification of the cardholder as well as setting up a Passkey…”
   • [claimed-docs] “Spend caps live in the purchase-intent mandate: Initiate a Purchase Intent (POST /acp/v1/instructions) exists "to verify that your agent is …”
   • [claimed-docs] “Credentials are scoped to an authenticated instruction: retrieval is POST /acp/v1/instructions/{instructionID}/credentials, and the request …”
   • [claimed-docs] “"Your agents can enroll a customer's card for tokenization during the customer's account registration or when the customer begins a new purc…”

   proof ↗⚑ flag

Machine payments

1. developerMonetize an API or service with HTTP 402 machine payments that agents pay per call without a checkout UI

   weight 3 · round to Visa Intelligent Commerce
   PayPal Agentic Commerce—none0/10

   All evidence describes PayPal's agentic commerce as checkout-flow based (carts, ACP/UCP delegated tokens, Store Sync, agent toolkit for orders/refunds/disputes) — none of it describes HTTP 402 status-code machine payments or per-call API monetization without a checkout UI, which is a distinct technical pattern. Since PayPal is a payments platform, this axis could plausibly apply, but there is no evidence it ships or supports the 402 pay-per-call mechanism described in the story.

   ⚑ flag

   Visa Intelligent Commerce~partialclaimed5/10

   Visa's Trusted Agent Protocol spec explicitly describes an HTTP 402 flow where a merchant/service returns a 402 with a 'payment IOU,' and after verifying the signed agent payload, 'the Merchant can grant access with the expectation that the funds will be available when settlement occurs' — a genuine machine-payable, checkout-less mechanism (visa-ic-supp-7, visa-ic-supp-6). However, all documentation and the reference implementation (agent-registry, cdn-proxy, merchant-backend) frame this around e-commerce/merchant checkout rather than generic API/service monetization or per-call billing, and there's no dedicated guide for developers wanting to gate an arbitrary API endpoint this way. Missing for 10: explicit API-monetization framing/tutorial, per-call billing/metering support, and independent/hands-on evidence of the 402 flow being used outside merchant checkout scenarios.

   • [claimed-docs] “TAP's signed Agentic Payment Container adapts to the merchant's rail: for guest-checkout key entry it carries a credential hash — "If the ha…”
   • [claimed-docs] “The Trusted Agent Protocol's agent recognition signature is HTTP Message Signatures "defined by RCF 9421" (typo in original), "aligned with …”
   • [claimed-docs] “The TAP spec is public with a runnable reference implementation: "Establishing a universal standard of trust between AI agents and merchants…”
   • [github] “Securely receive key information needed for checkout via query parameters. This can include, as consented by the consumer, verifiable consum…”

   proof ↗⚑ flag

Settlement rails

1. developerSettle agent-initiated payments in stablecoins over documented rails

   weight 2 · round drawn
   PayPal Agentic Commerce—none0/10

   The evidence pack details PayPal's agentic commerce rails extensively (ACP/UCP via Braintree tokens, agent toolkit, cart APIs, webhooks, fees) but none of it mentions stablecoins, PYUSD, crypto, or blockchain-based settlement rails for agent-initiated payments — all documented settlement is via traditional card/Braintree processing and standard PayPal fee schedules.

   • [claimed-docs] “"Agent Ready helps Braintree merchants accept payments from AI shopping assistants across major platforms, including ChatGPT, Google AI Mode…”
   • [claimed-docs] “The ACP path is an in-ChatGPT checkout build: "Implement an MCP server with the `complete_checkout` tool to receive tokens", "Call `requestC…”
   • [claimed-docs] “The UCP path targets Google surfaces: "This enables AI-powered checkout experiences through Google AI Mode (Gemini), where Google Pay return…”
   • [claimed-docs] “The published US commercial rates that agent-initiated orders inherit: "PayPal Checkout" and "PayPal Guest Checkout" at "3.49% +" fixed fee,…”

   proof ↗⚑ flag

   Visa Intelligent Commerce—none0/10

   All evidence describes Visa Intelligent Commerce's card-network rails (tokenized cards, network tokens, VisaNet authorization, passkey-anchored mandates) — there is no mention anywhere of stablecoin settlement, crypto rails, or any non-card settlement currency. The axis applies to a payments product but no evidence supports stablecoin settlement specifically.

   • [claimed-docs] “Secure retrieval and management of network tokens, supporting seamless agentic commerce across multiple payment networks.”
   • [claimed-docs] “Agent-scoped credentials are the core primitive: "Provisioning and life cycle management of agent-specific payment tokens that can be used b…”
   • [claimed-docs] “Spend caps live in the purchase-intent mandate: Initiate a Purchase Intent (POST /acp/v1/instructions) exists "to verify that your agent is …”
   • [claimed-docs] “"Your agents can enroll a customer's card for tokenization during the customer's account registration or when the customer begins a new purc…”

   proof ↗⚑ flag

Wallets

1. ai-native userProvision a wallet my agent holds and spends from — funded and controlled by me, with balance visibility

   weight 3 · round to Visa Intelligent Commerce
   PayPal Agentic Commerce—none0/10

   All evidence describes merchant-side infrastructure (Agent Ready, Store Sync, agent toolkit, cart APIs) that lets AI agents check out with merchants or lets merchants build agents for order/refund/dispute management — none of it describes a consumer-provisioned wallet that a user funds, an agent holds/spends from, with balance visibility. The delegated tokens in ACP/UCP are single-use, merchant-bound checkout credentials, not a persistent user wallet.

   ⚑ flag

   Visa Intelligent Commerce~partialclaimed5/10

   Visa IC lets a consumer enroll/tokenize their card for agent use, set decline-threshold spend limits via mandates, and authenticate/control every agent payment instruction via Passkey — covering 'funded and controlled by me' reasonably well (visa-ic-supp-1, visa-ic-supp-2, visa-ic-supp-3, visa-ic-supp-4). But this is card-linkage/tokenization infrastructure, not a stored-value 'wallet' with its own balance, and there is no evidence of a balance-visibility feature for the end user or agent. Missing for 10: an actual funded wallet construct (vs. tokenized card-on-file), explicit balance-visibility UI/API, and independent confirmation beyond Visa's own docs.

   • [claimed-docs] “Agent-scoped credentials are the core primitive: "Provisioning and life cycle management of agent-specific payment tokens that can be used b…”
   • [claimed-docs] “Human approval is passkey-anchored end to end: provisioning includes "step up verification of the cardholder as well as setting up a Passkey…”
   • [claimed-docs] “Spend caps live in the purchase-intent mandate: Initiate a Purchase Intent (POST /acp/v1/instructions) exists "to verify that your agent is …”
   • [claimed-docs] “"Your agents can enroll a customer's card for tokenization during the customer's account registration or when the customer begins a new purc…”
   • [claimed-docs] “Capture consumer consent, set spending limits, and manage mandates for agent-initiated payments.”

   proof ↗⚑ flag

1. ai-native userControl data retention and deletion

   weight 2 · round drawn
   PayPal Agentic Commerce—none0/10

   The evidence pack covers agentic commerce protocols, cart APIs, webhooks, fees, and toolkit integrations, but contains no mention of data retention policies, deletion controls, or privacy settings that an AI-native user could invoke to manage stored data. This axis plausibly applies to a payments platform handling AI agent transaction data, but no supporting evidence exists.

   ⚑ flag

   Visa Intelligent Commerce—none0/10

   Visa Intelligent Commerce documents consent capture, mandates, spend caps, and even cancellation of a purchase intent, but none of the evidence addresses a user's ability to control data retention periods or request deletion of stored consumer data, tokens, or consent records. Revocation of a 'purchase intent' (visa-ic-supp-3) is a transactional control, not a data-retention/deletion mechanism, so the specific privacy-posture story is unaddressed.

   • [claimed-docs] “Spend caps live in the purchase-intent mandate: Initiate a Purchase Intent (POST /acp/v1/instructions) exists "to verify that your agent is …”
   • [claimed-docs] “Capture consumer consent, set spending limits, and manage mandates for agent-initiated payments.”
   • [claimed-docs] “Human approval is passkey-anchored end to end: provisioning includes "step up verification of the cardholder as well as setting up a Passkey…”

   proof ↗⚑ flag

Ecosystem adoption

1. developerAt least two independent parties beyond the vendor implement the protocol or platform — it is an ecosystem, not a private integration

   weight 2 · round drawn
   PayPal Agentic Commerce—none0/10

   The evidence shows PayPal/Braintree acting as an implementer of protocols defined by other parties (OpenAI's ACP, Google's UCP, and the Anthropic-originated MCP), but nothing shows independent third parties implementing PayPal's own agentic-commerce platform (Cart API, Store Sync, agent toolkit) as an open ecosystem. Merchants and partners (Wix, Shopware, BigCommerce) are consumers/integrators of PayPal's platform, not independent implementers of its protocol.

   • [claimed-docs] “The ACP path is an in-ChatGPT checkout build: "Implement an MCP server with the `complete_checkout` tool to receive tokens", "Call `requestC…”
   • [claimed-docs] “The UCP path targets Google surfaces: "This enables AI-powered checkout experiences through Google AI Mode (Gemini), where Google Pay return…”
   • [claimed-docs] “Store Sync is the full-catalog path, "enabling AI agents to discover your products, create and manage shopping carts, and complete purchases…”
   • [claimed-docs] “Access to PayPal's agentic commerce services is form-gated, not self-serve: merchants must complete a form "to contact the AI team at PayPal…”

   proof ↗⚑ flag

   Visa Intelligent Commerce—none0/10

   All evidence is first-party Visa documentation, GitHub repos owned by Visa, and Visa's own MCP/agent-toolkit; none names a second independent implementer (merchant platform, other network, AI vendor, etc.) building on the protocol. Community commentary even frames the initiative as still 'premature' with no adoption signals cited, so there's no evidence of an ecosystem beyond the vendor.

   • [community] “The Visa/Mastercard announcements are interesting but feel premature. The missing piece is standardized agent identity and capability declar…”
   • [community] “The Visa/Mastercard moves are interesting but I'd bet the real unlock is when businesses start issuing agent-specific cards with embedded po…”
   • [claimed-docs] “The TAP spec is public with a runnable reference implementation: "Establishing a universal standard of trust between AI agents and merchants…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the Trusted Agent Protocol is published in the open — https://raw.githubusercontent.com/visa/trusted-ag…”

   proof ↗⚑ flag

Spec publication

1. developerThe commerce protocol this product speaks is published as an open, versioned specification I can read and implement without signing anything

   weight 3 · round to Visa Intelligent Commerce
   PayPal Agentic Commerce—none0/10

   The evidence pack shows PayPal implements OpenAI's ACP and Google's UCP protocols and tells developers to 'follow the ACP agentic checkout specification,' but never provides or links a version number, license, or spec document for ACP/UCP that a developer could read independently of PayPal. Instead, everything documented is gated: Braintree merchant account required, PayPal AI team form-approval required for agentic commerce services, and separate Google merchant registration required for UCP enablement — none of this evidences an open, versioned, sign-nothing spec.

   • [claimed-docs] “The ACP path is an in-ChatGPT checkout build: "Implement an MCP server with the `complete_checkout` tool to receive tokens", "Call `requestC…”
   • [claimed-docs] “The UCP path targets Google surfaces: "This enables AI-powered checkout experiences through Google AI Mode (Gemini), where Google Pay return…”
   • [claimed-docs] “Access to PayPal's agentic commerce services is form-gated, not self-serve: merchants must complete a form "to contact the AI team at PayPal…”
   • [claimed-docs] “"Agent Ready helps Braintree merchants accept payments from AI shopping assistants across major platforms, including ChatGPT, Google AI Mode…”

   proof ↗⚑ flag

   Visa Intelligent Commerce~partialprobed5/10

   Visa's Trusted Agent Protocol (TAP) is published openly on GitHub with a runnable reference implementation and keyless README access, satisfying 'read without signing' for that layer (visa-ic-probe-rt-1, visa-ic-supp-9, visa-ic-supp-6). However, the core Intelligent Commerce payment protocol (ACP instructions, tokens, credentials) requires a sandbox sign-up form with terms acceptance and 'Contact Visa for fees in Production' for real use, meaning the actual commerce protocol is gated behind registration/agreements, not a freely implementable open spec (visa-ic-supp-10, visa-ic-supp-8). Missing for 10: a single unified, explicitly versioned spec document covering the full commerce protocol (not just TAP) that can be implemented end-to-end without any sandbox registration or production agreement.

   • [probe] “PROBE runtime (recorded 2026-09-14): the Trusted Agent Protocol is published in the open — https://raw.githubusercontent.com/visa/trusted-ag…”
   • [claimed-docs] “The TAP spec is public with a runnable reference implementation: "Establishing a universal standard of trust between AI agents and merchants…”
   • [claimed-docs] “The Trusted Agent Protocol's agent recognition signature is HTTP Message Signatures "defined by RCF 9421" (typo in original), "aligned with …”
   • [claimed-docs] “Merchant-side onboarding starts with a self-serve "Intelligent Commerce Sandbox Sign up" form (Organization ID, company, contact details, te…”
   • [claimed-docs] “Fees, verbatim from FEES & TERMS: "Free to use in Sandbox. Contact Visa for fees in Production." On refunds/disputes the docs stop at eviden…”

   proof ↗⚑ flag

Disputes

1. developerDisputes and chargebacks on agent transactions can be handled via API — evidence submission, status, outcomes

   weight 2 · round to PayPal Agentic Commerce
   PayPal Agentic Commerce~partialclaimed6/10

   The agent toolkit exposes dispute tools — list_disputes, get_dispute, and accept_dispute_claim — plus the general REST API surface explicitly lists 'disputes' alongside orders/payments, giving developers programmatic access to dispute status and resolution outcomes. However, no evidence-submission endpoint (e.g., uploading documents/evidence for a dispute) is documented anywhere in the pack, so the 'evidence submission' part of the story is unsupported. missing for 10: documented evidence-submission API/tool for disputes, and any hands-on/independent confirmation that these dispute tools work end-to-end in production.

   • [claimed-docs] “Post-purchase operations are first-class agent tools: refunds via create_refund / get_refund (a "refund for a captured payment", where "If n…”
   • [claimed-docs] “Integrate with PayPal APIs to access orders, invoices, subscriptions, shipment tracking, transaction details, and dispute management through…”
   • [claimed-docs] “The developer portal's REST API getting-started page anchors the agent surface: "REST APIs, including orders, payments, subscriptions, invoi…”
   • [claimed-docs] “"PayPal's agent toolkit supports the integration of PayPal APIs into AI agent workflows using" Amazon Bedrock, CrewAI, LangChain, MCP, OpenA…”

   proof ↗⚑ flag

   Visa Intelligent Commerce—none0/10

   Evidence explicitly states Visa's docs stop at collecting 'commerce signals' to aid dispute resolution, not a dedicated dispute/chargeback API with evidence submission, status, or outcome endpoints (visa-ic-supp-8). No other citation shows any dispute-specific API surface.

   • [claimed-docs] “Fees, verbatim from FEES & TERMS: "Free to use in Sandbox. Contact Visa for fees in Production." On refunds/disputes the docs stop at eviden…”

   proof ↗⚑ flag

Refunds

1. developerRefunds on agent-placed orders can be initiated and tracked programmatically

   weight 2 · round to PayPal Agentic Commerce
   PayPal Agentic Commerce~partialprobed6/10

   The Agent Toolkit exposes create_refund/get_refund tools and dispute tools (list_disputes, get_dispute, accept_dispute_claim) so refunds on agent-placed orders can be initiated and tracked programmatically via MCP/LangChain/etc., backed by the underlying PayPal REST orders/disputes API and webhooks for status updates. However, the docs don't specifically address refund flows tied to the new agentic-commerce cart/checkout (ACP/UCP) orders, and there's no independent hands-on confirmation of refund success for agent-originated transactions. missing for 10: explicit documentation linking refund/dispute tools to agent-placed (ACP/UCP/Store Sync) orders specifically, and independent/hands-on verification of the refund tracking flow.

   • [claimed-docs] “Post-purchase operations are first-class agent tools: refunds via create_refund / get_refund (a "refund for a captured payment", where "If n…”
   • [claimed-docs] “"PayPal's agent toolkit supports the integration of PayPal APIs into AI agent workflows using" Amazon Bedrock, CrewAI, LangChain, MCP, OpenA…”
   • [claimed-docs] “"Webhooks are HTTPS posts from PayPal to an endpoint on your server whenever the corresponding event type occurs" — "Up to 10 webhook URLs m…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the PayPal Agent Toolkit resolves on the public npm registry (npm view @paypal/agent-toolkit → 1.11.0, …”
   • [claimed-docs] “The developer portal's REST API getting-started page anchors the agent surface: "REST APIs, including orders, payments, subscriptions, invoi…”

   proof ↗⚑ flag

   Visa Intelligent Commerce—none0/10

   Evidence explicitly states Visa Intelligent Commerce docs 'stop at evidence capture, not a dispute API' — there's only an optional 'policies.refundPolicy' metadata field attached to a credential request and generic 'commerce signals' for dispute resolution, not a programmatic refund initiation/tracking endpoint or status API for agent-placed orders.

   • [claimed-docs] “Fees, verbatim from FEES & TERMS: "Free to use in Sandbox. Contact Visa for fees in Production." On refunds/disputes the docs stop at eviden…”
   • [claimed-docs] “Credentials are scoped to an authenticated instruction: retrieval is POST /acp/v1/instructions/{instructionID}/credentials, and the request …”

   proof ↗⚑ flag

Agent identity

1. merchantAgents identify themselves verifiably — registered profiles, signatures, or trust tiers — so I can tell trusted agent traffic from anonymous bots

   weight 3 · round to Visa Intelligent Commerce
   PayPal Agentic Commerce—none0/10

   PayPal's docs describe payment-token authentication (Braintree single-use tokens bound to merchant ID), PayPal-issued JWTs for verifying that requests come from PayPal's own Shopping Cart service, and webhook signature verification — but none of this constitutes a verifiable agent identity system (no registered agent profiles, agent-level signatures, or trust tiers that would let a merchant distinguish which specific AI agent or bot is originating traffic). The authentication documented is merchant-to-PayPal or PayPal-to-merchant channel security, not agent-to-merchant identity/trust signaling.

   • [claimed-docs] “Cart execution is a reverse API the merchant hosts: POST /merchant-cart "Creates a new cart with the provided PayPalCart object. This is cal…”
   • [claimed-docs] “The ACP path is an in-ChatGPT checkout build: "Implement an MCP server with the `complete_checkout` tool to receive tokens", "Call `requestC…”
   • [claimed-docs] “"Webhooks are HTTPS posts from PayPal to an endpoint on your server whenever the corresponding event type occurs" — "Up to 10 webhook URLs m…”
   • [probe] “PROBE runtime (recorded 2026-09-14): PayPal's remote MCP server is live — a keyless JSON-RPC initialize POST to https://mcp.paypal.com/mcp a…”

   proof ↗⚑ flag

   Visa Intelligent Commerce✓fullprobed8/10

   Visa's Trusted Agent Protocol gives merchants a concrete verifiable-identity mechanism: RFC9421 HTTP message signatures tagged 'agent-browser-auth'/'agent-payer-auth', anti-replay nonces/timestamps, verification against Visa's public JWKS, and an open reference implementation that includes an 'agent-registry' component explicitly described as letting merchants 'instantly distinguish a legitimate, credentialed agent from an anonymous bot' and confirm it acts on behalf of an authenticated user. This is corroborated by a runtime probe showing the spec and reference repo are live and publicly accessible, going beyond marketing copy. Missing for 10: independent/production adoption evidence beyond Visa's own repo and probes, and clearer merchant-facing tooling for classifying agents into explicit 'trust tiers' rather than a binary signed/unsigned check.

   • [github] “By presenting a secure digital signature with every interaction, a merchant can verify that an agent is legitimate and has the user's permis…”
   • [github] “This allows you to confidently welcome agent-driven commerce while protecting your site from harmful bots.”
   • [claimed-docs] “including the cryptographic standards (RFC9421), required message signature fields, and the process for validating an agent's intent.”
   • [claimed-docs] “The Trusted Agent Protocol's agent recognition signature is HTTP Message Signatures "defined by RCF 9421" (typo in original), "aligned with …”
   • [claimed-docs] “TAP's signed Agentic Payment Container adapts to the merchant's rail: for guest-checkout key entry it carries a credential hash — "If the ha…”
   • [claimed-docs] “The TAP spec is public with a runnable reference implementation: "Establishing a universal standard of trust between AI agents and merchants…”
   • [probe] “PROBE runtime (recorded 2026-09-14): the Trusted Agent Protocol is published in the open — https://raw.githubusercontent.com/visa/trusted-ag…”

   proof ↗⚑ flag

Human oversight

1. ai-native userSensitive agent spending requires my documented approval — a confirmation step, signed mandate, or per-purchase consent — before money moves

   weight 3 · round to Visa Intelligent Commerce
   PayPal Agentic Commerce~partialclaimed5/10

   PayPal's ACP/UCP flows use single-use, time- and amount-bound delegated tokens tied to a specific merchant and transaction, and the toolkit docs explicitly recommend 'human oversight' for judgment-sensitive actions — both suggest transaction-level guardrails rather than fully autonomous spending. However, the evidence never documents an explicit user-facing confirmation screen, signed mandate artifact, or per-purchase consent UI shown to the end user before the token is used to move money; the checkout flow (requestCheckout/Instant Checkout) is described only at a technical/token level, not from the consent-UX perspective. Missing for 10: an explicit documented consent/confirmation step or mandate artifact shown to the payer, and any independent/hands-on confirmation that this consent step actually blocks unauthorized charges.

   • [claimed-docs] “The ACP path is an in-ChatGPT checkout build: "Implement an MCP server with the `complete_checkout` tool to receive tokens", "Call `requestC…”
   • [claimed-docs] “The UCP path targets Google surfaces: "This enables AI-powered checkout experiences through Google AI Mode (Gemini), where Google Pay return…”
   • [claimed-docs] “"PayPal's agent toolkit supports the integration of PayPal APIs into AI agent workflows using" Amazon Bedrock, CrewAI, LangChain, MCP, OpenA…”
   • [claimed-docs] “Cart execution is a reverse API the merchant hosts: POST /merchant-cart "Creates a new cart with the provided PayPalCart object. This is cal…”

   proof ↗⚑ flag

   Visa Intelligent Commerce✓fullclaimed8/10

   Visa Intelligent Commerce documents passkey-anchored authentication of payment instructions, per-purchase mandates with declineThreshold caps and consumerPrompt confirmation text, credential requests scoped to specific merchant/amount, and a Trusted Agent Protocol signature scheme validating agent intent before authorization — collectively a documented consent/mandate flow gating money movement. missing for 10: independent hands-on verification that the consent/mandate flow works end-to-end in production (product still carries a 'in process of development and deployment' caveat) and no third-party audit of the passkey step-up UX.

   • [claimed-docs] “Human approval is passkey-anchored end to end: provisioning includes "step up verification of the cardholder as well as setting up a Passkey…”
   • [claimed-docs] “Spend caps live in the purchase-intent mandate: Initiate a Purchase Intent (POST /acp/v1/instructions) exists "to verify that your agent is …”
   • [claimed-docs] “"Your agents can enroll a customer's card for tokenization during the customer's account registration or when the customer begins a new purc…”
   • [claimed-docs] “Credentials are scoped to an authenticated instruction: retrieval is POST /acp/v1/instructions/{instructionID}/credentials, and the request …”
   • [claimed-docs] “The Trusted Agent Protocol's agent recognition signature is HTTP Message Signatures "defined by RCF 9421" (typo in original), "aligned with …”
   • [claimed-docs] “Controls to ensure that the agent’s purchasing actions and the related authorizations align with the user’s authenticated instruction”
   • [claimed-docs] “Agent-scoped credentials are the core primitive: "Provisioning and life cycle management of agent-specific payment tokens that can be used b…”

   proof ↗⚑ flag

Liability

1. merchantThe fraud, liability, and chargeback rules for agent-initiated transactions are documented so I know who bears the risk

   weight 2 · round to Visa Intelligent Commerce
   PayPal Agentic Commerce—none0/10

   Evidence shows general dispute-management and refund tools (list_disputes, accept_dispute_claim, create_refund) and standard PayPal fee/webhook docs, but nothing documents fraud, liability, or chargeback allocation specifically for agent-initiated transactions (e.g., who bears risk when a delegated token or AI agent purchase is disputed). The delegated-token docs mention tokens are 'bound to your merchant ID' but stop short of stating liability shift or chargeback rules for agent-driven checkouts.

   • [claimed-docs] “Post-purchase operations are first-class agent tools: refunds via create_refund / get_refund (a "refund for a captured payment", where "If n…”
   • [claimed-docs] “The ACP path is an in-ChatGPT checkout build: "Implement an MCP server with the `complete_checkout` tool to receive tokens", "Call `requestC…”
   • [claimed-docs] “The published US commercial rates that agent-initiated orders inherit: "PayPal Checkout" and "PayPal Guest Checkout" at "3.49% +" fixed fee,…”
   • [claimed-docs] “"Webhooks are HTTPS posts from PayPal to an endpoint on your server whenever the corresponding event type occurs" — "Up to 10 webhook URLs m…”

   proof ↗⚑ flag

   Visa Intelligent Commerce~partialclaimed3/10

   Docs describe extensive fraud-prevention plumbing (passkey authentication, mandates, TAP signatures) but the only mention of chargebacks/disputes explicitly stops at 'commerce signals... allow for quick resolution of most disputes' rather than a documented liability-shift or chargeback-allocation policy, and explicitly notes there is no dispute API. Missing for 10: explicit statement of who bears fraud/chargeback liability (merchant vs. issuer vs. cardholder) for agent-initiated transactions, documented dispute resolution process/API, and any liability-shift terms analogous to EMV rules.

   • [claimed-docs] “Fees, verbatim from FEES & TERMS: "Free to use in Sandbox. Contact Visa for fees in Production." On refunds/disputes the docs stop at eviden…”
   • [claimed-docs] “Human approval is passkey-anchored end to end: provisioning includes "step up verification of the cardholder as well as setting up a Passkey…”
   • [claimed-docs] “The Trusted Agent Protocol's agent recognition signature is HTTP Message Signatures "defined by RCF 9421" (typo in original), "aligned with …”

   proof ↗⚑ flag

Spend controls

1. ai-native userSet per-agent spend caps and usage limits and revoke an agent's payment authority instantly

   weight 2 · round to Visa Intelligent Commerce
   PayPal Agentic Commerce—none0/10

   Evidence shows per-transaction delegated tokens with configurable amount/time restrictions bound to a merchant (paypal-ac-supp-acp-chatgpt), but nothing about a user or merchant setting persistent per-agent spend caps/usage limits across multiple transactions, or an instant revoke-authority mechanism for a given agent's payment access. No dashboard, API, or docs reference for agent-level authorization management or revocation is present.

   • [claimed-docs] “The ACP path is an in-ChatGPT checkout build: "Implement an MCP server with the `complete_checkout` tool to receive tokens", "Call `requestC…”
   • [claimed-docs] “The UCP path targets Google surfaces: "This enables AI-powered checkout experiences through Google AI Mode (Gemini), where Google Pay return…”
   • [claimed-docs] “Cart execution is a reverse API the merchant hosts: POST /merchant-cart "Creates a new cart with the provided PayPalCart object. This is cal…”

   proof ↗⚑ flag

   Visa Intelligent Commerce~partialclaimed7/10

   Docs show concrete mandate mechanics — declineThreshold spend caps, effectiveUntilTime, and a documented 'cancel a purchase intent' revocation path — plus passkey-gated instruction authentication and per-request credential scoping to merchant/amount, which together implement caps and a revocation-like control. However, evidence covers per-purchase-intent caps/cancellation rather than a persistent 'agent-wide spend cap + instant kill-switch' dashboard, and the product itself is flagged as still 'in the process of development and deployment.' Missing for 10: consumer-facing UI/API for setting ongoing per-agent usage limits (not just per-transaction mandates), explicit 'revoke all future authority instantly' mechanism beyond canceling a single intent, and independent/hands-on confirmation of revocation latency.

   • [claimed-docs] “Spend caps live in the purchase-intent mandate: Initiate a Purchase Intent (POST /acp/v1/instructions) exists "to verify that your agent is …”
   • [claimed-docs] “Human approval is passkey-anchored end to end: provisioning includes "step up verification of the cardholder as well as setting up a Passkey…”
   • [claimed-docs] “Agent-scoped credentials are the core primitive: "Provisioning and life cycle management of agent-specific payment tokens that can be used b…”
   • [claimed-docs] “Credentials are scoped to an authenticated instruction: retrieval is POST /acp/v1/instructions/{instructionID}/credentials, and the request …”
   • [claimed-docs] “Capture consumer consent, set spending limits, and manage mandates for agent-initiated payments.”

   proof ↗⚑ flag