AP2 Has 3,270 Stars and No Package. @x402/core Had 1,940,555 Downloads.

1,940,555. That is how many times npm served @x402/core from October 11 through November 9, 2026.

@ucp-js/sdk, the package the Universal Commerce Protocol’s JavaScript README tells you to install, had 65,082 downloads in the same window. Dividing those two counters gives 29.8. ACP and AP2 are not in the division. Their official repositories do not name a registry package. AP2 had 3,270 stars at 07:48 GMT on November 11 anyway.

The November 10 version note says which snapshot to pin. This page says which repository a package manager actually fetched. Checkout behavior, which neither number is, stays on Can an AI shopping agent check out for you? and the shopping-agents report. Daily refresh of a different package set is the downloads tracker. Bookmarks for agent frameworks, not these four repos, are the stars tracker.

Which repository is the protocol, and which package does its README name?

The protocol org’s README decides the package. A name that merely sounds like the protocol does not.

Stars and forks were read at 07:48:15–07:48:17 GMT. The commit window is the commits API with since=2026-08-13T00:00:00Z, which GitHub documents as commits after that instant. August 13 at 00:00 UTC is 90 days before November 11 at 00:00 UTC. The requests ran at 07:44 GMT, so the morning of November 11 is inside the count. Contributor totals are the last page of the contributors list with anon=1, read at 07:41 GMT for these four repos. That list can include bots. It is the list GitHub returned.

x402 is the active repository. 401 commits, the newest at 2026-11-10T17:05:41Z, message starting refactor(core): share facilitator initialization across HTTP middleware. UCP’s spec repo is also moving. 104 commits, the newest at 2026-11-11T05:03:09Z, docs(food): update ucp.dev for Food Checkout launch. ACP’s newest commit is still July 18. AP2’s newest commit on main is April 29, fix: remove uvlock. AP2’s pushed_at is June 17, 2026, which is before this window and later than that April commit. This count is the default branch.

The UCP packages live in two other repositories, both in the same org, both describing themselves as the official SDK:

Main is ahead of the registry and not ahead of the schema string the README cares about. The js-sdk package.json on main says 0.6.0. npm’s dist-tags.latest is 0.5.1. The python pyproject.toml on main says 0.6.0. PyPI’s latest is 0.5.0. Both READMEs map 0.5.x and 0.6.x to UCP schema 2026-08-25. The unpublished bump is not a new spec date. The spec repo’s November 11 commit is also not inside the tarball npm will hand you.

What did the registries return for October 11 through November 9?

The npm point API named the window. Last-month is October 11 through November 9. Last-week is November 3 through November 9. November 10 and November 11 are outside it. PyPI’s comparison column is the sum of without_mirrors daily rows for those same dates, not the recent endpoint.

@x402/core is 29.8 times @ucp-js/sdk on the month, 1,940,555 against 65,082. On the week it is 30.9 times, 546,580 against 17,692. The rank did not flip. Python is the same shape at a smaller scale. x402 had 320,715 downloads without mirrors. ucp-sdk had 13,500. That is 23.8 times. Do not add the PyPI figure to the npm figure. They are different registries, and one install that fetches both is two file requests.

The x402 README’s minimal client line is npm install @x402/core @x402/evm @x402/svm @x402/fetch. The minimal server line swaps in @x402/express. Those extra names, same window, not added to 1,940,555:

@x402/core is larger than @x402/evm by 636,863. Some installs fetch the core tarball without the EVM package. Adding the column would still double-count the installs that fetch both. The Go line in the same README, go get github.com/x402-foundation/x402/go/v2, has no download count in this note.

The pypistats recent endpoint, read at 07:45:30 GMT, does not name dates. It returned last_month 204,765 for x402 and 8,621 for ucp-sdk, and last_week 69,074 and 2,686. The week is close to the dated sum. The month is not. 204,765 is not 320,715. This note keeps the dated sum in the table and does not split the difference.

Two names that are not the protocol org:

@coinbase/x402 had 312,060 npm downloads in the dated month and 78,819 in the week. Version 2.1.0 was published 2025-12-23. The registry repository is coinbase/x402, which at 07:41:55 GMT was a fork of x402-foundation/x402 with 182 stars. The foundation README does not list this package in the install block. It is Coinbase’s facilitator. Pairing its 312,060 downloads with the foundation’s 6,797 stars, or adding them to @x402/core, would invent a second install base.

What is the stars-to-downloads ratio?

The ratio is last-month file requests divided by stargazers_count, for the repository the package’s own metadata names. One star to N downloads. A pairing that uses a different repository is shown once, as the mistake.

285.5 is 1,940,555 divided by 6,797. 1,328.2 is 65,082 divided by 49. The JavaScript SDK looks “more installed per star” only because its stars sit on a 49-star repo. Move the same 65,082 onto the spec repo people actually bookmark and the ratio falls to 18.6. That fall is the bookmark. It is not a collapse in downloads.

AP2 is the clean case of the opposite error. 3,270 is 93.7 percent of UCP’s 3,490. The forks are even closer the other way, 518 against 493. A star chart ranks them as peers. The install line does not. One has a September tarball. The other tells you to pip-install a git URL, and then tells you the PyPI package is future tense.

Which spec version would you pin today?

Pin a release, then check that the package you imported is that release. On November 11 those are four different strings.

x402’s SDK version and the spec file’s version are not the same number. The packages you install are 2.30.0 and 2.27.0. The specification markdown on main still says Protocol Version 1, and specs/transports-v2/ is a separate directory. This note does not collapse those into one version string. There is also no GitHub Release object. The releases list was empty and releases/latest returned 404. The version a package manager will resolve is the registry version.

UCP’s release tag and the SDK’s published version do point at the same schema, 2026-08-25, and the repo has kept committing. 79 commits after the tag is a moving main. The November 10 version note already said not to code against main. The download count is a reason to repeat it. The 65,082 fetches were of 0.5.1, a September tarball mapped to the August schema, not of whatever landed at 05:03 UTC this morning.

ACP has the opposite calm. Zero commits since August 13 means the April 17 folder is not being quietly rewritten on main. It does not mean OpenAI’s checkout example and that folder are the same string. This page did not re-fetch the checkout spec’s Last-Modified header. The November 10 note is the place that header was read.

What do the web scans say, and what do they not say?

Installs and public endpoints rank these protocols differently. Both counts are real. They answer different questions.

agent economy’s scan, read November 11, says it was updated November 5, 2026 UTC, for the data week of November 2. Of 115,468 domains, the page lists UCP on 5,429, ACP on 32, x402 on 7, and AP2 on 4. The same page says the UCP check is a loose heuristic and the 5,429 should be treated as a suspected over-count. It also says a share of all crawled domains is the wrong denominator for a payment header, and that the shares are not a ranking across standards. Read that way, the useful contrast is narrow. x402’s 1,940,555 npm downloads and 7 matched domains are not a contradiction until someone adds them. A library install does not publish a 402 response on a homepage. A homepage match does not run npm install.

spck.dev’s State of UCP, read the same day, says it is independent and not affiliated with the UCP maintainers. Its population probe is dated 2026-08-13: 3,037 verified domains, 2,957 with a valid profile, 99.5 percent of those on *.myshopify.com, and 15 endpoints it calls deliberate and self-hosted. A re-probe of eight named launch partners on 2026-10-13 found one discovery profile, at www.chewy.com, advertising version 2026-01-23. The page’s own registry and star figures are dated 2026-10-11. They are an earlier reading. They are not the 3,490 stars or the 65,082 downloads above. The part that survives that gap is the distinction the page draws and this note’s download count cannot: a Shopify-provisioned profile is not a developer running npm install @ucp-js/sdk, and neither is a completed checkout.

What should a builder or a merchant integrate first?

If you sell on a channel that has already named a protocol, integrate that protocol and pin the release. UCP’s pin is v2026-08-25. The package that matches it on npm today is @ucp-js/sdk@0.5.1, not whatever main says. ACP’s pin is spec/2026-04-17, and you will be copying schemas or following OpenAI’s and Stripe’s docs, because there is no official package to add. The shopping report is the dated record of which companies have said they will take the order. This table cannot overrule a channel.

If the job is an API that should answer 402 Payment Required and settle through the x402 flow, install @x402/core and the chain package the README names next to it, or pip install x402. That is the only row in this set with a registry release from November 4, a triple-digit commit count since August 13, and an install line a package manager can resolve without a git URL. Budget a facilitator separately. @coinbase/x402 is one official facilitator package, last published December 23, 2025, and its 312,060 downloads are not the core SDK. The spec file still says Protocol Version 1. Read that file before you treat 2.30.0 as the spec version.

Do not start with AP2 because the star count sits next to UCP. 3,270 stars, 0 commits on main since August 13, release v0.2.0 from April 28, and a README that still describes PyPI as later. When a card network or a merchant you actually clear through requires an AP2 mandate, pin v0.2.0 and install from the git URL the README prints, or wait for the package the README says is coming. Do not pip install ap2. That name is a different repository.

A star is a bookmark. A download is a file request. A domain with a /.well-known/ucp document is a third thing, and on the August scan most of those documents were one platform turning the file on. None of the three is a count of carts that completed. The agentic checkout glossary is the definition. The number that tells you a protocol is being imported, today, is 1,940,555, and it belongs to @x402/core.