Protocols
The agent protocols Datalayer targets, one spec each under agentspecs/protocols/.
An agent spec or an application lists the ones it speaks in protocols; an
application may not list a planned one, and its pap, pact, signed_fetch and
a2a blocks are refused unless their protocol is listed.
| Protocol | Id | Layer | Publisher | Version implemented | Status | Connects to | Appspec block |
|---|---|---|---|---|---|---|---|
| Agent2Agent | a2a | transport | Google, now the Linux Foundation | 1.0 | shipped | Other agents, each at its address with its Agent Card | a2a |
| Model Context Protocol | mcp | transport | Anthropic | 2026-07-28 (Python), 2025-11-25 (TypeScript) | shipped | Tools, resources and prompts served by MCP servers | |
| Personal Agent Consent & Trust | pact | consent | Decagon, Instinct | 1.0 | shipped | Businesses' agents, asked for a person with their delegation | pact |
| Personal Agent Protocol | pap | consent | Sierra, Meta | draft 0.3 | shipped | Companies, as a person's agent there, or being one | pap |
| Trusted Agent Protocol | tap | identity | Visa | draft (Merchant Specifications, read 2026-10-13) | shipped | Merchants that recognise an agent by its signature | |
| Web Bot Auth | web-bot-auth | identity | Cloudflare (IETF draft) | draft-ietf-webbotauth-httpsig-protocol-00 | shipped | Websites, which can tell the application's requests from someone pretending | signed_fetch |
| Agentic Commerce Protocol | acp | commerce | OpenAI, Stripe | 2026-04-17 | shipped | Sellers, to check out with a delegated payment | |
| Universal Commerce Protocol | ucp | commerce | Google, with Shopify and retailers | 2026-08-25 | shipped | Merchants, to search, check out and follow orders | |
| A2UI | a2ui | ui | 0.9 | shipped | The person, through components an answer draws | ||
| AG-UI | ag-ui | ui | CopilotKit | 0.0.57 (@ag-ui/core) | shipped | The page a person talks to the agent on |
Each protocol
Agent2Agent (a2a)
How agents talk to agents: teams and scenes talk over it, an application's route serves it, and its Agent Card advertises its extensions.
- Python:
fasta2a,a2a-sdk - TypeScript:
@a2a-js/sdk
A2UI (a2ui)
How an agent's answer becomes an interface: components the host renders from a declarative surface.
- Python:
agent-runtimes - TypeScript:
@a2ui/react,@a2ui/web_core
Agentic Commerce Protocol (acp)
Checkout sessions at a seller, completed with a payment the model never sees. In applications at test merchants only, with no real payment token (decided 2026-10-13): each purchase asked of the person first, made at most once.
- Python:
agent-runtimes - TypeScript:
@datalayer/agent-runtimes - Its tools' action classes:
protocol-tools/agentic-commerce.yaml
AG-UI (ag-ui)
How an agent streams its run to a page: messages, tool calls and state as events.
- Python:
ag-ui-protocol - TypeScript:
@ag-ui/client,@ag-ui/core
Model Context Protocol (mcp)
How an agent calls tools and reads resources: clients and servers in both languages, and the MCP gateway every connection goes through.
- Python:
mcp - TypeScript:
@modelcontextprotocol/sdk,@mcp-ui/client
Personal Agent Consent & Trust (pact)
A personal agent asking a business's agent over A2A, first as itself, then for a person who delegated some of their permissions.
- Python:
agent-runtimes - TypeScript:
@datalayer/agent-runtimes - Its tools' action classes:
protocol-tools/pact.yaml
Personal Agent Protocol (pap)
A person's agent working with a company for them — signed out, then signed in at the company, its changes confirmed by the person — and an application being a company personal agents reach.
- Python:
personal-agent-protocol - TypeScript:
@datalayer/personal-agent-protocol - Its tools' action classes:
protocol-tools/pap.yaml
Trusted Agent Protocol (tap)
An agent-recognition profile over Web Bot Auth for merchants: a signature tagged agent-browser-auth to browse or agent-payer-auth to pay. Still a draft profile, built from Visa's public Merchant Specifications (2026-10-13) until Visa confirms it. In applications at test merchants only (decided 2026-10-14): the MCP gateway signs each UCP or ACP purchase with agent-payer-auth under the application's own key, and the test merchants verify it; browsing stays Web Bot Auth.
- Python:
agent-runtimes - TypeScript:
@datalayer/agent-runtimes,http-message-sig
Universal Commerce Protocol (ucp)
Shopping at a merchant: catalogue, checkout and orders, every purchase an exact proposal the person approves. In applications at test merchants only, with no real payment (decided 2026-10-13): each purchase asked of the person first, made at most once.
- Python:
ucp-sdk,agent-runtimes - TypeScript:
@ucp-js/sdk,@datalayer/agent-runtimes - Its tools' action classes:
protocol-tools/ucp.yaml
Web Bot Auth (web-bot-auth)
Signed outbound requests (RFC 9421) and the key directory a website checks them against. In applications, every request to a company, business or merchant is signed, and a signed fetch reads pages at the sites an application names, GET only (decided 2026-10-13).
- Python:
agent-runtimes - TypeScript:
@datalayer/agent-runtimes,web-bot-auth - Its tools' action classes:
protocol-tools/signed-fetch.yaml