The agentic commerce stack is a seven-layer reference taxonomy that maps every category of vendor sitting between an AI agent and a completed purchase. The layers run from AI platforms and surfaces at the top, through protocols, payments and identity, card issuance, checkout execution, merchant enablement and discovery, down to trust and security. The framework was published by checkout-execution startup Rye in 2025 and extended in Insignia Business Review's April 24, 2026 analysis, which adds a value-accrual thesis. More than 50 named companies are building across the stack as of early 2026, with roughly $50 million in disclosed Series A and B funding concentrated in the payments-and-identity layer alone (Basis Theory $33M, Skyfire $9.5M, Nekuda $5M). This piece walks each layer, names the working companies, lists their funding where disclosed, and notes the maturity of each segment. It also identifies where cross-chain stablecoin orchestration fits as a sublayer beneath payments and identity, and which layers Insignia argues will capture durable economic rent.
​

The agentic commerce stack is a seven-layer architecture organizing every vendor in the path from an AI agent's intent to a completed merchant transaction. Layer 1 hosts the agent surface; Layer 2 carries protocol messages; Layer 3 handles payments and identity; Layer 4 issues cards; Layer 5 executes checkout; Layer 6 supplies merchant catalogs; Layer 7 verifies trust.
​

The 7-layer agentic commerce stack is the dominant reference taxonomy for the category. Rye, a checkout-execution vendor whose product sits at Layer 5, codified the framework in a company blog post that has become the canonical citation for "what is the agentic commerce stack." Each layer maps to a distinct vendor cluster with distinct economics. The top layer (AI platforms) is dominated by a handful of model labs. The middle layers (protocols, payments, card issuance, checkout, merchant enablement) hold most of the active 2025–2026 startup funding. The bottom layer (trust and security) hosts large incumbents (Cloudflare, Akamai, HUMAN Security) plus chargeback and fraud specialists.
​

Scope and scale are both expanding. McKinsey's QuantumBlack October 2025 study projects $3 trillion to $5 trillion in global retail spend orchestrated by agentic commerce by 2030. Adobe Analytics measured a 4,700% year-over-year increase in generative-AI traffic to US retail sites between July 2024 and July 2025. The vendor stack supporting that traffic has expanded in lockstep: more than 50 named companies are now building production infrastructure across the seven layers, including roughly $50 million of 2025-vintage Series A and B funding concentrated in payments and identity (Layer 3). For a deeper definition of the category itself, the 2026 guide to agentic commerce covers the buyer-side mechanics; this article goes deep on the supplier side.
​

An end-to-end agent purchase touches at least four of the seven layers. The agent surface (Layer 1) routes a goal; the protocol (Layer 2) carries discovery and checkout messages; payments and identity (Layer 3) authorizes the spend; a card issuer (Layer 4) or a stablecoin rail moves the money. Trust and security (Layer 7) signs every step.
​

The 7-layer agentic commerce stack is composable, not monolithic. A typical purchase moves top-to-bottom but skips a layer or two depending on the merchant. ChatGPT Instant Checkout, while it ran from September 2025 to March 2026, used Layers 1, 2, 3, and 7 — the agent surface (OpenAI), the protocol (ACP), the payment rail (Stripe), and a trust layer (Stripe Radar plus account-level abuse controls). It skipped Layer 5 (checkout execution) because Stripe accepted the Shared Payment Token directly, and skipped Layer 6 (merchant enablement) because Etsy and the dozen Shopify merchants on ACP exposed catalogs natively.
​

The composition gets richer for x402-style machine-to-machine payments. Coinbase's x402 protocol (Layer 2) sits over a stablecoin settlement layer (a sublayer beneath Layer 3), with no card issuer and minimal merchant-enablement footprint. By April 2026, x402 had registered approximately 69,000 active agents and 165 million transactions. For a longer technical breakdown, see the x402 protocol explainer and the wider agentic payments overview.
​

Composition also explains why most large retailers are integrating with multiple Layer 2 protocols in parallel. ACP, UCP, AP2, MCP, and Visa TAP each cover different slices of the stack; a merchant that supports only one is reachable by a narrower set of agents. The agent payment protocols comparison details the overlap.
​

Layer 1 is where shopping journeys originate. The platforms hosting agent surfaces are OpenAI (ChatGPT), Google (Gemini, AI Mode), Anthropic (Claude), Perplexity (Comet browser), Amazon (Rufus), Microsoft (Copilot, Azure AI Foundry), and Meta. Each surface decides which protocols it speaks and which merchants its agents can transact with.
​

The Layer 1 cohort is small, well-funded, and fast-moving. Six platforms account for nearly all consumer agent traffic as of early 2026.
​

OpenAI launched Instant Checkout on September 29, 2025 with Etsy and a small Shopify cohort. CNBC reported that OpenAI retired Instant Checkout in March 2026, replacing it with retailer-specific apps inside ChatGPT (Walmart, Target, and Instacart at launch). OpenAI co-developed ACP with Stripe.
​

Google's agent surfaces ship inside Gemini and Search AI Mode. The company backs three Layer 2 protocols: UCP (announced at NRF 2026), AP2, and A2A. UCP launch partners include Walmart, Target, Best Buy, Etsy, PayPal, Visa, Stripe, and American Express.
​

Anthropic originated MCP, the agent-to-tool data plane, and donated MCP to the Linux Foundation's Agentic AI Foundation in December 2025, co-founded with Block and OpenAI. Claude is the model behind Amazon's Buy for Me agent.
​

Perplexity's Comet browser embeds an agent that reads pages on the user's behalf and can complete checkouts on supported merchants. Comet was among the first browser-native agent surfaces to ship to general consumer availability, going free worldwide in October 2025.
​

Amazon's Q4 2025 earnings call disclosed Rufus reached more than 300 million customers and was on a roughly $12 billion incremental annualized run-rate by year-end. Buy for Me grew from 65,000 SKUs at its April 2025 launch to over 500,000 by late 2025.
​

Microsoft's commerce surface lives inside Copilot. Azure AI Foundry exposes A2A endpoints for enterprise agent-to-agent commerce. Microsoft Agent Framework 1.0 went GA on April 3, 2026 with a .NET A2A SDK.
​

Meta runs LLaMA-based commerce agents inside its consumer surfaces (Instagram, WhatsApp). Public deployment data is thinner than for OpenAI or Google, but Meta is on the named-platform list in Rye's framework.
​

Layer 2 is the communication plane. Six protocols define the working stack as of April 2026: ACP from OpenAI and Stripe, UCP from Google, AP2 from Google with payment networks, MCP from Anthropic and the Linux Foundation, A2A from Google, and Visa TAP. Most production deployments compose two or three of these together rather than picking one.
​

The Layer 2 cohort is the most negotiated tier in the 7-layer agentic commerce stack. Each protocol covers a different slice of the discovery, authorization, payment, or trust workflow.
​

OpenAI and Stripe co-developed ACP, the protocol that powered ChatGPT Instant Checkout from September 2025 to March 2026. The core primitive is a Shared Payment Token (SPT) — a merchant-scoped, amount-bounded, single-use credential issued by the buyer's payment provider. The agent passes the SPT to the merchant; the merchant runs it through Stripe.
​

Google announced UCP at NRF 2026 with backing from Shopify, Walmart, Target, Best Buy, Etsy, PayPal, Visa, Stripe, and American Express. UCP is broader than ACP — it covers product discovery, capability negotiation, checkout, and post-purchase handoff. The UCP explainer covers the technical scope.
​

AP2 separates user authorization from payment execution using cryptographic mandates signed by the user's wallet or identity provider. Google announced AP2 in September 2025 with 60+ launch partners including Adyen, American Express, Coinbase, Mastercard, and PayPal. UCP composes with AP2 for the payment step.
​

Anthropic open-sourced MCP in November 2024. It runs over JSON-RPC 2.0 and standardizes how an agent discovers and calls tools (search, query, read) exposed by any compliant server. Anthropic donated MCP to the Linux Foundation's Agentic AI Foundation in December 2025, with Block and OpenAI as co-founders. MCP sits upstream of every commerce protocol in active use.
​

Google launched A2A on April 9, 2025 with 50+ launch partners; the Linux Foundation press release on April 9, 2026 confirmed 150+ organizations in production. A2A standardizes one agent delegating a task to another. A2A x402 is the production extension that pairs A2A messaging with x402 stablecoin settlement.
​

Visa launched TAP on October 14, 2025 with Cloudflare. TAP signs the agent's identity into HTTP request headers; merchants verify against Visa's directory. Early implementers include Adyen, Ant International, Checkout.com, Coinbase, Fiserv, Microsoft, Shopify, Stripe, and Worldpay.
​

Layer 3 is the financial-rail and authorization layer. Network incumbents (Visa, Mastercard, PayPal) and processors (Stripe, Adyen, Checkout.com) compete with a well-funded startup tier. Roughly $50 million in disclosed Series A and B funding concentrated in three startups (Basis Theory, Skyfire, Nekuda) reflects the bet that the layer between protocols and rails is where new vendors can build defensibility.
​

The Layer 3 startup cohort is the most heavily funded segment of the 7-layer agentic commerce stack outside the AI labs themselves. The four named startups concentrate on different slices: tokenization and vault infrastructure (Basis Theory), agent payment-method abstraction (Skyfire), agent identity and KYC (Nekuda, Prava), and agent-card orchestration (PayOS).
​

Tokenization and vault infrastructure for agent payments. Basis Theory raised a $33 million Series B in October 2025 led by Costanoa Ventures. The company also seeded the Agentic Commerce Consortium (with Lithic, Crossmint, Skyfire, Rye, Channel3, and others), which publishes security standards across Layers 3, 4, 5, and 7.
​

Skyfire abstracts agent payment methods so a single agent can pay across cards, ACH, and stablecoin rails. Skyfire has raised $9.5 million from Neuberger Berman, a16z CSX, and Coinbase Ventures. It is a Visa Intelligent Commerce pilot partner.
​

Nekuda focuses on agent identity and KYC. Nekuda raised a $5 million seed in May 2025 from Madrona, with Amex Ventures and Visa Ventures participating — investors that map directly to Layer 3 incumbents.
​

Prava builds KYC and identity primitives for agents. The company is one of several Layer 3 startups standardizing how a merchant verifies a non-human counterparty without breaking existing KYC obligations.
​

PayOS abstracts the agent-card layer for issuers. Visa included PayOS as a pilot partner in its Intelligent Commerce program. The PayOS approach is to give an agent one logical card that resolves to whichever underlying account the user has authorized.
​

Visa, Mastercard, Stripe, PayPal, Adyen, Checkout.com, and American Express span the same layer with deeper rails. Stripe added x402 support in February 2026 with USDC on Base as the launch pair. For more on the agent-side payment surface, see the agent wallets explainer.
​

Eco operates a cross-chain stablecoin orchestration sublayer beneath Layer 3. When an agent-payment protocol (x402, AP2, or MPP) hands off a USDC obligation, Eco resolves which chain to settle on, sources liquidity through Hyperlane and CCTP partner rails, and finalizes settlement in seconds. That role sits between Layer 3 (payments and identity) and the underlying chain rails — a sublayer the original Rye framework treats implicitly. The cross-chain agent payments article covers the orchestration mechanics in depth.
​

Layer 4 issues programmable virtual cards that an agent can spin up per merchant or per session. The named players are Lithic, Stripe Issuing, Marqeta, Highnote, Ramp, and Brex. Card issuance bridges agentic protocols and existing card-network infrastructure, letting an agent transact with the long tail of merchants that have not adopted ACP or UCP.
​

Layer 4 is the bridge layer in the 7-layer agentic commerce stack. Card-issuing platforms convert the protocol-level concept of an agent's authorization into a concrete card credential that any merchant can charge through their existing payment processor. The economics favor the bridge: every agent-card transaction earns interchange, and most agent traffic still settles on cards rather than stablecoins.
​

Lithic powers many of the agent-card programs in production today. The company is a programmatic issuer-processor and is a member of the Agentic Commerce Consortium that Basis Theory seeded.
​

Stripe Issuing is the default Layer 4 surface for any merchant or agent platform already on Stripe. It supports virtual cards spun up per session with embedded spend rules and merchant restrictions.
​

Marqeta is the public-company incumbent in modern card issuing. Marqeta-issued cards underpin a meaningful share of programmatic-issuance volume across fintech.
​

Highnote is a newer modern issuer focused on developer ergonomics. It targets the same use cases as Stripe Issuing and Lithic but with a different feature surface.
​

Ramp and Brex are corporate-card platforms increasingly used to issue cards under AI-controlled budgets. The corporate-card model fits the agentic case neatly because the buyer's spend authority is already delegated to a budget rather than tied to an individual cardholder. The AI agent spend controls article goes deeper on how budget delegation interacts with card issuance.
​

Layer 5 is the "browser robot" layer. When a merchant has not adopted ACP or UCP, an agent still needs a way to complete the purchase. Vendors at this layer (Rye, Induced AI, Henry Labs, Zinc, CartAI, Channel3) run automation that fills out checkout forms on the merchant's actual site, keeping the long tail of merchants reachable.
​

Layer 5 exists because the protocol-adoption curve is long. As of April 2026, only a small share of US e-commerce GMV is reachable through ACP, UCP, AP2, or MCP. The other 90%-plus of merchants still expect a browser session and a human-style checkout flow. Layer 5 vendors plug that gap by acting as agentic checkout middleware.
​

Rye operates a checkout-execution API and published the original 7-layer framework that organizes this article. Rye has raised approximately $14 million across seed and Series A. Its API lets an agent place an order on hundreds of merchant sites without per-merchant integrations.
​

Induced AI runs a browser-automation agent runtime aimed at production checkout flows. The company's pitch is reliability under selector drift — when a merchant's checkout page changes, the runtime adapts.
​

Henry Labs builds programmatic checkout-execution infrastructure for agent platforms that prefer to keep the agent-side logic in-house and outsource only the merchant-page automation.
​

Zinc has run an automated retail-purchasing API for years, predating the agentic-commerce category. Gift apps and reseller platforms use Zinc to place orders programmatically; agent platforms now use it as a Layer 5 substrate.
​

CartAI focuses on direct-to-cart agentic flows. Channel3 builds agent-side checkout middleware and is a member of the Agentic Commerce Consortium.
​

Layer 6 is the product-data and catalog layer. E-commerce platforms (Shopify, commercetools, BigCommerce, Adobe Commerce, SAP Commerce) supply the storefront backends; product information management vendors (Salsify, Syndigo, Akeneo) standardize the feeds that agents read. Without machine-readable catalogs, no Layer 1 surface can match a goal to a SKU.
​

Layer 6 is where agents learn what is actually for sale. The 7-layer agentic commerce stack treats this as a distinct category because the catalog problem is independent of the checkout problem. A perfectly working ACP integration still fails if the merchant's product feed doesn't surface the right SKU.
​

Shopify is the backbone of mid-market e-commerce and an early UCP and ACP integrator. Shopify-hosted merchants are reachable through both protocols by default once the merchant opts in, which is part of why Shopify appears on Google's UCP launch-partner list.
​

commercetools and BigCommerce are composable-commerce platforms increasingly used by enterprise retailers; both expose agentic API surfaces. Adobe Commerce (Magento) and SAP Commerce span the rest of the enterprise tier with agent-discovery hooks layered onto their existing storefront APIs.
​

Salsify, Syndigo, and Akeneo are product information management (PIM) vendors. Their job is to standardize attribute schemas so that agents from different Layer 1 surfaces can read the same merchant catalog without merchant-by-merchant adapters. Akeneo is the open-source option in the cluster; Salsify and Syndigo are enterprise-tier.
​

Layer 7 verifies who is acting on whose behalf. Bot-detection and fraud vendors (HUMAN Security, Riskified, Forter, Signifyd, Kasada, DataDome) plus edge networks (Cloudflare, Akamai) sit here. Visa's TAP, technically a Layer 2 protocol, ties directly into Layer 7 by giving merchants a cryptographic signal to feed into bot-management decisions.
​

Layer 7 is where agent traffic gets distinguished from scrapers, brute-force bots, and impersonators. The bottom of the 7-layer agentic commerce stack is also where existing internet infrastructure (CDNs, WAFs, fraud platforms) intersects with the new agent stack, making it one of the most incumbent-heavy layers.
​

HUMAN runs bot-detection at internet scale and is one of the named vendors developing agent-vs-scraper differentiation. HUMAN's signals feed into both fraud platforms and edge networks.
​

Riskified, Forter, and Signifyd are commerce-fraud platforms. Each is updating its risk model to account for legitimate agent traffic — a chargeback rule that assumes a human dispute window has to be rewritten when the buyer is an agent acting under delegated authority.
​

Kasada and DataDome are bot-management specialists. Both ship agent-aware policy primitives so that a merchant can allow legitimate Layer 1 surfaces (OpenAI, Google, Anthropic) while blocking unauthorized scrapers.
​

Cloudflare is the Layer 7 incumbent most aggressively integrated with the new agent stack. Cloudflare partnered with Visa on TAP and operates a pay-per-crawl program that treats agent traffic as a chargeable category. Cloudflare's edge sees a meaningful share of US web traffic, which gives it telemetry advantages.
​

Akamai is the other large-scale CDN and bot-management vendor at this layer. Akamai's bot manager exposes integration hooks for agent-protocol partners.
​

Insignia Business Review's April 2026 thesis is that the durable economic rent in the 7-layer agentic commerce stack accrues to settlement rails (Layer 3 incumbents and stablecoin issuers) and trust infrastructure (Layer 7 incumbents) — not to the open-source protocols at Layer 2. The analogy is TCP/IP, which captured no rents while AWS, Akamai, and Cloudflare captured plenty.
​

The Insignia analysis argues that protocol-layer revenue in agentic commerce will stay thin because the protocols are open-source and adopted by competing incumbents simultaneously. Value accrues to the layers that move money (Layer 3 settlement, Layer 4 card issuance) and the layers that verify the actor is legitimate (Layer 7). On that thesis, Visa and Mastercard at Layer 3, Stripe Issuing and Lithic at Layer 4, and Cloudflare and Akamai at Layer 7 are the natural beneficiaries.
​

The startup tier disagrees, or at least hedges. The roughly $50 million in concentrated Series A and B funding for Basis Theory, Skyfire, and Nekuda reflects a bet that net-new Layer 3 vendors can establish defensibility between protocols and rails, even when the protocols themselves don't capture rent. The argument: tokenization, agent-card orchestration, and agent-identity infrastructure are sticky once integrated, even though the underlying protocols are not.
​

Layer 5 (checkout execution) is the most contingent in the value-accrual picture. If protocol adoption (Layers 2 and 6) accelerates to cover most of US e-commerce GMV, Layer 5 vendors lose addressable market. If protocol adoption stalls, Layer 5 keeps growing because the long tail of merchants stays unreachable through ACP or UCP. The Stripe Link and x402 deep-dive covers how settlement-side incumbents are positioning to capture stablecoin volume specifically.
​

The table below summarizes each layer of the 7-layer agentic commerce stack with representative companies, example funding for the named startup tier, and the current maturity of each segment. Values reflect publicly disclosed data as of April 2026.

Eco operates a cross-chain stablecoin orchestration sublayer between Layer 3 (payments and identity) and the underlying chain rails of the 7-layer agentic commerce stack. When an agent-payment protocol such as x402, AP2, or MPP hands off a USDC-denominated obligation, Eco resolves the optimal chain, sources liquidity through Hyperlane and CCTP partner rails, and finalizes settlement within seconds.
​

The 7-layer agentic commerce stack treats settlement as implicit: Layer 3 hands off a payment instruction; the rail moves the money. For card payments, Layer 4 (card issuance) and the existing card networks fill that role. For stablecoin payments, the rail layer is fragmented across more than a dozen public chains, and the orchestration problem (which chain, which liquidity source, what finality guarantees) is non-trivial. Eco operates as a stablecoin execution network across 15 chains, abstracting routing, solver selection, and finality so that an agent paying in USDC on Base can transact with a counterparty whose treasury sits on Solana, Arbitrum, or Tron without writing the bridging logic itself. The combined stablecoin float backing this layer is roughly $318 billion as of April 29, 2026 (DeFiLlama). For the wider stablecoin payments picture, see the stablecoin payments for AI agents article.
​

The 7-layer agentic commerce stack composes with the buyer-side, protocol-level, and rail-level deep-dives in this cluster. Each article in the list below goes deeper on one layer or one cross-cutting concern in the stack: the buyer-side mechanics, an individual Layer 2 protocol, the agent-wallet surface, the stablecoin rails, the cross-chain orchestration sublayer, or the spend-control patterns.

Sources and methodology. Layer taxonomy adapted from Rye's published 7-layer framework and Insignia Business Review's April 24, 2026 extension. Funding figures verified against the rounds disclosed by Basis Theory (October 2025), Skyfire (combined to date), and Nekuda (May 2025) plus their lead investors. Stablecoin supplies pulled from DeFiLlama on April 29, 2026. Protocol launch dates verified against Linux Foundation, Google Developers, OpenAI, Anthropic, and Visa investor releases. Figures refresh quarterly.
​