docs: chart coverage, aggregated commits and all-registries downloads

docs/research/tools/capability-map/PROTOCOLS.md

@@ -30,23 +30,23 @@ Every protocol that appears in the capability map ([`generate.py`](./generate.py
 
 Collected 16 Oct 2026 from the GitHub API and the npm and PyPI download APIs. "Commits (90d)" counts commits to the default branch since 18 Jul 2026.
 
-| Protocol | Main repo | Stars | Forks | Contributors | Commits (90d) | Latest release | Package downloads (last month) |
+| Protocol | Main repo | Stars | Forks | Contributors | Commits (90d) | Latest release | Package downloads, last 4 weeks (per registry, the top package) |
 |---|---|---|---|---|---|---|---|
-| A2A | [a2aproject/A2A](https://github.com/a2aproject/A2A) | 26,175 | 2,675 | 176 | 64 | v1.0.1, 28 May 2026 | `@a2a-js/sdk` 15.4M (npm); `a2a-sdk` 11.4M (PyPI) |
-| MCP | [modelcontextprotocol/modelcontextprotocol](https://github.com/modelcontextprotocol/modelcontextprotocol) | 9,458 | 1,870 | 372 | 390 | 28 Jul 2026 | `@modelcontextprotocol/sdk` 273M (npm); `mcp` 235M (PyPI) |
-| x402 | [x402-foundation/x402](https://github.com/x402-foundation/x402) | 6,723 | 2,192 | 334 | 267 | no GitHub releases | `x402` 2.0M, `@x402/core` 1.5M, `@x402/fetch` 552k (npm); `x402` 205k (PyPI) |
-| UCP | [Universal-Commerce-Protocol/ucp](https://github.com/Universal-Commerce-Protocol/ucp) | 3,429 | 479 | 64 | 98 | v2026-08-25 | `@ucp-js/sdk` 52k (npm); `ucp-sdk` 8.6k (PyPI) |
-| AP2 | [google-agentic-commerce/AP2](https://github.com/google-agentic-commerce/AP2) | 3,230 | 512 | 19 | 0 | v0.2.0, 28 Apr 2026 | None found. The `ap2` package on PyPI belongs to an unrelated project |
-| ACP | [agentic-commerce-protocol/agentic-commerce-protocol](https://github.com/agentic-commerce-protocol/agentic-commerce-protocol) | 1,574 | 255 | 26 | 0 | no GitHub releases | None found |
-| TAP | [visa/trusted-agent-protocol](https://github.com/visa/trusted-agent-protocol) | 213 | 45 | 2 | 0 | no GitHub releases | None found |
-| MPP | [wevm/mppx](https://github.com/wevm/mppx) (TypeScript SDK) and [tempoxyz/mpp-specs](https://github.com/tempoxyz/mpp-specs) | 186 and 95 | 71 and 71 | 31 and 23 | 262 and 41 | `mppx@0.13.5`, 15 Oct 2026 (122 releases) | `mppx` 1.04M (npm) |
-| L402 | [lightninglabs/aperture](https://github.com/lightninglabs/aperture) and [lightninglabs/L402](https://github.com/lightninglabs/L402) | 271 and 91 | 82 and 19 | 27 and 8 | 106 and 0 | aperture v0.5.0, 25 Mar 2026 | None checked |
-| Web Bot Auth | [cloudflare/web-bot-auth](https://github.com/cloudflare/web-bot-auth) | 170 | 43 | 17 | 35 | no GitHub releases | `web-bot-auth` 736k (npm) |
-| x401 | [proof/x401](https://github.com/proof/x401) | 42 | 5 | 4 | 3 | no GitHub releases | `@proof.com/x401-node` 744 (npm) |
-| ANS | [agentnameservice/ans](https://github.com/agentnameservice/ans) (reference implementation) | 43 | 6 | 9 | 29 | v0.1.6, 26 Jun 2026 | None found |
-| KYA-OS | [decentralized-identity/kya-os-mcp](https://github.com/decentralized-identity/kya-os-mcp) | 31 | 13 | 6 | 178 | v1.20.0, 13 Oct 2026 | `@kya-os/mcp` 57k, `@kya-os/mcp-i` 16k (npm) |
-| PAP (Poppy) | [personal-agent-protocol/personal-agent-protocol](https://github.com/personal-agent-protocol/personal-agent-protocol) (spec and site, created 14 Oct 2026) | 20 | 1 | 1 | 3 | no GitHub releases | None found |
-| KYAPay | [skyfire-xyz/kyapay](https://github.com/skyfire-xyz/kyapay) | 13 | 0 | 8 | 1 | no GitHub releases | None found |
+| A2A | [a2aproject/A2A](https://github.com/a2aproject/A2A) | 26,175 | 2,675 | 176 | 64 | v1.0.1, 28 May 2026 | Official: `@a2a-js/sdk` 14.4M (npm), `a2a-sdk` 11.1M (PyPI), `a2a-lf` 55K (crates.io); Third-party: `fasta2a` 191K (PyPI, Pydantic), `ra2a` 7.1K (crates.io) |
+| MCP | [modelcontextprotocol/modelcontextprotocol](https://github.com/modelcontextprotocol/modelcontextprotocol) | 9,458 | 1,870 | 372 | 390 | 28 Jul 2026 | Official: `@modelcontextprotocol/sdk` 256.4M (npm), `mcp` 229.2M (PyPI), `rmcp` 8.5M (crates.io); Third-party: `fastmcp` 52.0M (PyPI, Prefect), `mcp-use` 143K (npm) |
+| x402 | [x402-foundation/x402](https://github.com/x402-foundation/x402) | 6,723 | 2,192 | 334 | 267 | no GitHub releases | Official: `x402` 1.9M (npm), `x402` 223K (PyPI); Third-party: `x402-types` 20K (crates.io) |
+| UCP | [Universal-Commerce-Protocol/ucp](https://github.com/Universal-Commerce-Protocol/ucp) | 3,429 | 479 | 64 | 98 | v2026-08-25 | Official: `@ucp-js/sdk` 50K (npm), `ucp-sdk` 7.2K (PyPI), `ucp-schema` 829 (crates.io); Third-party: `@shopify/ucp-cli` 19K (npm, Shopify) |
+| AP2 | [google-agentic-commerce/AP2](https://github.com/google-agentic-commerce/AP2) | 3,230 | 512 | 19 | 0 | v0.2.0, 28 Apr 2026 | None found on npm, PyPI or crates.io |
+| ACP | [agentic-commerce-protocol/agentic-commerce-protocol](https://github.com/agentic-commerce-protocol/agentic-commerce-protocol) | 1,574 | 255 | 26 | 0 | no GitHub releases | Third-party: `acp-handler` 857 (npm, Vercel), `agentic-commerce-protocol` 50 (PyPI, Svix) |
+| TAP | [visa/trusted-agent-protocol](https://github.com/visa/trusted-agent-protocol) | 213 | 45 | 2 | 0 | no GitHub releases | Third-party: `@inflowpayai/tap-seller` 398 (npm, InFlow) |
+| MPP | [wevm/mppx](https://github.com/wevm/mppx) (TypeScript SDK) and [tempoxyz/mpp-specs](https://github.com/tempoxyz/mpp-specs) | 186 and 95 | 71 and 71 | 31 and 23 | 262 and 41 | `mppx@0.13.5`, 15 Oct 2026 (122 releases) | Official: `mppx` 977K (npm), `pympp` 2.0M (PyPI) |
+| L402 | [lightninglabs/aperture](https://github.com/lightninglabs/aperture) and [lightninglabs/L402](https://github.com/lightninglabs/L402) | 271 and 91 | 82 and 19 | 27 and 8 | 106 and 0 | aperture v0.5.0, 25 Mar 2026 | Official: `@lightninglabs/l402` 104 (npm); Third-party: `l402` 24 (PyPI, Fewsats) |
+| Web Bot Auth | [cloudflare/web-bot-auth](https://github.com/cloudflare/web-bot-auth) | 170 | 43 | 17 | 35 | no GitHub releases | Official: `web-bot-auth` 689K (npm), `web-bot-auth` 82K (crates.io); Third-party: `vestauth` 561 (npm, the dotenv author), `regent-httpsig` 519 (PyPI) |
+| x401 | [proof/x401](https://github.com/proof/x401) | 42 | 5 | 4 | 3 | no GitHub releases | Official: `@proof.com/x401-node` 729 (npm); Third-party: `@solidus-network/x401` 20 (npm) |
+| ANS | [agentnameservice/ans](https://github.com/agentnameservice/ans) (reference implementation) | 43 | 6 | 9 | 29 | v0.1.6, 26 Jun 2026 | None found on npm, PyPI or crates.io |
+| KYA-OS | [decentralized-identity/kya-os-mcp](https://github.com/decentralized-identity/kya-os-mcp) | 31 | 13 | 6 | 178 | v1.20.0, 13 Oct 2026 | Official: `@kya-os/mcp` 54K (npm) |
+| PAP (Poppy) | [personal-agent-protocol/personal-agent-protocol](https://github.com/personal-agent-protocol/personal-agent-protocol) (spec and site, created 14 Oct 2026) | 20 | 1 | 1 | 3 | no GitHub releases | Third-party: `@datalayer/personal-agent-protocol` 2.0K (npm, Datalayer), `personal-agent-protocol` 1.4K (PyPI, Datalayer) |
+| KYAPay | [skyfire-xyz/kyapay](https://github.com/skyfire-xyz/kyapay) | 13 | 0 | 8 | 1 | no GitHub releases | Official: `@skyfire-xyz/skyfire-seller-sdk-node` 52 (npm); Third-party: `@tollstile/kyapay` 383 (npm, Tollstile) |
 | cheqd | [cheqd/did-resolver](https://github.com/cheqd/did-resolver) | 12 | 7 | 17 | 3 | v3.8.5, 3 Sep 2026 | `@cheqd/sdk` 3.4k, `@cheqd/did-provider-cheqd` 864 (npm) |
 | Baselayer KYA | No public repo | n/a | n/a | n/a | n/a | n/a | n/a |
 
@@ -65,27 +65,41 @@ Collected 16 Oct 2026 from the GitHub API and the npm and PyPI download APIs. "C
 - Stars measure attention more than use. The x401 and PAP repos are days or weeks old.
 - The MPP and L402 rows cover two repos each because the specification and the reference code live apart.
 - `coinbase/x402` is a fork of `x402-foundation/x402` with 168 stars. The canonical repo is the foundation's.
-- Package-to-repo mappings were checked against npm registry metadata for `web-bot-auth`, `x402`, `mppx`, `@a2a-js/sdk`, `@kya-os/mcp`, `@modelcontextprotocol/sdk`, `@ucp-js/sdk`, `@proof.com/x401-node` and `@cheqd/sdk`. `@x402/core` and `@x402/fetch` are assumed to be x402 SDK packages. `ucp-sdk` and `a2a-sdk` on PyPI were matched by name only.
+- Packages were matched to protocols by the repository URL in their registry metadata. `pympp` and `pytempo` are published by Tempo, `agentic-commerce-protocol` by Svix and `l402` by Fewsats, and I did not verify that these publishers are authorised by the protocol owners. The `ap2` package on PyPI belongs to an unrelated project and is not counted.
 
 ## Traction charts
 
-Three charts, drawn from the data in the metrics table. They follow the system light or dark setting. Hover a point in a browser for the exact value.
+Four charts, drawn from the data in the metrics table. cheqd is not charted. They follow the system light or dark setting, and hovering a point in a browser gives the exact value. Each ends with a "Not covered by this chart" box.
 
-![Weekly npm downloads of each protocol's main SDK, log scale](./traction/npm-downloads.svg)
+Where a protocol has implementations by other people, both are shown: official repositories and packages (the protocol's own organisation or named steward) and third-party ones, as third-party implementations are a sign of adoption. The third-party repositories and packages are hand-picked examples, not a census. For each protocol I took up to three that implement the protocol itself (an SDK, server, library or plugin), highest stars first, after setting aside applications that merely use it and curated lists. GitHub tags far more repositories with each protocol's topic (for example MCP 37,653, x402 3,827 and A2A 604 on 16 Oct 2026), but most of those are applications.
 
-**Downloads over time.** MCP is two orders of magnitude ahead of everything else and still rising (about 0.8M to 65M a week). A2A's JavaScript SDK went from about 100 to 4.1M a week in 16 months. x402 has grown steadily to 467K a week. MPP's SDK went from 317 downloads in its first week (9 Feb 2026) to 336K and is closing on Web Bot Auth. UCP and KYA-OS are two to three orders of magnitude smaller, and x401's SDK is under 300 a week.
+![Weekly commits to each protocol, official and third-party](./traction/commit-activity.svg)
 
-![Weekly commits to each protocol's main repository, small multiples](./traction/commit-activity.svg)
+**Development activity.** Each line adds commits across its repositories, including SDKs and samples. MCP leads with 4,442 official and 3,177 third-party commits in the last year, ahead of A2A (2,300 official, 151 third-party), MPP, x402 and UCP. x402's third-party activity (955) is almost level with its official (1,046), mostly from `x402-rs`. AP2, ACP and TAP are flat on the official side, while their third-party repositories are more active: AP2 20 official against 124 third-party, ACP 100 against 146, TAP 1 against 112. The AP2, TAP and MPP figures lean on repositories that serve several protocols (`solana-foundation/pay`, and InFlow's payments SDK for TAP), which are counted under each protocol. Web Bot Auth's 1,062 third-party commits are mostly a burst in one repository, `vestauth`.
 
-**Development activity.** MCP, x402 and MPP carry most of the commit volume. AP2, ACP and TAP are flat, which matches their last pushes of June, July and October 2025.
+PAP has 3 official commits, in the specification and website repository, and 176 third-party commits. 162 of those are in [`datalayer/personal-agent-protocol`](https://github.com/datalayer/personal-agent-protocol), a Python and TypeScript SDK by Datalayer, Inc. (BSD-3-Clause, created 10 Oct 2026, nearly all by one author, with releases 0.21 to 0.24 between 13 and 14 Oct). Nothing found links Datalayer to Sierra or Meta: it is not a listed design partner and its README claims no affiliation. It is an independent implementation of the draft.
+
+![Weekly package downloads for each protocol, official and third-party](./traction/downloads-all-registries.svg)
+
+**Downloads.** The same 12 weeks for every protocol across npm, PyPI and crates.io. Per registry and group, the most downloaded package is counted, so a package and its dependencies are not counted twice. MCP is far ahead (129M official a week, plus 14M for the third-party FastMCP on PyPI), then A2A (6.9M official, with Pydantic's `fasta2a` at 48K), MPP (1.5M, more from `pympp` on PyPI than from `mppx` on npm), x402 (542K) and Web Bot Auth (181K). PAP, ACP and TAP have only third-party packages: Datalayer's SDK for PAP (3.4K a week), Vercel's `acp-handler` and Svix's package for ACP (396), InFlow's `@inflowpayai/tap-seller` for TAP (178). AP2, ANS and Baselayer KYA have no data: no package was found for AP2 (the `ap2` package on PyPI belongs to an unrelated project) or ANS, and Baselayer is closed.
+
+![Weekly npm downloads of each protocol's main official SDK, log scale](./traction/npm-downloads.svg)
+
+**npm history.** Official npm packages for eight protocols on one log scale since April 2025, the longest history any registry gives. MCP is two orders of magnitude ahead and still rising. A2A's JavaScript SDK went from about 100 to 4.1M a week in 16 months. MPP's SDK went from 317 downloads in its first week to 336K. UCP and KYA-OS are two to three orders of magnitude smaller, and x401's SDK is under 300 a week. The palette allows eight series, so other protocols and the third-party packages are in the box and in the chart above.
 
 ![GitHub stars on each protocol's main repository, log scale](./traction/github-stars.svg)
 
-**Stars.** A2A leads, then MCP, x402, UCP and AP2. AP2 and ACP hold thousands of stars with no recent commits, so their attention has outrun their activity. Hollow dots mark repositories with no commits in the last 13 weeks.
+**Stars.** A2A leads, then MCP, x402, UCP and AP2. AP2 and ACP hold thousands of stars with no recent official commits. Hollow dots mark repositories with no commits in the last 13 weeks. One repository per protocol is charted, and others can be larger: FastMCP (28,102) and the MCP Python and TypeScript SDKs (24,593 and 13,592) hold more stars than the MCP specification repository (9,459). The box lists the other official and third-party repositories with their stars.
+
+### Gaps marked on the charts
 
-**Not shown:** star history over time. GitHub's stargazer endpoints returned nothing in this environment, so stars appear only as a snapshot. SDK downloads exist only for npm packages, so AP2, ACP, TAP, L402 and ANS have no line in the first chart.
+- **No data is marked, not hidden.** Dashed boxes and panels show where a protocol has nothing to plot, with the reason.
+- **No repository or package yet.** Dashed shading marks weeks before a repository existed (commits chart) or before a package had downloads (all-registries chart), so a flat line means no activity rather than no project.
+- **Counting choices.** Commits use the default branch only. Downloads cover npm, PyPI and crates.io. Maven, NuGet, Go modules and container pulls are not measured, and downloads include CI and mirrors. A repository that implements several protocols (`solana-foundation/pay`, the NVIDIA retail blueprint) is counted under each and marked in the box.
+- **Publishers.** Third-party packages name their publisher in the box. I did not verify whether any publisher is authorised by the protocol's owner.
+- **Star history over time** is not shown. GitHub's stargazer endpoints returned nothing in this environment, so stars are a snapshot.
 
-Refresh with `python3 traction/fetch.py` (needs `gh` logged in), then `python3 traction/render.py`. The data behind the charts is in [`traction/data.json`](./traction/data.json).
+The repositories and packages counted are set in `OTHERS` and `PACKAGES` in `traction/fetch.py`. Refresh with `python3 traction/fetch.py` (needs `gh` logged in), then `python3 traction/render.py`. The data behind the charts is in [`traction/data.json`](./traction/data.json).
 
 ## Notes