{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-08", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "tool": { "slug": "fluxa-ai-wallet", "name": "FluxA AI Wallet", "vendor": "FluxA Technology Pte. Ltd.", "vendorUrl": "https://fluxapay.xyz", "kind": "http-api", "category": "agent-wallets", "summary": "FluxA AI Wallet is a hosted agent wallet from FluxA Technology that signs x402 (EIP-3009) USDC payments on Base within budgets a person approves, reached through the fluxa-wallet CLI, a stdio MCP server and agent skills.", "url": "https://www.anchorterminal.com/tools/fluxa-ai-wallet", "markdownUrl": "https://www.anchorterminal.com/tools/fluxa-ai-wallet.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/fluxa-ai-wallet.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/fluxa-ai-wallet.json", "dns": "fluxa-ai-wallet.grade.anchorterminal.com", "repo": "https://github.com/FluxA-Agent-Payment/FluxA-AI-Wallet-MCP", "license": "The CLI and MCP server source is Apache-2.0 (LICENSE file and both package.json files), though the README's last section says MIT. The hosted wallet service is closed, and no terms covering the wallet were found", "transports": [ "http", "stdio" ], "remoteUrl": "https://walletapi.fluxapay.xyz", "packages": [ { "registry": "npm", "name": "@fluxa-pay/fluxa-wallet" }, { "registry": "npm", "name": "@fluxa-pay/fluxa-wallet-mcp" } ], "auth": "mixed", "authNotes": "An agent connects with `fluxa-wallet connect` (or the MCP tool `connect_wallet`), which returns an `authorization_url` on agentwallet.fluxapay.xyz for the owner to approve in a browser. The claim returns an Agent ID, a token and an RS256 JWT, stored in `~/.fluxa-ai-wallet-mcp/config.json` (mode 0600) or injected as `AGENT_ID`, `AGENT_TOKEN` and `AGENT_JWT`. The owner picks the token's validity (1h, 24h, 7d, 1mo, 180d or 1y; the server suggests 180 days locally and 7 days in cloud or container environments), and the JWT is refreshed with the token. `token_expired` and `token_revoked` return `reconnect_required`. The legacy `init` registers an Agent ID with an unauthenticated `POST https://agentid.fluxapay.xyz/register`. Spending needs a mandate the owner signs in the browser. AgentMarket commands can instead use `fxa_live_` keys with a spend limit, revocable from the CLI.", "pricing": "usage", "pricingNotes": "No fee schedule for the wallet, x402 signing, payouts, payment links or refunds was found in the repository, the skills or the AgentMarket pricing, terms and llms.txt pages (checked 2026-11-07). Merchants set x402 prices. Agent card products list their fees through `fluxa-wallet card types`, which needs a connected wallet, so those fees were not read. The wallet site and docs at agentwallet.fluxapay.xyz and docs.fluxapay.xyz could not be read, so whether opening a wallet needs a card is unchecked. AgentMarket's Balance is $1 = 1 Balance, with Units bundles from $1 to $25.", "priceSummary": "Pay per use", "where": "both", "x402": { "level": "partial", "evidence": "The wallet signs x402 `exact` (EIP-3009) payment authorisations for USDC on Base and Base Sepolia as a buyer (`fluxa-wallet x402 --mandate \u003cid\u003e --payload \u003c402 body\u003e`, MCP `request_x402_payment` and `request_x402_v3_payment`), and its payment links can be paid over x402 so another agent can pay the holder (https://github.com/FluxA-Agent-Payment/FluxA-AI-Wallet-MCP/blob/main/skills/fluxa-agent-wallet/INTEGRATION-GUIDE-CHARGE-AGENT.md, checked 2026-11-07). FluxA's own wallet API is not paid over x402, MPP or L402.", "endpoints": [] }, "toolCount": 15, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-07" }, "docsUrl": "https://docs.fluxapay.xyz/", "capabilities": [ "payments.x402", "wallet.spend-limits", "wallet.onchain", "payments.card", "auth.agent-identity" ], "tags": [ "hosted", "official", "open-source", "apache-2.0", "cli", "mcp", "stdio", "skills", "typescript", "wallet", "x402", "stablecoins", "virtual-cards", "usdc", "base" ], "lastRelease": "2026-11-06", "graded": true, "anchor": { "graded": true, "score": 47, "grade": "D", "agentReady": false, "rank": 1164, "ranked": true, "rankOf": 1513, "categoryRank": 11, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 60, "maintenance": 66, "payments": 45, "reliability": 20, "schema": 61, "security": 52, "transparency": 32 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 20, "points": 4, "reason": "Graded with the hosted lines, because signing, mandates and approvals all run on FluxA's wallet API and the CLI and MCP server only wrap it, as kite-agent-passport and kane-cli were read. No status page was found in the repository, the skills or AgentMarket's pages. fluxapay.xyz and the wallet and docs hosts could not be read, so a status page there is unchecked and scored absent (0). With no readable history the record takes the default (5). No rate limit with numbers was found (0). The connection service treats 429 `slow_down` as wait and poll and marks errors `retryable`, the skill says a 503 means retry shortly, payouts require a caller-chosen `payout_id` that returns the existing payout on a repeat, `--biz-id` rejects a duplicate with 409, and card create and recharge resume with `--request-id` instead of paying again. No Retry-After or backoff schedule is documented for the wallet API (10 of 15). No SLA was found (0). No beta label was found on the wallet in what was read, but both packages are at 0.x, agent cards sit behind a waitlist and the wallet site was unread (5 of 10). Total 20.", "checked": "2026-11-07" }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 61, "points": 9.91, "reason": "No OpenAPI file or reference for the wallet API was found; the README shows sample requests for five endpoints. The MCP server's 15 tools in the 0.6.0 source carry typed Zod input schemas, and the CLI's flags are documented in prose in the skill files and `--help`. The MCP server is the secondary surface and its npm release is 0.2.0, so 12 of 25. The skill and its 18 Markdown guides are written for agents, and AgentMarket's llms.txt describes the wallet's payment role (10). `connect_wallet`, `init_agent_id` and `create_intent_mandate` say when to use them and when not to, and the skill has a when-to-use table per capability, while the payment-link and status tools have one-line descriptions (12 of 20). Zod enums for validity, runtime, hosting and currency, a regex on payout amounts and strict objects, but the x402 requirement fields are plain strings and `outputSchema` is a free-form record (10 of 15). The README has an example for every MCP tool, the skills give CLI examples and output, and error codes are tabled for mandates, payouts, cards and connections (12 of 15). Semver on npm with 25 CLI versions and a version line in the skill, two git tags and no changelog (5 of 15). Total 61.", "checked": "2026-11-07" }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 60, "points": 9.75, "reason": "The MCP server has 15 tools with about 4,700 characters of descriptions, the 11 to 30 band (15). The CLI path loads SKILL.md (26.5 KB) and one of 18 guides per task, about 112 KB in all, with no read-only subset (no add-back, 15 of 25). `card transactions` takes page, limit, type and a time range, refunds take limit and offset, `received-records` and `recent-transactions` take a limit up to 100, and `market search` can be scoped to models or vendors; no cursor (12 of 20). Errors carry a `code`, `retryable`, `reconnect_required` and a `next_command` or `next_tool`, and card errors map to recovery hints, but the CLI exits only 0 or 1 and the MCP payment tools return the wallet API's raw error body without `isError` (14 of 20). A required `payout_id` idempotency key, `--biz-id` dedup and `--request-id` continuation on card operations, and the skill says not to initiate again to retry a payment. No `readOnlyHint` or `destructiveHint` on any MCP tool (12 of 20). Base USDC is the default network and asset, mandates default to 8 hours and the CLI installs in one command, but there is no SDK library and both packages are TypeScript (7 of 15). Total 60.", "checked": "2026-11-07" }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 52, "points": 9.1, "reason": "The agent holds an Agent ID, a token whose validity the owner picks from 1 hour to 1 year at browser approval, and a short-lived RS256 JWT refreshed from the token; `token_revoked` exists. Credentials sit in a 0600 JSON file or environment variables. The token is not scoped, since limits live in mandates, and legacy `init` tokens are described as not expiring. Agent VCs are audience-bound and rejected by FluxA's own endpoints. No secret travels in a URL (22 of 30). Every x402 payment needs a mandate the owner signs, with a limit, a validity and an optional host allowlist enforced by the wallet API, payouts need per-payout approval unless a mandate covers them, cards need a mandate and KYC, and linked-card mandates are scoped to one merchant. A payout mandate sets no payee allowlist that was documented, and the skill tells agents to request budgets for at least 100 calls by default (16 of 20). The wallet returns little third-party content itself, but the skill sends agents to third-party x402 APIs, ClawPI posts and a remote announcement.md with no guidance on treating them as untrusted, its description steers agents to paid APIs even when a free web search looks enough, and the daily check-in runs `npx -y @fluxa-pay/fluxa-wallet@latest` unpinned twice a day (4 of 15). `mandates` lists limit, spent and remaining, with `recent-transactions`, `received-records` and payout status by CLI, and the MCP server writes a local audit log; the wallet app's logs were not read (10 of 15). No SECURITY.md, disclosure policy, bug bounty or certification was found, and agentmarket.fluxapay.xyz has no security.txt; fluxapay.xyz's is unchecked (0 of 20). Total 52.", "checked": "2026-11-07" }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 45, "points": 5.63, "reason": "Payment platforms and wallets take the highest step that applies on the 40-point protocol line. 40 for x402, MPP or L402 on all their own endpoints, 30 on part of their own API, 25 when their merchants can accept one, 20 for running a facilitator, 15 for paying as a buyer, 0 for only a protocol of their own. The wallet pays x402 as a buyer and its payment links can be paid over x402 so another agent pays the holder, as sponge-wallet's payment links were read. FluxA's own wallet API is not paid over x402, so the merchant step (25 of 40). No fee schedule for the wallet, x402 signing, payouts or payment links was found, and card fees appear only through an authenticated command (0 of 20). Registering an Agent ID and creating payment links cost nothing and need no card per the README and the charge-agent guide, but the wallet sign-up at agentwallet.fluxapay.xyz could not be read, so whether opening a funded wallet needs a card is unchecked (10 of 20). `POST https://agentid.fluxapay.xyz/register` returns credentials with no human step, but the CLI marks it legacy, the default connection needs a browser approval, and every spend needs the owner's wallet and a mandate signed in a browser (10 of 20). Total 45.", "checked": "2026-11-07" }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 66, "points": 5.78, "reason": "`@fluxa-pay/fluxa-wallet` 0.6.0 was published on 6 November 2026, one day before this check (30). Eight CLI releases since 10 August 2026, among them 0.5.2 on 14 October, 0.5.3 on 25 October and 0.5.6, 0.5.7 and 0.6.0 between 3 and 6 November (20). The repository merged 43 pull requests, all from the organisation's own branches, and commits run weekly. Issues and outside pull requests could not be read because the GitHub API refused the session. Discord and a support address are linked from AgentMarket and were not tested (8 of 25). Graded as an API, the line asks for current official SDKs. The CLI is current, but there is no SDK library and the MCP package on npm has not been published since 2 March 2026 (5 of 15). 68 node:test cases exist with no CI workflow, neither npm package declares its repository, and the MCP package's last release lags the source by eight months (3 of 10). Total 66.", "checked": "2026-11-07" }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 32, "points": 2.8, "note": "editorial 26, provenance 38", "reason": "The CLI and MCP server source is Apache-2.0 per the LICENSE file and both package.json files, while the README's last section says MIT. The hosted wallet is closed, and no terms covering it were found. AgentMarket's terms describe only the marketplace (15 of 30). AgentMarket's privacy policy of 14 January 2026 names Stripe and model providers and gives no retention periods, and it does not mention wallet addresses, KYC profiles, card data or payouts, which the CLI collects or handles. The wallet's own privacy policy was unreachable (5 of 30). The README marks `init` and `link-wallet` as legacy but still supported, and the skill pins a minimum CLI version; no deprecation policy or dated notice was found (3 of 20). Stripe is the only provider named; no card issuer, KYC provider, custody provider or data location is named. The CLI and MCP code send no telemetry (3 of 20). Total 26.", "checked": "2026-11-07" } ], "assessment": { "date": "2026-11-07", "basis": "public evidence", "confidence": "low", "notes": { "ergonomics": "The MCP server has 15 tools with about 4,700 characters of descriptions, the 11 to 30 band (15). The CLI path loads SKILL.md (26.5 KB) and one of 18 guides per task, about 112 KB in all, with no read-only subset (no add-back, 15 of 25). `card transactions` takes page, limit, type and a time range, refunds take limit and offset, `received-records` and `recent-transactions` take a limit up to 100, and `market search` can be scoped to models or vendors; no cursor (12 of 20). Errors carry a `code`, `retryable`, `reconnect_required` and a `next_command` or `next_tool`, and card errors map to recovery hints, but the CLI exits only 0 or 1 and the MCP payment tools return the wallet API's raw error body without `isError` (14 of 20). A required `payout_id` idempotency key, `--biz-id` dedup and `--request-id` continuation on card operations, and the skill says not to initiate again to retry a payment. No `readOnlyHint` or `destructiveHint` on any MCP tool (12 of 20). Base USDC is the default network and asset, mandates default to 8 hours and the CLI installs in one command, but there is no SDK library and both packages are TypeScript (7 of 15). Total 60.", "maintenance": "`@fluxa-pay/fluxa-wallet` 0.6.0 was published on 6 November 2026, one day before this check (30). Eight CLI releases since 10 August 2026, among them 0.5.2 on 14 October, 0.5.3 on 25 October and 0.5.6, 0.5.7 and 0.6.0 between 3 and 6 November (20). The repository merged 43 pull requests, all from the organisation's own branches, and commits run weekly. Issues and outside pull requests could not be read because the GitHub API refused the session. Discord and a support address are linked from AgentMarket and were not tested (8 of 25). Graded as an API, the line asks for current official SDKs. The CLI is current, but there is no SDK library and the MCP package on npm has not been published since 2 March 2026 (5 of 15). 68 node:test cases exist with no CI workflow, neither npm package declares its repository, and the MCP package's last release lags the source by eight months (3 of 10). Total 66.", "payments": "Payment platforms and wallets take the highest step that applies on the 40-point protocol line. 40 for x402, MPP or L402 on all their own endpoints, 30 on part of their own API, 25 when their merchants can accept one, 20 for running a facilitator, 15 for paying as a buyer, 0 for only a protocol of their own. The wallet pays x402 as a buyer and its payment links can be paid over x402 so another agent pays the holder, as sponge-wallet's payment links were read. FluxA's own wallet API is not paid over x402, so the merchant step (25 of 40). No fee schedule for the wallet, x402 signing, payouts or payment links was found, and card fees appear only through an authenticated command (0 of 20). Registering an Agent ID and creating payment links cost nothing and need no card per the README and the charge-agent guide, but the wallet sign-up at agentwallet.fluxapay.xyz could not be read, so whether opening a funded wallet needs a card is unchecked (10 of 20). `POST https://agentid.fluxapay.xyz/register` returns credentials with no human step, but the CLI marks it legacy, the default connection needs a browser approval, and every spend needs the owner's wallet and a mandate signed in a browser (10 of 20). Total 45.", "reliability": "Graded with the hosted lines, because signing, mandates and approvals all run on FluxA's wallet API and the CLI and MCP server only wrap it, as kite-agent-passport and kane-cli were read. No status page was found in the repository, the skills or AgentMarket's pages. fluxapay.xyz and the wallet and docs hosts could not be read, so a status page there is unchecked and scored absent (0). With no readable history the record takes the default (5). No rate limit with numbers was found (0). The connection service treats 429 `slow_down` as wait and poll and marks errors `retryable`, the skill says a 503 means retry shortly, payouts require a caller-chosen `payout_id` that returns the existing payout on a repeat, `--biz-id` rejects a duplicate with 409, and card create and recharge resume with `--request-id` instead of paying again. No Retry-After or backoff schedule is documented for the wallet API (10 of 15). No SLA was found (0). No beta label was found on the wallet in what was read, but both packages are at 0.x, agent cards sit behind a waitlist and the wallet site was unread (5 of 10). Total 20.", "schema": "No OpenAPI file or reference for the wallet API was found; the README shows sample requests for five endpoints. The MCP server's 15 tools in the 0.6.0 source carry typed Zod input schemas, and the CLI's flags are documented in prose in the skill files and `--help`. The MCP server is the secondary surface and its npm release is 0.2.0, so 12 of 25. The skill and its 18 Markdown guides are written for agents, and AgentMarket's llms.txt describes the wallet's payment role (10). `connect_wallet`, `init_agent_id` and `create_intent_mandate` say when to use them and when not to, and the skill has a when-to-use table per capability, while the payment-link and status tools have one-line descriptions (12 of 20). Zod enums for validity, runtime, hosting and currency, a regex on payout amounts and strict objects, but the x402 requirement fields are plain strings and `outputSchema` is a free-form record (10 of 15). The README has an example for every MCP tool, the skills give CLI examples and output, and error codes are tabled for mandates, payouts, cards and connections (12 of 15). Semver on npm with 25 CLI versions and a version line in the skill, two git tags and no changelog (5 of 15). Total 61.", "security": "The agent holds an Agent ID, a token whose validity the owner picks from 1 hour to 1 year at browser approval, and a short-lived RS256 JWT refreshed from the token; `token_revoked` exists. Credentials sit in a 0600 JSON file or environment variables. The token is not scoped, since limits live in mandates, and legacy `init` tokens are described as not expiring. Agent VCs are audience-bound and rejected by FluxA's own endpoints. No secret travels in a URL (22 of 30). Every x402 payment needs a mandate the owner signs, with a limit, a validity and an optional host allowlist enforced by the wallet API, payouts need per-payout approval unless a mandate covers them, cards need a mandate and KYC, and linked-card mandates are scoped to one merchant. A payout mandate sets no payee allowlist that was documented, and the skill tells agents to request budgets for at least 100 calls by default (16 of 20). The wallet returns little third-party content itself, but the skill sends agents to third-party x402 APIs, ClawPI posts and a remote announcement.md with no guidance on treating them as untrusted, its description steers agents to paid APIs even when a free web search looks enough, and the daily check-in runs `npx -y @fluxa-pay/fluxa-wallet@latest` unpinned twice a day (4 of 15). `mandates` lists limit, spent and remaining, with `recent-transactions`, `received-records` and payout status by CLI, and the MCP server writes a local audit log; the wallet app's logs were not read (10 of 15). No SECURITY.md, disclosure policy, bug bounty or certification was found, and agentmarket.fluxapay.xyz has no security.txt; fluxapay.xyz's is unchecked (0 of 20). Total 52.", "transparency": "The CLI and MCP server source is Apache-2.0 per the LICENSE file and both package.json files, while the README's last section says MIT. The hosted wallet is closed, and no terms covering it were found. AgentMarket's terms describe only the marketplace (15 of 30). AgentMarket's privacy policy of 14 January 2026 names Stripe and model providers and gives no retention periods, and it does not mention wallet addresses, KYC profiles, card data or payouts, which the CLI collects or handles. The wallet's own privacy policy was unreachable (5 of 30). The README marks `init` and `link-wallet` as legacy but still supported, and the skill pins a minimum CLI version; no deprecation policy or dated notice was found (3 of 20). Stripe is the only provider named; no card issuer, KYC provider, custody provider or data location is named. The CLI and MCP code send no telemetry (3 of 20). Total 26." }, "sources": [ { "what": "Repository, full history read as text (219 commits, 6 November 2025 to 6 November 2026)", "url": "https://github.com/FluxA-Agent-Payment/FluxA-AI-Wallet-MCP", "seen": "2026-11-07" }, { "what": "README, MCP tools, wallet API samples and configuration", "url": "https://github.com/FluxA-Agent-Payment/FluxA-AI-Wallet-MCP/blob/main/README.md", "seen": "2026-11-07" }, { "what": "Wallet skill 0.6.0", "url": "https://github.com/FluxA-Agent-Payment/FluxA-AI-Wallet-MCP/blob/main/skills/fluxa-agent-wallet/SKILL.md", "seen": "2026-11-07" }, { "what": "Mandate planning policy", "url": "https://github.com/FluxA-Agent-Payment/FluxA-AI-Wallet-MCP/blob/main/skills/fluxa-agent-wallet/MANDATE-PLANNING.md", "seen": "2026-11-07" }, { "what": "x402 payment reference and error codes", "url": "https://github.com/FluxA-Agent-Payment/FluxA-AI-Wallet-MCP/blob/main/skills/fluxa-agent-wallet/X402-PAYMENT.md", "seen": "2026-11-07" }, { "what": "Payout reference", "url": "https://github.com/FluxA-Agent-Payment/FluxA-AI-Wallet-MCP/blob/main/skills/fluxa-agent-wallet/PAYOUT.md", "seen": "2026-11-07" }, { "what": "Payment link and refund reference", "url": "https://github.com/FluxA-Agent-Payment/FluxA-AI-Wallet-MCP/blob/main/skills/fluxa-agent-wallet/PAYMENT-LINK.md", "seen": "2026-11-07" }, { "what": "Refund and payout test plan", "url": "https://github.com/FluxA-Agent-Payment/FluxA-AI-Wallet-MCP/blob/main/TEST-CLI-REFUND-PAYOUT.md", "seen": "2026-11-07" }, { "what": "Daily check-in guide", "url": "https://github.com/FluxA-Agent-Payment/FluxA-AI-Wallet-MCP/blob/main/skills/fluxa-agent-wallet/SCHEDULED-CHECKIN.md", "seen": "2026-11-07" }, { "what": "Connection flow source", "url": "https://github.com/FluxA-Agent-Payment/FluxA-AI-Wallet-MCP/blob/main/src/agent/connect.ts", "seen": "2026-11-07" }, { "what": "MCP server source, 15 tools", "url": "https://github.com/FluxA-Agent-Payment/FluxA-AI-Wallet-MCP/blob/main/src/mcp/server.ts", "seen": "2026-11-07" }, { "what": "npm registry, @fluxa-pay/fluxa-wallet (25 versions, 0.6.0 on 6 November 2026), tarball read as text", "url": "https://registry.npmjs.org/@fluxa-pay%2Ffluxa-wallet", "seen": "2026-11-07" }, { "what": "npm registry, @fluxa-pay/fluxa-wallet-mcp (8 versions, 0.2.0 on 2 March 2026), tarball read as text", "url": "https://registry.npmjs.org/@fluxa-pay%2Ffluxa-wallet-mcp", "seen": "2026-11-07" }, { "what": "AgentMarket home page and footer naming FluxA Technology Pte. Ltd.", "url": "https://agentmarket.fluxapay.xyz/", "seen": "2026-11-07" }, { "what": "AgentMarket llms.txt, wallet CLI as the payment path", "url": "https://agentmarket.fluxapay.xyz/llms.txt", "seen": "2026-11-07" }, { "what": "AgentMarket terms, effective 14 January 2026", "url": "https://agentmarket.fluxapay.xyz/terms", "seen": "2026-11-07" }, { "what": "AgentMarket privacy policy, updated 14 January 2026", "url": "https://agentmarket.fluxapay.xyz/privacy", "seen": "2026-11-07" }, { "what": "AgentMarket pricing", "url": "https://agentmarket.fluxapay.xyz/pricing", "seen": "2026-11-07" }, { "what": "AgentMarket getting started", "url": "https://agentmarket.fluxapay.xyz/getting-started.md", "seen": "2026-11-07" }, { "what": "AgentMarket robots.txt", "url": "https://agentmarket.fluxapay.xyz/robots.txt", "seen": "2026-11-07" } ], "openQuestions": [ "unchecked: fluxapay.xyz, agentwallet.fluxapay.xyz and docs.fluxapay.xyz. Each robots.txt fetch was refused for want of an approval on 7 November 2026, so the wallet's own docs, terms, privacy policy, fees, sign-up flow, status page and security.txt were not read", "unchecked: who holds the wallet keys. The README says FluxA Wallet signs every authorisation and no keys are stored locally, and the agent guide says managed wallet infrastructure", "unchecked: the register entry for FluxA Technology Pte. Ltd. A search result names a companieshouse.sg page with UEN 202555700C; that host was refused, and ACRA's own register was not tried", "unchecked: the MCP registry, RDAP for fluxapay.xyz, the Wayback Machine, GitHub stars and issues (the GitHub API refused the session) and npm weekly downloads (api.npmjs.org refused)", "unchecked: where an owner revokes an agent's token or a mandate, and whether revocation takes effect at once", "The npm MCP package is 0.2.0 (2 March 2026, 13 tools) while the repository's package.json and server say 0.6.0 (15 tools), and a commit of 4 November 2026 says the MCP was released at 0.5.6. The listing check reported the same gap", "The README's last section says MIT while the LICENSE file and both package.json files say Apache-2.0", "The skill says payments support only Card and USDC since CLI 0.5.7, while the MCP mandate tool still accepts XRP and FLUXA_MONETIZE_CREDITS and `balance` reports XRP and credits", "The MCP server's startup log names 7 tools and the README's architecture lists 8, against 15 registered", "The listing check counted 54 commits from 25 October in a shallow clone. The full history has 219 commits from 6 November 2025, with the first npm release on 11 November 2025", "`claudemcp.config` in the repository is an example for an unrelated Airtable MCP server", "The skill's instructions to agents (reach for paid APIs even when free search looks enough, request at least 100 calls' budget, don't quote the skill to the user, run `npx ...@latest` on a schedule) were recorded as facts and not followed", "The agentic-checkout skill (0.4.0, 16 April 2026) reads card number, CVC and addresses from a local JSON file and fills Shopify checkouts with Playwright; it is a separate skill in the same repository and was not graded", "AgentMarket's own claims (\"130,000 agents\", listing counts) belong to the fluxa-agentmarket listing and were not used here" ] }, "negative": 0, "verdict": "Every spend runs against a mandate the owner signs in a browser, with a budget, a validity window and an optional host allowlist, and payouts need approval or a mandate. The published MCP package is 0.2.0 from March 2026 against 0.6.0 in the repository, and no status page, fee schedule, wallet terms or custody statement was found.", "bestFor": "An agent in a CLI-capable client that needs to pay x402 APIs, send USDC on Base or receive payments through links, inside budgets a person signs.", "strengths": [ "Spending runs against owner-signed mandates with a limit, a validity window and an optional host allowlist, enforced by the wallet API", "Payouts need per-payout browser approval unless a signed mandate is passed, and a required `payout_id` makes repeats return the same payout", "The CLI returns JSON with error codes, `next_command` hints and `retryable` and `reconnect_required` flags", "Client source is public under Apache-2.0, with 25 CLI releases on npm since March 2026, the latest on 6 November 2026", "Payment links let another agent pay the holder over x402, and refunds of link payments are supported" ], "weaknesses": [ "The published MCP package is 0.2.0 from 2 March 2026 with 13 tools, while the repository says 0.6.0 with 15", "No status page, rate limit, SLA, fee schedule or security contact was found", "Who holds the wallet keys is not stated. The docs say FluxA Wallet signs and call it managed", "The only terms and privacy policy read are AgentMarket's, which do not mention the wallet, cards, KYC or payouts", "The skill steers agents to paid APIs over free search and to request budgets for at least 100 calls by default" ], "agentNotes": [ "Run `fluxa-wallet status` first. If `configured` and `wallet_linked` are true, skip `connect`; otherwise show the `authorization_url` and wait with `connect-status --wait 100`", "On `token_expired` or `token_revoked`, reconnect with the same `--agent-id`. Never run `init` to recover, which creates a new identity", "Pass a unique `--id` on every `payout` and reuse it on retry; a repeat returns the existing payout instead of paying twice", "Check `fluxa-wallet mandates` for a signed mandate with enough remaining budget before creating one, and size new budgets to the task", "Install the CLI from npm, not the MCP package, whose npm release 0.2.0 lacks `connect_wallet` and `get_wallet_connection`" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "low", "grade": "D", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 47 } ], "editorialScores": { "ergonomics": 60, "maintenance": 66, "payments": 45, "reliability": 20, "schema": 61, "security": 52, "transparency": 26 }, "provenanceScore": 38, "checked": { "categories": { "ergonomics": "2026-11-07", "maintenance": "2026-11-07", "payments": "2026-11-07", "reliability": "2026-11-07", "schema": "2026-11-07", "security": "2026-11-07", "transparency": "2026-11-07" }, "last": "2026-11-07", "oldest": "2026-11-07", "stale": false, "staleAfterDays": 90 }, "scoreHistory": [ { "date": "2026-11-07", "grade": "D", "kind": "listed", "method": "0.7", "score": 47 } ] }, "connect": { "install": "npm install -g @fluxa-pay/fluxa-wallet" }, "letme": { "capability": "https://letme.dev/payments.x402", "tool": "https://letme.dev/fluxa-ai-wallet" }, "sameCompany": [ "fluxa-agentmarket" ], "notable": [ "The skill at version 0.6.0 tells agents to use the `fluxa-wallet` CLI, and AgentMarket's llms.txt says payment is settled by the FluxA Wallet CLI (https://github.com/FluxA-Agent-Payment/FluxA-AI-Wallet-MCP/blob/main/skills/fluxa-agent-wallet/SKILL.md; https://agentmarket.fluxapay.xyz/llms.txt)", "`@fluxa-pay/fluxa-wallet-mcp` on npm is at 0.2.0, published on 2 March 2026 with 13 tools, while the repository's package.json and server say 0.6.0 with 15 tools. The CLI `@fluxa-pay/fluxa-wallet` is at 0.6.0, published on 6 November 2026 (https://registry.npmjs.org/@fluxa-pay%2Ffluxa-wallet-mcp; https://registry.npmjs.org/@fluxa-pay%2Ffluxa-wallet)", "The README says no private keys are stored locally and that all signing and policies are handled by FluxA Wallet. The agent guide calls it managed wallet infrastructure. Who holds the keys is not stated (https://github.com/FluxA-Agent-Payment/FluxA-AI-Wallet-MCP/blob/main/README.md)", "Intent mandates carry a natural-language purpose, a limit in atomic units, a validity (default 8 hours in the MCP tool) and an optional host allowlist, and the owner signs each at an `authorizationUrl`. Payment errors include `mandate_budget_exceeded` and `mandate_insufficient_budget` (https://github.com/FluxA-Agent-Payment/FluxA-AI-Wallet-MCP/blob/main/skills/fluxa-agent-wallet/X402-PAYMENT.md)", "Payouts of USDC on Base need the owner's approval at an `approvalUrl` unless a signed mandate is passed, take a required `payout_id` that returns the existing payout on a repeat, and cannot be reversed once settled (https://github.com/FluxA-Agent-Payment/FluxA-AI-Wallet-MCP/blob/main/skills/fluxa-agent-wallet/PAYOUT.md)", "The skill's description tells agents to reach for paid AgentMarket APIs even when a free web search looks enough, to request a budget for at least 100 calls by default, and not to swap a paid API the user asked for for a free one (https://github.com/FluxA-Agent-Payment/FluxA-AI-Wallet-MCP/blob/main/skills/fluxa-agent-wallet/SKILL.md)", "The daily check-in guide has the agent run `npx -y @fluxa-pay/fluxa-wallet@latest` twice a day and read https://fluxapay.xyz/announcement.md (https://github.com/FluxA-Agent-Payment/FluxA-AI-Wallet-MCP/blob/main/skills/fluxa-agent-wallet/SCHEDULED-CHECKIN.md)", "The repository has 219 commits from 6 November 2025 to 6 November 2026, 43 merged pull requests, two git tags (fluxa-wallet@0.4.6 and @0.5.0), 68 node:test cases and no CI workflow (https://github.com/FluxA-Agent-Payment/FluxA-AI-Wallet-MCP)", "Neither npm package declares a repository or homepage. Maintainers are yy-fluxa, jennyagi3000 and sky_fluxapay (https://registry.npmjs.org/@fluxa-pay%2Ffluxa-wallet)", "AgentMarket's footer names FluxA Technology Pte. Ltd. and links the Agent Wallet at agentwallet.fluxapay.xyz. AgentMarket's terms (effective 14 January 2026) and privacy policy do not mention the wallet (https://agentmarket.fluxapay.xyz/terms)" ], "area": "payments", "details": [ { "label": "Surface graded", "value": "The hosted FluxA wallet (walletapi.fluxapay.xyz, agentid.fluxapay.xyz and the approval pages on agentwallet.fluxapay.xyz and wallet.fluxapay.xyz) as an agent reaches it through the `fluxa-wallet` CLI 0.6.0, with the stdio MCP server described beside it. Read on 7 November 2026 from a full clone of FluxA-Agent-Payment/FluxA-AI-Wallet-MCP read as text (source, README, skills, docs, tests), the npm registry documents and tarballs of both packages read as text, and AgentMarket's home, about, terms, privacy, pricing, getting-started and llms.txt pages. Nothing was installed or run, no wallet was connected and no API was called" }, { "label": "Kind", "value": "Listed as `http-api` and read with the hosted lines. The repository is named for the MCP server and its README opens with it, but the 0.6.0 skill tells agents to use the CLI and says agents never write payment code, AgentMarket's llms.txt says payment is settled by the CLI, the CLI has about 60 commands (cards, linked cards, refunds, balances, the marketplace) against the MCP server's 15 tools, and the CLI is published on npm at 0.6.0 while the MCP package stopped at 0.2.0. Signing, mandates and approvals all happen on FluxA's servers, which the CLI wraps" }, { "label": "Custody", "value": "Not stated. The README says no private keys are stored or managed locally and that FluxA Wallet signs every authorisation; the agent guide calls it managed wallet infrastructure; the skill calls it a co-wallet for the user's wallet. No page read says whether FluxA, a provider or the user holds the keys" }, { "label": "Spending controls", "value": "Intent mandates with a purpose in plain words, a limit in atomic units, a validity (MCP default 28,800 seconds), a category and an optional `hostAllowlist`, signed by the owner. The wallet API tracks spent, pending and remaining amounts and refuses payments with `mandate_not_signed`, `mandate_expired`, `mandate_budget_exceeded` or `mandate_insufficient_budget`. A failed call keeps its price reserved on the mandate for about 6 minutes, per the skill. Linked-card (`CARD_USD`) mandates are scoped to one merchant name, HTTPS URL and country" }, { "label": "Approvals", "value": "The owner approves the agent connection, each mandate and each payout without a mandate in a browser. A signed mandate lets payouts and x402 payments run without further approval. The skill says top-ups and card payments still need an explicit yes in chat" }, { "label": "Revocation", "value": "Tokens carry an owner-chosen validity, and the API answers `token_revoked` for revoked tokens; where the owner revokes was not read, since the wallet site could not be fetched. AgentMarket `fxa_live_` keys are revoked with `fluxa-wallet market keys revoke \u003cid\u003e`. Legacy `init` tokens are described in the README as not expiring" }, { "label": "Chains and assets", "value": "USDC on Base (chain 8453) and Base Sepolia for x402 and payouts. The CLI's `balance` reports USDC, XRP and credits, while the skill says payments support only Card and USDC since CLI 0.5.7; the MCP mandate tool still lists USDC, XRP and FLUXA_MONETIZE_CREDITS" }, { "label": "Machine payments", "value": "x402 v1 and v2 payloads, `exact` scheme only, signed as EIP-3009 authorisations by the wallet API and returned as the payment header for the agent to retry with. Payment links on wallet.fluxapay.xyz can be paid over x402. AgentMarket Balance top-ups go over x402 in Base USDC" }, { "label": "Cards", "value": "Prepaid agent cards issued against a mandate after a KYC profile (name, email, phone, address), behind a waitlist (`card_waitlist_required`), with balance, transactions, 3DS challenges, recharge and withdrawal commands; `card details` reveals PAN, CVV and expiry. Linked-card checkout pays a merchant's payment attempt with the user's own card under a `CARD_USD` mandate. A separate agentic-checkout skill (0.4.0) fills Shopify checkouts with Playwright from card data in a local JSON file" }, { "label": "Payouts and refunds", "value": "`payout` sends USDC on Base to an address with a required idempotency `--id`, optional `--mandate`, `--biz-id` (duplicates answer 409) and `--description`; statuses run from `pending_authorization` to `succeeded`, `failed` or `expired`, and settled payouts cannot be reversed. Payment-link refunds, full or partial, are created, listed, read and cancelled from the CLI; cancelling a settled refund answers 410, per TEST-CLI-REFUND-PAYOUT.md (a test plan in Chinese)" }, { "label": "MCP server", "value": "Stdio only, run from the repository with `npm run build` and `npm start`; the docs give no npx or client config. 15 tools in the 0.6.0 source with Zod input schemas and no annotations, namely connect_wallet, get_wallet_connection, init_agent_id, request_x402_payment, request_x402_v3_payment, create_intent_mandate, get_mandate_status, request_payout, get_payout_status, get_agent_status and five payment-link tools. About 4,700 characters of descriptions. npm 0.2.0 has 13 of them, without the two connection tools. It writes a local `audit.log` of payment requests" }, { "label": "CLI", "value": "`@fluxa-pay/fluxa-wallet` 0.6.0, Node 18 or later, one bundled file with no runtime dependencies or install scripts. JSON output with `success`, `data`, `code` and `error`, exit code 0 or 1. It calls only fluxapay.xyz hosts (agentid, walletapi, wallet, agentwallet, agentcard, agentmarket, router)" }, { "label": "Agent identity", "value": "Agent IDs with a token and an RS256 JWT. `agent-vc` issues a verifiable credential bound to one audience and challenge with a TTL up to 24 hours, which FluxA's own endpoints reject, so it cannot be replayed against the wallet" }, { "label": "Errors", "value": "Connection errors carry `code`, `retryable` and `next_command` or `next_tool`; credential errors carry `reconnect_required` and the Agent ID; card errors map about 20 codes to recovery hints. The MCP payment tools pass the wallet API's error body through as text and mark only missing-connection errors with `isError`" }, { "label": "Status", "value": "No status page, rate limit or SLA was found in the repository or on AgentMarket's pages. fluxapay.xyz and the wallet and docs hosts could not be read" }, { "label": "Releases", "value": "npm `@fluxa-pay/fluxa-wallet-mcp` 0.1.0 on 11 November 2025 to 0.2.0 on 2 March 2026 (8 versions). `@fluxa-pay/fluxa-wallet` 0.2.0 on 2 March 2026 to 0.6.0 on 6 November 2026 (25 versions, 8 since 10 August). A commit of 4 November 2026 says it released the CLI, MCP and skill at 0.5.6, and npm has no MCP release after 0.2.0. No changelog file" } ], "provenance": { "legalEntity": "FluxA Technology Pte. Ltd.", "domain": "fluxapay.xyz", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "", "privacy": "", "statusPage": "", "changelog": "", "securityTxt": "unknown", "checked": "2026-11-07", "notes": [ "The legal entity is from the footer of agentmarket.fluxapay.xyz, \"© 2025 FluxA Technology Pte. Ltd. All rights reserved.\", the same on the about, terms, privacy and pricing pages. No registration number, address or country is given on those pages. A web search result names a companieshouse.sg page for FluxA Technology Pte Ltd with UEN 202555700C; that host could not be fetched, so the register entry is unread.", "AgentMarket's terms (effective 14 January 2026) and privacy policy (updated 14 January 2026) describe the marketplace and its Balance and do not mention the Agent Wallet, cards, KYC or payouts, so they are not recorded as the wallet's terms. The terms name no entity in their text and no governing law; contact support.fluxapay@fluxapay.xyz.", "fluxapay.xyz, agentwallet.fluxapay.xyz and docs.fluxapay.xyz could not be read. Each robots.txt fetch was refused for want of an approval on 7 November 2026, so nothing on those hosts was fetched. The wallet's own terms, privacy policy, fees, security.txt and docs are unchecked.", "https://agentmarket.fluxapay.xyz/.well-known/security.txt answered a client error. The repository has no SECURITY.md.", "The wallet API, Agent ID API and approval pages are on fluxapay.xyz subdomains named in the CLI source. agentmarket.fluxapay.xyz's robots.txt allows / and disallows /api/ (except /api/discover and /api/llm/skills.md) and /console/; nothing disallowed was fetched.", "unchecked: RDAP for fluxapay.xyz, the MCP registry, the Wayback Machine, GitHub stars and issues (the GitHub API refused the session) and npm download counts." ], "score": 38, "checks": [ { "check": "Legal entity named", "value": "FluxA Technology Pte. Ltd.", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "fluxapay.xyz, no registry record we could read", "points": 0, "max": 15, "state": "no" }, { "check": "Endpoint on the vendor's domain", "value": "walletapi.fluxapay.xyz", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Privacy policy", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Status page", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Changelog", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "security.txt", "value": "could not be fetched", "points": 0, "max": 10, "state": "no" }, { "check": "People named", "value": "not researched yet", "points": 0, "max": 0, "state": "na" }, { "check": "Support route", "value": "a support address, help pages, a community", "points": 5, "max": 5, "state": "ok" } ] }, "humans": { "slug": "fluxa-ai-wallet", "checked": "2026-11-07", "company": "FluxA Technology Pte. Ltd.", "peopleNote": "No person is named with a role on any first-hand page read. AgentMarket's about page names no people, founding date or location, and its terms, privacy policy and pricing page name only FluxA Technology Pte. Ltd. in the footer and support.fluxapay@fluxapay.xyz. The repository's README, skills and docs name nobody. Commit authors in FluxA-Agent-Payment/FluxA-AI-Wallet-MCP and the npm maintainers yy-fluxa, jennyagi3000 and sky_fluxapay are not roles and were not used, nor was the submitter's name. fluxapay.xyz, agentwallet.fluxapay.xyz and docs.fluxapay.xyz could not be read (robots.txt fetches refused for want of an approval on 7 November 2026), and neither could fluxapay.substack.com, so any team or funding page there is unchecked. Ownership is private from the footer's Singapore private limited company; the register entry was not read (a search result names a companieshouse.sg page with UEN 202555700C, a host that was refused). Investors were looked for on AgentMarket's about, terms, privacy and pricing pages and in five web searches (FluxA with funding, seed, pre-seed, investors and the company's full name), which returned only unrelated companies named Flux, job listings, dev.to posts and directory pages; no round, backer, grant or accelerator was found.", "companySocial": { "linkedin": "https://www.linkedin.com/company/fluxa-pay/", "x": "https://x.com/FluxA_Official", "github": "https://github.com/FluxA-Agent-Payment" }, "support": { "emails": [ "support.fluxapay@fluxapay.xyz" ], "urls": [ "https://docs.fluxapay.xyz/", "https://agentwallet.fluxapay.xyz/" ], "community": [ { "label": "FluxA Discord", "url": "https://discord.gg/fluxapay", "kind": "discord" }, { "label": "FluxA-AI-Wallet-MCP on GitHub", "url": "https://github.com/FluxA-Agent-Payment/FluxA-AI-Wallet-MCP", "kind": "github" } ] }, "sources": [ "https://agentmarket.fluxapay.xyz/", "https://agentmarket.fluxapay.xyz/about", "https://agentmarket.fluxapay.xyz/terms", "https://agentmarket.fluxapay.xyz/privacy", "https://agentmarket.fluxapay.xyz/pricing", "https://github.com/FluxA-Agent-Payment/FluxA-AI-Wallet-MCP" ], "ownership": { "status": "private", "checked": "2026-11-07", "sources": [ "https://agentmarket.fluxapay.xyz/about", "https://agentmarket.fluxapay.xyz/terms" ] } }, "pageJsonUrl": "https://www.anchorterminal.com/tools/fluxa-ai-wallet.json", "live": { "slug": "fluxa-ai-wallet", "probe": { "target": "https://walletapi.fluxapay.xyz", "method": "get", "lastAt": "2026-11-08T14:47:50.695700215Z", "lastOk": true, "lastStatus": 404, "lastMs": 532, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 542, "p95ms24h": 603, "samples24h": 90, "samples30d": 90, "days": [ { "date": "2026-11-08", "probes": 90, "ok": 90 } ], "since": "2026-11-08T00:00:00Z" }, "updatedAt": "2026-11-08T14:47:50.695700215Z" }, "streak": { "days": 0, "from": "2026-11-08", "sinceWatching": true, "best": 0 } } }