Adyen MCP server vs FluxA AgentMarket

Adyen MCP server 83

The server is MIT on GitHub (30). It runs locally and sends requests only to Adyen's APIs. Adyen's privacy statement of 4 August 2025 and a sub-processor list of 1 July 2026 are public. We did not read retention periods, and nothing addresses MCP use (20 of 30). Adyen documents API versioning and what counts as a breaking change. The server has no deprecation policy and is labelled alpha (8 of 20). No telemetry code was found in the source. The server sets the application name adyen-mcp-server 0.4.0 on its API requests, which the README does not mention (14 of 20).

FluxA AgentMarket 32

The editorial half. The marketplace, proxy and gateway are closed. The terms (effective 14 January 2026) cover pricing, refunds and acceptable use but name no governing law, termination terms, liability for third-party listings or creator obligations, and the company appears only in the footer. The CLI is Apache-2.0 (8 of 30). The privacy policy (14 January 2026) lists account, payment and usage data and says identity isn't shared with model providers. It says nothing on prompts, API payloads, retention, training or data location (6 of 30). No deprecation policy or dated notice was found, and the terms may change 'at any time' (0 of 20). The policy names Stripe and 'OpenAI/Anthropic API' as a non-exhaustive list, while the models page lists AIHubMix, UnifyLLM and Baidu AI Cloud as providers. No locations are given (4 of 20). Total 18. The provenance half is computed from the provenance block.

Adyen MCP server 62

Read on the local-software lines, because the server runs on the owner's machine over stdio. It installs from the official npm package @adyen/mcp, published from GitHub Actions with a provenance attestation, with Node 18 or later stated, per the 9 October check, not re-read on 4 November (20). The TypeScript Tests workflow runs npm test on every push and pull request to main, over four vitest files of 959 lines. GitHub's pages and API refuse us, so the latest result is unread, and public CI that runs the tests with an unread result scores 15 in this run (15 of 25). One bug report was open on 9 October, filed on 7 October 2026 and unanswered, about refunds repeated after a timeout, and earlier issues were answered within three days. Issues per the 9 October check, not re-read on 4 November (19 of 25). Releases are tagged by version with notes on GitHub and a breaking-change category in the release template, but there is no changelog file and 0.6.0 reports itself as 0.4.0 (8 of 15). The README is headed alpha and the version is 0.6.0 (0). Adyen's status page at status.adyen.com shows 99.999% uptime for the last 30 days and draws its incident history by script, which these lines don't score. 20+15+19+8+0 = 62.

FluxA AgentMarket 12

Graded as a hosted service, the discovery gateway on agentmarket.fluxapay.xyz and the proxy and LLM endpoints on router.fluxapay.xyz, from the vendor's pages. Nothing was called. No status page is linked from the site, the footer, llms.txt or the guides, and no status host was checked (0). With no readable incident history the record takes the default (5). Listing pages show a health count with no history, such as '10/10 endpoints healthy' on Minifetch. No rate limit with numbers was found in llms.txt, the guides or the CLI help. The only cap is a per-key spending limit (0). The Balance guide says to retry a 503 shortly without minting a new credential, replays of a settled top-up finalize call are idempotent, a failed order answers 409, and the card flow says 'a retry is a new order'. No 429 or Retry-After guidance was found. Termix earned 8 for the same kind of guidance with idempotency keys on writes (7 of 15). No SLA was found, and the terms supply the service 'as is' (0). The about page labels the product 'v.01 / Beta' (0). Total 12.

Adyen MCP server 35

The server is free, so pricing is read on the Adyen account it needs. No x402, MPP or L402 in the docs page, the repository or the pricing page (0). The pricing page lists per-transaction fees without a login, $0.13 plus the payment method's fee, with no setup or monthly fee (20). A developer test account is free through a signup form. The form's fields are drawn by script, so whether it asks for a card was not read, and a minimum invoice applies to live accounts (15 of 20). A person has to sign up, and live accounts go through sales (0).

FluxA AgentMarket 75

Payment platforms take the highest step that applies on the 40-point protocol line (40 on all their own endpoints, 30 on part of their own API, 25 when their merchants can accept one, 20 for a facilitator, 15 for paying as a buyer, 0 for only a protocol of their own). AgentMarket's proxied API endpoints and Balance top-ups answer x402 (v1 body or v2 PAYMENT-REQUIRED header), the pricing page says USDC from another wallet works over x402 on Base, and the FluxA CLI signs the standard exact EIP-3009 scheme. Model calls are charged to the Balance with a key or Agent VC. Nothing was paid, so this rests on the vendor's pages (30 of 40). Per-call price ranges are public in the catalogue, per-endpoint prices on listing pages, model prices per 1M tokens, Balance bundles and Token Plan prices, all without a login (20). Discovery and price reads are free with no account and some listed endpoints are priced at $0, but no free credit or trial was found. The wallet's TokenGo guide calls a $1 first top-up a trial. Termix earned 20 for free reads, and here a judgement call gives half (10 of 20). An agent holding Base USDC can pay a listed API per call with no account, per the pricing page and the 402 flow. Model calls, the Balance and keys need an account a person creates by signing in ('an agent cannot create either account'), and the FluxA wallet path needs a person to approve registration and sign a mandate (15 of 20). Total 75.

Adyen MCP server 42

0.6.0 was tagged on 24 August 2026, 72 days before this check, and the clone's newest commit on 4 November is still b65825d of 11 September (20 of 30). It is the only release in the 90 days from 6 August, with 0.5.0 on 22 April per npm on 9 October (0). Maintainers answered two outside issues within one and three days in September and merged dependency updates on 11 September. Two outside pull requests from July were still open, and the 7 October bug report had no reply after two days, per the 9 October check, not re-read on 4 November (15 of 25). The repository has no server.json or mcpName, and the official registry's search for adyen returns two entries on 4 November, both io.github.codespar/mcp-adyen from a third party (0). Renovate, CodeQL, lint and test workflows run, and npm publishing uses provenance. @adyen/api-library is pinned at ^27.0.0 in package.json while an update to 32 waits, per the 9 October check (7 of 10). 20+0+15+0+7 = 42.

FluxA AgentMarket 64

Read for a closed service. No changelog or dated release notes were found. The models page says the catalogue was 'last updated November 5, 2026', and @fluxa-pay/fluxa-wallet 0.6.0, the CLI that carries the market commands llms.txt relies on, was published on 6 November 2026 (30). The CLI had eight releases between 10 August and 6 November 2026, 0.4.12 to 0.6.0 (20). Support is a Discord server and support.fluxapay@fluxapay.xyz, neither tested, and GitHub issues couldn't be read because the GitHub API refused us (3 of 15). No AgentMarket SDK. The TypeScript CLI is the official client and the LLM endpoints take OpenAI and Anthropic SDKs. Not an MCP server, so the registry line reads as SDKs (7 of 15). The CLI repository has 7 test files and no CI workflow, and the npm package declares no repository. @fluxa-pay/fluxa-connect-mcp points to a repository that isn't public (4 of 10). Total 64.

Adyen MCP server 73

Every tool is registered with a zod shape that the MCP SDK turns into JSON Schema (25). docs.adyen.com has an llms.txt and a Markdown twin of every page, the MCP page included (10). Descriptions give arguments, returns, notes and an example, and several say when to pick another tool. Some are wrong. refund_payment names paymentPspReference where the schema has pspReference and omits the required reference, and cancel_payment points to reversal tools that do not exist (12 of 20). Terminal tools have enums and described fields. The checkout tools take currency, country and status as free strings (9 of 15). Each description has an example. No error reference for the tools was found, though Adyen documents HTTP status and error codes for the APIs (8 of 15). Releases are versioned with notes on GitHub, while the docs page was last modified on 11 June 2025 and names two of the four APIs covered (9 of 15).

FluxA AgentMarket 53

No OpenAPI file was found. llms.txt names none and the documentation site, docs.fluxapay.xyz, couldn't be read because its robots.txt couldn't be. The discovery response has documented fields (apiServers, skills, models, pagination), a GET on each listing's urls.access returns its endpoints and prices as JSON per the skill-creation guide, and the LLM endpoints follow the OpenAI and Anthropic formats (8 of 25). llms.txt and Markdown guides (getting-started.md, currency.md, create-skill.md, the APIs and Balance guides) written for agents (10). The guides say when to use search against query, that the external catalogues are a last resort and which rail fits which job. Listing descriptions come from creators and 17 of the first 50 skills have none (12 of 20). type is an enum that answers 400 to unknown values, limit is bounded at 1,000, and the chat and messages bodies follow published formats. Listing endpoints are described by each creator (9 of 15). curl examples for discovery, models and payment, a status table in the Balance guide with the action for 401, 503, 404, 402 and 409, and seven named mandate errors in the APIs guide (11 of 15). Paths carry /llm/v1/ and llms.txt names minimum CLI versions, but no changelog was found (3 of 15). Total 53.

Adyen MCP server 63

The credential is an Adyen API key on a web service user with roles and company or merchant scope, replaceable at any time with 24 hours of overlap. The docs page still shows the key on the command line, and 0.6.0 added the environment variable and a warning for live use (26 of 30). --tools and roles narrow what the server can do, the test environment is the default, and writes are annotated. No read-only switch and no confirmation step for refunds or terminal changes was found (11 of 20). Tools return webhook settings, user records and payment data written by other people, and no guidance on untrusted content was found (3 of 15). The Customer Area keeps API logs of each request and response for 30 days (12 of 15). Adyen has a responsible disclosure policy with a 60-day fix target and a hall of fame, its terms commit to PCI DSS certification, and the repository runs CodeQL. security.txt expired on 31 December 2025, the repository has no security policy file, and no bug bounty was found (11 of 20).

FluxA AgentMarket 51

fxa_live_ keys are created by a person at /keys and shown once, each with a spending limit in Units that changes within seconds, and are revoked immediately over DELETE /llm/keys/<id>, with written rotation steps. Key management needs a 5-minute Agent VC, never a key, and creation can be set to need a person's approval. No permission scopes beyond the spending limit were found, and no secret in a URL (24 of 30). Wallet payments need a mandate a person signs with a USDC budget and an expiry, and the Balance guide says to confirm every top-up with the user. The APIs guide tells agents not to ask before paying within a signed mandate, and no read-only key was found (14 of 20). The marketplace returns content from third-party APIs and installs third-party skills. Results carry a fluxa or bazaar source tag, but entries named ssrf1, keyprobe and tooltest1 are tagged fluxa, no review of uploads is described, and no guidance on treating responses or skills as untrusted was found (2 of 15). The balance endpoint returns available, spent, burn per day and owed, the ledger lists spend and purchases per merchant, and the wallet skill reads an X-LLM-Cost header on model calls (11 of 15). No disclosure policy, bug bounty, certification or advisory was found. security.txt couldn't be read and is scored absent, and the privacy policy says only 'industry-standard security measures' (0 of 20). Total 51.