# Agentcard vs FluxA AI Wallet

> Agentcard scores 52.5 (D) to FluxA AI Wallet's 47 (D) for card payments. Prices, MCP, x402, uptime and agent notes side by side.

- Canonical: https://www.anchorterminal.com/compare/agentcard-vs-fluxa-ai-wallet
- Markdown: https://www.anchorterminal.com/compare/agentcard-vs-fluxa-ai-wallet.md (~6,150 tokens)
- Site index for agents: https://www.anchorterminal.com/llms.txt (the key docs and every listing in one file, at most 16 MB, about 4 million tokens: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key)
- DNS: dig +short TXT <slug>.grade.anchorterminal.com (the grade as a DNS TXT record, for a sandbox with no HTTP where names still resolve; also top., best.<category>. and <a>.vs.<b>. under the zone, and the same under grade.letme.dev)
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)
- Updated: 2026-11-07

Agentcard scores 52.5 (D) on agent readiness against FluxA AI Wallet's 47 (D), and leads in 6 of 7 scored categories. Both do card payments.

- Agentcard: grade D, 52.5/100, rank #989 of 1513. Markdown https://www.anchorterminal.com/tools/agentcard.md · JSON https://www.anchorterminal.com/api/v1/tools/agentcard.json
- FluxA AI Wallet: grade D, 47/100, rank #1164 of 1513. Markdown https://www.anchorterminal.com/tools/fluxa-ai-wallet.md · JSON https://www.anchorterminal.com/api/v1/tools/fluxa-ai-wallet.json
- Best agent wallets and spending controls: https://www.anchorterminal.com/best/agent-wallets/index.md
- All 77 wallets comparisons: https://www.anchorterminal.com/compare/agent-wallets/index.md

## Which one, for what

### Agentcard (D)

Good for: A company building a shopping or purchasing agent that needs users to pay with their own cards under passkey approval, or needs capped virtual Visa cards per task.

Ahead on:
- Reliability, 26 against 20
- Schema & documentation, 80 against 61
- Security & auth, 71 against 52
- Maintenance & community, 74 against 66
- Transparency & trust, 68 against 32

Watch for: No status page or incident history was found on the site or in the docs. An SLA is listed for Enterprise plans only, with no published text

### FluxA AI Wallet (D)

Good for: An agent in a CLI-capable client that needs to pay x402 APIs, send USDC on Base or receive payments through links, inside budgets a person signs.

Also in its favour:
- Runs on your own machine
- Open source
- No incidents deducted, where Agentcard loses 6 points for them

Watch for: The published MCP package is 0.2.0 from 2 March 2026 with 13 tools, while the repository says 0.6.0 with 15


## Why the edge

### Transparency & trust: Agentcard +36

- Agentcard (68): A closed service. The repository named in the npm packages is private, `agent-cards` declares no licence and `@agent-cards/checkout` is marked as having none (per the 9 October check). The terms of use, updated 10 July 2026, name the legal entity and its addresses, cover the API, MCP server and CLI, and state what a card is and who issues it (13 of 30). Agentcard now publishes its own privacy policy at agentcard.com/privacy, last updated 21 October 2026. It lists what is collected, including session recordings in the dashboard, says personal data isn't sold, holds a one-time card credential for at most 45 minutes, and keeps other data as long as the account is active or as needed, with no fixed period and no public DPA (the Enterprise plans offer one) (15 of 30). The older token path is kept with a note, and the changelog labels some changes Breaking on the day they ship. No deprecation policy or advance notice was found (5 of 20). The privacy policy names Crossmint, Coinbase, Third National, Sumsub, Visa and Stripe, lists other providers by kind (AI model providers, browser session providers, analytics and error monitoring) and names Ahrefs Analytics, PostHog and Vector, and says data is transferred to the United States. The CLI README discloses telemetry and two settings that turn it off (15 of 20). 13 + 15 + 5 + 15 = 48.
- FluxA AI Wallet (32): The CLI and MCP server source is Apache-2.0 per the LICENSE file and both package.json files, while the README's last section says MIT. The hosted wallet is closed, and no terms covering it were found. AgentMarket's terms describe only the marketplace (15 of 30). AgentMarket's privacy policy of 14 January 2026 names Stripe and model providers and gives no retention periods, and it does not mention wallet addresses, KYC profiles, card data or payouts, which the CLI collects or handles. The wallet's own privacy policy was unreachable (5 of 30). The README marks `init` and `link-wallet` as legacy but still supported, and the skill pins a minimum CLI version; no deprecation policy or dated notice was found (3 of 20). Stripe is the only provider named; no card issuer, KYC provider, custody provider or data location is named. The CLI and MCP code send no telemetry (3 of 20). Total 26.

### Schema & documentation: Agentcard +19

- Agentcard (80): A public OpenAPI 3.1.0 file at docs.agentcard.sh/openapi.json, version 2.0.0, with 20 paths and 21 operations for tokens, connections, identity checks, `/buy` and cards. The Vault, preset, webhook endpoint and Blooio routes in the API reference are Markdown pages with no entry in the file. Each MCP tool has a page with typed inputs and returns (17 of 25). We read the description file and the Markdown pages, not the rendered reference. llms.txt indexes 379 pages, each with a Markdown twin (10). Tool and endpoint descriptions say what a call does, when to use it and when not to, for example that `get_card_details` is for the payment form only and `get_card_balance` is preferred otherwise (17 of 20). The OpenAPI file has 36 enums and 31 required lists, and amounts are integers in cents. `/buy` takes free text in `ask`, and `preset` accepts a name, a list, inline JSON or an object (11 of 15). Every operation documents error responses with named codes, the file holds 37 examples, and MCP pages show captured error results (13 of 15). The API is versioned in the path as `/api/v2`, the older `/api/v1/oauth/token` path still answers, and a public changelog is dated almost daily to 28 September 2026. The changelog mixes product and API changes and the OpenAPI version has no dated history (12 of 15).
- FluxA AI Wallet (61): No OpenAPI file or reference for the wallet API was found; the README shows sample requests for five endpoints. The MCP server's 15 tools in the 0.6.0 source carry typed Zod input schemas, and the CLI's flags are documented in prose in the skill files and `--help`. The MCP server is the secondary surface and its npm release is 0.2.0, so 12 of 25. The skill and its 18 Markdown guides are written for agents, and AgentMarket's llms.txt describes the wallet's payment role (10). `connect_wallet`, `init_agent_id` and `create_intent_mandate` say when to use them and when not to, and the skill has a when-to-use table per capability, while the payment-link and status tools have one-line descriptions (12 of 20). Zod enums for validity, runtime, hosting and currency, a regex on payout amounts and strict objects, but the x402 requirement fields are plain strings and `outputSchema` is a free-form record (10 of 15). The README has an example for every MCP tool, the skills give CLI examples and output, and error codes are tabled for mandates, payouts, cards and connections (12 of 15). Semver on npm with 25 CLI versions and a version line in the skill, two git tags and no changelog (5 of 15). Total 61.

### Security & auth: Agentcard +19

- Agentcard (71): OAuth 2.0 client credentials. Client secrets are shown once, clients are separate for sandbox and production and can be revoked, platform tokens last one hour, and user connection tokens last one hour with refresh tokens that rotate on each use. Platform tokens carry the single scope `api`, and the MCP guide sends the client secret itself as the bearer for organisation tools. No secret travels in a URL (23 of 30). Vault purchases wait for the user's passkey or master password by default, production card creation returns `approval_pending`, users can require approval for each reveal of card details, and presets cap spend and restrict merchants, categories, places, currencies and hours. A connected app gets `read_only` when it tries to change presets, and approval tools answer `personal_surface_only` to a connected session. An app's auto-approval permission on a saved card has no spending limit or end date per the docs (18 of 20). The Purchase API returns merchant catalogue text to the agent. Money moves only when the agent echoes a cart `hash`, `buy_checkout` re-checks `expected_total_cents` and the address, and preset rules ignore the `merchant` text an agent sends. No guidance that names untrusted content or prompt injection was found (9 of 15). Webhooks cover cards, transactions, approvals and orders, deliveries are logged, each read of card credentials notifies the member, and transactions are listed by API and tool (11 of 15). agentcard.com/.well-known/security.txt is valid on 4 November 2026, with the contact security@agentcard.com and an expiry of 1 October 2027, and states no acknowledgement time (7). The Enterprise plans list a SOC 2 report and a pen-test summary, and the Trust Centre on app.vanta.com was closed to us by robots.txt on 9 October, so the report wasn't read (3). No bug bounty or published advisory was found. The changelog describes security fixes in prose (10 of 20). 23 + 18 + 9 + 11 + 10 = 71.
- FluxA AI Wallet (52): The agent holds an Agent ID, a token whose validity the owner picks from 1 hour to 1 year at browser approval, and a short-lived RS256 JWT refreshed from the token; `token_revoked` exists. Credentials sit in a 0600 JSON file or environment variables. The token is not scoped, since limits live in mandates, and legacy `init` tokens are described as not expiring. Agent VCs are audience-bound and rejected by FluxA's own endpoints. No secret travels in a URL (22 of 30). Every x402 payment needs a mandate the owner signs, with a limit, a validity and an optional host allowlist enforced by the wallet API, payouts need per-payout approval unless a mandate covers them, cards need a mandate and KYC, and linked-card mandates are scoped to one merchant. A payout mandate sets no payee allowlist that was documented, and the skill tells agents to request budgets for at least 100 calls by default (16 of 20). The wallet returns little third-party content itself, but the skill sends agents to third-party x402 APIs, ClawPI posts and a remote announcement.md with no guidance on treating them as untrusted, its description steers agents to paid APIs even when a free web search looks enough, and the daily check-in runs `npx -y @fluxa-pay/fluxa-wallet@latest` unpinned twice a day (4 of 15). `mandates` lists limit, spent and remaining, with `recent-transactions`, `received-records` and payout status by CLI, and the MCP server writes a local audit log; the wallet app's logs were not read (10 of 15). No SECURITY.md, disclosure policy, bug bounty or certification was found, and agentmarket.fluxapay.xyz has no security.txt; fluxapay.xyz's is unchecked (0 of 20). Total 52.

### Maintenance & community: Agentcard +8

- Agentcard (74): The newest changelog entry is dated 27 October 2026, and `@agent-cards/checkout` 0.23.6 was published on 9 October 2026 per the 9 October check (30). The changelog has 176 dated entries from 27 February to 27 October 2026, 82 of them in the 90 days from 6 August (20). The service is closed and the repository named in the packages is private. Support is an email address, a support chat reachable through MCP tools and the CLI, and an `ask_agentcard_engineer` tool. None was tested (10 of 15). The CLI and the TypeScript checkout SDK were current on 9 October, and npm wasn't re-read. Presence in the official MCP registry was not checked (10 of 15). The CLI has 19 runtime dependencies, needs Node 22 or later and declares no licence. CI is not visible (4 of 10). 30 + 20 + 10 + 10 + 4 = 74.
- FluxA AI Wallet (66): `@fluxa-pay/fluxa-wallet` 0.6.0 was published on 6 November 2026, one day before this check (30). Eight CLI releases since 10 August 2026, among them 0.5.2 on 14 October, 0.5.3 on 25 October and 0.5.6, 0.5.7 and 0.6.0 between 3 and 6 November (20). The repository merged 43 pull requests, all from the organisation's own branches, and commits run weekly. Issues and outside pull requests could not be read because the GitHub API refused the session. Discord and a support address are linked from AgentMarket and were not tested (8 of 25). Graded as an API, the line asks for current official SDKs. The CLI is current, but there is no SDK library and the MCP package on npm has not been published since 2 March 2026 (5 of 15). 68 node:test cases exist with no CI workflow, neither npm package declares its repository, and the MCP package's last release lags the source by eight months (3 of 10). Total 66.

### Reliability: Agentcard +6

- Agentcard (26): Graded as a hosted service on the REST API at api.agentcard.sh and the MCP server at mcp.agentcard.sh. The site moved to agentcard.com in October 2026, and www.agentcard.sh pages answer 301 to it. No status page was found. The site footer and the docs link none (0). With no readable incident history the record takes the default (5). The changelog of 22 September 2026 records a fixed startup failure in which a deploy could make every API request return an error, with no duration. The only rate limit with numbers is 30 requests per 5 minutes per IP on the token endpoint, and the MCP `create_card` tool can answer `rate_limited` with advice to wait about a minute (5 of 15, the 9 October partial kept). `POST /api/v2/cards` requires an `Idempotency-Key`, `buy_checkout` and the organisation `create_card` tool take an `idempotency_key`, webhooks are delivered at least once with advice to deduplicate on `id`, and the docs say never to retry a payment automatically. No 429 response or `Retry-After` header is documented (10 of 15). The pricing page lists an SLA with uptime and response-time guarantees in writing for the Enterprise plans, and no SLA text is published. A listed SLA nobody could read scores 0 in this run (0 of 10). Vault and Issuing carry no beta label. The Purchase Agent is free in beta and `create_card` can return `beta_capacity_reached` (6 of 10, the 9 October partial kept). 0 + 5 + 5 + 10 + 0 + 6 = 26.
- FluxA AI Wallet (20): Graded with the hosted lines, because signing, mandates and approvals all run on FluxA's wallet API and the CLI and MCP server only wrap it, as kite-agent-passport and kane-cli were read. No status page was found in the repository, the skills or AgentMarket's pages. fluxapay.xyz and the wallet and docs hosts could not be read, so a status page there is unchecked and scored absent (0). With no readable history the record takes the default (5). No rate limit with numbers was found (0). The connection service treats 429 `slow_down` as wait and poll and marks errors `retryable`, the skill says a 503 means retry shortly, payouts require a caller-chosen `payout_id` that returns the existing payout on a repeat, `--biz-id` rejects a duplicate with 409, and card create and recharge resume with `--request-id` instead of paying again. No Retry-After or backoff schedule is documented for the wallet API (10 of 15). No SLA was found (0). No beta label was found on the wallet in what was read, but both packages are at 0.x, agent cards sit behind a waitlist and the wallet site was unread (5 of 10). Total 20.

## Score by category

| Category | Weight | Agentcard | FluxA AI Wallet | Edge |
| --- | --- | --- | --- | --- |
| Reliability | 16% (20 this run) | 26 | 20 | Agentcard +6 |
| Performance | 10%, pending | pending | pending | not scored in this run |
| Schema & documentation | 13% (16.2 this run) | 80 | 61 | Agentcard +19 |
| Agent ergonomics | 13% (16.2 this run) | 63 | 60 | Agentcard +3 |
| Security & auth | 14% (17.5 this run) | 71 | 52 | Agentcard +19 |
| Payments & pricing | 10% (12.5 this run) | 42 | 45 | FluxA AI Wallet +3 |
| Task success | 10%, pending | pending | pending | not scored in this run |
| Maintenance & community | 7% (8.8 this run) | 74 | 66 | Agentcard +8 |
| Transparency & trust | 7% (8.8 this run) | 68 | 32 | Agentcard +36 |
| Negative events | ≤15 | -6 | 0 | |
| **Total** | | **52.5 · D** | **47 · D** | |

## Facts side by side

| Fact | Agentcard | FluxA AI Wallet |
| --- | --- | --- |
| Kind | HTTP API | HTTP API |
| Vendor | Agentcard Corporation | FluxA Technology Pte. Ltd. |
| Hosted endpoint | `https://api.agentcard.sh` | `https://walletapi.fluxapay.xyz` |
| Transports | HTTP | HTTP, stdio |
| Auth | OAuth | OAuth or key |
| Pricing | Freemium | Pay per use |
| x402 | no | payer tooling only |
| Licence | Proprietary service under Agentcard's terms of use. The `agent-cards` CLI on npm declares no licence, `@agent-cards/checkout` is marked as having none, and the repository they name is private | The CLI and MCP server source is Apache-2.0 (LICENSE file and both package.json files), though the README's last section says MIT. The hosted wallet service is closed, and no terms covering the wallet were found |
| Tools exposed | none | 15 |
| Read-only variant documented | no | no |
| llms.txt | yes | no |
| Last release | 2026-10-09 | 2026-11-06 |
| Terms last updated | 2026-07-10 | no document linked |
| Privacy policy last updated | 2026-10-21 | no document linked |
| Customer content may train models | not found in the text | not read yet |
| Terms restrict automated access | yes | not read yet |
| Terms restrict benchmarking | not found in the text | not read yet |
| Terms or service can change without notice | not found in the text | not read yet |
| Arbitration or class-action waiver | yes | not read yet |
| Popularity | 33k npm/wk | none |

## How the scores have moved

### Agentcard

- -4.3 on 4 November 2026 (C to D): product, correction
- +0.3 on 27 October 2026: new evidence

### FluxA AI Wallet

No score change since it was listed.

## Verdicts

**Agentcard.** Purchases need the user's passkey approval by default, cards carry spending rules, and card creation takes an idempotency key. No status page or rate limits beyond the token endpoint were found. A 10 September change removed webhook amount fields on the day it was announced, and the changelog describes security fixes with no advisory. Issuing costs $5,000 a month.

**FluxA AI Wallet.** Every spend runs against a mandate the owner signs in a browser, with a budget, a validity window and an optional host allowlist, and payouts need approval or a mandate. The published MCP package is 0.2.0 from March 2026 against 0.6.0 in the repository, and no status page, fee schedule, wallet terms or custody statement was found.

## Before you call either

### Agentcard

1. Mint a platform token with `POST /api/v2/oauth/token` and cache it for its one hour. The endpoint allows 30 requests per 5 minutes per IP
2. Send the same `Idempotency-Key` on every retry of `POST /api/v2/cards`, and the same `idempotency_key` on every retry of `buy_checkout`
3. Pass `source: "issued"` to the MCP `create_card` tool for a card number. Without it the tool may start Vault setup and return a link
4. Call `get_card_details` only at the payment form and never log the result. Each read notifies the member and may return `approval_required`
5. Treat `transaction.authorized` and `order.*` webhooks as the record of a payment, and deduplicate deliveries on the event `id`
6. Read `amount`, `currency` and `amount_display` on checkout results and transaction webhooks. `amount_cents` and `charged_amount_cents` were removed on 10 September 2026

### FluxA AI Wallet

1. Run `fluxa-wallet status` first. If `configured` and `wallet_linked` are true, skip `connect`; otherwise show the `authorization_url` and wait with `connect-status --wait 100`
2. On `token_expired` or `token_revoked`, reconnect with the same `--agent-id`. Never run `init` to recover, which creates a new identity
3. Pass a unique `--id` on every `payout` and reuse it on retry; a repeat returns the existing payout instead of paying twice
4. Check `fluxa-wallet mandates` for a signed mandate with enough remaining budget before creating one, and size new budgets to the task
5. Install the CLI from npm, not the MCP package, whose npm release 0.2.0 lacks `connect_wallet` and `get_wallet_connection`

## Questions

### Which is better for AI agents, Agentcard or FluxA AI Wallet?

Agentcard scores 52.5 (D) on agent readiness against FluxA AI Wallet's 47 (D), and leads in 6 of 7 scored categories.

### Do Agentcard and FluxA AI Wallet need an API key?

Agentcard uses an OAuth sign-in. FluxA AI Wallet takes an API key or an OAuth sign-in.

### Can an agent call Agentcard and FluxA AI Wallet without installing anything?

Yes. Agentcard has a hosted endpoint at https://api.agentcard.sh and FluxA AI Wallet at https://walletapi.fluxapay.xyz.

### Are Agentcard and FluxA AI Wallet open source?

No open-source release is listed for Agentcard. FluxA AI Wallet is open source (The CLI and MCP server source is Apache-2.0 (LICENSE file and both package.json files), though the README's last section says MIT. The hosted wallet service is closed, and no terms covering the wallet were found).


## For agents

- This comparison as JSON: https://www.anchorterminal.com/compare/agentcard-vs-fluxa-ai-wallet.json, and with the fewest tokens: https://www.anchorterminal.com/compare/agentcard-vs-fluxa-ai-wallet.min.md
- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "agentcard", "b": "fluxa-ai-wallet"}`. From a terminal: `anchor compare agentcard fluxa-ai-wallet`
- Each listing in full: https://www.anchorterminal.com/api/v1/tools/agentcard.json and https://www.anchorterminal.com/api/v1/tools/fluxa-ai-wallet.json

## Other comparisons with Agentcard or FluxA AI Wallet

- [Agentcard vs Crossmint API + Docs MCP](https://www.anchorterminal.com/compare/agentcard-vs-crossmint.md)
- [Agentcard vs Kite Agent Passport](https://www.anchorterminal.com/compare/agentcard-vs-kite-agent-passport.md)
- [Agentcard vs Agent Vault by Self](https://www.anchorterminal.com/compare/agentcard-vs-self-agent-vault.md)
- [Agentcard vs Sponge Wallet](https://www.anchorterminal.com/compare/agentcard-vs-sponge-wallet.md)
- [Agentcard vs Stripe API + MCP](https://www.anchorterminal.com/compare/agentcard-vs-stripe-mcp.md)
- [Circle Wallets (Agent Wallets, Programmable Wallets) vs FluxA AI Wallet](https://www.anchorterminal.com/compare/circle-wallets-vs-fluxa-ai-wallet.md)
- [Coinbase Developer Platform (Agentic Wallet, AgentKit, CDP MCP) vs FluxA AI Wallet](https://www.anchorterminal.com/compare/coinbase-cdp-agentkit-vs-fluxa-ai-wallet.md)
- [Circle Gateway Nanopayments vs FluxA AI Wallet](https://www.anchorterminal.com/compare/circle-gateway-nanopayments-vs-fluxa-ai-wallet.md)
- [FluxA AgentMarket vs FluxA AI Wallet](https://www.anchorterminal.com/compare/fluxa-agentmarket-vs-fluxa-ai-wallet.md)
- [FluxA AI Wallet vs Kite Agent Passport](https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-kite-agent-passport.md)
- [FluxA AI Wallet vs Nevermined API + MCP](https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-nevermined.md)
- [FluxA AI Wallet vs Openfort](https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-openfort.md)
- [FluxA AI Wallet vs Payman Genie MCP](https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-payman.md)
- [FluxA AI Wallet vs Privy Wallets (server wallets, agent wallets, policy engine)](https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-privy.md)
- [FluxA AI Wallet vs Sponge Wallet](https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-sponge-wallet.md)
- [FluxA AI Wallet vs Turnkey Agentic Wallets](https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-turnkey-agentic-wallets.md)
- [Agentcard vs Circle Wallets (Agent Wallets, Programmable Wallets)](https://www.anchorterminal.com/compare/agentcard-vs-circle-wallets.md)
- [Agentcard vs Coinbase Developer Platform (Agentic Wallet, AgentKit, CDP MCP)](https://www.anchorterminal.com/compare/agentcard-vs-coinbase-cdp-agentkit.md)
- [Agentcard vs Openfort](https://www.anchorterminal.com/compare/agentcard-vs-openfort.md)
- [Agentcard vs Privy Wallets (server wallets, agent wallets, policy engine)](https://www.anchorterminal.com/compare/agentcard-vs-privy.md)
- [Agentcard vs Turnkey Agentic Wallets](https://www.anchorterminal.com/compare/agentcard-vs-turnkey-agentic-wallets.md)
- [FluxA AI Wallet vs Agent Vault by Self](https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-self-agent-vault.md)

---

Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp