ATXP vs FluxA AgentMarket

ATXP 33

The newest tag is @atxp/client v0.11.12 on 2 June 2026, 129 days before this check. The CLI's is v1.29.0 on 2 April 2026. The last commit in atxp-dev/sdk is 30 June 2026 and in atxp-dev/cli 27 April 2026 (10 of 30). No release or dated changelog entry falls in the last 90 days (0). The SDK repository has 5 open issues and the CLI 2. We did not read them. Support is a Discord server and a developer relations address, neither tested (8 of 25). The SDK is official and TypeScript only, last released in June. Presence in the MCP registry was not checked (8 of 15). Both repositories run tests in CI on pull requests and the SDK has 82 test files. The CI results were not read (7 of 10).

FluxA AgentMarket 64

Read for a closed service. No changelog or dated release notes were found. The models page says the catalogue was 'last updated November 5, 2026', and @fluxa-pay/fluxa-wallet 0.6.0, the CLI that carries the market commands llms.txt relies on, was published on 6 November 2026 (30). The CLI had eight releases between 10 August and 6 November 2026, 0.4.12 to 0.6.0 (20). Support is a Discord server and support.fluxapay@fluxapay.xyz, neither tested, and GitHub issues couldn't be read because the GitHub API refused us (3 of 15). No AgentMarket SDK. The TypeScript CLI is the official client and the LLM endpoints take OpenAI and Anthropic SDKs. Not an MCP server, so the registry line reads as SDKs (7 of 15). The CLI repository has 7 test files and no CI workflow, and the npm package declares no repository. @fluxa-pay/fluxa-connect-mcp points to a repository that isn't public (4 of 10). Total 64.

ATXP 51

Each job has its own MCP server, so an agent loads one to eleven tools at a time. The skill file lists 29 tools across eight servers (18 of 25). transactions takes --limit and the SMS and call lists take direction and unread filters. The search tool takes only a query, with no result count or size control documented (7 of 20). The client SDK has nine typed payment errors with codes such as INSUFFICIENT_FUNDS and PAYMENT_EXPIRED. They are in the source and not in the docs (10 of 20). requirePayment looks up an existing payment id before charging, and batch prepayment avoids a payment on every call. No idempotency key or tool annotation was found (6 of 20). Registration takes one command with no parameters and the gateway works with any OpenAI-compatible client. ATXP's own SDK is TypeScript only (10 of 15).

FluxA AgentMarket 66

Graded on the HTTP API. Discovery takes limit up to 1,000, type and tags filters and a Markdown format, with no field selection, and listing responses vary by creator (15 of 25). limit, offset and nextOffset on discovery, search and query modes, and the ledger takes kind, limit (maximum 100) and offset. llms.txt says filters ignore limit and offset (16 of 20). The Balance guide's status table gives an action for each status, the APIs guide names insufficient_balance, mandate_budget_exceeded, agent_not_registered and others, and a model served only on Messages answers 400 on chat (15 of 20). finalize replays are idempotent and a dead order answers 409 with the instruction to start a new one. No idempotency key on paid calls was found (10 of 20). The LLM endpoints accept any OpenAI or Anthropic client, discovery needs no parameters, and the only official client is the TypeScript wallet CLI (10 of 15). Total 66.

ATXP 45

The SDK and CLI are MIT on GitHub. The hosted accounts, gateway and tools are closed. The terms grant a licence for personal, noncommercial use and bar automated agents from sending requests, while the docs address agents and commercial builders (18 of 30). The privacy policy of 17 June 2026 lists prompts and outputs, wallet and transaction data among what is collected, allows interest-based advertising, and gives no retention period beyond as long as needed. No DPA and no statement on training with customer content was found (10 of 30). No deprecation policy or dated notice was found, and the terms allow changes or discontinuation without notice (0). The terms name Privy for wallets, the CLI docs name Stripe, and the SDK names Coinbase's facilitator. No sub-processor list was found, and the policy says the company is in the United States (5 of 20).

FluxA AgentMarket 32

The editorial half. The marketplace, proxy and gateway are closed. The terms (effective 14 January 2026) cover pricing, refunds and acceptable use but name no governing law, termination terms, liability for third-party listings or creator obligations, and the company appears only in the footer. The CLI is Apache-2.0 (8 of 30). The privacy policy (14 January 2026) lists account, payment and usage data and says identity isn't shared with model providers. It says nothing on prompts, API payloads, retention, training or data location (6 of 30). No deprecation policy or dated notice was found, and the terms may change 'at any time' (0 of 20). The policy names Stripe and 'OpenAI/Anthropic API' as a non-exhaustive list, while the models page lists AIHubMix, UnifyLLM and Baidu AI Cloud as providers. No locations are given (4 of 20). Total 18. The provenance half is computed from the provenance block.

ATXP 41

One connection string per account grants the wallet, the mailbox and every tool. The MCP tools use OAuth at auth.atxp.ai with scopes read and write, and login --force refreshes the string (20 of 30). The string is a URL with the secret in its query string, and the documented MCP proxy URL carries it too (less 10). The client SDK has an approvePayment hook and a list of allowed authorisation servers, each agent account holds its own balance, and the proxy accepts only ATXP's servers. approvePayment returns true by default, the skill file says it enforces no limit, and no server-side spending limit was found (8 of 20). The skill file names the commands that return untrusted content and sets rules against acting on it, forwarding it or paying because of it (13 of 15). npx atxp transactions and the account portal show payments. No audit log of tool calls was found (8 of 15). No security.txt, disclosure policy, certification, bug bounty or advisory was found, and neither repository has a SECURITY.md (2 of 20, for the supply-chain notes in the skill file).

FluxA AgentMarket 51

fxa_live_ keys are created by a person at /keys and shown once, each with a spending limit in Units that changes within seconds, and are revoked immediately over DELETE /llm/keys/<id>, with written rotation steps. Key management needs a 5-minute Agent VC, never a key, and creation can be set to need a person's approval. No permission scopes beyond the spending limit were found, and no secret in a URL (24 of 30). Wallet payments need a mandate a person signs with a USDC budget and an expiry, and the Balance guide says to confirm every top-up with the user. The APIs guide tells agents not to ask before paying within a signed mandate, and no read-only key was found (14 of 20). The marketplace returns content from third-party APIs and installs third-party skills. Results carry a fluxa or bazaar source tag, but entries named ssrf1, keyprobe and tooltest1 are tagged fluxa, no review of uploads is described, and no guidance on treating responses or skills as untrusted was found (2 of 15). The balance endpoint returns available, spent, burn per day and owed, the ledger lists spend and purchases per merchant, and the wallet skill reads an X-LLM-Cost header on model calls (11 of 15). No disclosure policy, bug bounty, certification or advisory was found. security.txt couldn't be read and is scored absent, and the privacy policy says only 'industry-standard security measures' (0 of 20). Total 51.