Circle Gateway Nanopayments vs FluxA AgentMarket

Circle Gateway Nanopayments 66

Graded as a hosted service on gateway-api.circle.com. status.circle.com is a Statuspage with Circle Gateway components for each chain, mainnet and testnet (20). The history pages, read on 1 November 2026, list every incident from June to 31 October. From 3 August none names Gateway or a Gateway component. They cover USDC mints on single chains, CCTP attestations, xReserve, Wallets and testnets, and the two HyperEVM incidents opened name only CCTP and USDC components. The last Gateway incident was testnet only, 29 June to 2 July, outside the window. A clean record (30). No rate limit with numbers was found for the Gateway API, and an unauthenticated call to /v1/x402/supported carried no rate-limit headers (0). No 429 or Retry-After guidance was found. Each authorisation carries a unique nonce, a repeat returns nonce_already_used, and the error reference says to retry unexpected_error (6 of 15). No SLA was found, and the developer terms allow changes without prior notice (0). The release notes record the mainnet launch on 29 April 2026 and the pages read carry no beta label (10).

FluxA AgentMarket 12

Graded as a hosted service, the discovery gateway on agentmarket.fluxapay.xyz and the proxy and LLM endpoints on router.fluxapay.xyz, from the vendor's pages. Nothing was called. No status page is linked from the site, the footer, llms.txt or the guides, and no status host was checked (0). With no readable incident history the record takes the default (5). Listing pages show a health count with no history, such as '10/10 endpoints healthy' on Minifetch. No rate limit with numbers was found in llms.txt, the guides or the CLI help. The only cap is a per-key spending limit (0). The Balance guide says to retry a 503 shortly without minting a new credential, replays of a settled top-up finalize call are idempotent, a failed order answers 409, and the card flow says 'a retry is a new order'. No 429 or Retry-After guidance was found. Termix earned 8 for the same kind of guidance with idempotency keys on writes (7 of 15). No SLA was found, and the terms supply the service 'as is' (0). The about page labels the product 'v.01 / Beta' (0). Total 12.

Circle Gateway Nanopayments 73

The SDK is Apache-2.0 on npm and the Gateway contracts are Apache-2.0 on GitHub. The API service and the enclave code are closed, under clear developer terms (22 of 30). The privacy policy of 16 September 2026 lists transaction and blockchain data among what is collected and keeps data as long as necessary, with no periods. The service terms link a DPA dated 2022. Nothing found says what the Gateway API logs about a payment (17 of 30). The developer terms promise reasonable efforts to announce the end of support for a version and also let Circle modify or discontinue Gateway without prior notice. The one breaking change found was noted on the day it took effect (6 of 20). A sub-processor list, last updated 22 December 2025, names each processor with its purpose and country (14 of 20).

FluxA AgentMarket 32

The editorial half. The marketplace, proxy and gateway are closed. The terms (effective 14 January 2026) cover pricing, refunds and acceptable use but name no governing law, termination terms, liability for third-party listings or creator obligations, and the company appears only in the footer. The CLI is Apache-2.0 (8 of 30). The privacy policy (14 January 2026) lists account, payment and usage data and says identity isn't shared with model providers. It says nothing on prompts, API payloads, retention, training or data location (6 of 30). No deprecation policy or dated notice was found, and the terms may change 'at any time' (0 of 20). The policy names Stripe and 'OpenAI/Anthropic API' as a non-exhaustive list, while the models page lists AIHubMix, UnifyLLM and Baidu AI Cloud as providers. No locations are given (4 of 20). Total 18. The provenance half is computed from the provenance block.

Circle Gateway Nanopayments 80

A public OpenAPI 3.0.3 file covers the five operations. It gives the 400 responses no body schema and attaches its Bearer scheme to no operation (23 of 25). llms.txt and a Markdown twin of every docs page (10). The docs say when to use this facilitator and when Circle's other one, and to call settle without verify in production (15 of 20). Transfer status and settle error reasons are enums and required fields are marked. payload, extra and extensions are open objects, and pageSize has no maximum (10 of 15). Every SDK method has a typed signature and an example, and 16 API error codes have a cause and a recovery step. The error reference says the validity window must be 3 days where the quickstart, the SDK and the live minValiditySeconds of 604800 say 7 (11 of 15). Paths are under /v1, the SDK follows semver and the release notes are dated. The npm package ships no changelog (11 of 15).

FluxA AgentMarket 53

No OpenAPI file was found. llms.txt names none and the documentation site, docs.fluxapay.xyz, couldn't be read because its robots.txt couldn't be. The discovery response has documented fields (apiServers, skills, models, pagination), a GET on each listing's urls.access returns its endpoints and prices as JSON per the skill-creation guide, and the LLM endpoints follow the OpenAI and Anthropic formats (8 of 25). llms.txt and Markdown guides (getting-started.md, currency.md, create-skill.md, the APIs and Balance guides) written for agents (10). The guides say when to use search against query, that the external catalogues are a last resort and which rail fits which job. Listing descriptions come from creators and 17 of the first 50 skills have none (12 of 20). type is an enum that answers 400 to unknown values, limit is bounded at 1,000, and the chat and messages bodies follow published formats. Listing endpoints are described by each creator (9 of 15). curl examples for discovery, models and payment, a status table in the Balance guide with the action for 401, 503, 404, 402 and 409, and seven named mandate errors in the APIs guide (11 of 15). Paths carry /llm/v1/ and llms.txt names minimum CLI versions, but no changelog was found (3 of 15). Total 53.

Circle Gateway Nanopayments 64

No API key. The buyer's EOA private key signs each payment, and each authorisation is bound to one amount, recipient, validity window and nonce. The same key controls the whole wallet, the SDK takes it as a plain config value, and smart contract accounts with their own policies are not supported (18 of 30). Only the deposited Gateway balance can be spent, and a client hook can abort a payment above a limit. No limit is set by default and none is enforced by the service (12 of 20). The amount comes from the seller's 402 response, which is untrusted. The docs show the spending-limit hook and give no other guidance. Circle's Gateway skill file says to ask the user before moving funds on mainnet (8 of 15). Transfers can be searched by address, nonce and date and each carries its batch transaction hash. No separate operator log was found (11 of 15). Audit reports by ChainSecurity and OtterSec are linked, one of them on batching, and a repository security policy names a HackerOne bug bounty programme. security.txt answered 404 and no certification was found on the pages read (15 of 20).

FluxA AgentMarket 51

fxa_live_ keys are created by a person at /keys and shown once, each with a spending limit in Units that changes within seconds, and are revoked immediately over DELETE /llm/keys/<id>, with written rotation steps. Key management needs a 5-minute Agent VC, never a key, and creation can be set to need a person's approval. No permission scopes beyond the spending limit were found, and no secret in a URL (24 of 30). Wallet payments need a mandate a person signs with a USDC budget and an expiry, and the Balance guide says to confirm every top-up with the user. The APIs guide tells agents not to ask before paying within a signed mandate, and no read-only key was found (14 of 20). The marketplace returns content from third-party APIs and installs third-party skills. Results carry a fluxa or bazaar source tag, but entries named ssrf1, keyprobe and tooltest1 are tagged fluxa, no review of uploads is described, and no guidance on treating responses or skills as untrusted was found (2 of 15). The balance endpoint returns available, spent, burn per day and owed, the ledger lists spend and purchases per merchant, and the wallet skill reads an X-LLM-Cost header on model calls (11 of 15). No disclosure policy, bug bounty, certification or advisory was found. security.txt couldn't be read and is scored absent, and the privacy policy says only 'industry-standard security measures' (0 of 20). Total 51.

Circle Gateway Nanopayments 77

@circle-fin/x402-batching 4.0.0 was published on 22 October 2026, 10 days before this check, and the Gateway release notes have an entry on 23 October (EURC and cirBTC) (30). Since 3 August there are four SDK versions, 3.3.0 on 4 August, 3.4.0 on 24 August, 3.5.0 on 16 September and 4.0.0, and four dated release notes, 5 August, 26 August, 16 September and 23 October (20). The SDK has no public repository or issue tracker that we found. Support is a Discord server and a help centre ticket form, neither tested, next to dated release notes (10 of 25). The SDK is official and current, in TypeScript only (12 of 15). The package declares tests and lint scripts and current peer dependencies. No public CI for it was found. The contracts repository runs a pipeline, per the 9 October check, not re-read on 1 November (5 of 10).

FluxA AgentMarket 64

Read for a closed service. No changelog or dated release notes were found. The models page says the catalogue was 'last updated November 5, 2026', and @fluxa-pay/fluxa-wallet 0.6.0, the CLI that carries the market commands llms.txt relies on, was published on 6 November 2026 (30). The CLI had eight releases between 10 August and 6 November 2026, 0.4.12 to 0.6.0 (20). Support is a Discord server and support.fluxapay@fluxapay.xyz, neither tested, and GitHub issues couldn't be read because the GitHub API refused us (3 of 15). No AgentMarket SDK. The TypeScript CLI is the official client and the LLM endpoints take OpenAI and Anthropic SDKs. Not an MCP server, so the registry line reads as SDKs (7 of 15). The CLI repository has 7 test files and no CI workflow, and the npm package declares no repository. @fluxa-pay/fluxa-connect-mcp points to a repository that isn't public (4 of 10). Total 64.

Circle Gateway Nanopayments 75

The API is five operations and the buyer path is one pay(url) call. Transfer search takes pageSize (20 of 25). Cursor pagination with pageAfter and pageBefore, and filters by sender, recipient, nonce, network, status and date. A status filter needs a second filter since 26 August 2026 (17 of 20). Sixteen error codes with recovery steps, and typed SDK error messages (17 of 20). The nonce stops one authorisation being settled twice and a completed or failed state tells a caller when to stop. No idempotency key was found, and a failed payment needs a newly signed authorisation (13 of 20). The seller middleware needs one address and a price, and the buyer client a chain and a key. The only official SDK is TypeScript (8 of 15).

FluxA AgentMarket 66

Graded on the HTTP API. Discovery takes limit up to 1,000, type and tags filters and a Markdown format, with no field selection, and listing responses vary by creator (15 of 25). limit, offset and nextOffset on discovery, search and query modes, and the ledger takes kind, limit (maximum 100) and offset. llms.txt says filters ignore limit and offset (16 of 20). The Balance guide's status table gives an action for each status, the APIs guide names insufficient_balance, mandate_budget_exceeded, agent_not_registered and others, and a model served only on Messages answers 400 on chat (15 of 20). finalize replays are idempotent and a dead order answers 409 with the instruction to start a new one. No idempotency key on paid calls was found (10 of 20). The LLM endpoints accept any OpenAI or Anthropic client, discovery needs no parameters, and the only official client is the TypeScript wallet CLI (10 of 15). Total 66.