Coinbase Developer Platform (Agentic Wallet, AgentKit, CDP MCP) vs FluxA AI Wallet

Coinbase Developer Platform (Agentic Wallet, AgentKit, CDP MCP) 77

AgentKit is Apache-2.0, cdp-sdk and the OpenAPI file are MIT, awal is Apache-2.0 on npm; the wallet service is closed under the CDP terms (25 of 30). The privacy policy, updated 27 May 2026 per the 1 October check, not re-read on 1 November, names Coinbase, Inc. for developer services, lists processing countries and transfer mechanisms (SCCs and the Data Privacy Frameworks), and ties retention to need without numbers (18 of 30). AgentKit's changelog marks the legacy cdp-wallet deprecated, without a removal date. cdp-sdk 1.58.0 (6 October) gave the old DELETE revoke-delegation methods until 22 October, 16 days, while 1.57.0 and 1.59.0 removed types and a method with no notice, so the line stays (10 of 20). Processing in Ireland, Germany, Singapore, the UK, the US and the Philippines is stated; service providers are named by category with no full subprocessor list (12 of 20).

FluxA AI Wallet 32

The CLI and MCP server source is Apache-2.0 per the LICENSE file and both package.json files, while the README's last section says MIT. The hosted wallet is closed, and no terms covering it were found. AgentMarket's terms describe only the marketplace (15 of 30). AgentMarket's privacy policy of 14 January 2026 names Stripe and model providers and gives no retention periods, and it does not mention wallet addresses, KYC profiles, card data or payouts, which the CLI collects or handles. The wallet's own privacy policy was unreachable (5 of 30). The README marks init and link-wallet as legacy but still supported, and the skill pins a minimum CLI version; no deprecation policy or dated notice was found (3 of 20). Stripe is the only provider named; no card issuer, KYC provider, custody provider or data location is named. The CLI and MCP code send no telemetry (3 of 20). Total 26.

Coinbase Developer Platform (Agentic Wallet, AgentKit, CDP MCP) 62

Scored on the hosted checklist although the listing is an SDK, because every wallet action ends in a call to Coinbase's API. status.coinbase.com, where the CDP docs send status readers, has a Coinbase Developer Platform group with Wallets, Payments, Stablecoins, Trading, Onchain Tools, Webhooks and Portal components (20). The history page carries its incident list in the page itself, and its two pages, read on 1 November, cover the whole 90 days from 3 August. Six incidents touch CDP, all partial or short. Degraded x402 facilitator performance for some users from 6:00 to 9:00 a.m. ET on 7 August, Onramp transactions for 4 minutes on 14 August, smart account API latency for 53 minutes on 19 August (Wallets), USDC payments on Polygon only from 22 to 24 August (Payments), Onramp guest checkout on 1 September and Payments Acceptance for 52 minutes on 15 September. Minor only (20 of 30, was 12 when the history couldn't be read). We found no rate-limit numbers for the wallet APIs, and the OpenAPI file defines 429 responses without figures (0). An optional X-Idempotency-Key with a 422 idempotency_error, and rate_limit_exceeded and operation_in_progress error types, but no Retry-After guidance (12 of 15). No SLA found (0). Server wallets and the awal CLI are generally available, and the Agentic Wallet overview, MCP overview, FAQ and MCP tools pages carry no beta label on 1 November (10, was 5). 20+20+0+12+0+10 = 62.

FluxA AI Wallet 20

Graded with the hosted lines, because signing, mandates and approvals all run on FluxA's wallet API and the CLI and MCP server only wrap it, as kite-agent-passport and kane-cli were read. No status page was found in the repository, the skills or AgentMarket's pages. fluxapay.xyz and the wallet and docs hosts could not be read, so a status page there is unchecked and scored absent (0). With no readable history the record takes the default (5). No rate limit with numbers was found (0). The connection service treats 429 slow_down as wait and poll and marks errors retryable, the skill says a 503 means retry shortly, payouts require a caller-chosen payout_id that returns the existing payout on a repeat, --biz-id rejects a duplicate with 409, and card create and recharge resume with --request-id instead of paying again. No Retry-After or backoff schedule is documented for the wallet API (10 of 15). No SLA was found (0). No beta label was found on the wallet in what was read, but both packages are at 0.x, agent cards sit behind a waitlist and the wallet site was unread (5 of 10). Total 20.

Coinbase Developer Platform (Agentic Wallet, AgentKit, CDP MCP) 85

Payment platforms and wallets take the highest step that applies on the 40-point protocol line. 40 for x402, MPP or L402 on all their own endpoints, 30 on part of their own API, 25 when their merchants can accept one, 20 for running a facilitator, 15 for paying as a buyer, 0 for only a protocol of their own. Coinbase's own CDP SQL API answers x402 at x402.cdp.coinbase.com, but the wallet API itself isn't paid per call, so the part-of-its-own-API step (30 of 40). Coinbase also runs the CDP facilitator, and Agentic Wallet pays and sells x402 services. $0.005 per wallet operation after 5,000 free a month, reads free, with units per operation published (20). The Agentic Wallet, wallet creation and gas are free, and the free operations need no card that we could find (20). An agent with its own mailbox can sign in by email OTP through awal auth login and verify, per the official skill; server wallets need a person to create a CDP Portal key (15 of 20).

FluxA AI Wallet 45

Payment platforms and wallets take the highest step that applies on the 40-point protocol line. 40 for x402, MPP or L402 on all their own endpoints, 30 on part of their own API, 25 when their merchants can accept one, 20 for running a facilitator, 15 for paying as a buyer, 0 for only a protocol of their own. The wallet pays x402 as a buyer and its payment links can be paid over x402 so another agent pays the holder, as sponge-wallet's payment links were read. FluxA's own wallet API is not paid over x402, so the merchant step (25 of 40). No fee schedule for the wallet, x402 signing, payouts or payment links was found, and card fees appear only through an authenticated command (0 of 20). Registering an Agent ID and creating payment links cost nothing and need no card per the README and the charge-agent guide, but the wallet sign-up at agentwallet.fluxapay.xyz could not be read, so whether opening a funded wallet needs a card is unchecked (10 of 20). POST https://agentid.fluxapay.xyz/register returns credentials with no human step, but the CLI marks it legacy, the default connection needs a browser approval, and every spend needs the owner's wallet and a mandate signed in a browser (10 of 20). Total 45.

Coinbase Developer Platform (Agentic Wallet, AgentKit, CDP MCP) 94

A public OpenAPI file, version 2.0.0, now with 243 operations, MIT-licensed in coinbase/cdp-sdk and regenerated into every SDK, re-read on 1 November (25). llms.txt and Markdown twins of the docs (10). Descriptions throughout the OpenAPI file, and the Agentic Wallet skill says when to use it and routes each task to a reference file (17 of 20). An ErrorType enum, now of 105 codes, patterns and length limits on IDs (14 of 15). Examples throughout the OpenAPI file and docs, errors with errorType and errorMessage (15). /v2 paths, a dated CDP changelog and changesets in AgentKit, though AgentKit's 0.11.0 changelog entry has never reached npm per the 1 October check (13 of 15). 25+10+17+14+15+13 = 94.

FluxA AI Wallet 61

No OpenAPI file or reference for the wallet API was found; the README shows sample requests for five endpoints. The MCP server's 15 tools in the 0.6.0 source carry typed Zod input schemas, and the CLI's flags are documented in prose in the skill files and --help. The MCP server is the secondary surface and its npm release is 0.2.0, so 12 of 25. The skill and its 18 Markdown guides are written for agents, and AgentMarket's llms.txt describes the wallet's payment role (10). connect_wallet, init_agent_id and create_intent_mandate say when to use them and when not to, and the skill has a when-to-use table per capability, while the payment-link and status tools have one-line descriptions (12 of 20). Zod enums for validity, runtime, hosting and currency, a regex on payout amounts and strict objects, but the x402 requirement fields are plain strings and outputSchema is a free-form record (10 of 15). The README has an example for every MCP tool, the skills give CLI examples and output, and error codes are tabled for mandates, payouts, cards and connections (12 of 15). Semver on npm with 25 CLI versions and a version line in the skill, two git tags and no changelog (5 of 15). Total 61.

Coinbase Developer Platform (Agentic Wallet, AgentKit, CDP MCP) 78

CDP API keys carry scopes (changing policies needs "Non-custodial > Manage"), the SDKs mint short-lived JWTs from them, and signing also needs a separate wallet secret through X-Wallet-Auth. Agentic Wallet sign-in is email OTP with no key handed to the agent (30). The operator sets max per call and max per session in the wallet UI and the agent can't change them; server wallets have a default-deny policy engine on value, address and network; x402 pay takes --max-amount. AgentKit itself has no caps or approval gate, as its README says (16 of 20). AgentKit's README names direct and indirect prompt-injection surfaces and points to guardrails middleware and a human-approval example, but the fix that sanitises attacker-set token names (merged 3 September) is still in no release on 1 November (10 of 15). Webhooks with delivery status and retry counts; we didn't check per-call logs in the Portal (10 of 15). HackerOne bug bounty linked from SECURITY.md in AgentKit and cdp-sdk; coinbase.com's security.txt still carries Expires 2024-06-01 on 1 November, and the AgentKit file-read fix went through a public PR without an advisory (12 of 20).

FluxA AI Wallet 52

The agent holds an Agent ID, a token whose validity the owner picks from 1 hour to 1 year at browser approval, and a short-lived RS256 JWT refreshed from the token; token_revoked exists. Credentials sit in a 0600 JSON file or environment variables. The token is not scoped, since limits live in mandates, and legacy init tokens are described as not expiring. Agent VCs are audience-bound and rejected by FluxA's own endpoints. No secret travels in a URL (22 of 30). Every x402 payment needs a mandate the owner signs, with a limit, a validity and an optional host allowlist enforced by the wallet API, payouts need per-payout approval unless a mandate covers them, cards need a mandate and KYC, and linked-card mandates are scoped to one merchant. A payout mandate sets no payee allowlist that was documented, and the skill tells agents to request budgets for at least 100 calls by default (16 of 20). The wallet returns little third-party content itself, but the skill sends agents to third-party x402 APIs, ClawPI posts and a remote announcement.md with no guidance on treating them as untrusted, its description steers agents to paid APIs even when a free web search looks enough, and the daily check-in runs npx -y @fluxa-pay/fluxa-wallet@latest unpinned twice a day (4 of 15). mandates lists limit, spent and remaining, with recent-transactions, received-records and payout status by CLI, and the MCP server writes a local audit log; the wallet app's logs were not read (10 of 15). No SECURITY.md, disclosure policy, bug bounty or certification was found, and agentmarket.fluxapay.xyz has no security.txt; fluxapay.xyz's is unchecked (0 of 20). Total 52.

Coinbase Developer Platform (Agentic Wallet, AgentKit, CDP MCP) 83

The Agentic Wallet skill is a 4,040-byte router that loads one of nine reference files on demand and every awal command takes --json; the CDP CLI's MCP mode generates a tool per endpoint with a cdp_help lookup, which we couldn't read because the CLI source isn't public (18 of 25). pageSize and pageToken on 20 list operations, and SQL queries with LIMIT (18 of 20). Typed error codes with messages that say when to retry (18 of 20). Optional idempotency keys on writes; tool annotations not checked (14 of 20). SDKs in TypeScript, Python, Go, Rust and Java, and an Agentic Wallet signs in with two commands (15).

FluxA AI Wallet 60

The MCP server has 15 tools with about 4,700 characters of descriptions, the 11 to 30 band (15). The CLI path loads SKILL.md (26.5 KB) and one of 18 guides per task, about 112 KB in all, with no read-only subset (no add-back, 15 of 25). card transactions takes page, limit, type and a time range, refunds take limit and offset, received-records and recent-transactions take a limit up to 100, and market search can be scoped to models or vendors; no cursor (12 of 20). Errors carry a code, retryable, reconnect_required and a next_command or next_tool, and card errors map to recovery hints, but the CLI exits only 0 or 1 and the MCP payment tools return the wallet API's raw error body without isError (14 of 20). A required payout_id idempotency key, --biz-id dedup and --request-id continuation on card operations, and the skill says not to initiate again to retry a payment. No readOnlyHint or destructiveHint on any MCP tool (12 of 20). Base USDC is the default network and asset, mandates default to 8 hours and the CLI installs in one command, but there is no SDK library and both packages are TypeScript (7 of 15). Total 60.