Crossmint API + Docs MCP vs FluxA AgentMarket

Crossmint API + Docs MCP 80

The SDKs are Apache-2.0 and the API is closed under published terms (18). Privacy policy updated 26 June 2026 names six Crossmint entities, states DPAs with each provider, keeps Persona biometric data no more than three years and otherwise retains data "as long as necessary", and uses SCCs and the EU-US Data Privacy Framework. It says personal data isn't used to train general-purpose models (20). The changelog dates deprecations, such as Checkout V2 ending on 30 October 2025, and SDK changesets give migration steps for removed chains (15). Subprocessors are listed on the Trust page, which we didn't open, and transfers outside the EEA are disclosed (12).

FluxA AgentMarket 32

The editorial half. The marketplace, proxy and gateway are closed. The terms (effective 14 January 2026) cover pricing, refunds and acceptable use but name no governing law, termination terms, liability for third-party listings or creator obligations, and the company appears only in the footer. The CLI is Apache-2.0 (8 of 30). The privacy policy (14 January 2026) lists account, payment and usage data and says identity isn't shared with model providers. It says nothing on prompts, API payloads, retention, training or data location (6 of 30). No deprecation policy or dated notice was found, and the terms may change 'at any time' (0 of 20). The policy names Stripe and 'OpenAI/Anthropic API' as a non-exhaustive list, while the models page lists AIHubMix, UnifyLLM and Baidu AI Cloud as providers. No locations are given (4 of 20). Total 18. The provenance half is computed from the provenance block.

Crossmint API + Docs MCP 53

status.crossmint.com redirects to a Datadog-hosted status page (20, per the 1 October check). On 1 November the Datadog host answered robots.txt with 403 AccessDenied, so it was treated as blocked and not read; on 1 October it rendered only in JavaScript with no readable history. No incident history could be read, a limit of our reading and not a finding against Crossmint (5). Rate limits published, 120 writes and 360 reads a minute per project on self-serve plans, with higher limits for token and minting endpoints (15). The limits page says a 429 comes back and to wait briefly, with no Retry-After or backoff guidance, but the wallets OpenAPI documents an x-idempotency-key header on wallet, transaction, transfer and signature creation (8 of 15). Enterprise gets "premium SLAs" through sales, and no SLA is published (0). Wallets are generally available, but Agent Checkouts runs in production only with no staging, and the wallets spec still routes balances and transfer history through /unstable paths (5 of 10).

FluxA AgentMarket 12

Graded as a hosted service, the discovery gateway on agentmarket.fluxapay.xyz and the proxy and LLM endpoints on router.fluxapay.xyz, from the vendor's pages. Nothing was called. No status page is linked from the site, the footer, llms.txt or the guides, and no status host was checked (0). With no readable incident history the record takes the default (5). Listing pages show a health count with no history, such as '10/10 endpoints healthy' on Minifetch. No rate limit with numbers was found in llms.txt, the guides or the CLI help. The only cap is a per-key spending limit (0). The Balance guide says to retry a 503 shortly without minting a new credential, replays of a settled top-up finalize call are idempotent, a failed order answers 409, and the card flow says 'a retry is a new order'. No 429 or Retry-After guidance was found. Termix earned 8 for the same kind of guidance with idempotency keys on writes (7 of 15). No SLA was found, and the terms supply the service 'as is' (0). The about page labels the product 'v.01 / Beta' (0). Total 12.

Crossmint API + Docs MCP 50

Payment platforms and wallets take the highest step that applies on the 40-point protocol line. 40 for x402, MPP or L402 on all their own endpoints, 30 on part of their own API, 25 when their merchants can accept one, 20 for running a facilitator, 15 for paying as a buyer, 0 for only a protocol of their own. Crossmint's own API isn't paid over x402 or MPP. Crossmint's n8n node (n8n-nodes-crossmint 1.1.0, 12 November 2025) puts an x402 paywall in front of a workflow and settles to an address the seller sets through the Corbits facilitator, so the merchant step, though only for n8n (25 of 40). Agent Wallets also pay x402 and MPP endpoints for the buyer. Wallet overage at $0.02 per monthly active wallet and tokenisation at $0.01 an action are public, while onramp, offramp, checkout, orchestration, Agent Cards and Agent Checkouts have no published price (10). 1,000 free monthly active wallets with up to 2,000 transactions, and free staging on testnets, but the pricing page doesn't say whether a card is needed (15). A person signs up in the console to get keys (0).

FluxA AgentMarket 75

Payment platforms take the highest step that applies on the 40-point protocol line (40 on all their own endpoints, 30 on part of their own API, 25 when their merchants can accept one, 20 for a facilitator, 15 for paying as a buyer, 0 for only a protocol of their own). AgentMarket's proxied API endpoints and Balance top-ups answer x402 (v1 body or v2 PAYMENT-REQUIRED header), the pricing page says USDC from another wallet works over x402 on Base, and the FluxA CLI signs the standard exact EIP-3009 scheme. Model calls are charged to the Balance with a key or Agent VC. Nothing was paid, so this rests on the vendor's pages (30 of 40). Per-call price ranges are public in the catalogue, per-endpoint prices on listing pages, model prices per 1M tokens, Balance bundles and Token Plan prices, all without a login (20). Discovery and price reads are free with no account and some listed endpoints are priced at $0, but no free credit or trial was found. The wallet's TokenGo guide calls a $1 first top-up a trial. Termix earned 20 for free reads, and here a judgement call gives half (10 of 20). An agent holding Base USDC can pay a listed API per call with no account, per the pricing page and the 402 flow. Model calls, the Balance and keys need an account a person creates by signing in ('an agent cannot create either account'), and the FluxA wallet path needs a person to approve registration and sign a mandate (15 of 20). Total 75.

Crossmint API + Docs MCP 73

Separate server-side and client-side API keys with named scopes such as wallets:transactions.create, and client keys can require a JWT from your own auth provider. Key rotation wasn't checked (25). Agent Wallets add the agent as a delegated signer with onchain spend caps, allowed counterparties and time windows, transactions carry an approvals step, and Agent Checkouts stops at a hard cap set per run (18). Agent Checkouts browses any merchant URL and we found no prompt-injection guidance for it (7). Transaction lists and webhooks give per-transaction visibility, and we found no API audit log (8). security.txt points to a disclosure policy with a 5 working day reply and 10 working day triage commitment, cash rewards only by exception, and a footer that cites SOC 2 and a Trust Centre. The same footer lists a Spanish CNMV crypto-asset service provider authorisation, FinCEN MSB registration and FINTRAC registration (15).

FluxA AgentMarket 51

fxa_live_ keys are created by a person at /keys and shown once, each with a spending limit in Units that changes within seconds, and are revoked immediately over DELETE /llm/keys/<id>, with written rotation steps. Key management needs a 5-minute Agent VC, never a key, and creation can be set to need a person's approval. No permission scopes beyond the spending limit were found, and no secret in a URL (24 of 30). Wallet payments need a mandate a person signs with a USDC budget and an expiry, and the Balance guide says to confirm every top-up with the user. The APIs guide tells agents not to ask before paying within a signed mandate, and no read-only key was found (14 of 20). The marketplace returns content from third-party APIs and installs third-party skills. Results carry a fluxa or bazaar source tag, but entries named ssrf1, keyprobe and tooltest1 are tagged fluxa, no review of uploads is described, and no guidance on treating responses or skills as untrusted was found (2 of 15). The balance endpoint returns available, spent, burn per day and owed, the ledger lists spend and purchases per merchant, and the wallet skill reads an X-LLM-Cost header on model calls (11 of 15). No disclosure policy, bug bounty, certification or advisory was found. security.txt couldn't be read and is scored absent, and the privacy policy says only 'industry-standard security measures' (0 of 20). Total 51.

Crossmint API + Docs MCP 85

Release packages commit on 29 October 2026 shipped @crossmint/wallets-sdk 1.21.0 and @crossmint/client-sdk-react-ui 4.13.1 (30). 18 release commits in the 90 days from 3 August, 7 August to 29 October (20). Per-package changesets are detailed and current, but the docs changelog hasn't had an entry since 11 February 2026, and we didn't read the GitHub issue queue (12 of 25). Current official SDKs (15). CI runs build and tests, plus smoke, end-to-end regression, CodeQL and security-scan workflows. Chain removals stop old code compiling, 1.18.0's with deprecation first and migration notes, 1.20.1's (Abstract, a patch release) with neither (8).

FluxA AgentMarket 64

Read for a closed service. No changelog or dated release notes were found. The models page says the catalogue was 'last updated November 5, 2026', and @fluxa-pay/fluxa-wallet 0.6.0, the CLI that carries the market commands llms.txt relies on, was published on 6 November 2026 (30). The CLI had eight releases between 10 August and 6 November 2026, 0.4.12 to 0.6.0 (20). Support is a Discord server and support.fluxapay@fluxapay.xyz, neither tested, and GitHub issues couldn't be read because the GitHub API refused us (3 of 15). No AgentMarket SDK. The TypeScript CLI is the official client and the LLM endpoints take OpenAI and Anthropic SDKs. Not an MCP server, so the registry line reads as SDKs (7 of 15). The CLI repository has 7 test files and no CI workflow, and the npm package declares no repository. @fluxa-pay/fluxa-connect-mcp points to a repository that isn't public (4 of 10). Total 64.

Crossmint API + Docs MCP 71

A Crossmint Wallets API OpenAPI 3.0 file with 39 paths sits in the public SDK repo, but we found none for payments, onramp, Agent Cards or Agent Checkouts (15 of 25). llms.txt with about 450 entries, an llms-full.txt, and every page served as Markdown by appending .md (10). Operation descriptions state the purpose and the API scope each call needs, with little on when not to use them (12). Typed DTOs with required fields, though wallets are addressed by formatted locator strings such as email:<email>:<chainType> (11). Payment and onramp error-code pages, and the wallets spec documents 400, 404, 409 and 422 responses, with code samples in the quickstarts (11). Date-versioned paths (/2025-06-09/) and a docs changelog, but its newest entry is 11 February 2026, so recent API changes are only in the SDK changelogs (12).

FluxA AgentMarket 53

No OpenAPI file was found. llms.txt names none and the documentation site, docs.fluxapay.xyz, couldn't be read because its robots.txt couldn't be. The discovery response has documented fields (apiServers, skills, models, pagination), a GET on each listing's urls.access returns its endpoints and prices as JSON per the skill-creation guide, and the LLM endpoints follow the OpenAI and Anthropic formats (8 of 25). llms.txt and Markdown guides (getting-started.md, currency.md, create-skill.md, the APIs and Balance guides) written for agents (10). The guides say when to use search against query, that the external catalogues are a last resort and which rail fits which job. Listing descriptions come from creators and 17 of the first 50 skills have none (12 of 20). type is an enum that answers 400 to unknown values, limit is bounded at 1,000, and the chat and messages bodies follow published formats. Listing endpoints are described by each creator (9 of 15). curl examples for discovery, models and payment, a status table in the Balance guide with the action for 401, 503, 404, 402 and 409, and seven named mandate errors in the APIs guide (11 of 15). Paths carry /llm/v1/ and llms.txt names minimum CLI versions, but no changelog was found (3 of 15). Total 53.