FluxA AgentMarket vs Metronome

FluxA AgentMarket 12

Graded as a hosted service, the discovery gateway on agentmarket.fluxapay.xyz and the proxy and LLM endpoints on router.fluxapay.xyz, from the vendor's pages. Nothing was called. No status page is linked from the site, the footer, llms.txt or the guides, and no status host was checked (0). With no readable incident history the record takes the default (5). Listing pages show a health count with no history, such as '10/10 endpoints healthy' on Minifetch. No rate limit with numbers was found in llms.txt, the guides or the CLI help. The only cap is a per-key spending limit (0). The Balance guide says to retry a 503 shortly without minting a new credential, replays of a settled top-up finalize call are idempotent, a failed order answers 409, and the card flow says 'a retry is a new order'. No 429 or Retry-After guidance was found. Termix earned 8 for the same kind of guidance with idempotency keys on writes (7 of 15). No SLA was found, and the terms supply the service 'as is' (0). The about page labels the product 'v.01 / Beta' (0). Total 12.

Metronome 71

Hosted lines. status.metronome.com runs on incident.io with seven components (20). Its feed now holds entries from 1 September, and lists 12 incidents and three maintenance windows from 1 September to 22 October 2026; the August entries rest on the 9 October check, which found data export or invoice delays among them. On 3 September a vendor's partial outage raised API error rates and delayed data exports for about two hours, posted as a partial outage. API errors were also elevated on 11 September and 8 October, and the rest were export, invoicing, threshold billing, alert or ingest delays, the latest on 22 October. Each was limited to elevated errors on a share of requests or to one pipeline, so they read as partial and minor, as on other listings (20 of 30). The rate limits page that published per-tier limits on 9 October is no longer in the docs index or sitemap, and its address now redirects to a Metronome sign-in page while unknown docs paths answer 404, so the per-tier figures sit behind a login. The public guides still give numbers for two calls, a default ingest limit of 5,000 events a second (high-volume ingestion guide) and 8 requests a second per client on the event cost preview endpoint, with none for contracts, invoices or the other endpoints (8 of 15, as dust's numbers for two operations only). 429 responses carry X-Metronome-Rate-Limit-Type and the status code page advises backoff, Idempotency-Key covers every POST and the SDKs retry twice by default. No Retry-After was found (13 of 15). The pricing page names enhanced SLAs on the Custom plan and no SLA document was found (0). The API is generally available (10). 71.

FluxA AgentMarket 75

Payment platforms take the highest step that applies on the 40-point protocol line (40 on all their own endpoints, 30 on part of their own API, 25 when their merchants can accept one, 20 for a facilitator, 15 for paying as a buyer, 0 for only a protocol of their own). AgentMarket's proxied API endpoints and Balance top-ups answer x402 (v1 body or v2 PAYMENT-REQUIRED header), the pricing page says USDC from another wallet works over x402 on Base, and the FluxA CLI signs the standard exact EIP-3009 scheme. Model calls are charged to the Balance with a key or Agent VC. Nothing was paid, so this rests on the vendor's pages (30 of 40). Per-call price ranges are public in the catalogue, per-endpoint prices on listing pages, model prices per 1M tokens, Balance bundles and Token Plan prices, all without a login (20). Discovery and price reads are free with no account and some listed endpoints are priced at $0, but no free credit or trial was found. The wallet's TokenGo guide calls a $1 first top-up a trial. Termix earned 20 for free reads, and here a judgement call gives half (10 of 20). An agent holding Base USDC can pay a listed API per call with no account, per the pricing page and the 402 flow. Model calls, the Balance and keys need an account a person creates by signing in ('an agent cannot create either account'), and the FluxA wallet path needs a person to approve registration and sign a mandate (15 of 20). Total 75.

Metronome 39

Payment platforms take the highest step that applies on the 40-point protocol line. No x402, MPP or L402 was found in the API description, the docs index or the pricing page (0). The Startup plan's prices are public at 0.8 per cent of billing volume and $0.04 per 1,000 ingested events. The Custom plan has no price (18 of 20). The pricing page says "Start free" and the quickstart links a self-serve sandbox sign-up, while production checkout needs a credit card. The sign-up page was not read, so whether the sandbox asks for a card is unconfirmed (15 of 20). A person signs up and creates the token in the web app. The changelog of 10 June 2026 says agents can provision an account through the Stripe Projects CLI, which we did not test and which needs a Stripe account (6 of 20). 39.

FluxA AgentMarket 53

No OpenAPI file was found. llms.txt names none and the documentation site, docs.fluxapay.xyz, couldn't be read because its robots.txt couldn't be. The discovery response has documented fields (apiServers, skills, models, pagination), a GET on each listing's urls.access returns its endpoints and prices as JSON per the skill-creation guide, and the LLM endpoints follow the OpenAI and Anthropic formats (8 of 25). llms.txt and Markdown guides (getting-started.md, currency.md, create-skill.md, the APIs and Balance guides) written for agents (10). The guides say when to use search against query, that the external catalogues are a last resort and which rail fits which job. Listing descriptions come from creators and 17 of the first 50 skills have none (12 of 20). type is an enum that answers 400 to unknown values, limit is bounded at 1,000, and the chat and messages bodies follow published formats. Listing endpoints are described by each creator (9 of 15). curl examples for discovery, models and payment, a status table in the Balance guide with the action for 401, 503, 404, 402 and 409, and seven named mandate errors in the APIs guide (11 of 15). Paths carry /llm/v1/ and llms.txt names minimum CLI versions, but no changelog was found (3 of 15). Total 53.

Metronome 88

The OpenAPI 3.0.1 description at docs.metronome.com/openapi.json answered 404 on 1 November, though llms.txt still lists it, and each endpoint's Markdown page embeds its own OpenAPI 3.0.1 fragment. On 9 October the file held 142 operations and 509 schemas (25). llms.txt and a Markdown twin of each docs page (10). Per the 9 October count, 131 of 142 operations carry a description longer than 80 characters and 76 have a section on when to use the call. Few say when not to (17 of 20). Per the same count, 345 enums and 774 required lists, with 36 free-form maps (13 of 15). 118 operations carry a request example and 99 a response example. Errors are one message string, and only 87 operations document a 4xx response (10 of 15). Paths are versioned /v1 and /v2, and a dated changelog tags API and SDK entries. No dated API versions (13 of 15). 88.

FluxA AgentMarket 32

The editorial half. The marketplace, proxy and gateway are closed. The terms (effective 14 January 2026) cover pricing, refunds and acceptable use but name no governing law, termination terms, liability for third-party listings or creator obligations, and the company appears only in the footer. The CLI is Apache-2.0 (8 of 30). The privacy policy (14 January 2026) lists account, payment and usage data and says identity isn't shared with model providers. It says nothing on prompts, API payloads, retention, training or data location (6 of 30). No deprecation policy or dated notice was found, and the terms may change 'at any time' (0 of 20). The policy names Stripe and 'OpenAI/Anthropic API' as a non-exhaustive list, while the models page lists AIHubMix, UnifyLLM and Baidu AI Cloud as providers. No locations are given (4 of 20). Total 18. The provenance half is computed from the provenance block.

Metronome 66

The platform is closed. Metronome's legal centre links the Stripe Services Agreement, last modified 28 September 2026, which does not name Metronome. The SDKs are Apache-2.0 (15 of 30). Stripe's privacy policy of 28 April 2026 and the DPA the agreement incorporates cover data handling. The agreement says Stripe need not retain data after the term and grants Stripe a licence to use customer content to develop and improve its services. No Metronome retention period was found beyond 30 days of webhook delivery history (15 of 30). No deprecation policy was found. One operation is marked deprecated, v1 contract reads point new clients to v2, and SDK releases of 16 January and 2 March 2026 removed fields with changelog entries on the day (7 of 20). Stripe's privacy pages link a sub-processors list we did not read, and Metronome's trust centre is script-drawn. No hosting region was found (8 of 20). 45.

FluxA AgentMarket 64

Read for a closed service. No changelog or dated release notes were found. The models page says the catalogue was 'last updated November 5, 2026', and @fluxa-pay/fluxa-wallet 0.6.0, the CLI that carries the market commands llms.txt relies on, was published on 6 November 2026 (30). The CLI had eight releases between 10 August and 6 November 2026, 0.4.12 to 0.6.0 (20). Support is a Discord server and support.fluxapay@fluxapay.xyz, neither tested, and GitHub issues couldn't be read because the GitHub API refused us (3 of 15). No AgentMarket SDK. The TypeScript CLI is the official client and the LLM endpoints take OpenAI and Anthropic SDKs. Not an MCP server, so the registry line reads as SDKs (7 of 15). The CLI repository has 7 test files and no CI workflow, and the npm package declares no repository. @fluxa-pay/fluxa-connect-mcp points to a repository that isn't public (4 of 10). Total 64.

Metronome 82

Node.js SDK 3.11.0 and Python SDK 4.12.0 were released on 27 October 2026, and the changelog's latest entry is dated 13 October 2026 (30). The changelog has 20 dated entries from 6 August to 13 October 2026, and Python 4.11.0 (25 August), 4.11.1 (27 August) and 4.12.0 and Node.js 3.11.0 (27 October) shipped in the window (20). A support portal and a public changelog exist. The SDK issue queues were not read, as github.com refused us (9 of 15). Official SDKs in five languages, the Node.js and Python ones regenerated with the 27 October releases (15). The repositories carry CI with lint, build and test jobs, lockfiles and Release Please automation. CI results were not read (8 of 10). 82.

FluxA AgentMarket 51

fxa_live_ keys are created by a person at /keys and shown once, each with a spending limit in Units that changes within seconds, and are revoked immediately over DELETE /llm/keys/<id>, with written rotation steps. Key management needs a 5-minute Agent VC, never a key, and creation can be set to need a person's approval. No permission scopes beyond the spending limit were found, and no secret in a URL (24 of 30). Wallet payments need a mandate a person signs with a USDC budget and an expiry, and the Balance guide says to confirm every top-up with the user. The APIs guide tells agents not to ask before paying within a signed mandate, and no read-only key was found (14 of 20). The marketplace returns content from third-party APIs and installs third-party skills. Results carry a fluxa or bazaar source tag, but entries named ssrf1, keyprobe and tooltest1 are tagged fluxa, no review of uploads is described, and no guidance on treating responses or skills as untrusted was found (2 of 15). The balance endpoint returns available, spent, burn per day and owed, the ledger lists spend and purchases per merchant, and the wallet skill reads an X-LLM-Cost header on model calls (11 of 15). No disclosure policy, bug bounty, certification or advisory was found. security.txt couldn't be read and is scored absent, and the privacy policy says only 'industry-standard security measures' (0 of 20). Total 51.

Metronome 68

Bearer tokens are created in the web app, shown once, separate for sandbox and production, and can be archived. Scoping by access level, environment or endpoint exists but is set by contacting support, and by default a token has its creator's permissions (22 of 30). The API description read on 9 October defines agentic tokens whose writes return 403 AgenticMutationBlocked and wait at /v1/approval_requests for a person. How to create such a token was not found in the docs index. Dashboard roles are documented on a page we did not read (15 of 20). The API returns customer-supplied names, custom fields and event properties, and no prompt-injection guidance was found (5 of 15). /v1/auditLogs records the user or token, resource, action, IP address and user agent (14 of 15). SOC 2 Type 2 and SOC 1 Type 2 badges, regular penetration tests per the security page, and a Vanta trust centre we could not read. security.txt still returned 404 on 1 November and no bounty or disclosure policy for the service was found (12 of 20). 68.