FluxA AgentMarket vs Orb

FluxA AgentMarket 12

Graded as a hosted service, the discovery gateway on agentmarket.fluxapay.xyz and the proxy and LLM endpoints on router.fluxapay.xyz, from the vendor's pages. Nothing was called. No status page is linked from the site, the footer, llms.txt or the guides, and no status host was checked (0). With no readable incident history the record takes the default (5). Listing pages show a health count with no history, such as '10/10 endpoints healthy' on Minifetch. No rate limit with numbers was found in llms.txt, the guides or the CLI help. The only cap is a per-key spending limit (0). The Balance guide says to retry a 503 shortly without minting a new credential, replays of a settled top-up finalize call are idempotent, a failed order answers 409, and the card flow says 'a retry is a new order'. No 429 or Retry-After guidance was found. Termix earned 8 for the same kind of guidance with idempotency keys on writes (7 of 15). No SLA was found, and the terms supply the service 'as is' (0). The about page labels the product 'v.01 / Beta' (0). Total 12.

Orb 87

Hosted lines. status.withorb.com runs on Atlassian Statuspage with eight components and 90-day uptime bars (20). The history feed for 3 August to 1 November lists five incidents, each partial. Usage-based invoices were delayed on 1 and 2 September (fixed-fee invoices unaffected), reporting surfaces failed to load in the dashboard on 16 September ("APIs and other services are unaffected"), read APIs failed or slowed for about 35 minutes on 24 September while writes recovered first, shared clusters saw 15 minutes of latency on 25 September, and analytics API requests timed out briefly on 26 October. Minor only (20). Rate limits are published per category for live, test and trial accounts, with live ingestion now 200,000 events a minute by default. The ingest reference's denial of a hard limit was not re-read (14 of 15). The docs advise exponential backoff on 429 with no Retry-After documented, and Idempotency-Key on POST and PATCH makes retries safe for 48 hours (13 of 15). The pricing page now lists a 99.9% uptime SLA included in Enterprise plans and a 99.99% SLA as a paid Enterprise add-on, read as resend's and auth0-ai-agents' Enterprise figures on their pricing pages were (10). The v1 API is generally available (10). 20 + 20 + 14 + 13 + 10 + 10 = 87.

FluxA AgentMarket 75

Payment platforms take the highest step that applies on the 40-point protocol line (40 on all their own endpoints, 30 on part of their own API, 25 when their merchants can accept one, 20 for a facilitator, 15 for paying as a buyer, 0 for only a protocol of their own). AgentMarket's proxied API endpoints and Balance top-ups answer x402 (v1 body or v2 PAYMENT-REQUIRED header), the pricing page says USDC from another wallet works over x402 on Base, and the FluxA CLI signs the standard exact EIP-3009 scheme. Model calls are charged to the Balance with a key or Agent VC. Nothing was paid, so this rests on the vendor's pages (30 of 40). Per-call price ranges are public in the catalogue, per-endpoint prices on listing pages, model prices per 1M tokens, Balance bundles and Token Plan prices, all without a login (20). Discovery and price reads are free with no account and some listed endpoints are priced at $0, but no free credit or trial was found. The wallet's TokenGo guide calls a $1 first top-up a trial. Termix earned 20 for free reads, and here a judgement call gives half (10 of 20). An agent holding Base USDC can pay a listed API per call with no account, per the pricing page and the 402 flow. Model calls, the Balance and keys need an account a person creates by signing in ('an agent cannot create either account'), and the FluxA wallet path needs a person to approve registration and sign a mandate (15 of 20). Total 75.

Orb 30

Payment platforms take the highest step that applies on the 40-point protocol line. No x402, MPP or L402 was found in the API description, the docs index or the pricing page. Orb can collect an invoice with a Stripe Shared Payment Token that a buyer's agent granted, which is a Stripe credential and not one of the three protocols (0). The pricing page now lists a self-serve Business plan at $6.00 a credit, less with volume, where one credit "works out to 0.60% of billing volume, plus event ingestion and other metered dimensions". The credit consumption table the pricing page links gives the meters, one credit for each $1,000 of billings, for 200,000 events ingested (live and test) and two for 500,000 rows exported, so per-unit prices are published (20 of 20). Enterprise is custom. Business sign-up comes with 100 free credits. Whether sign-up needs a card couldn't be read, because the sign-up page is on app.withorb.com, whose robots.txt disallows every path (10 of 20). A person signs up in the web app and creates the key there. No keyless route or programmatic key API was found (0). 0 + 20 + 10 + 0 = 30.

FluxA AgentMarket 53

No OpenAPI file was found. llms.txt names none and the documentation site, docs.fluxapay.xyz, couldn't be read because its robots.txt couldn't be. The discovery response has documented fields (apiServers, skills, models, pagination), a GET on each listing's urls.access returns its endpoints and prices as JSON per the skill-creation guide, and the LLM endpoints follow the OpenAI and Anthropic formats (8 of 25). llms.txt and Markdown guides (getting-started.md, currency.md, create-skill.md, the APIs and Balance guides) written for agents (10). The guides say when to use search against query, that the external catalogues are a last resort and which rail fits which job. Listing descriptions come from creators and 17 of the first 50 skills have none (12 of 20). type is an enum that answers 400 to unknown values, limit is bounded at 1,000, and the chat and messages bodies follow published formats. Listing endpoints are described by each creator (9 of 15). curl examples for discovery, models and payment, a status table in the Balance guide with the action for 401, 503, 404, 402 and 409, and seven named mandate errors in the APIs guide (11 of 15). Paths carry /llm/v1/ and llms.txt names minimum CLI versions, but no changelog was found (3 of 15). Total 53.

Orb 90

A public OpenAPI 3.1 description, now 160 operations on 124 paths, 781 schemas and 117 webhook events (25). llms.txt and a Markdown twin for every docs page (10). Most operations carry long descriptions, and the ingest, ledger and subscription entries explain when to use each call. Few say when not to (17 of 20). The description has enums and required lists, with free-form maps for metadata and event properties (13 of 15). Examples throughout, and errors follow RFC 7807 with nine documented types and stable type URIs that point at an older docs path (13 of 15). The path is versioned v1 and the description says 1.0, with no dated API versions. The product changelog is active again, with 20 entries from 30 September to 29 October 2026, many of them API changes, and the SDK changelogs record each spec update (12 of 15). 25 + 10 + 17 + 13 + 13 + 12 = 90.

FluxA AgentMarket 32

The editorial half. The marketplace, proxy and gateway are closed. The terms (effective 14 January 2026) cover pricing, refunds and acceptable use but name no governing law, termination terms, liability for third-party listings or creator obligations, and the company appears only in the footer. The CLI is Apache-2.0 (8 of 30). The privacy policy (14 January 2026) lists account, payment and usage data and says identity isn't shared with model providers. It says nothing on prompts, API payloads, retention, training or data location (6 of 30). No deprecation policy or dated notice was found, and the terms may change 'at any time' (0 of 20). The policy names Stripe and 'OpenAI/Anthropic API' as a non-exhaustive list, while the models page lists AIHubMix, UnifyLLM and Baidu AI Cloud as providers. No locations are given (4 of 20). Total 18. The provenance half is computed from the provenance block.

Orb 66

The platform is closed under published Platform Terms and Conditions, and the SDKs are Apache-2.0. The terms page shows no version date (17 of 30). The privacy policy of 7 May 2025 covers product data, the terms allow a data export within 30 days of termination before deletion, and the security page states seven-day snapshot retention and deletion on request. The terms let Orb use aggregated, de-identified customer data to improve the service. The DPA is available only on request (16 of 30). No deprecation policy was found. The API description marks 235 items deprecated with no removal dates, and the SDK changelog shows the ingestion debug parameter deprecated on 15 July and removed on 12 September 2026. The reliability page no longer mentions it (6 of 20). The security page names AWS as host and says Orb keeps a sub-processor list, which is not public. The privacy policy lists provider categories and names Stripe. No hosting region was found (6 of 20).

FluxA AgentMarket 51

fxa_live_ keys are created by a person at /keys and shown once, each with a spending limit in Units that changes within seconds, and are revoked immediately over DELETE /llm/keys/<id>, with written rotation steps. Key management needs a 5-minute Agent VC, never a key, and creation can be set to need a person's approval. No permission scopes beyond the spending limit were found, and no secret in a URL (24 of 30). Wallet payments need a mandate a person signs with a USDC budget and an expiry, and the Balance guide says to confirm every top-up with the user. The APIs guide tells agents not to ask before paying within a signed mandate, and no read-only key was found (14 of 20). The marketplace returns content from third-party APIs and installs third-party skills. Results carry a fluxa or bazaar source tag, but entries named ssrf1, keyprobe and tooltest1 are tagged fluxa, no review of uploads is described, and no guidance on treating responses or skills as untrusted was found (2 of 15). The balance endpoint returns available, spent, burn per day and owed, the ledger lists spend and purchases per merchant, and the wallet skill reads an X-LLM-Cost header on model calls (11 of 15). No disclosure policy, bug bounty, certification or advisory was found. security.txt couldn't be read and is scored absent, and the privacy policy says only 'industry-standard security measures' (0 of 20). Total 51.

Orb 72

API keys are Bearer tokens created in the web app, separately for test mode and live mode, and can be revoked. Since the MCP server launched on 22 October the docs describe scoped keys, each scope covering one area (customers and credits, subscriptions, invoices, plans, prices and others) set to none, read or write, and a call outside the key's scopes fails with a permissions error. The readiness guide says to scope and rotate keys (30 of 30). A read-only key is now possible, dashboard users have Admin, Editor or Viewer roles, and the Dry-Run header and preview calls let a caller check a write first. Write approval is left to the client (15 of 20). The API returns customer-supplied names, metadata and event properties, and no prompt-injection guidance was found, including on the MCP page (5 of 15). Audit logs name the API key or user, the targets, the IP address and the user agent and can stream to a SIEM, but they are in private preview on the Enterprise plan only (8 of 15). SOC 2 Type 2 and SOC 1 Type 2 per the trust centre, an annual third-party penetration test and a written disclosure policy with a reporting address. security.txt returned 404 on 1 November and no bounty was found (14 of 20). 30 + 15 + 5 + 8 + 14 = 72.

FluxA AgentMarket 64

Read for a closed service. No changelog or dated release notes were found. The models page says the catalogue was 'last updated November 5, 2026', and @fluxa-pay/fluxa-wallet 0.6.0, the CLI that carries the market commands llms.txt relies on, was published on 6 November 2026 (30). The CLI had eight releases between 10 August and 6 November 2026, 0.4.12 to 0.6.0 (20). Support is a Discord server and support.fluxapay@fluxapay.xyz, neither tested, and GitHub issues couldn't be read because the GitHub API refused us (3 of 15). No AgentMarket SDK. The TypeScript CLI is the official client and the LLM endpoints take OpenAI and Anthropic SDKs. Not an MCP server, so the registry line reads as SDKs (7 of 15). The CLI repository has 7 test files and no CI workflow, and the npm package declares no repository. @fluxa-pay/fluxa-connect-mcp points to a repository that isn't public (4 of 10). Total 64.

Orb 84

The Python SDK 4.93.0, TypeScript SDK 6.36.0 and Go SDK v1.136.0 were all tagged on 31 October 2026 (30). Each repository has at least 29 tags since 3 August, the depth the shallow clones reach (20). The product changelog has 20 entries from 30 September to 29 October 2026, a support site is linked, the terms name email and Slack support, and the SDK issue queues were not read (11 of 15). Current official SDKs in six languages (15). The repositories carry CI workflows with lint, build and test jobs, lockfiles and automated releases. CI results were not read (8 of 10). 30 + 20 + 11 + 15 + 8 = 84.