FluxA AgentMarket vs Paid

FluxA AgentMarket 75

Payment platforms take the highest step that applies on the 40-point protocol line (40 on all their own endpoints, 30 on part of their own API, 25 when their merchants can accept one, 20 for a facilitator, 15 for paying as a buyer, 0 for only a protocol of their own). AgentMarket's proxied API endpoints and Balance top-ups answer x402 (v1 body or v2 PAYMENT-REQUIRED header), the pricing page says USDC from another wallet works over x402 on Base, and the FluxA CLI signs the standard exact EIP-3009 scheme. Model calls are charged to the Balance with a key or Agent VC. Nothing was paid, so this rests on the vendor's pages (30 of 40). Per-call price ranges are public in the catalogue, per-endpoint prices on listing pages, model prices per 1M tokens, Balance bundles and Token Plan prices, all without a login (20). Discovery and price reads are free with no account and some listed endpoints are priced at $0, but no free credit or trial was found. The wallet's TokenGo guide calls a $1 first top-up a trial. Termix earned 20 for free reads, and here a judgement call gives half (10 of 20). An agent holding Base USDC can pay a listed API per call with no account, per the pricing page and the 402 flow. Model calls, the Balance and keys need an account a person creates by signing in ('an agent cannot create either account'), and the FluxA wallet path needs a person to approve registration and sign a mandate (15 of 20). Total 75.

Paid 30

Payment platforms take the highest step that applies on the 40-point protocol line. No x402, MPP or L402 was found on Paid's own API or for its merchants, whose customers pay by card or bank transfer through a connected Stripe account (0). Plan prices are public at $0, $300, $600 and $1,000 a month by billings tier, with no per-unit price (10). The Free plan covers up to $100,000 of billings a year and the page says no credit card is required (20). A person signs up at app.paid.ai and creates the first key in the dashboard (0). Per the 9 October check, not re-read on 4 November, because Paid's website terms (clause 6(d)) bar automated access to its sites, docs, trust pages and APIs.

FluxA AgentMarket 12

Graded as a hosted service, the discovery gateway on agentmarket.fluxapay.xyz and the proxy and LLM endpoints on router.fluxapay.xyz, from the vendor's pages. Nothing was called. No status page is linked from the site, the footer, llms.txt or the guides, and no status host was checked (0). With no readable incident history the record takes the default (5). Listing pages show a health count with no history, such as '10/10 endpoints healthy' on Minifetch. No rate limit with numbers was found in llms.txt, the guides or the CLI help. The only cap is a per-key spending limit (0). The Balance guide says to retry a 503 shortly without minting a new credential, replays of a settled top-up finalize call are idempotent, a failed order answers 409, and the card flow says 'a retry is a new order'. No 429 or Retry-After guidance was found. Termix earned 8 for the same kind of guidance with idempotency keys on writes (7 of 15). No SLA was found, and the terms supply the service 'as is' (0). The about page labels the product 'v.01 / Beta' (0). Total 12.

Paid 35

Hosted lines. No status page was found in the pricing page footer, the docs index or the pages read, and trust.paid.ai was not read (0). With no history to read, the incident line takes 5. Rate limits are described as a token bucket per organisation on signal ingestion, counted per signal, with a 500-signal cap a request, but no bucket size or refill rate is published and other endpoints are not yet limited (7 of 15). A 429 carries Retry-After, the docs ask for exponential backoff with jitter, a per-signal idempotencyKey makes batch retries safe and the SDKs retry twice by default. No idempotency key was found on orders or payments (13 of 15). The agreement promises commercially reasonable efforts at 24-hour availability and 48 hours' notice of planned downtime, with no percentage or credit (0). The v2 API is the default version with no beta label, and custom views are marked experimental (10). Per the 9 October check, not re-read on 4 November, because Paid's website terms (clause 6(d)) bar automated access to its sites, docs, trust pages and APIs.

FluxA AgentMarket 32

The editorial half. The marketplace, proxy and gateway are closed. The terms (effective 14 January 2026) cover pricing, refunds and acceptable use but name no governing law, termination terms, liability for third-party listings or creator obligations, and the company appears only in the footer. The CLI is Apache-2.0 (8 of 30). The privacy policy (14 January 2026) lists account, payment and usage data and says identity isn't shared with model providers. It says nothing on prompts, API payloads, retention, training or data location (6 of 30). No deprecation policy or dated notice was found, and the terms may change 'at any time' (0 of 20). The policy names Stripe and 'OpenAI/Anthropic API' as a non-exhaustive list, while the models page lists AIHubMix, UnifyLLM and Baidu AI Cloud as providers. No locations are given (4 of 20). Total 18. The provenance half is computed from the provenance block.

Paid 52

The platform is closed under a published Master Subscription Agreement, and the Node and Python SDKs are MIT. The Go SDK repository has no licence file (17 of 30). The agreement, privacy policy and DPA agree with each other on a 30-day retrieval window, deletion from backups within 90 days, hosting on AWS US-East-1 and no training of general-purpose models on customer data. The agreement is undated (22 of 30). Six operations are marked deprecated with a named replacement and no removal date, and no deprecation policy was found (6 of 20). The DPA names AWS and its region and points to trust.paid.ai for the full sub-processor list, which was not read (10 of 20). Per the 9 October check for the legal pages, not re-read on 4 November under the website terms' clause 6(d). The Go SDK clone still has no licence file on 4 November.

FluxA AgentMarket 51

fxa_live_ keys are created by a person at /keys and shown once, each with a spending limit in Units that changes within seconds, and are revoked immediately over DELETE /llm/keys/<id>, with written rotation steps. Key management needs a 5-minute Agent VC, never a key, and creation can be set to need a person's approval. No permission scopes beyond the spending limit were found, and no secret in a URL (24 of 30). Wallet payments need a mandate a person signs with a USDC budget and an expiry, and the Balance guide says to confirm every top-up with the user. The APIs guide tells agents not to ask before paying within a signed mandate, and no read-only key was found (14 of 20). The marketplace returns content from third-party APIs and installs third-party skills. Results carry a fluxa or bazaar source tag, but entries named ssrf1, keyprobe and tooltest1 are tagged fluxa, no review of uploads is described, and no guidance on treating responses or skills as untrusted was found (2 of 15). The balance endpoint returns available, spent, burn per day and owed, the ledger lists spend and purchases per merchant, and the wallet skill reads an X-LLM-Cost header on model calls (11 of 15). No disclosure policy, bug bounty, certification or advisory was found. security.txt couldn't be read and is scored absent, and the privacy policy says only 'industry-standard security measures' (0 of 20). Total 51.

Paid 65

The MCP server uses OAuth 2.1 with PKCE and client registration, and tools run with the user's role. API keys are full-access or restricted by scope, and customer keys are bound to one customer and one route, expire on request, can be revoked and are stored as a hash. No full scope list was found (27 of 30). Viewers are read-only through MCP and restricted keys limit a workload. No confirmation step for deletes was found (14 of 20). The API returns customer-supplied names and metadata, and the MCP page warns about answers the tools did not produce, with no prompt-injection guidance (7 of 15). An audit log names the user or the key's creator, and keys show lastUsedAt (11 of 15). security.txt returned 404, the DPA gives a reporting address and lists TLS 1.2 and AES-256, and no certification or bounty was found in the pages read. trust.paid.ai was not read (6 of 20). Per the 9 October check for the hosted pages, not re-read on 4 November under the website terms' automated-access clause. OSV lists no advisory for the Node, Python or Go SDK or the CLI on 4 November.

FluxA AgentMarket 64

Read for a closed service. No changelog or dated release notes were found. The models page says the catalogue was 'last updated November 5, 2026', and @fluxa-pay/fluxa-wallet 0.6.0, the CLI that carries the market commands llms.txt relies on, was published on 6 November 2026 (30). The CLI had eight releases between 10 August and 6 November 2026, 0.4.12 to 0.6.0 (20). Support is a Discord server and support.fluxapay@fluxapay.xyz, neither tested, and GitHub issues couldn't be read because the GitHub API refused us (3 of 15). No AgentMarket SDK. The TypeScript CLI is the official client and the LLM endpoints take OpenAI and Anthropic SDKs. Not an MCP server, so the registry line reads as SDKs (7 of 15). The CLI repository has 7 test files and no CI workflow, and the npm package declares no repository. @fluxa-pay/fluxa-connect-mcp points to a repository that isn't public (4 of 10). Total 64.

Paid 77

The Node, Python and Go SDKs were tagged 2.0.0 on 27 October 2026, 8 days before the check (30). Releases in the 90 days from 6 August, from the clones' tags, are Node 1.8.0 (11 September) and 2.0.0, Python 1.12.0 (10 September) and 2.0.0, Go v2.0.0, and the CLI's 1.2.0 of 15 September per the 9 October check (20). Later version bumps in the repositories (Node 2.6.0 in package.json) carry no tag and aren't counted. No public API changelog was found on 9 October; support is by email, with Slack on paid plans, and the issue queues were not read (5 of 15). Current official SDKs in five languages (15). The SDK repositories carry CI workflows and lockfiles. CI results were not read, and the Go module still declares go 1.13 (7 of 10).

FluxA AgentMarket 53

No OpenAPI file was found. llms.txt names none and the documentation site, docs.fluxapay.xyz, couldn't be read because its robots.txt couldn't be. The discovery response has documented fields (apiServers, skills, models, pagination), a GET on each listing's urls.access returns its endpoints and prices as JSON per the skill-creation guide, and the LLM endpoints follow the OpenAI and Anthropic formats (8 of 25). llms.txt and Markdown guides (getting-started.md, currency.md, create-skill.md, the APIs and Balance guides) written for agents (10). The guides say when to use search against query, that the external catalogues are a last resort and which rail fits which job. Listing descriptions come from creators and 17 of the first 50 skills have none (12 of 20). type is an enum that answers 400 to unknown values, limit is bounded at 1,000, and the chat and messages bodies follow published formats. Listing endpoints are described by each creator (9 of 15). curl examples for discovery, models and payment, a status table in the Balance guide with the action for 401, 503, 404, 402 and 409, and seven named mandate errors in the APIs guide (11 of 15). Paths carry /llm/v1/ and llms.txt names minimum CLI versions, but no changelog was found (3 of 15). Total 53.

Paid 64

The docs index says an OpenAPI 3.1 file is at /v-2/openapi.json and /v-2/openapi.yaml, and both returned 404 on 9 October 2026. Each reference page has a typed Markdown twin and the SDKs are generated from the specification, so 10 of 25. llms.txt per version and Markdown for every page (10). The pages read state purpose and limits well on signals and customer keys and tersely on list calls (15 of 20). Inputs carry enums, defaults and required flags, with free-form maps for data and metadata (12 of 15). Examples use placeholder values, and errors share one error, code, details shape with named codes in the guides (10 of 15). Docs and paths are versioned v1 and v2. No API changelog was found (7 of 15). Per the 9 October check, not re-read on 4 November, because Paid's website terms (clause 6(d)) bar automated access to its sites, docs, trust pages and APIs.