FluxA AgentMarket vs Payman Genie MCP

FluxA AgentMarket 75

Payment platforms take the highest step that applies on the 40-point protocol line (40 on all their own endpoints, 30 on part of their own API, 25 when their merchants can accept one, 20 for a facilitator, 15 for paying as a buyer, 0 for only a protocol of their own). AgentMarket's proxied API endpoints and Balance top-ups answer x402 (v1 body or v2 PAYMENT-REQUIRED header), the pricing page says USDC from another wallet works over x402 on Base, and the FluxA CLI signs the standard exact EIP-3009 scheme. Model calls are charged to the Balance with a key or Agent VC. Nothing was paid, so this rests on the vendor's pages (30 of 40). Per-call price ranges are public in the catalogue, per-endpoint prices on listing pages, model prices per 1M tokens, Balance bundles and Token Plan prices, all without a login (20). Discovery and price reads are free with no account and some listed endpoints are priced at $0, but no free credit or trial was found. The wallet's TokenGo guide calls a $1 first top-up a trial. Termix earned 20 for free reads, and here a judgement call gives half (10 of 20). An agent holding Base USDC can pay a listed API per call with no account, per the pricing page and the 402 flow. Model calls, the Balance and keys need an account a person creates by signing in ('an agent cannot create either account'), and the FluxA wallet path needs a person to approve registration and sign a mandate (15 of 20). Total 75.

Payman Genie MCP 35

Payment platforms and wallets take the highest step that applies on the 40-point protocol line. 40 for x402, MPP or L402 on all their own endpoints, 30 on part of their own API, 25 when their merchants can accept one, 20 for running a facilitator, 15 for paying as a buyer, 0 for only a protocol of their own. Genie pays x402 APIs from a daily agent budget the owner sets, the buyer step (15 of 40). Payman has no way to accept x402 or MPP, and Genie itself isn't paid over either. No price list for Genie anywhere we looked (0). Free signup with no card or bank details (20). A person signs up and signs in through a browser (0).

FluxA AgentMarket 64

Read for a closed service. No changelog or dated release notes were found. The models page says the catalogue was 'last updated November 5, 2026', and @fluxa-pay/fluxa-wallet 0.6.0, the CLI that carries the market commands llms.txt relies on, was published on 6 November 2026 (30). The CLI had eight releases between 10 August and 6 November 2026, 0.4.12 to 0.6.0 (20). Support is a Discord server and support.fluxapay@fluxapay.xyz, neither tested, and GitHub issues couldn't be read because the GitHub API refused us (3 of 15). No AgentMarket SDK. The TypeScript CLI is the official client and the LLM endpoints take OpenAI and Anthropic SDKs. Not an MCP server, so the registry line reads as SDKs (7 of 15). The CLI repository has 7 test files and no CI workflow, and the npm package declares no repository. @fluxa-pay/fluxa-connect-mcp points to a repository that isn't public (4 of 10). Total 64.

Payman Genie MCP 30

The bridge's newest tagged release is v0.2.1 (14 September 2026), 51 days before 4 November (20). Since 6 August the repository has two tagged releases, v0.2.0 and v0.2.1, both on 14 September; the 0.3.0 and 0.4.0 version bumps of 18 September carry no tag or changelog entry, so they don't count as releases, and no commit has landed since 18 September (0). Two merged pull requests and no changelog. The older developer platform looks abandoned, with docs.paymanai.com failing on a Cloudflare 526 and the payman-ts SDK last released on 18 September 2025, per the 1 October check, not re-read on 4 November (5). No current SDK, and the official MCP registry wasn't read first-hand (0). A Node test suite with a fake authorisation server, but no CI workflow in the repository (5). 20+0+5+0+5 = 30.

FluxA AgentMarket 51

fxa_live_ keys are created by a person at /keys and shown once, each with a spending limit in Units that changes within seconds, and are revoked immediately over DELETE /llm/keys/<id>, with written rotation steps. Key management needs a 5-minute Agent VC, never a key, and creation can be set to need a person's approval. No permission scopes beyond the spending limit were found, and no secret in a URL (24 of 30). Wallet payments need a mandate a person signs with a USDC budget and an expiry, and the Balance guide says to confirm every top-up with the user. The APIs guide tells agents not to ask before paying within a signed mandate, and no read-only key was found (14 of 20). The marketplace returns content from third-party APIs and installs third-party skills. Results carry a fluxa or bazaar source tag, but entries named ssrf1, keyprobe and tooltest1 are tagged fluxa, no review of uploads is described, and no guidance on treating responses or skills as untrusted was found (2 of 15). The balance endpoint returns available, spent, burn per day and owed, the ledger lists spend and purchases per merchant, and the wallet skill reads an X-LLM-Cost header on model calls (11 of 15). No disclosure policy, bug bounty, certification or advisory was found. security.txt couldn't be read and is scored absent, and the privacy policy says only 'industry-standard security measures' (0 of 20). Total 51.

Payman Genie MCP 80

OAuth 2.1 with S256 PKCE, scopes genie:ask and genie:self, one-hour access tokens, refresh tokens rotated on every use and revoked through RFC 7009 on logout. Dynamic client registration is now documented (30). The owner sets per-payment, daily and monthly limits and approved payees, payments over an ask-me threshold need a six-digit code or passkey, and approvals happen in Genie, never in the chat. The assistant can grant itself read access only, and full access needs the owner (20). The agent passes the person's words to another agent; limits and out-of-band approval sit behind it, but we found no prompt-injection guidance as such (10). Genie says every decision is logged in an activity history (12). "AICPA SOC 2 certified" on the site and a Vanta trust centre we couldn't render, no security.txt per the 30 September check, and no disclosure policy or bug bounty found (8). No advisory for @paymanai/genie-mcp-stdio or any Payman package on osv.dev on 4 November. Genie holds no funds; money stays at the bank, card wallet or Coinbase, and we found no licence claim. The developer page, home page and trust centre readings are per the 1 October check, not re-read on 4 November (paymanai.com hosts are paused on the terms). 30+20+10+12+8 = 80.

FluxA AgentMarket 32

The editorial half. The marketplace, proxy and gateway are closed. The terms (effective 14 January 2026) cover pricing, refunds and acceptable use but name no governing law, termination terms, liability for third-party listings or creator obligations, and the company appears only in the footer. The CLI is Apache-2.0 (8 of 30). The privacy policy (14 January 2026) lists account, payment and usage data and says identity isn't shared with model providers. It says nothing on prompts, API payloads, retention, training or data location (6 of 30). No deprecation policy or dated notice was found, and the terms may change 'at any time' (0 of 20). The policy names Stripe and 'OpenAI/Anthropic API' as a non-exhaustive list, while the models page lists AIHubMix, UnifyLLM and Baidu AI Cloud as providers. No locations are given (4 of 20). Total 18. The provenance half is computed from the provenance block.

Payman Genie MCP 46

Bridge under MIT, Genie closed under published terms (updated 1 November 2026) and an API licence (15). Privacy policy updated 21 September 2026 names Payman AI, Inc. in Durango, Colorado, gives no retention periods and no DPA, and says anonymised or aggregated data is used to train AI models (12). No deprecation notice for the old developer platform even though its docs no longer load (0). Stripe, Google and unnamed identity-verification and credit-bureau providers are named, with transfers "including the United States" (6). The privacy policy is per the 1 October check, not re-read on 4 November. 15+12+0+6 = 33.

FluxA AgentMarket 12

Graded as a hosted service, the discovery gateway on agentmarket.fluxapay.xyz and the proxy and LLM endpoints on router.fluxapay.xyz, from the vendor's pages. Nothing was called. No status page is linked from the site, the footer, llms.txt or the guides, and no status host was checked (0). With no readable incident history the record takes the default (5). Listing pages show a health count with no history, such as '10/10 endpoints healthy' on Minifetch. No rate limit with numbers was found in llms.txt, the guides or the CLI help. The only cap is a per-key spending limit (0). The Balance guide says to retry a 503 shortly without minting a new credential, replays of a settled top-up finalize call are idempotent, a failed order answers 409, and the card flow says 'a retry is a new order'. No 429 or Retry-After guidance was found. Termix earned 8 for the same kind of guidance with idempotency keys on writes (7 of 15). No SLA was found, and the terms supply the service 'as is' (0). The about page labels the product 'v.01 / Beta' (0). Total 12.

Payman Genie MCP 25

No status page found for Genie or Payman (0), so no incident history to read (5). No rate limits published (0). The developer page says to retry an error only after NOTHING_RAN or BUSY and never after OUTCOME_UNKNOWN, which is safe-retry guidance for money-moving calls, but there's no 429 or Retry-After behaviour (12 of 15). No SLA (0). Genie is sold as a live product with no beta label, while the stdio bridge is at 0.4.0 (8 of 10). Per the 1 October check, not re-read on 4 November (paymanai.com hosts are paused on the terms of 1 November 2026). 0+5+0+12+0+8 = 25.