FluxA AgentMarket vs Skyfire API + MCP

FluxA AgentMarket 75

Payment platforms take the highest step that applies on the 40-point protocol line (40 on all their own endpoints, 30 on part of their own API, 25 when their merchants can accept one, 20 for a facilitator, 15 for paying as a buyer, 0 for only a protocol of their own). AgentMarket's proxied API endpoints and Balance top-ups answer x402 (v1 body or v2 PAYMENT-REQUIRED header), the pricing page says USDC from another wallet works over x402 on Base, and the FluxA CLI signs the standard exact EIP-3009 scheme. Model calls are charged to the Balance with a key or Agent VC. Nothing was paid, so this rests on the vendor's pages (30 of 40). Per-call price ranges are public in the catalogue, per-endpoint prices on listing pages, model prices per 1M tokens, Balance bundles and Token Plan prices, all without a login (20). Discovery and price reads are free with no account and some listed endpoints are priced at $0, but no free credit or trial was found. The wallet's TokenGo guide calls a $1 first top-up a trial. Termix earned 20 for free reads, and here a judgement call gives half (10 of 20). An agent holding Base USDC can pay a listed API per call with no account, per the pricing page and the 402 flow. Model calls, the Balance and keys need an account a person creates by signing in ('an agent cannot create either account'), and the FluxA wallet path needs a person to approve registration and sign a mandate (15 of 20). Total 75.

Skyfire API + MCP 20

Payment platforms and wallets take the highest step that applies on the 40-point protocol line. 40 for x402, MPP or L402 on all their own endpoints, 30 on part of their own API, 25 when their merchants can accept one, 20 for running a facilitator, 15 for paying as a buyer, 0 for only a protocol of their own. No x402, MPP or L402. Payment runs on Skyfire's own KYAPay tokens, an open specification but none of the three protocols, so the own-protocol step (0). No price list; the terms say Skyfire doesn't currently charge for buying credits or generating tokens and may add fees with 30 days' notice (10). A sandbox environment exists, and we didn't establish whether signup or the sandbox needs a card (10). A person signs up and is identity-checked through Persona before an agent can pay (0).

FluxA AgentMarket 64

Read for a closed service. No changelog or dated release notes were found. The models page says the catalogue was 'last updated November 5, 2026', and @fluxa-pay/fluxa-wallet 0.6.0, the CLI that carries the market commands llms.txt relies on, was published on 6 November 2026 (30). The CLI had eight releases between 10 August and 6 November 2026, 0.4.12 to 0.6.0 (20). Support is a Discord server and support.fluxapay@fluxapay.xyz, neither tested, and GitHub issues couldn't be read because the GitHub API refused us (3 of 15). No AgentMarket SDK. The TypeScript CLI is the official client and the LLM endpoints take OpenAI and Anthropic SDKs. Not an MCP server, so the registry line reads as SDKs (7 of 15). The CLI repository has 7 test files and no CI workflow, and the npm package declares no repository. @fluxa-pay/fluxa-connect-mcp points to a repository that isn't public (4 of 10). Total 64.

Skyfire API + MCP 31

Seller SDK 0.0.7 published to npm on 4 August 2026, 58 days ago (20). No other release or dated change found in the last 90 days (0). No changelog and no public SDK repository; the KYAPay specification repo was last touched on 2 September (4). One pre-1.0 Node SDK and no MCP registry entry found (5). The SDK repository is private, so we can't see CI (2).

FluxA AgentMarket 32

The editorial half. The marketplace, proxy and gateway are closed. The terms (effective 14 January 2026) cover pricing, refunds and acceptable use but name no governing law, termination terms, liability for third-party listings or creator obligations, and the company appears only in the footer. The CLI is Apache-2.0 (8 of 30). The privacy policy (14 January 2026) lists account, payment and usage data and says identity isn't shared with model providers. It says nothing on prompts, API payloads, retention, training or data location (6 of 30). No deprecation policy or dated notice was found, and the terms may change 'at any time' (0 of 20). The policy names Stripe and 'OpenAI/Anthropic API' as a non-exhaustive list, while the models page lists AIHubMix, UnifyLLM and Baidu AI Cloud as providers. No locations are given (4 of 20). Total 18. The provenance half is computed from the provenance block.

Skyfire API + MCP 55

Closed service under terms dated 25 June 2025. The KYAPay specification is published under the Community Specification License and the seller SDK under MIT (17). Privacy policy dated 25 June 2025 links a DPA, names Persona and Google Analytics, keeps data in US data centres, gives no retention periods, permits training AI models on personal data, and says sellers receive any personal information carried in a token (18). No deprecation policy or notices found (0). A service-providers page lists processors, and data locations are stated (15).

FluxA AgentMarket 51

fxa_live_ keys are created by a person at /keys and shown once, each with a spending limit in Units that changes within seconds, and are revoked immediately over DELETE /llm/keys/<id>, with written rotation steps. Key management needs a 5-minute Agent VC, never a key, and creation can be set to need a person's approval. No permission scopes beyond the spending limit were found, and no secret in a URL (24 of 30). Wallet payments need a mandate a person signs with a USDC budget and an expiry, and the Balance guide says to confirm every top-up with the user. The APIs guide tells agents not to ask before paying within a signed mandate, and no read-only key was found (14 of 20). The marketplace returns content from third-party APIs and installs third-party skills. Results carry a fluxa or bazaar source tag, but entries named ssrf1, keyprobe and tooltest1 are tagged fluxa, no review of uploads is described, and no guidance on treating responses or skills as untrusted was found (2 of 15). The balance endpoint returns available, spent, burn per day and owed, the ledger lists spend and purchases per merchant, and the wallet skill reads an X-LLM-Cost header on model calls (11 of 15). No disclosure policy, bug bounty, certification or advisory was found. security.txt couldn't be read and is scored absent, and the privacy policy says only 'industry-standard security measures' (0 of 20). Total 51.

Skyfire API + MCP 41

A skyfire-api-key header, with separate buyer, seller and enterprise admin key types so a buyer key can't charge and a seller key can't mint. Rotation and revocation weren't documented in what we read (22). A pay token caps what a seller can charge at its amount, expires in 10 seconds to 24 hours and is bound to one seller service, but we found no buyer-side spending cap on an agent and no confirmation on create-pay-token (10). find-sellers returns third-party listings with no prompt-injection guidance (6). No audit log or per-call history found (0). Tokens are JWTs verified against a public JWKS, with jti for replay checks, and Skyfire runs KYB on buyer platforms and KYC through Persona. No security.txt per the 30 September check, and no disclosure policy, bug bounty or SOC 2 found (3). Funds sit in "a digital wallet set up by Skyfire or our service providers", the terms name no bank, custodian or licence, and credits are non-refundable.

FluxA AgentMarket 12

Graded as a hosted service, the discovery gateway on agentmarket.fluxapay.xyz and the proxy and LLM endpoints on router.fluxapay.xyz, from the vendor's pages. Nothing was called. No status page is linked from the site, the footer, llms.txt or the guides, and no status host was checked (0). With no readable incident history the record takes the default (5). Listing pages show a health count with no history, such as '10/10 endpoints healthy' on Minifetch. No rate limit with numbers was found in llms.txt, the guides or the CLI help. The only cap is a per-key spending limit (0). The Balance guide says to retry a 503 shortly without minting a new credential, replays of a settled top-up finalize call are idempotent, a failed order answers 409, and the card flow says 'a retry is a new order'. No 429 or Retry-After guidance was found. Termix earned 8 for the same kind of guidance with idempotency keys on writes (7 of 15). No SLA was found, and the terms supply the service 'as is' (0). The about page labels the product 'v.01 / Beta' (0). Total 12.

Skyfire API + MCP 19

No status page found, and status.skyfire.xyz doesn't resolve (0), so no incident history (5). No rate limits in the docs index or the error reference (0). The error reference says to branch on code and not to retry FORBIDDEN or NOT_ELIGIBLE, but has no 429, Retry-After or idempotency guidance for token creation (4 of 15). No SLA (0). Production and sandbox are both live, with no beta label (10).

FluxA AgentMarket 53

No OpenAPI file was found. llms.txt names none and the documentation site, docs.fluxapay.xyz, couldn't be read because its robots.txt couldn't be. The discovery response has documented fields (apiServers, skills, models, pagination), a GET on each listing's urls.access returns its endpoints and prices as JSON per the skill-creation guide, and the LLM endpoints follow the OpenAI and Anthropic formats (8 of 25). llms.txt and Markdown guides (getting-started.md, currency.md, create-skill.md, the APIs and Balance guides) written for agents (10). The guides say when to use search against query, that the external catalogues are a last resort and which rail fits which job. Listing descriptions come from creators and 17 of the first 50 skills have none (12 of 20). type is an enum that answers 400 to unknown values, limit is bounded at 1,000, and the chat and messages bodies follow published formats. Listing endpoints are described by each creator (9 of 15). curl examples for discovery, models and payment, a status table in the Balance guide with the action for 401, 503, 404, 402 and 409, and seven named mandate errors in the APIs guide (11 of 15). Paths carry /llm/v1/ and llms.txt names minimum CLI versions, but no changelog was found (3 of 15). Total 53.

Skyfire API + MCP 59

We found no public OpenAPI file for Skyfire's own API; the "OpenAPI Specs" page tells sellers how to describe token requirements in theirs. The MCP server's four tools are documented with their inputs, but the server is closed (10 of 25). llms.txt with about 70 entries and Markdown pages (10). The docs explain when to use a kya, pay or kya-pay token, while the MCP tool descriptions are one line each (12). Token type is one of three values, expiresAt is bounded to 10 seconds to 24 hours, and amounts and sellerServiceId are typed (11). Eight error codes documented with a fixed code, message, details body (12). /api/v1 in paths and no changelog (4).