FluxA AgentMarket vs Stripe API + MCP

FluxA AgentMarket 12

Graded as a hosted service, the discovery gateway on agentmarket.fluxapay.xyz and the proxy and LLM endpoints on router.fluxapay.xyz, from the vendor's pages. Nothing was called. No status page is linked from the site, the footer, llms.txt or the guides, and no status host was checked (0). With no readable incident history the record takes the default (5). Listing pages show a health count with no history, such as '10/10 endpoints healthy' on Minifetch. No rate limit with numbers was found in llms.txt, the guides or the CLI help. The only cap is a per-key spending limit (0). The Balance guide says to retry a 503 shortly without minting a new credential, replays of a settled top-up finalize call are idempotent, a failed order answers 409, and the card flow says 'a retry is a new order'. No 429 or Retry-After guidance was found. Termix earned 8 for the same kind of guidance with idempotency keys on writes (7 of 15). No SLA was found, and the terms supply the service 'as is' (0). The about page labels the product 'v.01 / Beta' (0). Total 12.

Stripe API + MCP 78

Status page at status.stripe.com, whose feed link resolves to Stripe's Statuspage history at www.stripestatus.com with components for the Stripe API, core components and payment methods (20). The 90 days to 1 November run from 3 August, so the 24 July incident (64 minutes of elevated API error rates and response times, our one major on 17 October) has left the window. In the window, 22 September (elevated errors on account and capability calls, 19:13 to 22:19 UTC, marked no impact) stays partial, 27 September (a vendor-marked major of 29 minutes, 00:32 to 01:01 UTC) stays minor by our line, the other Stripe API incidents read on 17 October ran 3 to 37 minutes, except 6 August, when retrieving balance transactions for automatic payouts returned elevated errors from 13:45 to about 16:20 UTC. That one hit a single group of calls, so it reads as partial, and its times come from a third-party tracker's copy of Stripe's notice, not Stripe's own page. The status page read on 1 November shows, from 17 to 31 October, elevated Issuing API errors on 28 October for cards created or updated between 17:13 and 17:54 UTC (fully resolved 20:41), which hit one product's endpoints and so reads as partial like 22 September, and otherwise partner payment methods (Revolut Pay, PayByBank, Bancontact, BLIK) and scheduled maintenance. Minor incidents only (20). We didn't re-read the 3 August to 16 October incident pages on 1 November, and rely on the 17 October readings checked by the verifier. Rate limits published, 100 requests a second in live mode, 25 in a sandbox, 25 per endpoint, plus per-resource limits (15). Every 429 carries a Stripe-Rate-Limited-Reason header, the docs prescribe exponential backoff with jitter, lock timeouts are retried by the SDKs, and the API takes idempotency keys with a dedicated idempotency_error, per the 17 October check, not re-read on 1 November (15). The pricing page, re-read on 1 November, cites 99.999% average historical uptime, which is a record rather than a commitment, and we found no SLA (0). The API, MCP server and machine payments are live, while stripe_analytics and the five Treasury tools are marked preview (8 of 10). 20+20+15+15+0+8 = 78.

FluxA AgentMarket 32

The editorial half. The marketplace, proxy and gateway are closed. The terms (effective 14 January 2026) cover pricing, refunds and acceptable use but name no governing law, termination terms, liability for third-party listings or creator obligations, and the company appears only in the footer. The CLI is Apache-2.0 (8 of 30). The privacy policy (14 January 2026) lists account, payment and usage data and says identity isn't shared with model providers. It says nothing on prompts, API payloads, retention, training or data location (6 of 30). No deprecation policy or dated notice was found, and the terms may change 'at any time' (0 of 20). The policy names Stripe and 'OpenAI/Anthropic API' as a non-exhaustive list, while the models page lists AIHubMix, UnifyLLM and Baidu AI Cloud as providers. No locations are given (4 of 20). Total 18. The provenance half is computed from the provenance block.

Stripe API + MCP 87

stripe/ai and stripe/openapi are MIT and the service is closed under published terms (18). The security page links the privacy policy, Privacy Center and DPA, states a data-retention policy without periods, and cites EU-US, UK and Swiss Data Privacy Framework participation and CBPR and PRP certifications (24). Dated API versions with an upgrade guide, and the MCP key change was announced in advance, with its date since moved from 31 October to 30 November 2026 (18). The sub-processor list, last updated 27 September 2026 per the 17 October check and not re-read on 1 November, names each provider with the data it handles, the purpose and the entity country, and Business Users can subscribe to change notices with 30 days to object. It gives entity countries rather than where data is processed (18 of 20).

FluxA AgentMarket 51

fxa_live_ keys are created by a person at /keys and shown once, each with a spending limit in Units that changes within seconds, and are revoked immediately over DELETE /llm/keys/<id>, with written rotation steps. Key management needs a 5-minute Agent VC, never a key, and creation can be set to need a person's approval. No permission scopes beyond the spending limit were found, and no secret in a URL (24 of 30). Wallet payments need a mandate a person signs with a USDC budget and an expiry, and the Balance guide says to confirm every top-up with the user. The APIs guide tells agents not to ask before paying within a signed mandate, and no read-only key was found (14 of 20). The marketplace returns content from third-party APIs and installs third-party skills. Results carry a fluxa or bazaar source tag, but entries named ssrf1, keyprobe and tooltest1 are tagged fluxa, no review of uploads is described, and no guidance on treating responses or skills as untrusted was found (2 of 15). The balance endpoint returns available, spent, burn per day and owed, the ledger lists spend and purchases per merchant, and the wallet skill reads an X-LLM-Cost header on model calls (11 of 15). No disclosure policy, bug bounty, certification or advisory was found. security.txt couldn't be read and is scored absent, and the privacy policy says only 'industry-standard security measures' (0 of 20). Total 51.

Stripe API + MCP 97

OAuth for interactive MCP clients with per-account and per-environment permissions and revocable sessions, restricted and Agent-tagged API keys with chosen permissions, and API key access policies by location. The MCP page now sets a migration deadline of 30 November 2026, after which, from December, the MCP server rejects full-access secret keys and untagged restricted keys (30). Least privilege through restricted keys and Dashboard roles, and Stripe requires a person to approve sensitive stripe_api_write actions such as refunds and outbound payments, with approvals expiring after 24 hours (20). The MCP page tells users to turn on human confirmation of tools and to take care combining Stripe with other servers because of prompt injection; customer-entered fields still come back through stripe_api_read (12). MCP tool-call logs in Workbench and an exportable security history (15). HackerOne bug bounty, PCI Service Provider Level 1, annual SOC 1 and SOC 2 Type II reports, a public SOC 3, no published advisories on stripe/ai, and a valid security.txt, read on 17 October with an expiry of 31 December 2026, not re-read on 1 November (20). Machine payments land in the Stripe balance, so Stripe holds the funds until payout.

FluxA AgentMarket 53

No OpenAPI file was found. llms.txt names none and the documentation site, docs.fluxapay.xyz, couldn't be read because its robots.txt couldn't be. The discovery response has documented fields (apiServers, skills, models, pagination), a GET on each listing's urls.access returns its endpoints and prices as JSON per the skill-creation guide, and the LLM endpoints follow the OpenAI and Anthropic formats (8 of 25). llms.txt and Markdown guides (getting-started.md, currency.md, create-skill.md, the APIs and Balance guides) written for agents (10). The guides say when to use search against query, that the external catalogues are a last resort and which rail fits which job. Listing descriptions come from creators and 17 of the first 50 skills have none (12 of 20). type is an enum that answers 400 to unknown values, limit is bounded at 1,000, and the chat and messages bodies follow published formats. Listing endpoints are described by each creator (9 of 15). curl examples for discovery, models and payment, a status table in the Balance guide with the action for 401, 503, 404, 402 and 409, and seven named mandate errors in the APIs guide (11 of 15). Paths carry /llm/v1/ and llms.txt names minimum CLI versions, but no changelog was found (3 of 15). Total 53.

Stripe API + MCP 90

Public OpenAPI 3 spec in stripe/openapi (MIT), regenerated for API version 2026-10-28.endive on 29 October (25). The 431-path count is from 30 September and wasn't recounted. llms.txt and every page as Markdown, also readable through stripe docs in the CLI (10). The MCP page, re-read on 1 November, describes each of its fifteen tools and warns about prompt injection when mixing servers, though the generic read and write tools leave method choice to the agent (15). The API is fully typed with enums, but stripe_api_write takes any POST, PATCH, PUT or DELETE method, so the MCP contract is looser than the API's (10). Examples for every endpoint and documented error types (15). Dated API versions pinned per request with Stripe-Version, and a public Developer Changelog (15).

FluxA AgentMarket 66

Graded on the HTTP API. Discovery takes limit up to 1,000, type and tags filters and a Markdown format, with no field selection, and listing responses vary by creator (15 of 25). limit, offset and nextOffset on discovery, search and query modes, and the ledger takes kind, limit (maximum 100) and offset. llms.txt says filters ignore limit and offset (16 of 20). The Balance guide's status table gives an action for each status, the APIs guide names insufficient_balance, mandate_budget_exceeded, agent_not_registered and others, and a model served only on Messages answers 400 on chat (15 of 20). finalize replays are idempotent and a dead order answers 409 with the instruction to start a new one. No idempotency key on paid calls was found (10 of 20). The LLM endpoints accept any OpenAI or Anthropic client, discovery needs no parameters, and the only official client is the TypeScript wallet CLI (10 of 15). Total 66.

Stripe API + MCP 91

The MCP page lists fifteen tools on 1 November, as on 17 October (ten on 4 October), among them atlas_company_formation and Treasury tools to convert, send and transfer money. That's the 11 to 30 band (15), plus 7 because stripe_api_search and stripe_api_details fetch method details on demand instead of loading the whole API into context (22). List endpoints take limit, cursor pagination, filters, search and expand (20). Errors carry a type, code and message, and rate-limit responses say which limit was hit (20). Idempotency keys on the API and human confirmation for refunds and outbound payments through the MCP server. We couldn't check tool annotations on the hosted server, and the open-source @stripe/mcp package only proxies to mcp.stripe.com, so its source doesn't show them (17). Official SDKs in seven or more languages and the agent toolkit in TypeScript and Python, but the generic tools mean a search, details and write sequence for most actions (12).

FluxA AgentMarket 64

Read for a closed service. No changelog or dated release notes were found. The models page says the catalogue was 'last updated November 5, 2026', and @fluxa-pay/fluxa-wallet 0.6.0, the CLI that carries the market commands llms.txt relies on, was published on 6 November 2026 (30). The CLI had eight releases between 10 August and 6 November 2026, 0.4.12 to 0.6.0 (20). Support is a Discord server and support.fluxapay@fluxapay.xyz, neither tested, and GitHub issues couldn't be read because the GitHub API refused us (3 of 15). No AgentMarket SDK. The TypeScript CLI is the official client and the LLM endpoints take OpenAI and Anthropic SDKs. Not an MCP server, so the registry line reads as SDKs (7 of 15). The CLI repository has 7 test files and no CI workflow, and the npm package declares no repository. @fluxa-pay/fluxa-connect-mcp points to a repository that isn't public (4 of 10). Total 64.

Stripe API + MCP 82

API version 2026-10-28.endive released on 28 October 2026, additive in the GA channel, and the OpenAPI repo updated for it on 29 October (30). Dated API versions and spec updates every few days through the last 90 days (20). Public Developer Changelog, support, and 81 commits to stripe/ai in the 90 days to 1 November, most of them daily skill syncs; we didn't read the issue queue (14 of 15). com.stripe/mcp is in the official registry, but the entry is still version 0.2.4 from 28 October 2025 and points at the old stripe/agent-toolkit repo name, although server.json in stripe/ai names the new repo and version 0.3.3 (12 of 15). On npm, @stripe/mcp 0.3.3 from 24 March 2026 is still the newest on 1 November, and @stripe/agent-toolkit 0.9.0 and stripe-agent-toolkit 0.7.0 on PyPI are per the 17 October and 4 October checks. CI runs on every pull request with actions pinned to commit SHAs (6).