FluxA AgentMarket vs TermiX AACP

FluxA AgentMarket 64

Read for a closed service. No changelog or dated release notes were found. The models page says the catalogue was 'last updated November 5, 2026', and @fluxa-pay/fluxa-wallet 0.6.0, the CLI that carries the market commands llms.txt relies on, was published on 6 November 2026 (30). The CLI had eight releases between 10 August and 6 November 2026, 0.4.12 to 0.6.0 (20). Support is a Discord server and support.fluxapay@fluxapay.xyz, neither tested, and GitHub issues couldn't be read because the GitHub API refused us (3 of 15). No AgentMarket SDK. The TypeScript CLI is the official client and the LLM endpoints take OpenAI and Anthropic SDKs. Not an MCP server, so the registry line reads as SDKs (7 of 15). The CLI repository has 7 test files and no CI workflow, and the npm package declares no repository. @fluxa-pay/fluxa-connect-mcp points to a repository that isn't public (4 of 10). Total 64.

TermiX AACP 6

No dated release was found. The 10 October reading of version 1.8.0 (15 September) came from a release manifest in an S3 bucket that the update script reads, and that bucket answered robots.txt with 403 AccessDenied on 5 November, so the reading is struck. The docs sitemap stamps 23 pages at four times on 22 September and four at one time on 13 August, deploy stamps that name no change, and the public skills repository's last commit is 14 May 2026 at plugin version 1.0.0 with no tag (0). No changelog or release history, so the 90-day line is 0. A closed service with a Discord link and no public changelog. Responses were not tested (3 of 15). No official SDK, and the public skills repository is a partial stand-in (3 of 15). No CI is visible and the manifest checksum reading is struck (0 of 10). Total 6.

FluxA AgentMarket 32

The editorial half. The marketplace, proxy and gateway are closed. The terms (effective 14 January 2026) cover pricing, refunds and acceptable use but name no governing law, termination terms, liability for third-party listings or creator obligations, and the company appears only in the footer. The CLI is Apache-2.0 (8 of 30). The privacy policy (14 January 2026) lists account, payment and usage data and says identity isn't shared with model providers. It says nothing on prompts, API payloads, retention, training or data location (6 of 30). No deprecation policy or dated notice was found, and the terms may change 'at any time' (0 of 20). The policy names Stripe and 'OpenAI/Anthropic API' as a non-exhaustive list, while the models page lists AIHubMix, UnifyLLM and Baidu AI Cloud as providers. No locations are given (4 of 20). Total 18. The provenance half is computed from the provenance block.

TermiX AACP 6

No terms of service were found (termix.ai/terms and www.agent.family/terms answered 404 on 5 November), so terms are unclear. The public skills repository is MIT and the whitepaper CC BY-SA 4.0 (5 of 30). No privacy policy was found, and termix.ai/privacy returned 404 (0 of 30). No deprecation policy or dated notice. The skill docs say a 400 on a documented path usually means a stale skill against changed schemas (0 of 20). No subprocessors or data locations are disclosed. The skill install link redirects to an AWS bucket in ap-southeast-1, and auto-reply sends inbox messages to the user's own OpenRouter or OpenAI key (2 of 20). Total 7.

FluxA AgentMarket 75

Payment platforms take the highest step that applies on the 40-point protocol line (40 on all their own endpoints, 30 on part of their own API, 25 when their merchants can accept one, 20 for a facilitator, 15 for paying as a buyer, 0 for only a protocol of their own). AgentMarket's proxied API endpoints and Balance top-ups answer x402 (v1 body or v2 PAYMENT-REQUIRED header), the pricing page says USDC from another wallet works over x402 on Base, and the FluxA CLI signs the standard exact EIP-3009 scheme. Model calls are charged to the Balance with a key or Agent VC. Nothing was paid, so this rests on the vendor's pages (30 of 40). Per-call price ranges are public in the catalogue, per-endpoint prices on listing pages, model prices per 1M tokens, Balance bundles and Token Plan prices, all without a login (20). Discovery and price reads are free with no account and some listed endpoints are priced at $0, but no free credit or trial was found. The wallet's TokenGo guide calls a $1 first top-up a trial. Termix earned 20 for free reads, and here a judgement call gives half (10 of 20). An agent holding Base USDC can pay a listed API per call with no account, per the pricing page and the 402 flow. Model calls, the Balance and keys need an account a person creates by signing in ('an agent cannot create either account'), and the FluxA wallet path needs a person to approve registration and sign a mandate (15 of 20). Total 75.

TermiX AACP 55

Payment platforms and wallets take the highest step that applies on the 40-point protocol line. 40 for x402, MPP or L402 on all their own endpoints, 30 on part of their own API, 25 when their merchants can accept one, 20 for running a facilitator, 15 for paying as a buyer, 0 for only a protocol of their own. Settlement runs only through TermiX's own escrow contracts, so the own-protocol step (0 of 40). The Config reference shows protocolFeeBps and campaignProtocolFeeBps of 200 (2 per cent) in its example responses for all three chains, without a login. Evaluator and arbitrator rates sit in the escrow contract and are not published in the docs (15 of 20). Reads and sign-in are free with no card, and gas is paid on-chain (20). An agent with a wallet signs in and gets an account and an API key with no human signup (20). Total 55. The 10 October live readings of the config endpoint are struck, as requests to the product's own API.

FluxA AgentMarket 12

Graded as a hosted service, the discovery gateway on agentmarket.fluxapay.xyz and the proxy and LLM endpoints on router.fluxapay.xyz, from the vendor's pages. Nothing was called. No status page is linked from the site, the footer, llms.txt or the guides, and no status host was checked (0). With no readable incident history the record takes the default (5). Listing pages show a health count with no history, such as '10/10 endpoints healthy' on Minifetch. No rate limit with numbers was found in llms.txt, the guides or the CLI help. The only cap is a per-key spending limit (0). The Balance guide says to retry a 503 shortly without minting a new credential, replays of a settled top-up finalize call are idempotent, a failed order answers 409, and the card flow says 'a retry is a new order'. No 429 or Retry-After guidance was found. Termix earned 8 for the same kind of guidance with idempotency keys on writes (7 of 15). No SLA was found, and the terms supply the service 'as is' (0). The about page labels the product 'v.01 / Beta' (0). Total 12.

TermiX AACP 28

Graded as a hosted service, the AACP REST API at platform-backend.prod.termix.live and its Base and Robinhood Chain twins. No status page was found and status.termix.ai still did not resolve on 5 November (0). With no readable incident history the record takes the default (5). The only numbers are for inbox polling, a 5-second default and no faster than every 2 seconds, with no request limits per endpoint (5 of 15). Tx-intents are idempotent by nonceKey, checkout takes an idempotencyKey, the docs say to poll rather than rebroadcast on a timeout, and inbox messageId is named as an idempotency key. No 429 or Retry-After behaviour is documented, so the earlier partial is kept (8 of 15). No SLA was found (0). The API runs on mainnet with no beta label found (10). Total 28.

FluxA AgentMarket 51

fxa_live_ keys are created by a person at /keys and shown once, each with a spending limit in Units that changes within seconds, and are revoked immediately over DELETE /llm/keys/<id>, with written rotation steps. Key management needs a 5-minute Agent VC, never a key, and creation can be set to need a person's approval. No permission scopes beyond the spending limit were found, and no secret in a URL (24 of 30). Wallet payments need a mandate a person signs with a USDC budget and an expiry, and the Balance guide says to confirm every top-up with the user. The APIs guide tells agents not to ask before paying within a signed mandate, and no read-only key was found (14 of 20). The marketplace returns content from third-party APIs and installs third-party skills. Results carry a fluxa or bazaar source tag, but entries named ssrf1, keyprobe and tooltest1 are tagged fluxa, no review of uploads is described, and no guidance on treating responses or skills as untrusted was found (2 of 15). The balance endpoint returns available, spent, burn per day and owed, the ledger lists spend and purchases per merchant, and the wallet skill reads an X-LLM-Cost header on model calls (11 of 15). No disclosure policy, bug bounty, certification or advisory was found. security.txt couldn't be read and is scored absent, and the privacy policy says only 'industry-standard security measures' (0 of 20). Total 51.

TermiX AACP 60

EIP-191 wallet sign-in issues a 24-hour session and a 30-day refresh token, with logout revoking a session. A session can mint an API key scoped to acn:rpc and a2a:rpc, stored as a hash and shown once, and a per-agent runtime token lasts about 12 hours. No secret travels in a URL (25 of 30). An API key cannot sign transactions, a runtime token covers one agent, and fund movements need the wallet owner's signature on a tx-intent. The skill confirms value-bearing transactions with the user and refuses a chain mismatch. It also asks for the owner's raw private key in WALLET_KEY (16 of 20). The inbox returns buyer messages and filters some by keyword, and deliverables come from other agents. No prompt-injection guidance was found (5 of 15). Orders, stake and settlement are on-chain and readable in the explorer and per-account dashboards. No API access log was found (9 of 15). The termix.ai home page now links a Salus audit of the AACP contracts dated 20 July 2026, 17 findings (4 High, 7 Medium), with three of the Highs marked resolved and one acknowledged. No security.txt (404 on 5 November), disclosure policy, security contact, bug bounty or certification was found (5 of 20). Total 60.

FluxA AgentMarket 66

Graded on the HTTP API. Discovery takes limit up to 1,000, type and tags filters and a Markdown format, with no field selection, and listing responses vary by creator (15 of 25). limit, offset and nextOffset on discovery, search and query modes, and the ledger takes kind, limit (maximum 100) and offset. llms.txt says filters ignore limit and offset (16 of 20). The Balance guide's status table gives an action for each status, the APIs guide names insufficient_balance, mandate_budget_exceeded, agent_not_registered and others, and a model served only on Messages answers 400 on chat (15 of 20). finalize replays are idempotent and a dead order answers 409 with the instruction to start a new one. No idempotency key on paid calls was found (10 of 20). The LLM endpoints accept any OpenAI or Anthropic client, discovery needs no parameters, and the only official client is the TypeScript wallet CLI (10 of 15). Total 66.

TermiX AACP 71

Paged lists with pageSize up to 100, but no field selection, and listing descriptions run to several paragraphs (15 of 25). page, pageSize, query, tag, minReputation, sort and since across the list endpoints (18 of 20). Errors return { error: { code, message } }, and 403 business gates state the exact shortfall, with a table of what to do per status (17 of 20). Tx-intents are idempotent and the docs say never to rebroadcast on a timeout. The skill dry-runs value-bearing transactions and asks the user before signing (16 of 20). No official SDK in any language. The skill's dependency-free Node scripts wrap any REST call, and sign-in needs three calls (5 of 15). Total 71.