FluxA AI Wallet vs Kite Agent Passport

FluxA AI Wallet 20

Graded with the hosted lines, because signing, mandates and approvals all run on FluxA's wallet API and the CLI and MCP server only wrap it, as kite-agent-passport and kane-cli were read. No status page was found in the repository, the skills or AgentMarket's pages. fluxapay.xyz and the wallet and docs hosts could not be read, so a status page there is unchecked and scored absent (0). With no readable history the record takes the default (5). No rate limit with numbers was found (0). The connection service treats 429 slow_down as wait and poll and marks errors retryable, the skill says a 503 means retry shortly, payouts require a caller-chosen payout_id that returns the existing payout on a repeat, --biz-id rejects a duplicate with 409, and card create and recharge resume with --request-id instead of paying again. No Retry-After or backoff schedule is documented for the wallet API (10 of 15). No SLA was found (0). No beta label was found on the wallet in what was read, but both packages are at 0.x, agent cards sit behind a waitlist and the wallet site was unread (5 of 10). Total 20.

Kite Agent Passport 45

Graded as a hosted service, the Passport backend behind the kpass CLI, skills and dashboard. status.gokite.ai shows 60 days of uptime for the Kite website, explorer and four RPC endpoints, but no Passport component, which this run reads as 15 of 20 for a vendor page without the product's component. With no readable Passport history the record takes the default (5). No rate limit with numbers was found (0). The skills map exit code 5 to a rate limit with a 30-second wait before retrying, and kpass session execute and shopping checkouts take an idempotency key so a retry doesn't pay twice, the core write that moves money (15). No SLA was found (0). No beta label was found on Passport, and production and a sandbox test mode are both live (10). Total 45.

FluxA AI Wallet 52

The agent holds an Agent ID, a token whose validity the owner picks from 1 hour to 1 year at browser approval, and a short-lived RS256 JWT refreshed from the token; token_revoked exists. Credentials sit in a 0600 JSON file or environment variables. The token is not scoped, since limits live in mandates, and legacy init tokens are described as not expiring. Agent VCs are audience-bound and rejected by FluxA's own endpoints. No secret travels in a URL (22 of 30). Every x402 payment needs a mandate the owner signs, with a limit, a validity and an optional host allowlist enforced by the wallet API, payouts need per-payout approval unless a mandate covers them, cards need a mandate and KYC, and linked-card mandates are scoped to one merchant. A payout mandate sets no payee allowlist that was documented, and the skill tells agents to request budgets for at least 100 calls by default (16 of 20). The wallet returns little third-party content itself, but the skill sends agents to third-party x402 APIs, ClawPI posts and a remote announcement.md with no guidance on treating them as untrusted, its description steers agents to paid APIs even when a free web search looks enough, and the daily check-in runs npx -y @fluxa-pay/fluxa-wallet@latest unpinned twice a day (4 of 15). mandates lists limit, spent and remaining, with recent-transactions, received-records and payout status by CLI, and the MCP server writes a local audit log; the wallet app's logs were not read (10 of 15). No SECURITY.md, disclosure policy, bug bounty or certification was found, and agentmarket.fluxapay.xyz has no security.txt; fluxapay.xyz's is unchecked (0 of 20). Total 52.

Kite Agent Passport 75

A person logs in with an emailed code and approves with a device passkey. Agents act through time-boxed sessions bound to that approval, and the hosted MCP endpoint uses OAuth. Key rotation for agents was not documented in what we read (25 of 30). Sessions enforce a per-transaction cap, a total budget, a lifetime and scope rules such as session_endpoint_forbidden and payment_target_forbidden. Wallet sends, session approvals and passkey changes need an action-bound passkey step-up since 4 June 2026 (18 of 20). The x402-execute and request-session skills tell agents to treat merchant URLs and response values as untrusted and to quote them safely in shell commands. The kite-passport skill steers agents to paid services ahead of free tools (8 of 15). A step-up log, a login history, a per-session activity feed and transaction history (14 of 15). SECURITY.md in the skills repository gives security@kitepassport.com and says reports are acknowledged within 48 hours, a disclosure route with a stated time, which this run reads as 10. No security.txt, bug bounty or SOC 2 was found (10 of 20). Total 75.

FluxA AI Wallet 32

The CLI and MCP server source is Apache-2.0 per the LICENSE file and both package.json files, while the README's last section says MIT. The hosted wallet is closed, and no terms covering it were found. AgentMarket's terms describe only the marketplace (15 of 30). AgentMarket's privacy policy of 14 January 2026 names Stripe and model providers and gives no retention periods, and it does not mention wallet addresses, KYC profiles, card data or payouts, which the CLI collects or handles. The wallet's own privacy policy was unreachable (5 of 30). The README marks init and link-wallet as legacy but still supported, and the skill pins a minimum CLI version; no deprecation policy or dated notice was found (3 of 20). Stripe is the only provider named; no card issuer, KYC provider, custody provider or data location is named. The CLI and MCP code send no telemetry (3 of 20). Total 26.

Kite Agent Passport 55

A closed service under terms from Datalego Inc. dated 29 April 2026, with the skills under MIT and the CLI source private (17 of 30). The privacy policy of the same date names Banxa (Australia) and Crossmint (US) as processors, says private keys are not collected, and keeps data for as long as necessary with no periods. The changelog adds that login history stores derived city and country without the IP. No DPA was found (14 of 30). Release notes carry 'Important updates' with required upgrades and breaking changes, such as Base settlement replacing the treasury relay, but give them on the day of release and no deprecation policy was found (6 of 20). Banxa, Crossmint, Halliday and MaxMind are named across the policy and changelog, with locations for the first two, and no subprocessor list (10 of 20). Total 47.

FluxA AI Wallet 45

Payment platforms and wallets take the highest step that applies on the 40-point protocol line. 40 for x402, MPP or L402 on all their own endpoints, 30 on part of their own API, 25 when their merchants can accept one, 20 for running a facilitator, 15 for paying as a buyer, 0 for only a protocol of their own. The wallet pays x402 as a buyer and its payment links can be paid over x402 so another agent pays the holder, as sponge-wallet's payment links were read. FluxA's own wallet API is not paid over x402, so the merchant step (25 of 40). No fee schedule for the wallet, x402 signing, payouts or payment links was found, and card fees appear only through an authenticated command (0 of 20). Registering an Agent ID and creating payment links cost nothing and need no card per the README and the charge-agent guide, but the wallet sign-up at agentwallet.fluxapay.xyz could not be read, so whether opening a funded wallet needs a card is unchecked (10 of 20). POST https://agentid.fluxapay.xyz/register returns credentials with no human step, but the CLI marks it legacy, the default connection needs a browser approval, and every spend needs the owner's wallet and a mandate signed in a browser (10 of 20). Total 45.

Kite Agent Passport 35

Payment platforms and wallets take the highest step that applies on the 40-point protocol line. 40 for x402, MPP or L402 on all their own endpoints, 30 on part of their own API, 25 when their merchants can accept one, 20 for running a facilitator, 15 for paying as a buyer, 0 for only a protocol of their own. Passport pays third-party x402 and MPP services as a buyer. Its own backend is not paid over either, and Kite recommends the third-party Pieverse facilitator, so the buyer step (15 of 40). No fee rate is published. The changelog says Passport's service margin is shown only in a per-session estimate before approval (0 of 20). Account creation and sandbox test mode with a testnet faucet need no card (20). Signup needs a person to click an emailed link and create a passkey in a browser (0). Total 35.

FluxA AI Wallet 60

The MCP server has 15 tools with about 4,700 characters of descriptions, the 11 to 30 band (15). The CLI path loads SKILL.md (26.5 KB) and one of 18 guides per task, about 112 KB in all, with no read-only subset (no add-back, 15 of 25). card transactions takes page, limit, type and a time range, refunds take limit and offset, received-records and recent-transactions take a limit up to 100, and market search can be scoped to models or vendors; no cursor (12 of 20). Errors carry a code, retryable, reconnect_required and a next_command or next_tool, and card errors map to recovery hints, but the CLI exits only 0 or 1 and the MCP payment tools return the wallet API's raw error body without isError (14 of 20). A required payout_id idempotency key, --biz-id dedup and --request-id continuation on card operations, and the skill says not to initiate again to retry a payment. No readOnlyHint or destructiveHint on any MCP tool (12 of 20). Base USDC is the default network and asset, mandates default to 8 hours and the CLI installs in one command, but there is no SDK library and both packages are TypeScript (7 of 15). Total 60.

Kite Agent Passport 68

The CLI returns JSON with --output json, and the skills load one per task, but the 26 skill files total about 6,900 lines and the router skill's description is long (15 of 25). ksearch services list takes --query, --payment-approach, --asset and --limit, activity filters by date and merchant, and the login log takes since, until, limit and offset (14 of 20). Numbered exit codes, a machine-readable error_code and a hint, with merchant decline reasons returned since 1 July 2026 (18 of 20). An idempotency key on paid executes, and session approval and wallet sends wait for the person's passkey (14 of 20). One-line install on macOS, Linux and Windows, with sensible session defaults, but no official SDK in any language for Passport (7 of 15). Total 68.

FluxA AI Wallet 66

@fluxa-pay/fluxa-wallet 0.6.0 was published on 6 November 2026, one day before this check (30). Eight CLI releases since 10 August 2026, among them 0.5.2 on 14 October, 0.5.3 on 25 October and 0.5.6, 0.5.7 and 0.6.0 between 3 and 6 November (20). The repository merged 43 pull requests, all from the organisation's own branches, and commits run weekly. Issues and outside pull requests could not be read because the GitHub API refused the session. Discord and a support address are linked from AgentMarket and were not tested (8 of 25). Graded as an API, the line asks for current official SDKs. The CLI is current, but there is no SDK library and the MCP package on npm has not been published since 2 March 2026 (5 of 15). 68 node:test cases exist with no CI workflow, neither npm package declares its repository, and the MCP package's last release lags the source by eight months (3 of 10). Total 66.

Kite Agent Passport 71

The docs changelog dates Kite Passport CLI 6.8.2 with Skills 3.5.5 and Skills 3.5.7 on 13 October 2026, 22 days before this check, and Passport Skills was tagged v3.6.7 on 26 October (30). Releases on 9, 13 and 15 October in the changelog and dozens of skills tags since 6 August (20). The skills repository merged 233 commits since 6 August, the last on 29 October, and kpass feedback submit sends reports to Kite. The backend and CLI sources are private, so 9 of 15 for a closed service. The CLI is current, but no official SDK for Passport exists and the PyPI gokite SDK was last released on 18 July 2025, per 10 October. The hosted MCP endpoint was not found in the official registry (5 of 15). The skills repository runs CI and release workflows, and the installer verifies checksums per 10 October (7 of 10). Total 71.