{ "data": { "a": { "slug": "fluxa-ai-wallet", "name": "FluxA AI Wallet", "vendor": "FluxA Technology Pte. Ltd.", "vendorUrl": "https://fluxapay.xyz", "kind": "http-api", "category": "agent-wallets", "summary": "FluxA AI Wallet is a hosted agent wallet from FluxA Technology that signs x402 (EIP-3009) USDC payments on Base within budgets a person approves, reached through the fluxa-wallet CLI, a stdio MCP server and agent skills.", "url": "https://www.anchorterminal.com/tools/fluxa-ai-wallet", "markdownUrl": "https://www.anchorterminal.com/tools/fluxa-ai-wallet.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/fluxa-ai-wallet.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/fluxa-ai-wallet.json", "dns": "fluxa-ai-wallet.grade.anchorterminal.com", "repo": "https://github.com/FluxA-Agent-Payment/FluxA-AI-Wallet-MCP", "license": "The CLI and MCP server source is Apache-2.0 (LICENSE file and both package.json files), though the README's last section says MIT. The hosted wallet service is closed, and no terms covering the wallet were found", "transports": [ "http", "stdio" ], "remoteUrl": "https://walletapi.fluxapay.xyz", "packages": [ { "registry": "npm", "name": "@fluxa-pay/fluxa-wallet" }, { "registry": "npm", "name": "@fluxa-pay/fluxa-wallet-mcp" } ], "auth": "mixed", "authNotes": "An agent connects with `fluxa-wallet connect` (or the MCP tool `connect_wallet`), which returns an `authorization_url` on agentwallet.fluxapay.xyz for the owner to approve in a browser. The claim returns an Agent ID, a token and an RS256 JWT, stored in `~/.fluxa-ai-wallet-mcp/config.json` (mode 0600) or injected as `AGENT_ID`, `AGENT_TOKEN` and `AGENT_JWT`. The owner picks the token's validity (1h, 24h, 7d, 1mo, 180d or 1y; the server suggests 180 days locally and 7 days in cloud or container environments), and the JWT is refreshed with the token. `token_expired` and `token_revoked` return `reconnect_required`. The legacy `init` registers an Agent ID with an unauthenticated `POST https://agentid.fluxapay.xyz/register`. Spending needs a mandate the owner signs in the browser. AgentMarket commands can instead use `fxa_live_` keys with a spend limit, revocable from the CLI.", "pricing": "usage", "pricingNotes": "No fee schedule for the wallet, x402 signing, payouts, payment links or refunds was found in the repository, the skills or the AgentMarket pricing, terms and llms.txt pages (checked 2026-11-07). Merchants set x402 prices. Agent card products list their fees through `fluxa-wallet card types`, which needs a connected wallet, so those fees were not read. The wallet site and docs at agentwallet.fluxapay.xyz and docs.fluxapay.xyz could not be read, so whether opening a wallet needs a card is unchecked. AgentMarket's Balance is $1 = 1 Balance, with Units bundles from $1 to $25.", "priceSummary": "Pay per use", "where": "both", "x402": { "level": "partial", "evidence": "The wallet signs x402 `exact` (EIP-3009) payment authorisations for USDC on Base and Base Sepolia as a buyer (`fluxa-wallet x402 --mandate \u003cid\u003e --payload \u003c402 body\u003e`, MCP `request_x402_payment` and `request_x402_v3_payment`), and its payment links can be paid over x402 so another agent can pay the holder (https://github.com/FluxA-Agent-Payment/FluxA-AI-Wallet-MCP/blob/main/skills/fluxa-agent-wallet/INTEGRATION-GUIDE-CHARGE-AGENT.md, checked 2026-11-07). FluxA's own wallet API is not paid over x402, MPP or L402.", "endpoints": [] }, "toolCount": 15, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-07" }, "docsUrl": "https://docs.fluxapay.xyz/", "capabilities": [ "payments.x402", "wallet.spend-limits", "wallet.onchain", "payments.card", "auth.agent-identity" ], "tags": [ "hosted", "official", "open-source", "apache-2.0", "cli", "mcp", "stdio", "skills", "typescript", "wallet", "x402", "stablecoins", "virtual-cards", "usdc", "base" ], "lastRelease": "2026-11-06", "graded": true, "anchor": { "graded": true, "score": 47, "grade": "D", "agentReady": false, "rank": 1164, "ranked": true, "rankOf": 1513, "categoryRank": 11, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 60, "maintenance": 66, "payments": 45, "reliability": 20, "schema": 61, "security": 52, "transparency": 32 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "low", "date": "2026-11-07" }, "negative": 0, "verdict": "Every spend runs against a mandate the owner signs in a browser, with a budget, a validity window and an optional host allowlist, and payouts need approval or a mandate. The published MCP package is 0.2.0 from March 2026 against 0.6.0 in the repository, and no status page, fee schedule, wallet terms or custody statement was found.", "bestFor": "An agent in a CLI-capable client that needs to pay x402 APIs, send USDC on Base or receive payments through links, inside budgets a person signs.", "strengths": [ "Spending runs against owner-signed mandates with a limit, a validity window and an optional host allowlist, enforced by the wallet API", "Payouts need per-payout browser approval unless a signed mandate is passed, and a required `payout_id` makes repeats return the same payout", "The CLI returns JSON with error codes, `next_command` hints and `retryable` and `reconnect_required` flags", "Client source is public under Apache-2.0, with 25 CLI releases on npm since March 2026, the latest on 6 November 2026", "Payment links let another agent pay the holder over x402, and refunds of link payments are supported" ], "weaknesses": [ "The published MCP package is 0.2.0 from 2 March 2026 with 13 tools, while the repository says 0.6.0 with 15", "No status page, rate limit, SLA, fee schedule or security contact was found", "Who holds the wallet keys is not stated. The docs say FluxA Wallet signs and call it managed", "The only terms and privacy policy read are AgentMarket's, which do not mention the wallet, cards, KYC or payouts", "The skill steers agents to paid APIs over free search and to request budgets for at least 100 calls by default" ], "agentNotes": [ "Run `fluxa-wallet status` first. If `configured` and `wallet_linked` are true, skip `connect`; otherwise show the `authorization_url` and wait with `connect-status --wait 100`", "On `token_expired` or `token_revoked`, reconnect with the same `--agent-id`. Never run `init` to recover, which creates a new identity", "Pass a unique `--id` on every `payout` and reuse it on retry; a repeat returns the existing payout instead of paying twice", "Check `fluxa-wallet mandates` for a signed mandate with enough remaining budget before creating one, and size new budgets to the task", "Install the CLI from npm, not the MCP package, whose npm release 0.2.0 lacks `connect_wallet` and `get_wallet_connection`" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "low", "grade": "D", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 47 } ], "editorialScores": { "ergonomics": 60, "maintenance": 66, "payments": 45, "reliability": 20, "schema": 61, "security": 52, "transparency": 26 }, "provenanceScore": 38, "checked": { "categories": { "ergonomics": "2026-11-07", "maintenance": "2026-11-07", "payments": "2026-11-07", "reliability": "2026-11-07", "schema": "2026-11-07", "security": "2026-11-07", "transparency": "2026-11-07" }, "last": "2026-11-07", "oldest": "2026-11-07", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install -g @fluxa-pay/fluxa-wallet" }, "letme": { "capability": "https://letme.dev/payments.x402", "tool": "https://letme.dev/fluxa-ai-wallet" }, "sameCompany": [ "fluxa-agentmarket" ], "area": "payments", "provenance": { "legalEntity": "FluxA Technology Pte. Ltd.", "domain": "fluxapay.xyz", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "", "privacy": "", "statusPage": "", "changelog": "", "securityTxt": "unknown", "checked": "2026-11-07", "notes": [ "The legal entity is from the footer of agentmarket.fluxapay.xyz, \"© 2025 FluxA Technology Pte. Ltd. All rights reserved.\", the same on the about, terms, privacy and pricing pages. No registration number, address or country is given on those pages. A web search result names a companieshouse.sg page for FluxA Technology Pte Ltd with UEN 202555700C; that host could not be fetched, so the register entry is unread.", "AgentMarket's terms (effective 14 January 2026) and privacy policy (updated 14 January 2026) describe the marketplace and its Balance and do not mention the Agent Wallet, cards, KYC or payouts, so they are not recorded as the wallet's terms. The terms name no entity in their text and no governing law; contact support.fluxapay@fluxapay.xyz.", "fluxapay.xyz, agentwallet.fluxapay.xyz and docs.fluxapay.xyz could not be read. Each robots.txt fetch was refused for want of an approval on 7 November 2026, so nothing on those hosts was fetched. The wallet's own terms, privacy policy, fees, security.txt and docs are unchecked.", "https://agentmarket.fluxapay.xyz/.well-known/security.txt answered a client error. The repository has no SECURITY.md.", "The wallet API, Agent ID API and approval pages are on fluxapay.xyz subdomains named in the CLI source. agentmarket.fluxapay.xyz's robots.txt allows / and disallows /api/ (except /api/discover and /api/llm/skills.md) and /console/; nothing disallowed was fetched.", "unchecked: RDAP for fluxapay.xyz, the MCP registry, the Wayback Machine, GitHub stars and issues (the GitHub API refused the session) and npm download counts." ], "score": 38 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/fluxa-ai-wallet.json", "live": { "slug": "fluxa-ai-wallet", "probe": { "target": "https://walletapi.fluxapay.xyz", "method": "get", "lastAt": "2026-11-08T14:47:50.695700215Z", "lastOk": true, "lastStatus": 404, "lastMs": 532, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 542, "p95ms24h": 603, "samples24h": 90, "samples30d": 90, "days": [ { "date": "2026-11-08", "probes": 90, "ok": 90 } ], "since": "2026-11-08T00:00:00Z" }, "updatedAt": "2026-11-08T14:47:50.695700215Z" }, "streak": { "days": 0, "from": "2026-11-08", "sinceWatching": true, "best": 0 } }, "answer": "Kite Agent Passport scores 53 (D) on agent readiness against FluxA AI Wallet's 47 (D), and leads in 6 of 7 scored categories. FluxA AI Wallet leads on payments \u0026 pricing.", "b": { "slug": "kite-agent-passport", "name": "Kite Agent Passport", "vendor": "Kite AI", "vendorUrl": "https://gokite.ai", "kind": "platform", "category": "agent-wallets", "summary": "Kite Agent Passport gives an AI agent a funded USDC wallet and an identity, with spending sessions a person approves by passkey. Agents use it through the kpass CLI and a skills bundle to pay x402 and MPP services.", "url": "https://www.anchorterminal.com/tools/kite-agent-passport", "markdownUrl": "https://www.anchorterminal.com/tools/kite-agent-passport.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/kite-agent-passport.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/kite-agent-passport.json", "dns": "kite-agent-passport.grade.anchorterminal.com", "repo": "https://github.com/gokite-ai/passport-skills", "license": "Closed service under terms from Datalego Inc. dated 29 April 2026. The Passport Skills repository is MIT. The kpass CLI is distributed as binaries and its source repository is private.", "transports": [ "http" ], "packages": [], "auth": "mixed", "authNotes": "A person signs up by email (a verification link plus an 8-character code) and creates a passkey on the Passport dashboard. The agent then registers itself with `kpass agent:register` and requests spending sessions, each approved by the person with the passkey. Wallet sends, session approvals and passkey changes need a fresh passkey step-up. Returning logins use an emailed code. A hosted MCP endpoint with OAuth exists for ChatGPT and other MCP clients (changelog, 23 June 2026); its URL was not found in the reviewed docs.", "pricing": "usage", "pricingNotes": "No published fee schedule was found (checked 10 October 2026). The changelog says session preflight returns an estimate covering merchant fees, network gas and Passport's own service margin, shown before approval, without stating the margin. Merchants set their own prices. Account creation and sandbox test mode with a testnet faucet need no card. Fiat funding goes through Banxa with an ID check.", "priceSummary": "Pay per use", "where": "local", "x402": { "level": "partial", "evidence": "Passport pays third-party x402 services as a buyer (`kpass agent:session execute`, `--payment-approach x402_http`) and also pays MPP services, per the Service Provider Guide (https://docs.gokite.ai/kite-agent-passport/service-provider-guide). Passport's own backend is not paid over x402, MPP or L402, and Kite recommends the third-party Pieverse facilitator for Kite chain.", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-10" }, "docsUrl": "https://docs.gokite.ai/kite-agent-passport", "llmsTxt": "https://docs.gokite.ai/llms.txt", "capabilities": [ "wallet.onchain", "wallet.spend-limits", "payments.x402", "payments.card", "auth.agent-identity" ], "tags": [ "hosted", "cli", "skills", "llms-txt", "wallet", "x402", "mpp", "stablecoins", "virtual-cards", "closed-source" ], "lastRelease": "2026-10-30", "graded": true, "anchor": { "graded": true, "score": 53, "grade": "D", "agentReady": false, "rank": 969, "ranked": true, "rankOf": 1513, "categoryRank": 8, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 68, "maintenance": 71, "payments": 35, "reliability": 45, "schema": 64, "security": 75, "transparency": 55 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-04" }, "negative": -6, "negativeNotes": [ "22 July 2026: Kite fixed a settlement-timing gap in agent-session payments, marked [security], that could allow repricing between detection and settlement. The fix shipped in the hosted service and is described only in the release note, with no advisory, so -3 as a released fix of the product's own described flaw (https://docs.gokite.ai/changelog/2026/2026-07-22-release).", "8 July 2026: settlement moved to Base, replacing the treasury relay path, and mainnet agent wallets' USDC was bridged to Base. The release note asked integrations that assumed Kite settlement to update, with no earlier notice found, so -3 (https://docs.gokite.ai/changelog/2026/2026-07-08-release)." ], "verdict": "Spending sessions with per-transaction and total caps, a lifetime and passkey approval are enforced by the service, with step-up checks and an audit log. A person must sign up by email and create a passkey before an agent can pay. No published fee rate, OpenAPI file or Passport status page was found.", "bestFor": "Coding agents such as Claude Code or Codex that need to pay x402 or MPP services within budgets a person approves by passkey.", "strengths": [ "Each spending session has a per-transaction cap, a USD budget, a lifetime and a scope, approved by the person with a passkey", "Wallet sends, session approvals and passkey changes need an action-bound passkey step-up, and a step-up log and login history are readable", "Pays third-party x402 and MPP services as a buyer, with cross-chain routing across Base, Tempo and Solana since 8 July 2026", "The kpass CLI returns JSON with numbered exit codes, an `error_code` and a `hint`, and documents an idempotency key on paid executes", "Active releases: CLI 6.8.2 on 13 October 2026, Passport Skills v3.6.7 on 26 October and dated changelog entries through 30 October" ], "weaknesses": [ "A person signs up by email, clicks a verification link and creates a passkey in a browser before any agent can spend", "No fee rate is published. Passport's service margin appears only in a per-session estimate before approval", "The API reference is a placeholder and no OpenAPI file is published, so agents work through the CLI or the hosted MCP endpoint", "No status page covers the Passport backend, and no rate limit with numbers or SLA was found", "The kite-passport skill tells agents to use paid services before WebSearch or built-in tools, which can spend budget on tasks free tools could do" ], "agentNotes": [ "Run `kpass` with `--output json --no-interactive` and branch on the exit code and `error_code`. Exit 6 is a session policy breach, so request a new session rather than logging in again", "Pass `--idempotency-key` on every `kpass session execute` so a retry after a timeout does not pay twice", "Ask the person for a session with a small per-transaction cap and a short `--ttl`, and confirm the merchant URL before executing", "Use `kpass sandbox` test mode and the faucet to try a payment flow without real funds. Scoped cards are not available in sandbox", "Check the kite-passport skill's trigger rules before installing it, since it directs the agent to paid services ahead of free tools" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 53 } ], "editorialScores": { "ergonomics": 68, "maintenance": 71, "payments": 35, "reliability": 45, "schema": 64, "security": 75, "transparency": 47 }, "provenanceScore": 63, "checked": { "categories": { "ergonomics": "2026-11-04", "maintenance": "2026-11-04", "payments": "2026-11-04", "reliability": "2026-11-04", "schema": "2026-11-04", "security": "2026-11-04", "transparency": "2026-11-04" }, "last": "2026-11-04", "lastMoved": "2026-11-04", "oldest": "2026-11-04", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "curl -fsSL https://agentpassport.ai/install.sh | bash" }, "letme": { "capability": "https://letme.dev/wallet.onchain", "tool": "https://letme.dev/kite-agent-passport" }, "area": "payments", "provenance": { "legalEntity": "Datalego Inc.", "domain": "agentpassport.ai", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "https://agentpassport.ai/terms/", "privacy": "https://agentpassport.ai/privacy/", "statusPage": "", "changelog": "https://docs.gokite.ai/changelog/2026/2026-10-30-release", "securityTxt": "none", "checked": "2026-11-04", "notes": [ "The terms (last updated 29 April 2026) and privacy policy name Datalego Inc. as the operator of agentpassport.ai, and the same terms cover gokite.ai and its subdomains. Neither bars automated access.", "status.gokite.ai covers the Kite website, explorer and RPC endpoints, not the Passport backend, so statusPage is empty.", "SECURITY.md in the skills repository names security@kitepassport.com with a 48-hour acknowledgement. security.txt per the 10 October check.", "The backend runs at passport.prod.gokite.ai, a Kite domain, per the skills repository." ], "score": 63 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/kite-agent-passport.json", "live": { "slug": "kite-agent-passport", "versions": [ { "registry": "github", "name": "gokite-ai/passport-skills", "version": "v3.5.7", "released": "2026-10-13", "seenAt": "2026-11-08T01:08:34.997334295Z" } ], "githubStars": 2, "securityTxt": { "url": "https://agentpassport.ai/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:36.182303961Z" }, "llmsTxt": { "url": "https://docs.gokite.ai/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:32:49.535224537Z" }, "domain": { "domain": "agentpassport.ai", "registered": "2025-04-17", "source": "https://rdap.identitydigital.services/rdap/domain/agentpassport.ai", "checkedAt": "2026-11-08T14:35:02.289037513Z" }, "pages": [ { "url": "https://docs.gokite.ai/changelog/2026/2026-07-29-release", "kind": "changelog", "status": 304, "checkedAt": "2026-11-04T08:21:08.870834731Z", "changedAt": "2026-11-02T07:14:25.476971889Z", "fingerprint": "bffc7d9fa6f6" }, { "url": "https://docs.gokite.ai/changelog/2026/2026-10-30-release", "kind": "changelog", "status": 304, "checkedAt": "2026-11-07T14:06:27.994296841Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "ba582320127f" }, { "url": "https://agentpassport.ai/privacy/", "kind": "privacy", "status": 304, "checkedAt": "2026-11-08T14:50:04.485290138Z", "changedAt": "2026-11-02T07:08:03.326285709Z", "fingerprint": "7dd59b21e47c" }, { "url": "https://agentpassport.ai/terms/", "kind": "terms", "status": 304, "checkedAt": "2026-11-08T14:50:06.567629167Z", "changedAt": "2026-11-02T07:08:05.58927437Z", "fingerprint": "c3616d06a577" } ], "github": { "repo": "gokite-ai/passport-skills", "checkedAt": "2026-11-02T08:51:16.486768749Z", "stars": 1, "archived": false, "issuesEnabled": true, "pushedAt": "2026-10-29T09:41:04Z", "openIssues": 3, "openPRs": 7, "issuesOpened90d": 2, "issuesClosed90d": 0, "prsMerged90d": 86, "ci": { "branch": "main", "runs": 50, "success": 48, "failure": 2, "other": 0, "latest": "success", "latestAt": "2026-10-29T09:41:20Z" }, "replies": { "sampled": 3, "unanswered": 3 } }, "updatedAt": "2026-11-08T14:50:06.567629167Z" } }, "edges": [ { "by": 25, "category": "reliability", "leads": "kite-agent-passport", "name": "Reliability", "reasons": { "a": "Graded with the hosted lines, because signing, mandates and approvals all run on FluxA's wallet API and the CLI and MCP server only wrap it, as kite-agent-passport and kane-cli were read. No status page was found in the repository, the skills or AgentMarket's pages. fluxapay.xyz and the wallet and docs hosts could not be read, so a status page there is unchecked and scored absent (0). With no readable history the record takes the default (5). No rate limit with numbers was found (0). The connection service treats 429 `slow_down` as wait and poll and marks errors `retryable`, the skill says a 503 means retry shortly, payouts require a caller-chosen `payout_id` that returns the existing payout on a repeat, `--biz-id` rejects a duplicate with 409, and card create and recharge resume with `--request-id` instead of paying again. No Retry-After or backoff schedule is documented for the wallet API (10 of 15). No SLA was found (0). No beta label was found on the wallet in what was read, but both packages are at 0.x, agent cards sit behind a waitlist and the wallet site was unread (5 of 10). Total 20.", "b": "Graded as a hosted service, the Passport backend behind the kpass CLI, skills and dashboard. status.gokite.ai shows 60 days of uptime for the Kite website, explorer and four RPC endpoints, but no Passport component, which this run reads as 15 of 20 for a vendor page without the product's component. With no readable Passport history the record takes the default (5). No rate limit with numbers was found (0). The skills map exit code 5 to a rate limit with a 30-second wait before retrying, and `kpass session execute` and shopping checkouts take an idempotency key so a retry doesn't pay twice, the core write that moves money (15). No SLA was found (0). No beta label was found on Passport, and production and a sandbox test mode are both live (10). Total 45." }, "scores": { "a": 20, "b": 45 } }, { "by": 23, "category": "security", "leads": "kite-agent-passport", "name": "Security \u0026 auth", "reasons": { "a": "The agent holds an Agent ID, a token whose validity the owner picks from 1 hour to 1 year at browser approval, and a short-lived RS256 JWT refreshed from the token; `token_revoked` exists. Credentials sit in a 0600 JSON file or environment variables. The token is not scoped, since limits live in mandates, and legacy `init` tokens are described as not expiring. Agent VCs are audience-bound and rejected by FluxA's own endpoints. No secret travels in a URL (22 of 30). Every x402 payment needs a mandate the owner signs, with a limit, a validity and an optional host allowlist enforced by the wallet API, payouts need per-payout approval unless a mandate covers them, cards need a mandate and KYC, and linked-card mandates are scoped to one merchant. A payout mandate sets no payee allowlist that was documented, and the skill tells agents to request budgets for at least 100 calls by default (16 of 20). The wallet returns little third-party content itself, but the skill sends agents to third-party x402 APIs, ClawPI posts and a remote announcement.md with no guidance on treating them as untrusted, its description steers agents to paid APIs even when a free web search looks enough, and the daily check-in runs `npx -y @fluxa-pay/fluxa-wallet@latest` unpinned twice a day (4 of 15). `mandates` lists limit, spent and remaining, with `recent-transactions`, `received-records` and payout status by CLI, and the MCP server writes a local audit log; the wallet app's logs were not read (10 of 15). No SECURITY.md, disclosure policy, bug bounty or certification was found, and agentmarket.fluxapay.xyz has no security.txt; fluxapay.xyz's is unchecked (0 of 20). Total 52.", "b": "A person logs in with an emailed code and approves with a device passkey. Agents act through time-boxed sessions bound to that approval, and the hosted MCP endpoint uses OAuth. Key rotation for agents was not documented in what we read (25 of 30). Sessions enforce a per-transaction cap, a total budget, a lifetime and scope rules such as `session_endpoint_forbidden` and `payment_target_forbidden`. Wallet sends, session approvals and passkey changes need an action-bound passkey step-up since 4 June 2026 (18 of 20). The x402-execute and request-session skills tell agents to treat merchant URLs and response values as untrusted and to quote them safely in shell commands. The kite-passport skill steers agents to paid services ahead of free tools (8 of 15). A step-up log, a login history, a per-session activity feed and transaction history (14 of 15). SECURITY.md in the skills repository gives security@kitepassport.com and says reports are acknowledged within 48 hours, a disclosure route with a stated time, which this run reads as 10. No security.txt, bug bounty or SOC 2 was found (10 of 20). Total 75." }, "scores": { "a": 52, "b": 75 } }, { "by": 23, "category": "transparency", "leads": "kite-agent-passport", "name": "Transparency \u0026 trust", "reasons": { "a": "The CLI and MCP server source is Apache-2.0 per the LICENSE file and both package.json files, while the README's last section says MIT. The hosted wallet is closed, and no terms covering it were found. AgentMarket's terms describe only the marketplace (15 of 30). AgentMarket's privacy policy of 14 January 2026 names Stripe and model providers and gives no retention periods, and it does not mention wallet addresses, KYC profiles, card data or payouts, which the CLI collects or handles. The wallet's own privacy policy was unreachable (5 of 30). The README marks `init` and `link-wallet` as legacy but still supported, and the skill pins a minimum CLI version; no deprecation policy or dated notice was found (3 of 20). Stripe is the only provider named; no card issuer, KYC provider, custody provider or data location is named. The CLI and MCP code send no telemetry (3 of 20). Total 26.", "b": "A closed service under terms from Datalego Inc. dated 29 April 2026, with the skills under MIT and the CLI source private (17 of 30). The privacy policy of the same date names Banxa (Australia) and Crossmint (US) as processors, says private keys are not collected, and keeps data for as long as necessary with no periods. The changelog adds that login history stores derived city and country without the IP. No DPA was found (14 of 30). Release notes carry 'Important updates' with required upgrades and breaking changes, such as Base settlement replacing the treasury relay, but give them on the day of release and no deprecation policy was found (6 of 20). Banxa, Crossmint, Halliday and MaxMind are named across the policy and changelog, with locations for the first two, and no subprocessor list (10 of 20). Total 47." }, "scores": { "a": 32, "b": 55 } }, { "by": 10, "category": "payments", "leads": "fluxa-ai-wallet", "name": "Payments \u0026 pricing", "reasons": { "a": "Payment platforms and wallets take the highest step that applies on the 40-point protocol line. 40 for x402, MPP or L402 on all their own endpoints, 30 on part of their own API, 25 when their merchants can accept one, 20 for running a facilitator, 15 for paying as a buyer, 0 for only a protocol of their own. The wallet pays x402 as a buyer and its payment links can be paid over x402 so another agent pays the holder, as sponge-wallet's payment links were read. FluxA's own wallet API is not paid over x402, so the merchant step (25 of 40). No fee schedule for the wallet, x402 signing, payouts or payment links was found, and card fees appear only through an authenticated command (0 of 20). Registering an Agent ID and creating payment links cost nothing and need no card per the README and the charge-agent guide, but the wallet sign-up at agentwallet.fluxapay.xyz could not be read, so whether opening a funded wallet needs a card is unchecked (10 of 20). `POST https://agentid.fluxapay.xyz/register` returns credentials with no human step, but the CLI marks it legacy, the default connection needs a browser approval, and every spend needs the owner's wallet and a mandate signed in a browser (10 of 20). Total 45.", "b": "Payment platforms and wallets take the highest step that applies on the 40-point protocol line. 40 for x402, MPP or L402 on all their own endpoints, 30 on part of their own API, 25 when their merchants can accept one, 20 for running a facilitator, 15 for paying as a buyer, 0 for only a protocol of their own. Passport pays third-party x402 and MPP services as a buyer. Its own backend is not paid over either, and Kite recommends the third-party Pieverse facilitator, so the buyer step (15 of 40). No fee rate is published. The changelog says Passport's service margin is shown only in a per-session estimate before approval (0 of 20). Account creation and sandbox test mode with a testnet faucet need no card (20). Signup needs a person to click an emailed link and create a passkey in a browser (0). Total 35." }, "scores": { "a": 45, "b": 35 } }, { "by": 8, "category": "ergonomics", "leads": "kite-agent-passport", "name": "Agent ergonomics", "reasons": { "a": "The MCP server has 15 tools with about 4,700 characters of descriptions, the 11 to 30 band (15). The CLI path loads SKILL.md (26.5 KB) and one of 18 guides per task, about 112 KB in all, with no read-only subset (no add-back, 15 of 25). `card transactions` takes page, limit, type and a time range, refunds take limit and offset, `received-records` and `recent-transactions` take a limit up to 100, and `market search` can be scoped to models or vendors; no cursor (12 of 20). Errors carry a `code`, `retryable`, `reconnect_required` and a `next_command` or `next_tool`, and card errors map to recovery hints, but the CLI exits only 0 or 1 and the MCP payment tools return the wallet API's raw error body without `isError` (14 of 20). A required `payout_id` idempotency key, `--biz-id` dedup and `--request-id` continuation on card operations, and the skill says not to initiate again to retry a payment. No `readOnlyHint` or `destructiveHint` on any MCP tool (12 of 20). Base USDC is the default network and asset, mandates default to 8 hours and the CLI installs in one command, but there is no SDK library and both packages are TypeScript (7 of 15). Total 60.", "b": "The CLI returns JSON with `--output json`, and the skills load one per task, but the 26 skill files total about 6,900 lines and the router skill's description is long (15 of 25). `ksearch services list` takes `--query`, `--payment-approach`, `--asset` and `--limit`, activity filters by date and merchant, and the login log takes `since`, `until`, `limit` and `offset` (14 of 20). Numbered exit codes, a machine-readable `error_code` and a `hint`, with merchant decline reasons returned since 1 July 2026 (18 of 20). An idempotency key on paid executes, and session approval and wallet sends wait for the person's passkey (14 of 20). One-line install on macOS, Linux and Windows, with sensible session defaults, but no official SDK in any language for Passport (7 of 15). Total 68." }, "scores": { "a": 60, "b": 68 } }, { "by": 5, "category": "maintenance", "leads": "kite-agent-passport", "name": "Maintenance \u0026 community", "reasons": { "a": "`@fluxa-pay/fluxa-wallet` 0.6.0 was published on 6 November 2026, one day before this check (30). Eight CLI releases since 10 August 2026, among them 0.5.2 on 14 October, 0.5.3 on 25 October and 0.5.6, 0.5.7 and 0.6.0 between 3 and 6 November (20). The repository merged 43 pull requests, all from the organisation's own branches, and commits run weekly. Issues and outside pull requests could not be read because the GitHub API refused the session. Discord and a support address are linked from AgentMarket and were not tested (8 of 25). Graded as an API, the line asks for current official SDKs. The CLI is current, but there is no SDK library and the MCP package on npm has not been published since 2 March 2026 (5 of 15). 68 node:test cases exist with no CI workflow, neither npm package declares its repository, and the MCP package's last release lags the source by eight months (3 of 10). Total 66.", "b": "The docs changelog dates Kite Passport CLI 6.8.2 with Skills 3.5.5 and Skills 3.5.7 on 13 October 2026, 22 days before this check, and Passport Skills was tagged v3.6.7 on 26 October (30). Releases on 9, 13 and 15 October in the changelog and dozens of skills tags since 6 August (20). The skills repository merged 233 commits since 6 August, the last on 29 October, and `kpass feedback submit` sends reports to Kite. The backend and CLI sources are private, so 9 of 15 for a closed service. The CLI is current, but no official SDK for Passport exists and the PyPI gokite SDK was last released on 18 July 2025, per 10 October. The hosted MCP endpoint was not found in the official registry (5 of 15). The skills repository runs CI and release workflows, and the installer verifies checksums per 10 October (7 of 10). Total 71." }, "scores": { "a": 66, "b": 71 } } ], "facts": [ { "a": "HTTP API", "b": "Platform", "name": "Kind" }, { "a": "FluxA Technology Pte. Ltd.", "b": "Kite AI", "name": "Vendor" }, { "a": "https://walletapi.fluxapay.xyz", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "HTTP, stdio", "b": "HTTP", "name": "Transports" }, { "a": "OAuth or key", "b": "OAuth or key", "name": "Auth" }, { "a": "Pay per use", "b": "Pay per use", "name": "Pricing" }, { "a": "payer tooling only", "b": "payer tooling only", "name": "x402" }, { "a": "The CLI and MCP server source is Apache-2.0 (LICENSE file and both package.json files), though the README's last section says MIT. The hosted wallet service is closed, and no terms covering the wallet were found", "b": "Closed service under terms from Datalego Inc. dated 29 April 2026. The Passport Skills repository is MIT. The kpass CLI is distributed as binaries and its source repository is private.", "name": "Licence" }, { "a": "15", "b": "none", "name": "Tools exposed" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "no", "b": "yes", "name": "llms.txt" }, { "a": "2026-11-06", "b": "2026-10-30", "name": "Last release" }, { "a": "no document linked", "b": "2026-04-29", "name": "Terms last updated" }, { "a": "no document linked", "b": "2026-04-29", "name": "Privacy policy last updated" }, { "a": "not read yet", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "not read yet", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "not read yet", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "not read yet", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "not read yet", "b": "not found in the text", "name": "Arbitration or class-action waiver" } ], "faq": [ { "answer": "Kite Agent Passport scores 53 (D) on agent readiness against FluxA AI Wallet's 47 (D), and leads in 6 of 7 scored categories. FluxA AI Wallet leads on payments \u0026 pricing.", "question": "Which is better for AI agents, FluxA AI Wallet or Kite Agent Passport?" }, { "answer": "FluxA AI Wallet has a hosted endpoint at https://walletapi.fluxapay.xyz. No hosted endpoint is listed for Kite Agent Passport.", "question": "Can an agent call FluxA AI Wallet and Kite Agent Passport without installing anything?" }, { "answer": "FluxA AI Wallet is open source (The CLI and MCP server source is Apache-2.0 (LICENSE file and both package.json files), though the README's last section says MIT. The hosted wallet service is closed, and no terms covering the wallet were found). No open-source release is listed for Kite Agent Passport.", "question": "Are FluxA AI Wallet and Kite Agent Passport open source?" } ], "goodFor": [ { "aheadOn": [ "Payments \u0026 pricing, 45 against 35" ], "also": [ "A hosted endpoint, with nothing to install", "Runs on your own machine", "Open source", "No incidents deducted, where Kite Agent Passport loses 6 points for them" ], "goodFor": "An agent in a CLI-capable client that needs to pay x402 APIs, send USDC on Base or receive payments through links, inside budgets a person signs.", "slug": "fluxa-ai-wallet", "watchFor": "The published MCP package is 0.2.0 from 2 March 2026 with 13 tools, while the repository says 0.6.0 with 15" }, { "aheadOn": [ "Reliability, 45 against 20", "Agent ergonomics, 68 against 60", "Security \u0026 auth, 75 against 52", "Maintenance \u0026 community, 71 against 66", "Transparency \u0026 trust, 55 against 32" ], "also": null, "goodFor": "Coding agents such as Claude Code or Codex that need to pay x402 or MPP services within budgets a person approves by passkey.", "slug": "kite-agent-passport", "watchFor": "A person signs up by email, clicks a verification link and creates a passkey in a browser before any agent can spend" } ], "history": { "fluxa-ai-wallet": null, "kite-agent-passport": [ { "causes": [ "correction" ], "date": "2026-11-04", "delta": 1.5, "from": 51.5, "fromGrade": "D", "to": 53, "toGrade": "D" }, { "causes": [ "correction" ], "date": "2026-10-28", "delta": 0, "from": 51.5, "fromGrade": "D", "to": 51.5, "toGrade": "D" }, { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.1, "from": 51.4, "fromGrade": "D", "to": 51.5, "toGrade": "D" } ] }, "job": { "capability": "payments.x402", "name": "x402 payments" }, "others": [ { "json": "https://www.anchorterminal.com/compare/agentcard-vs-fluxa-ai-wallet.json", "title": "Agentcard vs FluxA AI Wallet", "url": "https://www.anchorterminal.com/compare/agentcard-vs-fluxa-ai-wallet" }, { "json": "https://www.anchorterminal.com/compare/agentcard-vs-kite-agent-passport.json", "title": "Agentcard vs Kite Agent Passport", "url": "https://www.anchorterminal.com/compare/agentcard-vs-kite-agent-passport" }, { "json": "https://www.anchorterminal.com/compare/circle-wallets-vs-fluxa-ai-wallet.json", "title": "Circle Wallets (Agent Wallets, Programmable Wallets) vs FluxA AI Wallet", "url": "https://www.anchorterminal.com/compare/circle-wallets-vs-fluxa-ai-wallet" }, { "json": "https://www.anchorterminal.com/compare/circle-wallets-vs-kite-agent-passport.json", "title": "Circle Wallets (Agent Wallets, Programmable Wallets) vs Kite Agent Passport", "url": "https://www.anchorterminal.com/compare/circle-wallets-vs-kite-agent-passport" }, { "json": "https://www.anchorterminal.com/compare/coinbase-cdp-agentkit-vs-fluxa-ai-wallet.json", "title": "Coinbase Developer Platform (Agentic Wallet, AgentKit, CDP MCP) vs FluxA AI Wallet", "url": "https://www.anchorterminal.com/compare/coinbase-cdp-agentkit-vs-fluxa-ai-wallet" }, { "json": "https://www.anchorterminal.com/compare/coinbase-cdp-agentkit-vs-kite-agent-passport.json", "title": "Coinbase Developer Platform (Agentic Wallet, AgentKit, CDP MCP) vs Kite Agent Passport", "url": "https://www.anchorterminal.com/compare/coinbase-cdp-agentkit-vs-kite-agent-passport" }, { "json": "https://www.anchorterminal.com/compare/kite-agent-passport-vs-openfort.json", "title": "Kite Agent Passport vs Openfort", "url": "https://www.anchorterminal.com/compare/kite-agent-passport-vs-openfort" }, { "json": "https://www.anchorterminal.com/compare/kite-agent-passport-vs-privy.json", "title": "Kite Agent Passport vs Privy Wallets (server wallets, agent wallets, policy engine)", "url": "https://www.anchorterminal.com/compare/kite-agent-passport-vs-privy" }, { "json": "https://www.anchorterminal.com/compare/kite-agent-passport-vs-sponge-wallet.json", "title": "Kite Agent Passport vs Sponge Wallet", "url": "https://www.anchorterminal.com/compare/kite-agent-passport-vs-sponge-wallet" }, { "json": "https://www.anchorterminal.com/compare/kite-agent-passport-vs-turnkey-agentic-wallets.json", "title": "Kite Agent Passport vs Turnkey Agentic Wallets", "url": "https://www.anchorterminal.com/compare/kite-agent-passport-vs-turnkey-agentic-wallets" }, { "json": "https://www.anchorterminal.com/compare/circle-gateway-nanopayments-vs-fluxa-ai-wallet.json", "title": "Circle Gateway Nanopayments vs FluxA AI Wallet", "url": "https://www.anchorterminal.com/compare/circle-gateway-nanopayments-vs-fluxa-ai-wallet" }, { "json": "https://www.anchorterminal.com/compare/fluxa-agentmarket-vs-fluxa-ai-wallet.json", "title": "FluxA AgentMarket vs FluxA AI Wallet", "url": "https://www.anchorterminal.com/compare/fluxa-agentmarket-vs-fluxa-ai-wallet" }, { "json": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-nevermined.json", "title": "FluxA AI Wallet vs Nevermined API + MCP", "url": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-nevermined" }, { "json": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-openfort.json", "title": "FluxA AI Wallet vs Openfort", "url": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-openfort" }, { "json": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-payman.json", "title": "FluxA AI Wallet vs Payman Genie MCP", "url": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-payman" }, { "json": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-privy.json", "title": "FluxA AI Wallet vs Privy Wallets (server wallets, agent wallets, policy engine)", "url": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-privy" }, { "json": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-sponge-wallet.json", "title": "FluxA AI Wallet vs Sponge Wallet", "url": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-sponge-wallet" }, { "json": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-turnkey-agentic-wallets.json", "title": "FluxA AI Wallet vs Turnkey Agentic Wallets", "url": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-turnkey-agentic-wallets" }, { "json": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-self-agent-vault.json", "title": "FluxA AI Wallet vs Agent Vault by Self", "url": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-self-agent-vault" }, { "json": "https://www.anchorterminal.com/compare/kite-agent-passport-vs-self-agent-vault.json", "title": "Kite Agent Passport vs Agent Vault by Self", "url": "https://www.anchorterminal.com/compare/kite-agent-passport-vs-self-agent-vault" } ], "panel": null, "scores": [ { "by": 25, "edge": "kite-agent-passport", "fluxa-ai-wallet": 20, "key": "reliability", "kite-agent-passport": 45, "name": "Reliability", "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 3, "edge": "kite-agent-passport", "fluxa-ai-wallet": 61, "key": "schema", "kite-agent-passport": 64, "name": "Schema \u0026 documentation", "weight": 13 }, { "by": 8, "edge": "kite-agent-passport", "fluxa-ai-wallet": 60, "key": "ergonomics", "kite-agent-passport": 68, "name": "Agent ergonomics", "weight": 13 }, { "by": 23, "edge": "kite-agent-passport", "fluxa-ai-wallet": 52, "key": "security", "kite-agent-passport": 75, "name": "Security \u0026 auth", "weight": 14 }, { "by": 10, "edge": "fluxa-ai-wallet", "fluxa-ai-wallet": 45, "key": "payments", "kite-agent-passport": 35, "name": "Payments \u0026 pricing", "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 5, "edge": "kite-agent-passport", "fluxa-ai-wallet": 66, "key": "maintenance", "kite-agent-passport": 71, "name": "Maintenance \u0026 community", "weight": 7 }, { "by": 23, "edge": "kite-agent-passport", "fluxa-ai-wallet": 32, "key": "transparency", "kite-agent-passport": 55, "name": "Transparency \u0026 trust", "weight": 7 } ], "summary": "Kite Agent Passport scores 53 (D) on agent readiness against FluxA AI Wallet's 47 (D), and leads in 6 of 7 scored categories. FluxA AI Wallet leads on payments \u0026 pricing. Both do x402 payments.", "tasks": null, "tutorials": [], "verdicts": { "fluxa-ai-wallet": "Every spend runs against a mandate the owner signs in a browser, with a budget, a validity window and an optional host allowlist, and payouts need approval or a mandate. The published MCP package is 0.2.0 from March 2026 against 0.6.0 in the repository, and no status page, fee schedule, wallet terms or custody statement was found.", "kite-agent-passport": "Spending sessions with per-transaction and total caps, a lifetime and passkey approval are enforced by the service, with step-up checks and an audit log. A person must sign up by email and create a passkey before an agent can pay. No published fee rate, OpenAPI file or Passport status page was found." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-kite-agent-passport", "json": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-kite-agent-passport.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-kite-agent-passport.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-kite-agent-passport.min.md" }, "markdown": "Kite Agent Passport scores 53 (D) on agent readiness against FluxA AI Wallet's 47 (D), and leads in 6 of 7 scored categories. FluxA AI Wallet leads on payments \u0026 pricing. Both do x402 payments.\n\n- FluxA AI Wallet: grade D, 47/100, rank #1164 of 1513. Markdown https://www.anchorterminal.com/tools/fluxa-ai-wallet.md · JSON https://www.anchorterminal.com/api/v1/tools/fluxa-ai-wallet.json\n- Kite Agent Passport: grade D, 53/100, rank #969 of 1513. Markdown https://www.anchorterminal.com/tools/kite-agent-passport.md · JSON https://www.anchorterminal.com/api/v1/tools/kite-agent-passport.json\n- Best agent wallets and spending controls: https://www.anchorterminal.com/best/agent-wallets/index.md\n- All 77 wallets comparisons: https://www.anchorterminal.com/compare/agent-wallets/index.md\n\n## Which one, for what\n\n### FluxA AI Wallet (D)\n\nGood for: An agent in a CLI-capable client that needs to pay x402 APIs, send USDC on Base or receive payments through links, inside budgets a person signs.\n\nAhead on:\n- Payments \u0026 pricing, 45 against 35\n\nAlso in its favour:\n- A hosted endpoint, with nothing to install\n- Runs on your own machine\n- Open source\n- No incidents deducted, where Kite Agent Passport loses 6 points for them\n\nWatch for: The published MCP package is 0.2.0 from 2 March 2026 with 13 tools, while the repository says 0.6.0 with 15\n\n### Kite Agent Passport (D)\n\nGood for: Coding agents such as Claude Code or Codex that need to pay x402 or MPP services within budgets a person approves by passkey.\n\nAhead on:\n- Reliability, 45 against 20\n- Agent ergonomics, 68 against 60\n- Security \u0026 auth, 75 against 52\n- Maintenance \u0026 community, 71 against 66\n- Transparency \u0026 trust, 55 against 32\n\nWatch for: A person signs up by email, clicks a verification link and creates a passkey in a browser before any agent can spend\n\n\n## Why the edge\n\n### Reliability: Kite Agent Passport +25\n\n- FluxA AI Wallet (20): Graded with the hosted lines, because signing, mandates and approvals all run on FluxA's wallet API and the CLI and MCP server only wrap it, as kite-agent-passport and kane-cli were read. No status page was found in the repository, the skills or AgentMarket's pages. fluxapay.xyz and the wallet and docs hosts could not be read, so a status page there is unchecked and scored absent (0). With no readable history the record takes the default (5). No rate limit with numbers was found (0). The connection service treats 429 `slow_down` as wait and poll and marks errors `retryable`, the skill says a 503 means retry shortly, payouts require a caller-chosen `payout_id` that returns the existing payout on a repeat, `--biz-id` rejects a duplicate with 409, and card create and recharge resume with `--request-id` instead of paying again. No Retry-After or backoff schedule is documented for the wallet API (10 of 15). No SLA was found (0). No beta label was found on the wallet in what was read, but both packages are at 0.x, agent cards sit behind a waitlist and the wallet site was unread (5 of 10). Total 20.\n- Kite Agent Passport (45): Graded as a hosted service, the Passport backend behind the kpass CLI, skills and dashboard. status.gokite.ai shows 60 days of uptime for the Kite website, explorer and four RPC endpoints, but no Passport component, which this run reads as 15 of 20 for a vendor page without the product's component. With no readable Passport history the record takes the default (5). No rate limit with numbers was found (0). The skills map exit code 5 to a rate limit with a 30-second wait before retrying, and `kpass session execute` and shopping checkouts take an idempotency key so a retry doesn't pay twice, the core write that moves money (15). No SLA was found (0). No beta label was found on Passport, and production and a sandbox test mode are both live (10). Total 45.\n\n### Security \u0026 auth: Kite Agent Passport +23\n\n- FluxA AI Wallet (52): The agent holds an Agent ID, a token whose validity the owner picks from 1 hour to 1 year at browser approval, and a short-lived RS256 JWT refreshed from the token; `token_revoked` exists. Credentials sit in a 0600 JSON file or environment variables. The token is not scoped, since limits live in mandates, and legacy `init` tokens are described as not expiring. Agent VCs are audience-bound and rejected by FluxA's own endpoints. No secret travels in a URL (22 of 30). Every x402 payment needs a mandate the owner signs, with a limit, a validity and an optional host allowlist enforced by the wallet API, payouts need per-payout approval unless a mandate covers them, cards need a mandate and KYC, and linked-card mandates are scoped to one merchant. A payout mandate sets no payee allowlist that was documented, and the skill tells agents to request budgets for at least 100 calls by default (16 of 20). The wallet returns little third-party content itself, but the skill sends agents to third-party x402 APIs, ClawPI posts and a remote announcement.md with no guidance on treating them as untrusted, its description steers agents to paid APIs even when a free web search looks enough, and the daily check-in runs `npx -y @fluxa-pay/fluxa-wallet@latest` unpinned twice a day (4 of 15). `mandates` lists limit, spent and remaining, with `recent-transactions`, `received-records` and payout status by CLI, and the MCP server writes a local audit log; the wallet app's logs were not read (10 of 15). No SECURITY.md, disclosure policy, bug bounty or certification was found, and agentmarket.fluxapay.xyz has no security.txt; fluxapay.xyz's is unchecked (0 of 20). Total 52.\n- Kite Agent Passport (75): A person logs in with an emailed code and approves with a device passkey. Agents act through time-boxed sessions bound to that approval, and the hosted MCP endpoint uses OAuth. Key rotation for agents was not documented in what we read (25 of 30). Sessions enforce a per-transaction cap, a total budget, a lifetime and scope rules such as `session_endpoint_forbidden` and `payment_target_forbidden`. Wallet sends, session approvals and passkey changes need an action-bound passkey step-up since 4 June 2026 (18 of 20). The x402-execute and request-session skills tell agents to treat merchant URLs and response values as untrusted and to quote them safely in shell commands. The kite-passport skill steers agents to paid services ahead of free tools (8 of 15). A step-up log, a login history, a per-session activity feed and transaction history (14 of 15). SECURITY.md in the skills repository gives security@kitepassport.com and says reports are acknowledged within 48 hours, a disclosure route with a stated time, which this run reads as 10. No security.txt, bug bounty or SOC 2 was found (10 of 20). Total 75.\n\n### Transparency \u0026 trust: Kite Agent Passport +23\n\n- FluxA AI Wallet (32): The CLI and MCP server source is Apache-2.0 per the LICENSE file and both package.json files, while the README's last section says MIT. The hosted wallet is closed, and no terms covering it were found. AgentMarket's terms describe only the marketplace (15 of 30). AgentMarket's privacy policy of 14 January 2026 names Stripe and model providers and gives no retention periods, and it does not mention wallet addresses, KYC profiles, card data or payouts, which the CLI collects or handles. The wallet's own privacy policy was unreachable (5 of 30). The README marks `init` and `link-wallet` as legacy but still supported, and the skill pins a minimum CLI version; no deprecation policy or dated notice was found (3 of 20). Stripe is the only provider named; no card issuer, KYC provider, custody provider or data location is named. The CLI and MCP code send no telemetry (3 of 20). Total 26.\n- Kite Agent Passport (55): A closed service under terms from Datalego Inc. dated 29 April 2026, with the skills under MIT and the CLI source private (17 of 30). The privacy policy of the same date names Banxa (Australia) and Crossmint (US) as processors, says private keys are not collected, and keeps data for as long as necessary with no periods. The changelog adds that login history stores derived city and country without the IP. No DPA was found (14 of 30). Release notes carry 'Important updates' with required upgrades and breaking changes, such as Base settlement replacing the treasury relay, but give them on the day of release and no deprecation policy was found (6 of 20). Banxa, Crossmint, Halliday and MaxMind are named across the policy and changelog, with locations for the first two, and no subprocessor list (10 of 20). Total 47.\n\n### Payments \u0026 pricing: FluxA AI Wallet +10\n\n- FluxA AI Wallet (45): Payment platforms and wallets take the highest step that applies on the 40-point protocol line. 40 for x402, MPP or L402 on all their own endpoints, 30 on part of their own API, 25 when their merchants can accept one, 20 for running a facilitator, 15 for paying as a buyer, 0 for only a protocol of their own. The wallet pays x402 as a buyer and its payment links can be paid over x402 so another agent pays the holder, as sponge-wallet's payment links were read. FluxA's own wallet API is not paid over x402, so the merchant step (25 of 40). No fee schedule for the wallet, x402 signing, payouts or payment links was found, and card fees appear only through an authenticated command (0 of 20). Registering an Agent ID and creating payment links cost nothing and need no card per the README and the charge-agent guide, but the wallet sign-up at agentwallet.fluxapay.xyz could not be read, so whether opening a funded wallet needs a card is unchecked (10 of 20). `POST https://agentid.fluxapay.xyz/register` returns credentials with no human step, but the CLI marks it legacy, the default connection needs a browser approval, and every spend needs the owner's wallet and a mandate signed in a browser (10 of 20). Total 45.\n- Kite Agent Passport (35): Payment platforms and wallets take the highest step that applies on the 40-point protocol line. 40 for x402, MPP or L402 on all their own endpoints, 30 on part of their own API, 25 when their merchants can accept one, 20 for running a facilitator, 15 for paying as a buyer, 0 for only a protocol of their own. Passport pays third-party x402 and MPP services as a buyer. Its own backend is not paid over either, and Kite recommends the third-party Pieverse facilitator, so the buyer step (15 of 40). No fee rate is published. The changelog says Passport's service margin is shown only in a per-session estimate before approval (0 of 20). Account creation and sandbox test mode with a testnet faucet need no card (20). Signup needs a person to click an emailed link and create a passkey in a browser (0). Total 35.\n\n### Agent ergonomics: Kite Agent Passport +8\n\n- FluxA AI Wallet (60): The MCP server has 15 tools with about 4,700 characters of descriptions, the 11 to 30 band (15). The CLI path loads SKILL.md (26.5 KB) and one of 18 guides per task, about 112 KB in all, with no read-only subset (no add-back, 15 of 25). `card transactions` takes page, limit, type and a time range, refunds take limit and offset, `received-records` and `recent-transactions` take a limit up to 100, and `market search` can be scoped to models or vendors; no cursor (12 of 20). Errors carry a `code`, `retryable`, `reconnect_required` and a `next_command` or `next_tool`, and card errors map to recovery hints, but the CLI exits only 0 or 1 and the MCP payment tools return the wallet API's raw error body without `isError` (14 of 20). A required `payout_id` idempotency key, `--biz-id` dedup and `--request-id` continuation on card operations, and the skill says not to initiate again to retry a payment. No `readOnlyHint` or `destructiveHint` on any MCP tool (12 of 20). Base USDC is the default network and asset, mandates default to 8 hours and the CLI installs in one command, but there is no SDK library and both packages are TypeScript (7 of 15). Total 60.\n- Kite Agent Passport (68): The CLI returns JSON with `--output json`, and the skills load one per task, but the 26 skill files total about 6,900 lines and the router skill's description is long (15 of 25). `ksearch services list` takes `--query`, `--payment-approach`, `--asset` and `--limit`, activity filters by date and merchant, and the login log takes `since`, `until`, `limit` and `offset` (14 of 20). Numbered exit codes, a machine-readable `error_code` and a `hint`, with merchant decline reasons returned since 1 July 2026 (18 of 20). An idempotency key on paid executes, and session approval and wallet sends wait for the person's passkey (14 of 20). One-line install on macOS, Linux and Windows, with sensible session defaults, but no official SDK in any language for Passport (7 of 15). Total 68.\n\n### Maintenance \u0026 community: Kite Agent Passport +5\n\n- FluxA AI Wallet (66): `@fluxa-pay/fluxa-wallet` 0.6.0 was published on 6 November 2026, one day before this check (30). Eight CLI releases since 10 August 2026, among them 0.5.2 on 14 October, 0.5.3 on 25 October and 0.5.6, 0.5.7 and 0.6.0 between 3 and 6 November (20). The repository merged 43 pull requests, all from the organisation's own branches, and commits run weekly. Issues and outside pull requests could not be read because the GitHub API refused the session. Discord and a support address are linked from AgentMarket and were not tested (8 of 25). Graded as an API, the line asks for current official SDKs. The CLI is current, but there is no SDK library and the MCP package on npm has not been published since 2 March 2026 (5 of 15). 68 node:test cases exist with no CI workflow, neither npm package declares its repository, and the MCP package's last release lags the source by eight months (3 of 10). Total 66.\n- Kite Agent Passport (71): The docs changelog dates Kite Passport CLI 6.8.2 with Skills 3.5.5 and Skills 3.5.7 on 13 October 2026, 22 days before this check, and Passport Skills was tagged v3.6.7 on 26 October (30). Releases on 9, 13 and 15 October in the changelog and dozens of skills tags since 6 August (20). The skills repository merged 233 commits since 6 August, the last on 29 October, and `kpass feedback submit` sends reports to Kite. The backend and CLI sources are private, so 9 of 15 for a closed service. The CLI is current, but no official SDK for Passport exists and the PyPI gokite SDK was last released on 18 July 2025, per 10 October. The hosted MCP endpoint was not found in the official registry (5 of 15). The skills repository runs CI and release workflows, and the installer verifies checksums per 10 October (7 of 10). Total 71.\n\n## Score by category\n\n| Category | Weight | FluxA AI Wallet | Kite Agent Passport | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 20 | 45 | Kite Agent Passport +25 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 61 | 64 | Kite Agent Passport +3 |\n| Agent ergonomics | 13% (16.2 this run) | 60 | 68 | Kite Agent Passport +8 |\n| Security \u0026 auth | 14% (17.5 this run) | 52 | 75 | Kite Agent Passport +23 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 45 | 35 | FluxA AI Wallet +10 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 66 | 71 | Kite Agent Passport +5 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 32 | 55 | Kite Agent Passport +23 |\n| Negative events | ≤15 | 0 | -6 | |\n| **Total** | | **47 · D** | **53 · D** | |\n\n## Facts side by side\n\n| Fact | FluxA AI Wallet | Kite Agent Passport |\n| --- | --- | --- |\n| Kind | HTTP API | Platform |\n| Vendor | FluxA Technology Pte. Ltd. | Kite AI |\n| Hosted endpoint | `https://walletapi.fluxapay.xyz` | no (local only) |\n| Transports | HTTP, stdio | HTTP |\n| Auth | OAuth or key | OAuth or key |\n| Pricing | Pay per use | Pay per use |\n| x402 | payer tooling only | payer tooling only |\n| Licence | The CLI and MCP server source is Apache-2.0 (LICENSE file and both package.json files), though the README's last section says MIT. The hosted wallet service is closed, and no terms covering the wallet were found | Closed service under terms from Datalego Inc. dated 29 April 2026. The Passport Skills repository is MIT. The kpass CLI is distributed as binaries and its source repository is private. |\n| Tools exposed | 15 | none |\n| Read-only variant documented | no | no |\n| llms.txt | no | yes |\n| Last release | 2026-11-06 | 2026-10-30 |\n| Terms last updated | no document linked | 2026-04-29 |\n| Privacy policy last updated | no document linked | 2026-04-29 |\n| Customer content may train models | not read yet | not found in the text |\n| Terms restrict automated access | not read yet | not found in the text |\n| Terms restrict benchmarking | not read yet | not found in the text |\n| Terms or service can change without notice | not read yet | not found in the text |\n| Arbitration or class-action waiver | not read yet | not found in the text |\n\n## How the scores have moved\n\n### FluxA AI Wallet\n\nNo score change since it was listed.\n\n### Kite Agent Passport\n\n- +1.5 on 4 November 2026: correction\n- no change on 28 October 2026: correction\n- +0.1 on 27 October 2026: checklist\n\n## Verdicts\n\n**FluxA AI Wallet.** Every spend runs against a mandate the owner signs in a browser, with a budget, a validity window and an optional host allowlist, and payouts need approval or a mandate. The published MCP package is 0.2.0 from March 2026 against 0.6.0 in the repository, and no status page, fee schedule, wallet terms or custody statement was found.\n\n**Kite Agent Passport.** Spending sessions with per-transaction and total caps, a lifetime and passkey approval are enforced by the service, with step-up checks and an audit log. A person must sign up by email and create a passkey before an agent can pay. No published fee rate, OpenAPI file or Passport status page was found.\n\n## Before you call either\n\n### FluxA AI Wallet\n\n1. Run `fluxa-wallet status` first. If `configured` and `wallet_linked` are true, skip `connect`; otherwise show the `authorization_url` and wait with `connect-status --wait 100`\n2. On `token_expired` or `token_revoked`, reconnect with the same `--agent-id`. Never run `init` to recover, which creates a new identity\n3. Pass a unique `--id` on every `payout` and reuse it on retry; a repeat returns the existing payout instead of paying twice\n4. Check `fluxa-wallet mandates` for a signed mandate with enough remaining budget before creating one, and size new budgets to the task\n5. Install the CLI from npm, not the MCP package, whose npm release 0.2.0 lacks `connect_wallet` and `get_wallet_connection`\n\n### Kite Agent Passport\n\n1. Run `kpass` with `--output json --no-interactive` and branch on the exit code and `error_code`. Exit 6 is a session policy breach, so request a new session rather than logging in again\n2. Pass `--idempotency-key` on every `kpass session execute` so a retry after a timeout does not pay twice\n3. Ask the person for a session with a small per-transaction cap and a short `--ttl`, and confirm the merchant URL before executing\n4. Use `kpass sandbox` test mode and the faucet to try a payment flow without real funds. Scoped cards are not available in sandbox\n5. Check the kite-passport skill's trigger rules before installing it, since it directs the agent to paid services ahead of free tools\n\n## Questions\n\n### Which is better for AI agents, FluxA AI Wallet or Kite Agent Passport?\n\nKite Agent Passport scores 53 (D) on agent readiness against FluxA AI Wallet's 47 (D), and leads in 6 of 7 scored categories. FluxA AI Wallet leads on payments \u0026 pricing.\n\n### Can an agent call FluxA AI Wallet and Kite Agent Passport without installing anything?\n\nFluxA AI Wallet has a hosted endpoint at https://walletapi.fluxapay.xyz. No hosted endpoint is listed for Kite Agent Passport.\n\n### Are FluxA AI Wallet and Kite Agent Passport open source?\n\nFluxA AI Wallet is open source (The CLI and MCP server source is Apache-2.0 (LICENSE file and both package.json files), though the README's last section says MIT. The hosted wallet service is closed, and no terms covering the wallet were found). No open-source release is listed for Kite Agent Passport.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-kite-agent-passport.json, and with the fewest tokens: https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-kite-agent-passport.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"fluxa-ai-wallet\", \"b\": \"kite-agent-passport\"}`. From a terminal: `anchor compare fluxa-ai-wallet kite-agent-passport`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/fluxa-ai-wallet.json and https://www.anchorterminal.com/api/v1/tools/kite-agent-passport.json\n\n## Other comparisons with FluxA AI Wallet or Kite Agent Passport\n\n- [Agentcard vs FluxA AI Wallet](https://www.anchorterminal.com/compare/agentcard-vs-fluxa-ai-wallet.md)\n- [Agentcard vs Kite Agent Passport](https://www.anchorterminal.com/compare/agentcard-vs-kite-agent-passport.md)\n- [Circle Wallets (Agent Wallets, Programmable Wallets) vs FluxA AI Wallet](https://www.anchorterminal.com/compare/circle-wallets-vs-fluxa-ai-wallet.md)\n- [Circle Wallets (Agent Wallets, Programmable Wallets) vs Kite Agent Passport](https://www.anchorterminal.com/compare/circle-wallets-vs-kite-agent-passport.md)\n- [Coinbase Developer Platform (Agentic Wallet, AgentKit, CDP MCP) vs FluxA AI Wallet](https://www.anchorterminal.com/compare/coinbase-cdp-agentkit-vs-fluxa-ai-wallet.md)\n- [Coinbase Developer Platform (Agentic Wallet, AgentKit, CDP MCP) vs Kite Agent Passport](https://www.anchorterminal.com/compare/coinbase-cdp-agentkit-vs-kite-agent-passport.md)\n- [Kite Agent Passport vs Openfort](https://www.anchorterminal.com/compare/kite-agent-passport-vs-openfort.md)\n- [Kite Agent Passport vs Privy Wallets (server wallets, agent wallets, policy engine)](https://www.anchorterminal.com/compare/kite-agent-passport-vs-privy.md)\n- [Kite Agent Passport vs Sponge Wallet](https://www.anchorterminal.com/compare/kite-agent-passport-vs-sponge-wallet.md)\n- [Kite Agent Passport vs Turnkey Agentic Wallets](https://www.anchorterminal.com/compare/kite-agent-passport-vs-turnkey-agentic-wallets.md)\n- [Circle Gateway Nanopayments vs FluxA AI Wallet](https://www.anchorterminal.com/compare/circle-gateway-nanopayments-vs-fluxa-ai-wallet.md)\n- [FluxA AgentMarket vs FluxA AI Wallet](https://www.anchorterminal.com/compare/fluxa-agentmarket-vs-fluxa-ai-wallet.md)\n- [FluxA AI Wallet vs Nevermined API + MCP](https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-nevermined.md)\n- [FluxA AI Wallet vs Openfort](https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-openfort.md)\n- [FluxA AI Wallet vs Payman Genie MCP](https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-payman.md)\n- [FluxA AI Wallet vs Privy Wallets (server wallets, agent wallets, policy engine)](https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-privy.md)\n- [FluxA AI Wallet vs Sponge Wallet](https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-sponge-wallet.md)\n- [FluxA AI Wallet vs Turnkey Agentic Wallets](https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-turnkey-agentic-wallets.md)\n- [FluxA AI Wallet vs Agent Vault by Self](https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-self-agent-vault.md)\n- [Kite Agent Passport vs Agent Vault by Self](https://www.anchorterminal.com/compare/kite-agent-passport-vs-self-agent-vault.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-08", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "FluxA AI Wallet vs Kite Agent Passport", "url": "" } ], "description": "Kite Agent Passport scores 53 (D) to FluxA AI Wallet's 47 (D) for x402 payments. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "FluxA AI Wallet D 47", "Kite Agent Passport D 53", "scores" ], "h1": "FluxA AI Wallet vs Kite Agent Passport", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/fluxa-ai-wallet-vs-kite-agent-passport", "published": "2026-10-01", "section": "tools", "title": "FluxA AI Wallet vs Kite Agent Passport for AI agents (2026)", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-kite-agent-passport" }, "tokens": { "markdown": 6050, "slim": 1330 }, "version": 1 }