{ "data": { "a": { "slug": "fluxa-ai-wallet", "name": "FluxA AI Wallet", "vendor": "FluxA Technology Pte. Ltd.", "vendorUrl": "https://fluxapay.xyz", "kind": "http-api", "category": "agent-wallets", "summary": "FluxA AI Wallet is a hosted agent wallet from FluxA Technology that signs x402 (EIP-3009) USDC payments on Base within budgets a person approves, reached through the fluxa-wallet CLI, a stdio MCP server and agent skills.", "url": "https://www.anchorterminal.com/tools/fluxa-ai-wallet", "markdownUrl": "https://www.anchorterminal.com/tools/fluxa-ai-wallet.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/fluxa-ai-wallet.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/fluxa-ai-wallet.json", "dns": "fluxa-ai-wallet.grade.anchorterminal.com", "repo": "https://github.com/FluxA-Agent-Payment/FluxA-AI-Wallet-MCP", "license": "The CLI and MCP server source is Apache-2.0 (LICENSE file and both package.json files), though the README's last section says MIT. The hosted wallet service is closed, and no terms covering the wallet were found", "transports": [ "http", "stdio" ], "remoteUrl": "https://walletapi.fluxapay.xyz", "packages": [ { "registry": "npm", "name": "@fluxa-pay/fluxa-wallet" }, { "registry": "npm", "name": "@fluxa-pay/fluxa-wallet-mcp" } ], "auth": "mixed", "authNotes": "An agent connects with `fluxa-wallet connect` (or the MCP tool `connect_wallet`), which returns an `authorization_url` on agentwallet.fluxapay.xyz for the owner to approve in a browser. The claim returns an Agent ID, a token and an RS256 JWT, stored in `~/.fluxa-ai-wallet-mcp/config.json` (mode 0600) or injected as `AGENT_ID`, `AGENT_TOKEN` and `AGENT_JWT`. The owner picks the token's validity (1h, 24h, 7d, 1mo, 180d or 1y; the server suggests 180 days locally and 7 days in cloud or container environments), and the JWT is refreshed with the token. `token_expired` and `token_revoked` return `reconnect_required`. The legacy `init` registers an Agent ID with an unauthenticated `POST https://agentid.fluxapay.xyz/register`. Spending needs a mandate the owner signs in the browser. AgentMarket commands can instead use `fxa_live_` keys with a spend limit, revocable from the CLI.", "pricing": "usage", "pricingNotes": "No fee schedule for the wallet, x402 signing, payouts, payment links or refunds was found in the repository, the skills or the AgentMarket pricing, terms and llms.txt pages (checked 2026-11-07). Merchants set x402 prices. Agent card products list their fees through `fluxa-wallet card types`, which needs a connected wallet, so those fees were not read. The wallet site and docs at agentwallet.fluxapay.xyz and docs.fluxapay.xyz could not be read, so whether opening a wallet needs a card is unchecked. AgentMarket's Balance is $1 = 1 Balance, with Units bundles from $1 to $25.", "priceSummary": "Pay per use", "where": "both", "x402": { "level": "partial", "evidence": "The wallet signs x402 `exact` (EIP-3009) payment authorisations for USDC on Base and Base Sepolia as a buyer (`fluxa-wallet x402 --mandate \u003cid\u003e --payload \u003c402 body\u003e`, MCP `request_x402_payment` and `request_x402_v3_payment`), and its payment links can be paid over x402 so another agent can pay the holder (https://github.com/FluxA-Agent-Payment/FluxA-AI-Wallet-MCP/blob/main/skills/fluxa-agent-wallet/INTEGRATION-GUIDE-CHARGE-AGENT.md, checked 2026-11-07). FluxA's own wallet API is not paid over x402, MPP or L402.", "endpoints": [] }, "toolCount": 15, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-07" }, "docsUrl": "https://docs.fluxapay.xyz/", "capabilities": [ "payments.x402", "wallet.spend-limits", "wallet.onchain", "payments.card", "auth.agent-identity" ], "tags": [ "hosted", "official", "open-source", "apache-2.0", "cli", "mcp", "stdio", "skills", "typescript", "wallet", "x402", "stablecoins", "virtual-cards", "usdc", "base" ], "lastRelease": "2026-11-06", "graded": true, "anchor": { "graded": true, "score": 47, "grade": "D", "agentReady": false, "rank": 1164, "ranked": true, "rankOf": 1513, "categoryRank": 11, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 60, "maintenance": 66, "payments": 45, "reliability": 20, "schema": 61, "security": 52, "transparency": 32 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "low", "date": "2026-11-07" }, "negative": 0, "verdict": "Every spend runs against a mandate the owner signs in a browser, with a budget, a validity window and an optional host allowlist, and payouts need approval or a mandate. The published MCP package is 0.2.0 from March 2026 against 0.6.0 in the repository, and no status page, fee schedule, wallet terms or custody statement was found.", "bestFor": "An agent in a CLI-capable client that needs to pay x402 APIs, send USDC on Base or receive payments through links, inside budgets a person signs.", "strengths": [ "Spending runs against owner-signed mandates with a limit, a validity window and an optional host allowlist, enforced by the wallet API", "Payouts need per-payout browser approval unless a signed mandate is passed, and a required `payout_id` makes repeats return the same payout", "The CLI returns JSON with error codes, `next_command` hints and `retryable` and `reconnect_required` flags", "Client source is public under Apache-2.0, with 25 CLI releases on npm since March 2026, the latest on 6 November 2026", "Payment links let another agent pay the holder over x402, and refunds of link payments are supported" ], "weaknesses": [ "The published MCP package is 0.2.0 from 2 March 2026 with 13 tools, while the repository says 0.6.0 with 15", "No status page, rate limit, SLA, fee schedule or security contact was found", "Who holds the wallet keys is not stated. The docs say FluxA Wallet signs and call it managed", "The only terms and privacy policy read are AgentMarket's, which do not mention the wallet, cards, KYC or payouts", "The skill steers agents to paid APIs over free search and to request budgets for at least 100 calls by default" ], "agentNotes": [ "Run `fluxa-wallet status` first. If `configured` and `wallet_linked` are true, skip `connect`; otherwise show the `authorization_url` and wait with `connect-status --wait 100`", "On `token_expired` or `token_revoked`, reconnect with the same `--agent-id`. Never run `init` to recover, which creates a new identity", "Pass a unique `--id` on every `payout` and reuse it on retry; a repeat returns the existing payout instead of paying twice", "Check `fluxa-wallet mandates` for a signed mandate with enough remaining budget before creating one, and size new budgets to the task", "Install the CLI from npm, not the MCP package, whose npm release 0.2.0 lacks `connect_wallet` and `get_wallet_connection`" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "low", "grade": "D", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 47 } ], "editorialScores": { "ergonomics": 60, "maintenance": 66, "payments": 45, "reliability": 20, "schema": 61, "security": 52, "transparency": 26 }, "provenanceScore": 38, "checked": { "categories": { "ergonomics": "2026-11-07", "maintenance": "2026-11-07", "payments": "2026-11-07", "reliability": "2026-11-07", "schema": "2026-11-07", "security": "2026-11-07", "transparency": "2026-11-07" }, "last": "2026-11-07", "oldest": "2026-11-07", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install -g @fluxa-pay/fluxa-wallet" }, "letme": { "capability": "https://letme.dev/payments.x402", "tool": "https://letme.dev/fluxa-ai-wallet" }, "sameCompany": [ "fluxa-agentmarket" ], "area": "payments", "provenance": { "legalEntity": "FluxA Technology Pte. Ltd.", "domain": "fluxapay.xyz", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "", "privacy": "", "statusPage": "", "changelog": "", "securityTxt": "unknown", "checked": "2026-11-07", "notes": [ "The legal entity is from the footer of agentmarket.fluxapay.xyz, \"© 2025 FluxA Technology Pte. Ltd. All rights reserved.\", the same on the about, terms, privacy and pricing pages. No registration number, address or country is given on those pages. A web search result names a companieshouse.sg page for FluxA Technology Pte Ltd with UEN 202555700C; that host could not be fetched, so the register entry is unread.", "AgentMarket's terms (effective 14 January 2026) and privacy policy (updated 14 January 2026) describe the marketplace and its Balance and do not mention the Agent Wallet, cards, KYC or payouts, so they are not recorded as the wallet's terms. The terms name no entity in their text and no governing law; contact support.fluxapay@fluxapay.xyz.", "fluxapay.xyz, agentwallet.fluxapay.xyz and docs.fluxapay.xyz could not be read. Each robots.txt fetch was refused for want of an approval on 7 November 2026, so nothing on those hosts was fetched. The wallet's own terms, privacy policy, fees, security.txt and docs are unchecked.", "https://agentmarket.fluxapay.xyz/.well-known/security.txt answered a client error. The repository has no SECURITY.md.", "The wallet API, Agent ID API and approval pages are on fluxapay.xyz subdomains named in the CLI source. agentmarket.fluxapay.xyz's robots.txt allows / and disallows /api/ (except /api/discover and /api/llm/skills.md) and /console/; nothing disallowed was fetched.", "unchecked: RDAP for fluxapay.xyz, the MCP registry, the Wayback Machine, GitHub stars and issues (the GitHub API refused the session) and npm download counts." ], "score": 38 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/fluxa-ai-wallet.json", "live": { "slug": "fluxa-ai-wallet", "probe": { "target": "https://walletapi.fluxapay.xyz", "method": "get", "lastAt": "2026-11-08T14:47:50.695700215Z", "lastOk": true, "lastStatus": 404, "lastMs": 532, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 542, "p95ms24h": 603, "samples24h": 90, "samples30d": 90, "days": [ { "date": "2026-11-08", "probes": 90, "ok": 90 } ], "since": "2026-11-08T00:00:00Z" }, "updatedAt": "2026-11-08T14:47:50.695700215Z" }, "streak": { "days": 0, "from": "2026-11-08", "sinceWatching": true, "best": 0 } }, "answer": "Nevermined API + MCP scores 71.7 (BB) on agent readiness against FluxA AI Wallet's 47 (D), and leads in every scored category.", "b": { "slug": "nevermined", "name": "Nevermined API + MCP", "vendor": "Nevermined", "vendorUrl": "https://nevermined.ai", "kind": "http-api", "category": "payment-platforms", "summary": "Payments, metering and access control for agents, MCP tools and APIs, with a catalogue of paid services agents search and pay through an MCP server or REST API, and a Router that pays x402 and MPP services from one budget.", "url": "https://www.anchorterminal.com/tools/nevermined", "markdownUrl": "https://www.anchorterminal.com/tools/nevermined.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/nevermined.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/nevermined.json", "dns": "nevermined.grade.anchorterminal.com", "repo": "https://github.com/nevermined-io/payments", "license": "Apache-2.0", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://api.live.nevermined.app", "packages": [ { "registry": "npm", "name": "@nevermined-io/payments" }, { "registry": "pypi", "name": "payments-py" } ], "auth": "mixed", "authNotes": "One Bearer API key per environment (sandbox or live prefix). Browser MCP clients get an x402 permission through OAuth 2.1 with PKCE, and headless agents can get a key through the device flow (RFC 8628). Keys from an earlier generation are rejected by the Router with 403 BCK.ROUTER.0008.", "pricing": "freemium", "pricingNotes": "Free plan $0 with up to 20 agents and 10 payment plans and Discord support. Premium $250 a month (100 agents, 50 plans, 5 seats, dashboards). Enterprise $500 a month (unlimited agents and plans). Merchants pay 1% on stablecoin rails and 2% on card rails, taken from settlement, plus card processing at cost. Buyers pay nothing on Nevermined merchants; the Router adds 2% on top when paying external x402 or MPP services (https://nevermined.ai/pricing).", "priceSummary": "1% fee", "where": "hosted", "x402": { "level": "partial", "evidence": "Seller paywalls answer 402 and verify a Nevermined x402 access token in the payment-signature header, settled against a plan rather than a raw onchain transfer. The Router pays standard x402 services on Base in USDC (https://nevermined.ai/docs/products/catalog/router/rails-x402).", "endpoints": [] }, "toolCount": 12, "popularity": { "githubStars": 17, "npmWeekly": 468, "pypiWeekly": 4372, "asOf": "2026-09-30" }, "docsUrl": "https://nevermined.ai/docs", "llmsTxt": "https://nevermined.ai/docs/llms.txt", "openapi": "https://nevermined.ai/docs/api-reference/openapi.json", "registryName": "io.github.nevermined-io/catalog", "capabilities": [ "payments.x402", "payments.card", "payments.stablecoin", "payments.metering", "payments.checkout" ], "tags": [ "hosted", "freemium", "mcp", "llms-txt", "x402", "stablecoin", "typescript", "python", "webhooks" ], "lastRelease": "2026-09-29", "graded": true, "disclosure": "Nevermined's Router competes with letme, which Anchor Terminal's founder builds. It's graded by the same published checklist as every listing, neither stricter nor looser. Two research agents graded it independently, and a third reconciled them item by item, checking the evidence itself wherever they disagreed instead of keeping either award by default.", "competesWith": "letme", "anchor": { "graded": true, "score": 71.7, "grade": "BB", "agentReady": true, "rank": 150, "ranked": true, "rankOf": 1513, "categoryRank": 4, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 76, "maintenance": 81, "payments": 70, "reliability": 63, "schema": 85, "security": 74, "transparency": 70 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-17" }, "negative": -2, "negativeNotes": [ "Conflicting certification claims on Nevermined's own pages, read 17 October 2026. The certifications page presents ISO/IEC 27001:2022 as held ('Certification of our information security management system') and the pricing page shows an ISO 27001 badge, while the Data Policy's section 8.5 reads 'ISO/IEC 27001:2022 certification programme in progress (Stage 1 audit complete; Stage 2 scheduled)'. At least one is wrong, and the Trust Center that would settle it renders only with JavaScript. Read as the ScaleDown dossier read the same kind of conflict (-2) (https://nevermined.ai/docs/products/payments/certifications, https://nevermined.app/legal/data-privacy)" ], "verdict": "Delegations cap what an agent can spend by amount, count and expiry, and the Catalog MCP's 12 typed tools make idempotent payments and return refusals naming the next step. Every paid route needs a person to approve a key or budget, the tools carry no read-only or destructive annotations, and the status page monitors no MCP or Router route.", "bestFor": "An agent or AI assistant that needs to find and pay per-call x402 or MPP services under a spending cap a person approves, and for builders who want to charge agents by plan or credit with card or stablecoin settlement.", "disclosure": "Nevermined's Router competes with letme, which Anchor Terminal's founder builds. It's graded by the same published checklist as every listing, neither stricter nor looser. Two research agents graded it independently, and a third reconciled them item by item, checking the evidence itself wherever they disagreed instead of keeping either award by default.", "strengths": [ "Delegations set a hard cap, transaction count and expiry, are never widened in place, and an OAuth commerce grant spends only from one", "Repeated paid calls with the same requestId are answered from the stored result for 24 hours, with indeterminate and duplicate payments documented", "Refusals carry a stable BCK code, a retryable flag and instructions that name the next tool", "Public OpenAPI 3.1 for 39 core and Router paths, llms.txt with Markdown twins, and API versions pinned per key with no forced sunsets", "MCP server 1.69.0 published to the official registry on 15 October 2026, the 14th version since 29 September" ], "weaknesses": [ "A person creates the first account in a browser, and every paid route needs a person to approve a key, consent or Delegation", "status.nevermined.ai probes five root URLs, not the MCP server or the Router, and had recorded nothing since 6 October 2026 when checked", "None of the 12 MCP tools carries readOnlyHint or destructiveHint, and their definitions total about 41,000 characters", "Merchants accept x402 and MPP only in Nevermined's own schemes, so a stock x402 or MPP client can't pay them", "The docs claim ISO/IEC 27001:2022 while the Data Policy calls the certification in progress" ], "agentNotes": [ "Rehearse on https://mcp.sandbox.nevermined.app/mcp with testnet funds. On live, pay_service and route_by_intent with autoPay move real money", "Call get_service before pay_service and pass the endpoint's payServiceArgs, since a bare slug on a multi-endpoint service answers 404 instead of a payment", "Keep one requestId per purchase across retries. On payment_indeterminate, check list_payments before retrying, and never retry with a new requestId", "Set maxTotalCents on paid calls, since the Router's 2 per cent fee on external services comes out of the same Delegation cap", "On no_delegation, call setup_delegation and pass its URL to the account owner. You can't set the cap yourself" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 2, "avgRating": 3, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 71.7 } ], "editorialScores": { "ergonomics": 76, "maintenance": 81, "payments": 70, "reliability": 63, "schema": 85, "security": 74, "transparency": 71 }, "provenanceScore": 69, "checked": { "categories": { "ergonomics": "2026-10-17", "maintenance": "2026-10-17", "payments": "2026-10-17", "reliability": "2026-10-17", "schema": "2026-10-17", "security": "2026-10-17", "transparency": "2026-10-17" }, "last": "2026-10-17", "lastMoved": "2026-10-27", "oldest": "2026-10-17", "stale": false, "staleAfterDays": 90 } }, "connect": { "http": "curl -X POST https://api.live.nevermined.app/api/v1/delegation/create -H \"Authorization: Bearer $NVM_API_KEY\" \\\n -H \"Content-Type: application/json\" -d '{\"provider\":\"erc4337\",\"currency\":\"usdc\",\"spendingLimitCents\":500,\"durationSecs\":604800}'", "claudeCode": "claude mcp add --transport http nevermined https://mcp.live.nevermined.app/mcp", "config": { "mcpServers": { "nevermined": { "headers": { "Authorization": "Bearer ${NVM_API_KEY}" }, "url": "https://mcp.live.nevermined.app/mcp" } } } }, "letme": { "capability": "https://letme.dev/payments.x402", "tool": "https://letme.dev/nevermined" }, "area": "payments", "unitPrices": [ { "item": "Stablecoin settlement", "unit": "pct", "usd": 1, "note": "taken from merchant settlement" }, { "item": "Card settlement", "unit": "pct", "usd": 2, "note": "plus processor fees" }, { "item": "Router fee", "unit": "pct", "usd": 2, "note": "added on top of external x402 and MPP payments" }, { "item": "Premium plan", "unit": "month", "usd": 250 }, { "item": "Enterprise plan", "unit": "month", "usd": 500 } ], "provenance": { "legalEntity": "Nevermined AG", "domain": "nevermined.ai", "domainRegistered": "2018-06-14", "domainNote": "The API, app and MCP server run on nevermined.app (registered 2022-09-15); nevermined.io redirects to nevermined.ai. Nevermined AG is in Zug, Switzerland.", "endpointOnVendorDomain": false, "terms": "https://nevermined.ai/legal/terms", "privacy": "https://nevermined.ai/legal/privacy", "statusPage": "https://status.nevermined.ai", "changelog": "https://github.com/nevermined-io/payments/releases", "securityTxt": "none", "checked": "2026-09-30", "score": 69 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/nevermined.json", "live": { "slug": "nevermined", "probe": { "target": "https://api.live.nevermined.app", "method": "get", "lastAt": "2026-11-08T14:48:01.444200232Z", "lastOk": true, "lastStatus": 200, "lastMs": 1343, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 1133, "p95ms24h": 1634, "samples24h": 242, "samples30d": 7844, "days": [ { "date": "2026-10-08", "probes": 268, "ok": 268 }, { "date": "2026-10-09", "probes": 250, "ok": 250 }, { "date": "2026-10-10", "probes": 247, "ok": 247 }, { "date": "2026-10-11", "probes": 247, "ok": 247 }, { "date": "2026-10-12", "probes": 247, "ok": 247 }, { "date": "2026-10-13", "probes": 248, "ok": 248 }, { "date": "2026-10-14", "probes": 249, "ok": 249 }, { "date": "2026-10-15", "probes": 253, "ok": 253 }, { "date": "2026-10-16", "probes": 252, "ok": 252 }, { "date": "2026-10-17", "probes": 253, "ok": 253 }, { "date": "2026-10-18", "probes": 256, "ok": 256 }, { "date": "2026-10-19", "probes": 255, "ok": 255 }, { "date": "2026-10-20", "probes": 252, "ok": 252 }, { "date": "2026-10-21", "probes": 253, "ok": 253 }, { "date": "2026-10-22", "probes": 253, "ok": 253 }, { "date": "2026-10-23", "probes": 248, "ok": 248 }, { "date": "2026-10-24", "probes": 251, "ok": 251 }, { "date": "2026-10-25", "probes": 250, "ok": 250 }, { "date": "2026-10-26", "probes": 252, "ok": 252 }, { "date": "2026-10-27", "probes": 249, "ok": 249 }, { "date": "2026-10-28", "probes": 251, "ok": 251 }, { "date": "2026-10-29", "probes": 248, "ok": 248 }, { "date": "2026-10-30", "probes": 249, "ok": 249 }, { "date": "2026-10-31", "probes": 251, "ok": 251 }, { "date": "2026-11-01", "probes": 249, "ok": 249 }, { "date": "2026-11-02", "probes": 250, "ok": 250 }, { "date": "2026-11-03", "probes": 248, "ok": 248 }, { "date": "2026-11-04", "probes": 246, "ok": 246 }, { "date": "2026-11-05", "probes": 185, "ok": 185 }, { "date": "2026-11-06", "probes": 241, "ok": 241 }, { "date": "2026-11-07", "probes": 243, "ok": 243 }, { "date": "2026-11-08", "probes": 150, "ok": 150 } ], "since": "2026-10-08T00:00:00Z" }, "vendorStatus": { "page": "https://status.nevermined.ai", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-08T14:51:13.119904709Z" }, "versions": [ { "registry": "github", "name": "nevermined-io/payments", "version": "v1.13.0", "released": "2026-09-09", "seenAt": "2026-11-08T01:20:37.155366766Z" }, { "registry": "mcp-registry", "name": "io.github.nevermined-io/catalog", "version": "1.92.0", "seenAt": "2026-11-07T18:16:28.95801333Z" }, { "registry": "npm", "name": "@nevermined-io/payments", "version": "1.13.0", "seenAt": "2026-11-08T01:20:36.0053331Z" }, { "registry": "pypi", "name": "payments-py", "version": "1.18.0", "released": "2026-09-09", "seenAt": "2026-11-08T01:20:36.906910821Z" } ], "githubStars": 16, "npmWeekly": 595, "pypiWeekly": 12131, "securityTxt": { "url": "https://nevermined.ai/.well-known/security.txt", "state": "valid", "expires": "2027-10-19T00:00:00.000Z", "checkedAt": "2026-11-07T16:00:19.819332497Z" }, "llmsTxt": { "url": "https://nevermined.ai/docs/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:33:19.606790129Z" }, "domain": { "domain": "nevermined.ai", "registered": "2018-06-14", "source": "https://rdap.identitydigital.services/rdap/domain/nevermined.ai", "checkedAt": "2026-11-01T14:25:52.998975935Z" }, "pages": [ { "url": "https://nevermined.ai/pricing", "kind": "pricing", "status": 304, "checkedAt": "2026-11-07T14:15:01.683001534Z", "changedAt": "2026-10-21T00:30:49.090890309Z", "fingerprint": "7f26446192d9" }, { "url": "https://nevermined.ai/legal/privacy", "kind": "privacy", "status": 304, "checkedAt": "2026-11-07T14:14:57.494510435Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "7f7e042de325" }, { "url": "https://nevermined.ai/legal/terms", "kind": "terms", "status": 304, "checkedAt": "2026-11-07T14:14:59.686857606Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "6742c17c79ba" } ], "mcpTools": { "url": "https://mcp.live.nevermined.app/mcp", "checkedAt": "2026-11-08T02:00:04.086802283Z", "status": "ok", "protocol": "2025-11-25", "tools": [ { "name": "get_subscription_checkout", "title": "Subscription checkout and credits", "description": "Read your personal subscription balance and get the link the human opens to subscribe or manage their allowance when credits are short. Charges nothing and never starts a paid checkout. `topUpAvailable` says whether the human can buy a pack of never-expiring credits from the dashboard (`dashboardUrl`) now, which also switches on automatic top-ups or resumes paused ones; the message mentions top-ups only when it is true. An existing subscriber gets the dashboard and reset date. After the human finishes checkout, use get_budget to verify the credits, then retry pay_service. OAuth commerce connections must explicitly grant Nevermined credits.", "inputSchema": { "properties": {}, "type": "object" }, "annotations": { "readOnlyHint": true } }, { "name": "list_categories", "title": "List service categories", "description": "List the categories of paid services in the Nevermined Agent Services Catalog, with a count per category. Discovery only; no payment.", "inputSchema": { "properties": {}, "type": "object" }, "annotations": { "readOnlyHint": true } }, { "name": "search_services", "title": "Search services", "description": "Search the Nevermined Agent Services Catalog for paid services, ranked by ARD HYBRID relevance — semantic (meaning) matches merged with lexical (keyword) matches, most relevant first — falling back to pure lexical when the embedding provider is unavailable. Each result includes a closed matchReason, a per-item rankingSource, and one scale-specific score. A query is required; the other filters are optional. Returns matching listings (vendor, protocol, headlinePriceLabel, endpoints). headlinePriceLabel is derived from endpoint prices; \"from\" means prices vary. Budget against the selected endpoint price and quote before paying. Only the first page is returned: the `pageToken` in the result cannot be passed back to this tool, so to see other matches narrow the query or filters, or raise `pageSize` (up to 100). Discovery only; no payment. To have the platform PICK (and optionally pay) the single best service for a need instead of choosing yourself, use route_by_intent.", "inputSchema": { "$schema": "http://json-schema.org/draft-07/schema#", "properties": { "category": { "description": "Restrict to services carrying this catalog tag — it filters on tags exactly like `tag`. The category names `list_categories` returns are not stored as tags, so passing one here matches nothing; put a category name in `query` instead. Given together, `category` and `tag` match a service carrying either one.", "type": "string" }, "exclude": { "description": "Never return this opaque catalog slug in the result page.", "minLength": 1, "type": "string" }, "funding": { "description": "Only services with at least one endpoint payable with Nevermined credits. Local catalog only. Check get_service: the specific endpoint carries subscription when credits can pay it; this does not check your balance.", "enum": [ "subscription" ], "type": "string" }, "pageSize": { "description": "Page size, 1–100 (a size of 0 is meaningless and is rejected).", "maximum": 100, "minimum": 1, "type": "integer" }, "prefer": { "description": "Move this opaque catalog slug to the front when it matched the returned page; if it did not match, keep the normal ranked fallback.", "minLength": 1, "type": "string" }, "protocol": { "description": "Restrict to a payment protocol. Only x402 and mpp are payable via the Router.", "enum": [ "x402", "mpp", "rest", "a2a", "other" ], "type": "string" }, "query": { "description": "What you need, in plain language. REQUIRED. Ranked semantically AND lexically (hybrid), most relevant first — a query describing the need (\"translate documents to German\") matches on meaning, not only exact words, and also keyword-matches title, descriptions and tags. Falls back to keyword-only ranking when the embedding provider is unavailable.", "minLength": 1, "type": "string" }, "tag": { "description": "Restrict to services carrying this catalog tag (e.g. a protocol or domain keyword from a listing's `tags`). Combined with `category` it widens the match to either value rather than narrowing it.", "type": "string" } }, "required": [ "query" ], "type": "object" }, "annotations": { "readOnlyHint": true } }, { "name": "get_service", "title": "Get a service", "description": "Fetch one catalog service by slug with metadata and a `requestShape` block. Read the endpoint's `payServiceArgs` before `pay_service`, replacing every `pathParams` placeholder. A checked invoke contract may include `invokePath`, `requestExample`, merchant-authored `responseSchema`/`responseExample`, and `exampleEvidence`: `paid-run` records a paid response, `challenge` proves only the request shape, and `docs` is unverified provider documentation. Only `paid-run` and `challenge` examples are pre-filled into `payServiceArgs`; adopt a `docs` example deliberately. Each endpoint also carries `requestExampleQuality`, grading how well it publishes the way to call it (not a callability verdict) — `proven` (a usable example earned against the real endpoint, including a concrete `invokePath` that fills a templated path), `docs` (a usable example from documentation, unverified), `no-input` (takes no request input, callable as-is), or `none` (no stored example — form the request from `requestSchema` if one is published). Merchant response shapes are sanitised, and harvested examples are published only when they validate against their schema. An `endpointCheck` records a dated unpaid failure. An endpoint with `auth: \"siwx\"` is not paid: it is a follow-up (a job or result poll) that only the wallet which paid an earlier call to the same service can read, so call it with `pay_service` after that call, filling its `pathParams` with the id the paid response returned; the Router signs the wallet challenge and charges nothing. A `requestSchema` is the merchant-declared JSON Schema of its request and is sanitised, not verified. A quote excludes the Router fee, which the budget must also cover. An unknown slug returns an error. Discovery only; no payment. Call `quote_service` for the live fee-inclusive total before paying.", "inputSchema": { "$schema": "http://json-schema.org/draft-07/schema#", "properties": { "slug": { "description": "The service slug (from search_services).", "minLength": 1, "type": "string" } }, "required": [ "slug" ], "type": "object" }, "annotations": { "readOnlyHint": true } }, { "name": "pay_service", "title": "Pay for and call a service", "description": "Pay for a catalog service from your spend-capped delegation and return the vendor response. This charges real funds. Paid calls can take several seconds, including payment verification, service work and settlement; longer tasks can take more. Call `get_service` FIRST: its `requestShape.endpoints[]` lists the callable paths with their HTTP method and price, and each `payServiceArgs` is the `slug`/`path`/`method` to pass here, after replacing any `pathParams` placeholder in `path` with a real value. A bare slug reaches the service base URL, which for a multi-endpoint API answers 404 instead of a payment challenge; only a single-endpoint service is called by slug alone. Send the endpoint's `payServiceArgs`: they carry an example only when it is `paid-run` or `challenge`. A `docs` example (and its `invokePath`) is unverified — use it only deliberately, filling any path parameter with the entity you want; otherwise build `body` from the endpoint description or the provider's docs. `method` may be omitted: it is taken from the catalog endpoint matching `path` (POST when the catalog names none) and echoed back under `request`. To accept a live quote, pass its `quoteId` before `expiresAt` with the exact same call arguments; the Router uses that cached challenge and exact fee-inclusive total. Keep `maxTotalCents` as an independent ceiling. Repeating an identical call (same arguments, no `fresh`) charges nothing new: on a deployment running API 1.48 or later it is answered within 24 hours from the first call's stored result, or its `pending` answer; on an older deployment it comes back as `already_paid`. For an ASYNC service, where you submit once and then poll a status endpoint with the same id, set `fresh: true` on every poll INCLUDING THE FIRST: otherwise each later poll reuses the first poll's idempotency key and gets the first poll's stored answer (or `already_paid`) back, so the status never advances. `fresh` makes each poll a distinct, separately billed call (the merchant charges per status call). Leave `fresh` off the submit and off any retry of a call whose outcome is unsure, because with `fresh` a retry is not de-duplicated and is charged again. A completed call returns `paid`, `upstreamStatus` (the vendor's HTTP status) and `response` (its body). `paid: true` means a payment was attempted, not that it settled, so read `payment.status` (`Settled`, `Issued` or `Failed`): `Issued` is not confirmed yet, which is neither a failure nor a reason to retry, and `Failed` does not prove nothing was charged, so check `deliveryStatus` in `list_payments` before paying again. With a non-2xx `upstreamStatus` it may still have cost the merchant price. Outcomes to act on: `{\"status\":\"pending\"}` means a payment was attempted and the service is still working, so whether it went through is not known yet; call `get_payment_result` with its `paymentId` every few seconds instead of calling pay_service again. `{\"status\":\"already_paid\"}` means this call's idempotency key already carries a payment whose result is not replayed here (the original call failed, its 24-hour result expired, the `requestId` was reused for a different request, or the deployment predates result replay, API 1.48); nothing new was charged, and it does not by itself say whether the original succeeded. Read the original with `get_payment_result` (`paymentId`) or `list_payments` (pass its `requestId`). A new `requestId` starts a separate, separately charged purchase: use one only after that read shows the original failed and the human still wants the result. `{\"error\":\"payment_indeterminate\"}` means the charge may or may not have landed: check `list_payments` first, and to retry reuse the returned `requestId` verbatim without `fresh` so the retry stays idempotent. `{\"error\":\"per_call_max_exceeded\"}` means no charge; raise `maxTotalCents` only after a deliberate decision and retry with the same requestId. `quote_not_found`, `quote_expired`, and `quote_mismatch` are named no-charge quote refusals; quote again rather than paying unpinned. `{\"error\":\"payment_failed\"}` is a definite decline (see `code`, `message` and `retryable`). These charge nothing: `{\"payable\":false}` (not payable via the Router; no upstream URL is ever returned), `service_not_found` (wrong slug), `catalog_unavailable` and `delegation_lookup_failed` (transient; retry later), `payment_not_started` (too little time remained to start a payment; retry with the same arguments), `no_delegation` (call `setup_delegation`), `router_controls_unavailable` (the API behind this server is too old to enforce `search`, `quoteId` or `maxTotalCents`; tell the human instead of retrying without them) and `credential_refused` (re-authorize). A paid result also carries `delegationId` and `budget`, the spending budget after this call (`capCents`/`spentCents`/`remainingCents`, cents with up to four decimals), so to say what has been spent or what is left, repeat `budget` rather than adding up your calls yourself; `budget: null` means it could not be read this time, not that it is zero (call `get_budget`). FUNDING (`funding`): omit it and the call is paid with your Nevermined credits when you hold credits that can pay it (a Nevermined Subscription allowance, welcome or top-up credits) and the endpoint carries a credits tariff (Nevermined pays the merchant; the call costs the tariff in credits, returned if the service does not answer successfully), otherwise from your delegation; pass `\"subscription\"` or `\"delegation\"` to choose. The price ceiling, and the credits left of a subscriber in good standing, are checked only when the call is made: a credits call refused for them (`insufficient_credits`, `subscription_cap_reached`, `subscription_ceiling_exceeded`) charges nothing and is NOT switched to your delegation, so follow its `alternative`. Without a subscription in good standing, your spendable credits are checked before the call, and a call they cannot cover (when no automatic credit pack would) is paid from your delegation, with `fundingCode` saying why. Every result that mentions funding states which funding was chosen: a subscription call returns `funding: \"subscription\"` with `creditsCharged`, `creditsStatus` and `creditsLeft` (a digit string read after the call; null means unavailable, not zero) (`Committed` = spent, `Reserved` = held or marked for refund, `Refunded` = returned) and no `budget`, plus `topUp` (`credits`, `amountUsd`) and `topUpMessage` when the call ran out of credits and charged one credit pack to the saved card to cover itself (credit top-ups on, and only on a call made with your own API key: a call made through an OAuth connection never charges a pack) — relay `topUpMessage` to the user, since their card was charged (it comes alone, without `topUp`, when the pack could not be read); `quoteId`, `maxTotalCents` and `delegationId` apply only to a delegation. `already_paid` states no funding: it answers for an earlier payment, which may have been funded either way, and a retry that lands on the other funding gets it even when the original succeeded and its result is still kept. To see which funding that payment used, read `fundingSource` from `list_payments` with its `requestId`. Subscription refusals charge nothing and no credits (unless they carry `topUps: \"bought\"`, below): `subscription_unavailable`, `no_active_subscription`, `subscription_not_eligible` (see `reason`), `subscription_rail_unsupported`, `subscription_ceiling_exceeded`, `insufficient_credits`, `credits_frozen` (every credit frozen by a card dispute; on a call with `funding` omitted and no delegation it names `setup_delegation`), `subscription_cap_reached`, `credit_daily_limit_exceeded` (wait until midnight UTC or ask the human to change their limit), `credit_budget_unavailable` (retry later) and `subscription_payment_refused`. Neither daily-budget refusal switches to a delegation; `credit_daily_limit_exceeded` carries `dailyLimitCredits` (number), `usedCredits`, `remainingCredits` (digit strings) and `resetsAt`. Other refusals say in `alternative` when the delegation can pay instead. With credit top-ups on, `insufficient_credits` on a call made with your own API key carries `topUps`, and a credit pack may have been charged even though the call was refused (no credits were spent on it); on a call made through an OAuth connection it carries none and no pack was charged: `paused` (a pack was declined; buying one from the Nevermined dashboard resumes them), `limitReached` (the monthly top-up limit), `pending` (a pack is being charged and may already be; retry in a moment), `unavailable` (no pack was charged; retry later) or `bought` (this call charged a pack but other calls spent it first; on `code` `BCK.SUBSCRIPTION_ROUTER.0009` retry, otherwise follow `message`). `credits_frozen` can carry `topUps: \"bought\"` too: a pack was charged, then frozen with the rest by a dispute. Any refusal with `topUps: \"bought\"` also carries `topUpMessage` and the pack’s `purchaseId`: relay `topUpMessage` to the user, since their card was charged. Requires your Nevermined API key on the Authorization header.", "inputSchema": { "$schema": "http://json-schema.org/draft-07/schema#", "properties": { "body": { "description": "Request payload sent to the vendor." }, "delegationId": { "description": "Delegation to charge when you authenticate with an API key; defaults to your active one. An OAuth-connected caller always spends from the grant it approved, so a value here does not choose the delegation; it still feeds the derived idempotency key when you omit `requestId`, so keep it the same across retries of one call. The result's `delegationId` names the delegation actually charged.", "type": "string" }, "fresh": { "description": "Set true on every POLL of an async status endpoint, including the first: each call mints a fresh idempotency key so the poll advances, instead of later polls reusing the derived key and getting the first poll's stored answer (or, before API 1.48, `already_paid`) back. Trade-off: with `fresh` a retry is NOT de-duplicated and WILL be charged again — use it to advance a poll, never to retry a call whose outcome you are unsure of. Leave unset for ordinary calls so a genuine retry stays idempotent. Ignored when you pass an explicit requestId.", "type": "boolean" }, "funding": { "description": "How to pay: `subscription` (your Nevermined credits) or `delegation` (your spend-capped delegation). Omit it to use your credits when the endpoint carries a credits tariff and they are accepted for it (without a subscription in good standing, only when they cover the call), else the delegation; a credits call refused when it is made, because too few credits are left or by the price ceiling, is NOT switched to the delegation. The result says which was chosen.", "enum": [ "subscription", "delegation" ], "type": "string" }, "headers": { "additionalProperties": { "type": "string" }, "description": "Extra headers for the vendor call.", "propertyNames": { "type": "string" }, "type": "object" }, "maxTotalCents": { "description": "Maximum whole cents this call may cost, including the buyer fee (compared exactly, so rounding alone never exceeds it). The price the service quotes on its 402 can differ from the catalog price label.", "maximum": 9007199254740991, "minimum": 0, "type": "integer" }, "method": { "description": "HTTP method for the vendor call. Omit to use the method the catalog records for the endpoint matching `path`; falls back to POST when the catalog records none.", "type": "string" }, "path": { "description": "Router suffix appended to the service base. Read `get_service`'s `requestShape.endpoints[].payServiceArgs.path`: a checked `invokePath` may be empty even when the display path is not. Replace every `pathParams` placeholder. Put query parameters in `search`, never in `path`.", "type": "string" }, "quoteId": { "description": "Opaque short-lived quote id returned by quote_service. Pass it only with the exact same call before expiresAt; the Router then pays the cached challenge and exact fee-inclusive total. Keep maxTotalCents as an independent ceiling.", "type": "string" }, "requestId": { "description": "Idempotency key. Leave unset — a retry of the same call is de-duplicated automatically. Only set a NEW value if you intend a genuinely separate, additional charge. To poll an async status endpoint, prefer `fresh: true` over minting your own value.", "type": "string" }, "requireProtocol": { "description": "Force the payment rail. Set it only when you must pay on one rail — for example a wallet that holds funds on a single chain. If the service offers both rails the Router uses this one; if the service does not offer it the call is refused (`payment_failed` with code BCK.ROUTER.0045, nothing charged) rather than paid on the other rail. Omit it to let the Router auto-select (it prefers mpp). A `quoteId` that was quoted on the other rail is refused (`quote_mismatch`); quote again with the same `requireProtocol`.", "enum": [ "x402", "mpp" ], "type": "string" }, "search": { "description": "Query string without ?, for a slug-routed GET (e.g. flight_iata=AA217).", "type": "string" }, "slug": { "description": "The service slug to pay for.", "minLength": 1, "type": "string" }, "validateRequestBody": { "description": "Opt-in safety check (default off). When true, and the request body provably fails the endpoint's published request schema, the Router refuses the call BEFORE anything is signed, minted or charged (`payment_failed` with code BCK.ROUTER.0046, nothing charged) — instead of paying and letting the merchant reject a malformed body. Leave it unset to let a questionable body through to the merchant unchecked. Only a provably-invalid body is refused; a missing or unverifiable schema still pays. Fix the body to match the endpoint's published requestSchema (see `get_service`), or drop this flag.", "type": "boolean" } }, "required": [ "slug" ], "type": "object" }, "annotations": { "destructiveHint": true, "readOnlyHint": false } }, { "name": "quote_service", "title": "Quote a service call", "description": "Price ONE call to a catalog service WITHOUT paying it: it charges nothing, signs nothing and reserves no budget. Pass exactly what you would pass to `pay_service` (the same `slug`, `path`, `method`, `search`, `headers`, `body` and `delegationId`): the Router sends that request to the service unpaid, reads the price it asks for, and returns an opaque `quoteId`, its short `expiresAt`, the rail (`protocol`), the network and merchant amount (`settlement`) and the fee-inclusive total (`fee.capChargedCents`, whole cents rounded up; `fee.capChargedMicros` exact, in 1/10,000 of a cent). Unlike the `quote` on a get_service endpoint (the last merchant price the catalog observed, routing fee excluded), this is priced live for your exact request and includes the fee. Because the request really reaches the service, a service that does not charge for it performs it, so take care quoting a method with side effects; and a quote spends the same per-service rate limit as a payment, so quote once per decision rather than polling. It prices the delegation pay_service would charge (`optionSet: \"delegation\"`, naming its `delegationId`), or, with no delegation set up, what a personal crypto delegation would select (`optionSet: \"deployment\"`); in that case `nextTool` is `setup_delegation`: set one up and quote again before paying, since the delegation you create can select a different rail and price. It checks neither your remaining budget nor your wallet balance (see get_budget and wallet_balance). Next step (`nextTool: \"pay_service\"`): if `fee.capChargedCents` fits what you planned to spend, call `pay_service` before expiry with the same arguments, the quoted `delegationId`, `quoteId`, and `maxTotalCents` set to that figure as a number. The quote id fixes the exact challenge and fee-inclusive total while `maxTotalCents` remains an independent ceiling. `paymentRequired: false` means the service did not ask for payment for this request; `upstreamStatus` is its answer, and a non-2xx usually means the path, method or body is wrong. The service response itself is never returned. Outcomes, all charging nothing: `{\"payable\":false}`, `service_not_found`, `catalog_unavailable` and `delegation_lookup_failed` as in pay_service; `quote_unavailable` (no quote can be made here and retrying will not change that, so bound the price with pay_service `maxTotalCents` instead); `quote_failed` (the Router refused to price the call, or did not answer; see `code`, `message` and `retryable`); `credential_refused` (re-authorize). FUNDING (`funding`): chosen as pay_service would choose it. When you hold Nevermined credits that can pay it (a Nevermined Subscription allowance, welcome or top-up credits) and the endpoint carries a credits tariff the answer is `{\"funding\":\"subscription\",\"credits\":…,\"tariffVersion\":…}`: the credits one call costs from the published tariff (the service is not contacted, and there is no `quoteId` or cent total); then call pay_service with the same arguments. The price ceiling, and the credits left of a subscriber in good standing, are checked only when pay_service makes the call, so this answer does not promise the call will be paid with credits. Pass `funding: \"delegation\"` to price the delegation instead. Subscription refusals are named as in pay_service. When `settlement.scheme` is `session`, the merchant is paid out of a deposit in a payment channel, and `sessionDeposit` says what this call would do to it: `action` is `open` (the first call locks a deposit), `top_up` (it locks more), `none` (no new money leaves the wallet), `closing` (the call would be refused, nothing moves; quote again once it has closed) or null (what the call would do could not be stated, and pay_service may refuse it); `approxCents` is how much would move into the deposit, in cents, the network fee not included, and `basis` says whether that is `sized` for this budget and wallet or an `upper_bound`. That money can far exceed the price. It is locked, not spent, it is not charged to the budget, and what the merchant does not take comes back when the channel closes, `idleCloseSeconds` after its last use. Tell the human before paying. Requires your Nevermined API key on the Authorization header.", "inputSchema": { "$schema": "http://json-schema.org/draft-07/schema#", "properties": { "body": { "description": "The request payload you would send; some services price by it." }, "delegationId": { "description": "The delegation you would pay with, when you authenticate with an API key; defaults to the one pay_service would use. A card or organization-wallet delegation can select a different rail, and so a different price. An OAuth-connected caller is always quoted for the grant it approved, so a value here does not choose the delegation; the result names the one priced.", "type": "string" }, "funding": { "description": "What to price: `subscription` (your Nevermined credits) or `delegation` (the fee-inclusive money total). Omit it to price the funding pay_service would use.", "enum": [ "subscription", "delegation" ], "type": "string" }, "headers": { "additionalProperties": { "type": "string" }, "description": "The extra headers you would send to the vendor.", "propertyNames": { "type": "string" }, "type": "object" }, "method": { "description": "HTTP method. Omit to use the method the catalog records for the endpoint matching `path` (POST when it records none), exactly as pay_service does.", "type": "string" }, "path": { "description": "The same `path` you would pass to pay_service: read `get_service`'s `requestShape.endpoints[].payServiceArgs.path` and replace every `pathParams` placeholder. Put query parameters in `search`.", "type": "string" }, "requireProtocol": { "description": "Price (and pin the returned quote to) one payment rail. Pass the same value you will pass to pay_service: the quote prices that rail, and the quoteId it returns is only payable on it. If the service does not offer the pinned rail the quote is refused (`quote_failed` with code BCK.ROUTER.0045, nothing charged) rather than priced on the other one. Omit to let the Router auto-select (it prefers mpp). A subscription-credit quote (`funding: \"subscription\"`) is rail-agnostic — it prices the published credit tariff, so the pin does not change it and is not applied here; the subsequent paid call still enforces the pin and can be refused if the service does not offer it.", "enum": [ "x402", "mpp" ], "type": "string" }, "search": { "description": "Query string without ?, for a slug-routed GET (e.g. flight_iata=AA217).", "type": "string" }, "slug": { "description": "The service slug to quote.", "minLength": 1, "type": "string" } }, "required": [ "slug" ], "type": "object" }, "annotations": { "readOnlyHint": true } }, { "name": "route_by_intent", "title": "Find (and optionally pay) the best service for a need", "description": "Given a plain-language description of what you need, find, and optionally pay in the same call, the single best payable catalog service, so you do not have to pick among listings yourself. Use it instead of search_services when you want the right service for a task rather than a list to browse: it ranks candidates on Nevermined's own relevance and quality signals (deterministic; no model reads the merchant listings), applies a fail-closed payability gate (listed, healthy, moderated, x402/mpp, not flagged unpayable), and returns the winner as `chosen` (with its opaque invoke handle, never a raw host) plus a ranked `shortlist`; every shortlist item carries a closed `matchReason`, `gateReason`, per-item `rankingSource`, and one scale-specific score. With `autoPay:false` (the default) it returns the pick only and charges nothing; the next step is normally `get_service` on `chosen.slug`, then `pay_service` with the endpoint you need. With `autoPay:true` it also pays the winner through the same path as pay_service and returns the upstream call in `result`: `result.status` and `result.body` are the vendor's answer, and `result.paid: true` means a payment was attempted, not that it settled, so read `result.payment.status` (`Settled`, `Issued` or `Failed`). autoPay calls the winner at its base URL plus any `path` you pass, and you only learn the winner from this call, so it suits single-endpoint services; a multi-endpoint winner typically answers 404 at its base URL. autoPay requires `requestId`; an API-key caller must also pass `delegationId`, while an OAuth-connected caller spends from the grant it approved and needs none. Outcomes: no listed, payable match → `{\"status\":\"no_fundable_match\"}` (broaden the intent or filters; nothing charged), never a wrong pick; `missing_autopay_fields` (nothing charged); on autoPay, `payment_indeterminate` (check `list_payments`, and retry only with the same `requestId`) and `already_paid` (this `requestId` already carries a payment, see `paymentId`; nothing new billed, and it does not by itself say whether the original succeeded). Every pick and each of these outcomes carries an `instructions` string with the next step; a payment the Router declines on autoPay comes back as a tool error carrying the API's message. Requires your Nevermined API key on the Authorization header.", "inputSchema": { "$schema": "http://json-schema.org/draft-07/schema#", "properties": { "autoPay": { "description": "When true, also pay and relay the winner in the same call (same path as pay_service); requires requestId, plus delegationId when you authenticate with an API key. Default false → return the pick only, no charge.", "type": "boolean" }, "body": { "description": "Request body for the paid call (autoPay only)." }, "credentialHeader": { "description": "Header the Router should carry the minted payment credential in on the paid hop (autoPay only). Send it only when the winning service needs its own auth AND a payment credential (e.g. \"Payment\"). Ignored when autoPay is false.", "type": "string" }, "delegationId": { "description": "Delegation to charge on autoPay. Required when you authenticate with an API key; an OAuth-connected caller spends from the grant it approved, so it can omit this (a value there does not choose the delegation).", "type": "string" }, "filters": { "description": "Optional structured narrowing; all fields optional.", "properties": { "category": { "description": "Narrow to services carrying this catalog tag. It matches tags, not the category names `list_categories` returns (those are not stored as tags and match nothing) — put a category name in `intent` instead.", "type": "string" }, "exclude": { "description": "Never choose this exact opaque catalog slug.", "minLength": 1, "type": "string" }, "maxPriceLabel": { "description": "Upper price bound as a label (e.g. \"$0.05\"); best-effort.", "type": "string" }, "network": { "description": "Narrow to a settlement network.", "type": "string" }, "prefer": { "description": "Prefer this exact opaque catalog slug when it is a payable match; otherwise keep the normal ranked fallback.", "minLength": 1, "type": "string" }, "protocol": { "description": "Narrow to a payment protocol (only x402 and mpp are payable).", "enum": [ "x402", "mpp" ], "type": "string" }, "require": { "description": "Require this exact opaque catalog slug. It is returned only if payable and healthy; otherwise the Router fails closed with BCK.ROUTER.0031 and never substitutes another service.", "minLength": 1, "type": "string" } }, "type": "object" }, "headers": { "additionalProperties": { "type": "string" }, "description": "Extra headers for the paid call (autoPay only).", "propertyNames": { "type": "string" }, "type": "object" }, "intent": { "description": "Plain-language description of the service you need (e.g. \"translate English to German\").", "minLength": 1, "type": "string" }, "limit": { "description": "Shortlist size to return (1–20, default 5).", "maximum": 20, "minimum": 1, "type": "integer" }, "maxTotalCents": { "description": "Refuse a paid quote above this (fee-inclusive), before purchase (autoPay only).", "maximum": 9007199254740991, "minimum": 0, "type": "integer" }, "method": { "description": "HTTP method for the paid call (autoPay only).", "type": "string" }, "path": { "description": "Subpath appended to the winner when paying (autoPay only).", "type": "string" }, "requestId": { "description": "Idempotency key — REQUIRED when autoPay is true.", "type": "string" }, "search": { "description": "Query string (no leading ?) for the paid call (autoPay only).", "type": "string" } }, "required": [ "intent" ], "type": "object" }, "annotations": { "destructiveHint": true, "readOnlyHint": false } }, { "name": "setup_delegation", "title": "Set up a spending delegation", "description": "Start the spending-delegation ceremony and return ONE URL for a human to open. Use this when `pay_service` returns `{\"error\":\"no_delegation\"}` — it is the way out of that state. It sets up a stablecoin (crypto) delegation that spends from the human's personal wallet, so that wallet also needs funds on the network a service settles on (see `wallet_balance`); it does not enroll a card or create a card delegation. The human sets the currency, spending cap, duration and transaction limit themselves in the browser; you CANNOT set them and must not ask the human to pass them to you. Returns `{\"status\":\"human_action_required\",\"url\":…}` — relay the url, wait for the human to confirm, then simply call `pay_service` again. `{\"status\":\"already_active\"}` means a usable spending budget is in place — for an OAuth commerce caller it is the grant approved on the consent screen — and nobody needs to do anything: tell the human `message` as it stands (it states the cap, spent, remaining and expiry the API reports, in a voice written to be relayed), then follow `instructions` and call pay_service. The url embeds a short-lived session token, so treat it as sensitive and give it only to the account owner. Other outcomes: `delegation_setup_unavailable` (this deployment cannot run the ceremony) and `delegation_setup_failed` (the session could not be started) produce no URL; `return_url_not_allowed` means drop or fix `returnUrl`; a `human_action_required` answer with `delegationCheck: \"failed\"` means an existing budget could not be ruled out, so follow its `instructions` and try pay_service first. Requires your Nevermined API key on the Authorization header.", "inputSchema": { "$schema": "http://json-schema.org/draft-07/schema#", "properties": { "returnUrl": { "description": "Where the human's browser should land after they authorise. Only a localhost callback (http://127.0.0.1:\u003cport\u003e/…) or an origin this Nevermined deployment has allow-listed is accepted; a rejected value is reported back rather than silently dropped. OMIT THIS unless you actually have somewhere to receive the redirect — without it the page just shows a confirmation and the human closes the tab, which is the normal case in a chat host. Validated by the Nevermined API rather than here, deliberately: a second validator in this schema could refuse a URL the API would have accepted.", "type": "string" } }, "type": "object" }, "annotations": { "destructiveHint": false, "readOnlyHint": false } }, { "name": "get_budget", "title": "Get spending budget", "description": "Read the spending budget pay_service spends from: its cap, what has been spent, what remains, how many payments were made (and the limit, if any), and when it expires. Reading costs nothing and charges nothing. Use it whenever the human asks how much is left, or before a run of paid calls. Money is in CENTS: `capCents` is whole cents; `spentCents` and `remainingCents` can carry up to four decimals because the budget is charged per call at 1/10,000 of a cent (e.g. `\"1.632\"` = 1.632¢), and `spentCents + remainingCents = capCents` while the budget is within its cap. Tell the human `message` as it stands and never substitute a figure of your own: the budget includes routing fees and rounding, so adding up your calls will not match it. With no `delegationId` it reads the budget pay_service would use; that only includes budgets that can still pay, so `{\"status\":\"no_active_delegation\"}` also covers a budget that ran out or expired — pass the `delegationId` from an earlier pay_service result to read that one anyway. On a deployment that reports it, `spentByDeliveryStatusCents` splits the spend by what each payment delivered (`delivered`, `charged_not_delivered`, `charged_unconfirmed`, `not_charged`, `not_delivered`, `pending`, the `deliveryStatus` values list_payments uses), and `unattributedSpentCents` is spend no payment record itemizes; a non-zero `charged_not_delivered` is what was spent on calls that delivered nothing although the merchant charged (the merchant charge plus any routing fee not given back), so tell the human. `not_delivered` is held for calls the merchant answered with an error: not a confirmed charge; the reserve stays held until reconciliation decides whether the merchant charged after confirmed cancellation or authorization expiry (an older deployment reports it inside `pending`). `lockedInChannels`, when present, is money the wallet this budget pays from has deposited into payment channels with merchants that charge per call (per token, as in wallet_balance). It is that WALLET's total, shared by every budget paying from it, not a figure of this budget's own: it is NOT spent and NOT charged to this budget, it can pay further calls only to the merchant holding each channel, and what is unused comes back to that wallet when the channel closes, after 15 minutes without use; `message` then says so. An empty list means nothing is locked; `null` means it could not be read, and `message` then says that too. `sessionChannels`, when present, is the history behind that: each payment channel this budget used, newest first, with the `merchant`, its `status`, what was deposited (`deposit`, or `depositAtomic` in raw units when `symbol` is null), what came back (`refund`, null until the channel has closed and the refund is confirmed) and `openedAt`/`closedAt`. It is what explains money leaving the wallet and coming back when no payment shows it: a payment record carries one call's price, never the deposit. `sharedWithOtherBudgets` means the wallet's channel also served another budget, so its figures are not this budget's alone, and `depositConfirmed: false` means the open is not confirmed, so the deposit may not have landed. `sessionChannelsTruncated: true` means the list holds only the newest channels and older ones exist; `message` then says so. An empty list means none was used; `null` means it could not be read, and `message` then says so. Absent means this reader cannot see them: a budget owned by someone else, or an older deployment. Inventory fields `creditsCoverage` and `creditsCoverageMessage` describe public catalog eligibility, even when this caller has no subscription access or credit consent. Relay the message when present; absent means unavailable, never zero. A get_service endpoint carries `subscription` when credits can pay it. When you have a Nevermined Subscription the result also carries `subscription` (`creditsLeft`, a digit string of every unexpired credit; `resetsAt`, when the allowance expires and, unless `cancelAtPeriodEnd`, the next period's is granted; `status`, `suspended` and `plan`) and `subscriptionMessage` to relay as it stands; `subscription.subscribed: false` means none. Whether or not you subscribe, it also carries `credits` (`null`: could not be read, which is not the same as none): `total`, `spendable` (what can pay a call now), `parts` (`kind` allowance | welcome | topup | sla, `credits`, `expiresAt` — null never expires — and `frozen`: null, `renewal_overdue` for allowance credits frozen until a renewal payment goes through, `dispute` for every credit while a card dispute holds them) and `nextExpiry`, with `creditsMessage` to relay as it stands. Every amount is a digit string. Never count credits yourself. Requires your Nevermined API key on the Authorization header.", "inputSchema": { "$schema": "http://json-schema.org/draft-07/schema#", "properties": { "delegationId": { "description": "A specific delegation to read (every paid pay_service result carries one). Omit it to read the budget pay_service spends by default.", "type": "string" } }, "type": "object" }, "annotations": { "readOnlyHint": true } }, { "name": "top_up_credits", "title": "Top up credits", "description": "Buy one credit pack on the card your human enrolled, within the monthly top-up limit they set — no new human approval. This CHARGES the human’s card. Pass `forCallCredits`: the credits the call you are about to make will spend. A pack is charged only when your spendable credits are below that — the recorded consent charges a pack “each time your credits are not enough for a call you make”, so state what that call needs (from a quote or your plan’s per-call cost); when your credits already cover it, nothing is charged (`not_needed`). Pass a `requestId` you choose as an idempotency handle: a NEW value for each top-up you intend, the SAME value only to re-send a call that may not have completed (a retry returns the pack already charged, never a second one). Read `status`: `bought` added credits (`creditsAdded`) — unless `replayed` is true, which means this requestId had already bought one and nothing new was charged (use a new id next time); `pending` means YOUR pack was charged and is awaiting confirmation (read the balance shortly); `busy` means another top-up is already being charged — nothing was charged for THIS request, so check your balance shortly and re-send the SAME requestId only if you still need one; `limit_reached` means this UTC month’s top-up limit is used up (no charge — do not retry until next month); `not_needed` means your credits already cover the call (no charge); `needs_attention` means the card was declined or needs 3-D Secure, a card payment to Nevermined is disputed, a human must finish setting top-ups up, a prior top-up is stuck, or a prior top-up’s outcome is unconfirmed (it may have been charged) — hand the human `operatorUrl`, never try to confirm it yourself, and do not start a new top-up until they act; `disabled` means a human must turn top-ups on first (give them `operatorUrl`); `unavailable` means nothing was charged — retry with a NEW requestId (reusing this one keeps returning the same settled result). `monthlyLimitUsd`/`boughtThisMonthUsd`/`packPriceUsd` are the human-set limit and this month’s spend. Requires your Nevermined API key on the Authorization header; a commerce OAuth grant must have enabled credit top-ups at consent.", "inputSchema": { "$schema": "http://json-schema.org/draft-07/schema#", "properties": { "forCallCredits": { "description": "The credits the call you are about to make will spend. A pack is charged only when your spendable credits are below this; when they already cover it, nothing is charged (`not_needed`).", "maximum": 1000000, "minimum": 1, "type": "integer" }, "requestId": { "description": "An idempotency handle you choose (8–200 chars, letters/digits/._:-). Use a NEW value for each top-up you intend; reuse the SAME value only to re-send a call that may not have completed.", "maxLength": 200, "minLength": 8, "pattern": "^[A-Za-z0-9._:-]+$", "type": "string" } }, "required": [ "requestId", "forCallCredits" ], "type": "object" }, "annotations": { "destructiveHint": true, "readOnlyHint": false } }, { "name": "get_payment_result", "title": "Get payment result", "description": "Read the result of a paid call, by its `paymentId`. Use it when `pay_service` answered `{\"status\":\"pending\"}` (the service was still working when the Router stopped waiting — a payment was attempted, the call keeps running and its outcome is not known yet), or to recover a result whose response you lost. Reading costs nothing and charges nothing. Every answer with a `state` carries `payment.status`. `state: \"Pending\"` — still running, call again in a few seconds. `state: \"Ready\"` — `status` is the service's HTTP status and `body` its response (`bodyEncoding` says whether it is parsed JSON, text, or base64). `state: \"Failed\"` — the call ended without a response; `failureReason` says why. That does not prove nothing was charged, so check `deliveryStatus` in `list_payments` before paying again. `{\"status\":\"not_available\"}` — nothing to return: results are kept for 24 hours for the account that paid, and only then. Do NOT call pay_service again to get a pending result: that does not return a new one. Requires your Nevermined API key on the Authorization header.", "inputSchema": { "$schema": "http://json-schema.org/draft-07/schema#", "properties": { "paymentId": { "description": "The `paymentId` a pay_service result returned.", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$", "type": "string" } }, "required": [ "paymentId" ], "type": "object" }, "annotations": { "readOnlyHint": true } }, { "name": "list_payments", "title": "List payments", "description": "List your Router payments: the unified ledger across every service and delegation, newest first, at most 1000 records. Each record carries its `id` (the `paymentId` get_payment_result takes), `createdAt`, `status`, `protocol`, `network`, `requestId`, `delegationId` and `amount` in the asset's smallest unit (see `assetDecimals`), not in cents. Each row also carries `deliveryStatus`: `delivered` (request settled), `charged_not_delivered` (request failed and the merchant charge was observed), `charged_unconfirmed` (charge observed; delivery unconfirmed), `not_charged` (reconciliation recorded no merchant charge, including unreadable write-offs; not conclusive proof that no money moved), `not_delivered` (the merchant answered with an error, so nothing was delivered, and no charge has been seen: the amount stays reserved until reconciliation decides, after confirmed cancellation or payment authorization expiry, whether the merchant charged; it is not a confirmed charge), or `pending` (charge outcome unknown). Issued + `pending` means the charge outcome is unknown: neither payment nor no charge is established. On SPT and card rails, pending is not proof of no charge; those rows are never decided on chain. `merchantSettlementObservedAt` records an observed merchant charge; null is not, on its own, proof of no charge. Flag both charged states to the user. Each record also carries `fundingSource`, the funding it used: `delegation`, or `subscription` for your Nevermined credits, with or without a subscription. On a `subscription` row, `deliveryStatus` and `merchantSettlementObservedAt` describe what Nevermined paid the merchant, not a charge to you: what the call cost you is `creditsCharged`, and `creditsStatus` says whether that stands (`Committed` spent, `Reserved` held or marked for refund, `Refunded` returned). Do not report a charged state on such a row as a charge to the user. Pass `requestId` to look up the one payment with that id: the answer is then `{\"presence\":…,\"payments\":[…]}`, it ignores the other filters and the 1000-record limit, and `presence: \"absent\"` means no payment carries that id. Use this tool to reconcile an uncertain payment or find a paymentId; it does not return service responses (use get_payment_result) or the remaining budget (use get_budget, whose figures include fees and rounding). Reading costs nothing. Requires your Nevermined API key on the Authorization header.", "inputSchema": { "$schema": "http://json-schema.org/draft-07/schema#", "properties": { "delegationId": { "description": "Only payments charged to this delegation.", "type": "string" }, "from": { "description": "ISO-8601 lower bound on `createdAt`, inclusive. An unparseable value is an error.", "type": "string" }, "requestId": { "description": "The `requestId` a pay_service or route_by_intent result gave you, matched exactly. Finds that one payment wherever it sits in the ledger; the other filters are ignored.", "minLength": 1, "type": "string" }, "to": { "description": "ISO-8601 upper bound on `createdAt`, inclusive. An unparseable value is an error.", "type": "string" } }, "type": "object" }, "annotations": { "readOnlyHint": true } }, { "name": "payment_summary", "title": "Payment summary", "description": "Count your Router payment requests: `total` is how many there were in the period (uncapped, unlike list_payments) and `series` is that count per day (`date`, `value`), oldest first. `chargedNotDelivered` is the count of failed payments in the period whose merchant charge reconciliation observed on-chain (a failed payment not yet reconciled is not counted); this is the confirmed failed-and-charged count only. `countsByDeliveryStatus` exposes all six ledger delivery states, including `charged_unconfirmed`, `not_delivered` and `pending`, with zero counts included. The latter two have unknown charge outcomes: do not count them as confirmed charges. Flag both charged buckets and explain unresolved outcomes to the user. These buckets include calls paid with your Nevermined credits, so check `fundingSource` and `creditsStatus` in `list_payments` before telling the user they were charged. This reports numbers of payments, not money: for what has been spent or what is left, and how much of it was charged without delivery, use get_budget, and for amounts per payment use list_payments. Reading costs nothing. Requires your Nevermined API key on the Authorization header.", "inputSchema": { "$schema": "http://json-schema.org/draft-07/schema#", "properties": { "from": { "description": "ISO-8601 lower bound on `createdAt`, inclusive. An unparseable value is an error.", "type": "string" }, "to": { "description": "ISO-8601 upper bound on `createdAt`, inclusive. An unparseable value is an error.", "type": "string" } }, "type": "object" }, "annotations": { "readOnlyHint": true } }, { "name": "wallet_balance", "title": "Wallet balance", "description": "Read the balances of YOUR OWN PERSONAL wallet — the funding source the crypto rails PULL from when pay_service charges a PERSONAL delegation. It answers `how much do I have, and on which chain`. Reading costs nothing and charges nothing. WHAT IT DOES NOT COVER, so you do not mis-diagnose: a delegation backed by an ORGANIZATION wallet is paid from that wallet, not this one; and a CARD delegation has no wallet at all — there `BCK.ROUTER.0009` is the card ISSUER declining, with nothing to top up, so this tool does not apply and the answer is a different card. BY RAIL: on MPP the wallet is checked BEFORE anything is signed, and the `BCK.ROUTER.0009` you get back already names the wallet and the chain — what it never says is HOW MUCH is there, which is what this tool supplies. On x402 there is NO balance pre-check and `BCK.ROUTER.0009` is never raised: the credential is minted, budget is reserved, and a short wallet only surfaces when the merchant's on-chain transfer fails — by which point your budget is already committed, and the reserve comes back only once the reconciler has seen the authorization expire unconsumed. So on that rail read the balance BEFORE you pay, not after. By default this reports EVERY network this deployment settles on, and you must read the one the merchant quoted: a healthy balance on one chain says NOTHING about the other, and most services settle on only one of them. Pass `network` (a chain id) to read a single chain. A token whose `atomic`/`formatted` is `null` was NOT READ (the on-chain read failed) — that is not a zero balance, and reporting it as empty is wrong; a chain that could not be read at all comes back as an entry with `error` instead of `balances`. This tool diagnoses and fixes nothing: there is no on-ramp and you cannot top your own wallet up, so a genuine shortfall is a stop condition — report the network and the amount to your human, and do not retry the payment. Each entry with `balances` also carries `lockedInChannels` when the API reports it, per token (`atomic` in the token's smallest unit, `formatted`, `symbol`): money your payer wallet (the one the Router signs MPP payments with, which is this wallet once your account is migrated) has deposited into payment channels with merchants that charge per call over an MPP session, held in the channel's escrow. It is NOT part of `balances` and it is NOT spent: it is still the human's. It can pay further calls only to the merchant holding that channel, never anyone else, and what is unused comes back to that wallet when the channel closes, after 15 minutes without use. Report it beside the balance, never as spending, and never count it toward paying any other merchant. Here a null `symbol`/`decimals`/`formatted` means a token Nevermined does not recognise, NOT an unread amount: report `atomic` as raw units of `token`. An empty list means nothing is locked; `lockedInChannels: null` means it could not be read, which is not the same as nothing locked. When you have a Nevermined Subscription the result also carries `subscription` (the credits left, reset date and plan, as in get_budget), and whenever you hold credits, subscribed or not, `credits` (total, spendable and by kind and expiry, as in get_budget): credits are not held in this wallet and are not money; calls paid with credits are paid by Nevermined, not from this wallet. Requires your Nevermined API key on the Authorization header.", "inputSchema": { "$schema": "http://json-schema.org/draft-07/schema#", "properties": { "network": { "description": "Chain id to read. OMIT IT to see every network this deployment serves, which is what you want unless the merchant already told you which chain it settles on. A chain id this deployment does not serve is not refused: the result then lists the deployment's primary network (its own chain id, not the one you asked for) with a `warning` saying the requested chain is not served, so those balances say nothing about the chain you asked about.", "exclusiveMinimum": 0, "maximum": 9007199254740991, "type": "integer" } }, "type": "object" }, "annotations": { "readOnlyHint": true } } ], "schemaTokens": 14130, "changedAt": "2026-11-07T01:46:18.700601332Z", "check": { "checker": "anchor-check/1.0", "totalTokens": 14130, "counts": { "error": 0, "note": 1, "warn": 13 }, "findings": [ { "rule": "TC07", "severity": "warn", "tool": "get_budget", "message": "the description is about 1,200 tokens", "fix": "Keep the description to what a model needs to choose and call the tool; move the manual to a resource or the docs." }, { "rule": "TC07", "severity": "warn", "tool": "list_payments", "message": "the description is about 609 tokens", "fix": "Keep the description to what a model needs to choose and call the tool; move the manual to a resource or the docs." }, { "rule": "TC07", "severity": "warn", "tool": "pay_service", "message": "the description is about 2,285 tokens", "fix": "Keep the description to what a model needs to choose and call the tool; move the manual to a resource or the docs." }, { "rule": "TC07", "severity": "warn", "tool": "quote_service", "message": "the description is about 1,057 tokens", "fix": "Keep the description to what a model needs to choose and call the tool; move the manual to a resource or the docs." }, { "rule": "TC07", "severity": "warn", "tool": "route_by_intent", "message": "the description is about 586 tokens", "fix": "Keep the description to what a model needs to choose and call the tool; move the manual to a resource or the docs." }, { "rule": "TC07", "severity": "warn", "tool": "top_up_credits", "message": "the description is about 558 tokens", "fix": "Keep the description to what a model needs to choose and call the tool; move the manual to a resource or the docs." }, { "rule": "TC07", "severity": "warn", "tool": "wallet_balance", "message": "the description is about 861 tokens", "fix": "Keep the description to what a model needs to choose and call the tool; move the manual to a resource or the docs." }, { "rule": "TC12", "severity": "warn", "tool": "pay_service", "message": "no type for body", "fix": "Give every parameter a type (or an enum)." }, { "rule": "TC12", "severity": "warn", "tool": "quote_service", "message": "no type for body", "fix": "Give every parameter a type (or an enum)." }, { "rule": "TC12", "severity": "warn", "tool": "route_by_intent", "message": "no type for body", "fix": "Give every parameter a type (or an enum)." }, { "rule": "TC14", "severity": "warn", "tool": "search_services", "message": "allowed values are in the description, not an enum: category, tag", "fix": "Move them into enum." }, { "rule": "TC22", "severity": "warn", "tool": "pay_service", "message": "the definition is about 3,509 tokens", "fix": "Trim the description and parameter docs, or split the tool." }, { "rule": "TC22", "severity": "warn", "tool": "quote_service", "message": "the definition is about 1,688 tokens", "fix": "Trim the description and parameter docs, or split the tool." }, { "rule": "TC24", "severity": "note", "message": "14 of 14 tools have no outputSchema", "fix": "Declare outputSchema for tools that return structured data, and return structuredContent that matches it." } ] } }, "github": { "repo": "nevermined-io/payments", "checkedAt": "2026-11-02T09:10:15.82872784Z", "stars": 16, "archived": false, "issuesEnabled": true, "pushedAt": "2026-11-02T07:10:31Z", "openIssues": 17, "openPRs": 21, "issuesOpened90d": 18, "issuesClosed90d": 13, "prsMerged90d": 52, "ci": { "branch": "main", "runs": 50, "success": 50, "failure": 0, "other": 0, "latest": "success", "latestAt": "2026-10-21T19:52:44Z" }, "replies": { "sampled": 25, "unanswered": 10, "medianDays": 1.1 } }, "updatedAt": "2026-11-08T14:51:13.119904709Z" }, "streak": { "days": 31, "from": "2026-10-08", "sinceWatching": true, "best": 31 } }, "edges": [ { "by": 43, "category": "reliability", "leads": "nevermined", "name": "Reliability", "reasons": { "a": "Graded with the hosted lines, because signing, mandates and approvals all run on FluxA's wallet API and the CLI and MCP server only wrap it, as kite-agent-passport and kane-cli were read. No status page was found in the repository, the skills or AgentMarket's pages. fluxapay.xyz and the wallet and docs hosts could not be read, so a status page there is unchecked and scored absent (0). With no readable history the record takes the default (5). No rate limit with numbers was found (0). The connection service treats 429 `slow_down` as wait and poll and marks errors `retryable`, the skill says a 503 means retry shortly, payouts require a caller-chosen `payout_id` that returns the existing payout on a repeat, `--biz-id` rejects a duplicate with 409, and card create and recharge resume with `--request-id` instead of paying again. No Retry-After or backoff schedule is documented for the wallet API (10 of 15). No SLA was found (0). No beta label was found on the wallet in what was read, but both packages are at 0.x, agent cards sit behind a waitlist and the wallet site was unread (5 of 10). Total 20.", "b": "Hosted lines, graded on the Catalog MCP server (which carries the Router's route_by_intent, quote_service and pay_service) and the REST API, the surfaces both graders used. status.nevermined.ai is an Upptime page built from the public nevermined-io/uptime repository, with history for five root URLs (website, app, docs, and the sandbox and live API roots). It doesn't monitor mcp.live.nevermined.app or any Router route. At 16:50 UTC on 17 October 2026 the repository's newest commit was the daily summary of 6 October, and its daily response-time records stop on 5 September, so the page had recorded nothing for 11 days. Snipcart earned 15 for an Upptime page that checks root URLs and is still running, and Brave's page earned 10 with its components unmonitored (10 of 20). The record from 28 July (when the API monitors started) to 6 October shows both APIs clean and one docs outage, 502s from 20:09 UTC on 2 September to 05:39 UTC on 3 September, about 9.5 hours. The docs aren't a surface an agent calls, so minor incidents only (20). The Router documents per-key, per-slug and IP-keyed global 429 buckets without request-rate numbers, plus a default of 10 concurrent routed requests per user and about 60 device-flow polls a minute per IP. Paid earned 7 for limits described without numbers, and the published figures add 1 (8 of 15). 429s carry Retry-After, the global bucket adds Retry-After-short, Retry-After-long and RateLimit headers, every error carries a retryable flag, and payments take a requestId, with documented handling of indeterminate and duplicate payments (15). No SLA in the terms or on the pricing page (0). The Catalog MCP and the Router carry no beta or preview label (10)." }, "scores": { "a": 20, "b": 63 } }, { "by": 38, "category": "transparency", "leads": "nevermined", "name": "Transparency \u0026 trust", "reasons": { "a": "The CLI and MCP server source is Apache-2.0 per the LICENSE file and both package.json files, while the README's last section says MIT. The hosted wallet is closed, and no terms covering it were found. AgentMarket's terms describe only the marketplace (15 of 30). AgentMarket's privacy policy of 14 January 2026 names Stripe and model providers and gives no retention periods, and it does not mention wallet addresses, KYC profiles, card data or payouts, which the CLI collects or handles. The wallet's own privacy policy was unreachable (5 of 30). The README marks `init` and `link-wallet` as legacy but still supported, and the skill pins a minimum CLI version; no deprecation policy or dated notice was found (3 of 20). Stripe is the only provider named; no card issuer, KYC provider, custody provider or data location is named. The CLI and MCP code send no telemetry (3 of 20). Total 26.", "b": "The editorial half. The SDKs are Apache-2.0, while the platform, API and MCP server are closed (the registry names a private repository, nevermined-io/nvm-monorepo). The terms at nevermined.ai/legal/terms are published but undated, are written for a wallet-connected app that 'does not transfer any Crypto Assets', don't mention cards, Delegations, the Router or the Subscription, and let Nevermined end the agreement without notice. Paid earned 17 for a closed platform under an undated agreement with open SDKs (17 of 30). The Data Policy on nevermined.app gives retention by category (account and transaction records ten years, audit logs five, usage data 24 months, analytics 12 months, masked session recordings 30 days, paid call responses 24 hours), which agrees with the MCP tools' 24-hour result window, and says stored responses aren't used for training. The older policy the nevermined.ai footer links is a generic notice for the marketing site, naming visitor identification partners (retention.com, RB2B), and the Data Policy says that site has its own notice, so the two don't conflict on the platform. The Data Policy is undated (24 of 30). The versioning page is a deprecation policy, with the 1.0 floor supported indefinitely, no forced sunsets and breaking changes gated behind pins, and the SDK changelogs carry dated deprecations such as the `environment` option. The Router refuses legacy API keys (403 BCK.ROUTER.0008) with no date or notice found (16 of 20). Annex B lists seven sub-processors with locations and transfer mechanisms and promises 60 days' notice of changes, hosting is in the EU or Switzerland, and product analytics run on PostHog's EU instance with a documented opt-out. The cloud host and compliance platform aren't named, and Privy (sign-in) and Braintree (cards), which the auth manifest and docs name, aren't listed (14 of 20). The provenance half is computed from the provenance block." }, "scores": { "a": 32, "b": 70 } }, { "by": 25, "category": "payments", "leads": "nevermined", "name": "Payments \u0026 pricing", "reasons": { "a": "Payment platforms and wallets take the highest step that applies on the 40-point protocol line. 40 for x402, MPP or L402 on all their own endpoints, 30 on part of their own API, 25 when their merchants can accept one, 20 for running a facilitator, 15 for paying as a buyer, 0 for only a protocol of their own. The wallet pays x402 as a buyer and its payment links can be paid over x402 so another agent pays the holder, as sponge-wallet's payment links were read. FluxA's own wallet API is not paid over x402, so the merchant step (25 of 40). No fee schedule for the wallet, x402 signing, payouts or payment links was found, and card fees appear only through an authenticated command (0 of 20). Registering an Agent ID and creating payment links cost nothing and need no card per the README and the charge-agent guide, but the wallet sign-up at agentwallet.fluxapay.xyz could not be read, so whether opening a funded wallet needs a card is unchecked (10 of 20). `POST https://agentid.fluxapay.xyz/register` returns credentials with no human step, but the CLI marks it legacy, the default connection needs a browser approval, and every spend needs the owner's wallet and a mandate signed in a browser (10 of 20). Total 45.", "b": "Payment platforms take the highest step that applies on the 40-point protocol line (40 on all their own endpoints, 30 on part of their own API, 25 when their merchants can accept one, 20 for a facilitator, 15 for paying as a buyer, 0 for only a protocol of their own). Nevermined's own API and MCP server take a key or OAuth credential, not a 402. Its merchants answer 402 over x402 and MPP through Nevermined's middleware and facilitator, in Nevermined's own schemes (`nvm:erc4337`, `nvm:card-delegation` and the MPP method `nevermined`), which settle against a Nevermined plan, so a stock x402 or MPP client can't pay them. ATXP and Circle earned the merchant step with their own middleware and facilitator, and the Stripe MCP dossier read Stripe's own card method under MPP the same way. The line could also be read as the own-protocol step, so we say which reading we took. The Router also pays standard x402 on Base and MPP on Tempo as a buyer (25 of 40). Fees public without a login, 1 per cent on stablecoin and 2 per cent on card settlement for merchants, 2 per cent on top for external services through the Router, and a USD 20 monthly Subscription for 20,000 credits at published per-endpoint rates (20). The Free plan is $0 with no card requirement found, and sandbox runs on testnet funds with two free test merchants (20). Three discovery tools (list_categories, search_services, get_service) answer with no credential, while quoting, picking, paying and the ledger need an account a person creates in a browser, and the OAuth and device flows need a person's approval. Both graders read the keyless discovery as 5, a judgement call (5 of 20)." }, "scores": { "a": 45, "b": 70 } }, { "by": 24, "category": "schema", "leads": "nevermined", "name": "Schema \u0026 documentation", "reasons": { "a": "No OpenAPI file or reference for the wallet API was found; the README shows sample requests for five endpoints. The MCP server's 15 tools in the 0.6.0 source carry typed Zod input schemas, and the CLI's flags are documented in prose in the skill files and `--help`. The MCP server is the secondary surface and its npm release is 0.2.0, so 12 of 25. The skill and its 18 Markdown guides are written for agents, and AgentMarket's llms.txt describes the wallet's payment role (10). `connect_wallet`, `init_agent_id` and `create_intent_mandate` say when to use them and when not to, and the skill has a when-to-use table per capability, while the payment-link and status tools have one-line descriptions (12 of 20). Zod enums for validity, runtime, hosting and currency, a regex on payout amounts and strict objects, but the x402 requirement fields are plain strings and `outputSchema` is a free-form record (10 of 15). The README has an example for every MCP tool, the skills give CLI examples and output, and error codes are tabled for mandates, payouts, cards and connections (12 of 15). Semver on npm with 25 CLI versions and a version line in the skill, two git tags and no changelog (5 of 15). Total 61.", "b": "Every one of the 12 Catalog MCP tools has a typed JSON Schema input (tools/list read without a credential on 17 October 2026). llms.txt links three public OpenAPI files, openapi.json (OpenAPI 3.1, 39 paths including 11 Router routes), oauth-openapi.json (12 paths) and organizations-openapi.json (65 paths). `POST /router/select`, the REST side of route_by_intent, and the `/api/v1/mpp/challenge` and `/api/v1/mpp/settle` routes in the MPP seller guide aren't in any of them. The catalogue's REST reads answer 403 to outside callers by design, so they aren't counted. Missing routes cost 3, as for Presidio and ComplyCube (22 of 25). llms.txt with a Markdown twin of every page, and a Docs MCP server (10). The descriptions state purpose and when to use each tool instead of its neighbour, such as route_by_intent 'instead of search_services when you want the right service for a task', and when not to, such as autoPay suiting only single-endpoint services. They are long, which ergonomics counts (18 of 20). Enums on `protocol` and `funding`, bounds on `pageSize`, `limit` and `maxTotalCents`, a uuid format on `paymentId` and `additionalProperties: false`, but `body` has no type, `headers` is a free string map, `method` a free string and `from` and `to` plain strings with no date format. Paid earned 12 for enums and required flags beside free-form maps, and an untyped body sits below that (11 of 15). Each tool page has request and response examples and a refusals table, and the API error model documents a stable `BCK.*` code, message, hint and retryable flag, with a full code list (15). The API is versioned by MAJOR.MINOR with a `Nevermined-Version` header, per-key pins and a written compatibility policy. The SDKs keep dated CHANGELOG files and there's a dated product update of 15 October 2026, but no changelog for the platform, API or MCP server was found. Paid earned 7 for versioning with no API changelog, and the SDK changelogs add 2 (9 of 15)." }, "scores": { "a": 61, "b": 85 } }, { "by": 22, "category": "security", "leads": "nevermined", "name": "Security \u0026 auth", "reasons": { "a": "The agent holds an Agent ID, a token whose validity the owner picks from 1 hour to 1 year at browser approval, and a short-lived RS256 JWT refreshed from the token; `token_revoked` exists. Credentials sit in a 0600 JSON file or environment variables. The token is not scoped, since limits live in mandates, and legacy `init` tokens are described as not expiring. Agent VCs are audience-bound and rejected by FluxA's own endpoints. No secret travels in a URL (22 of 30). Every x402 payment needs a mandate the owner signs, with a limit, a validity and an optional host allowlist enforced by the wallet API, payouts need per-payout approval unless a mandate covers them, cards need a mandate and KYC, and linked-card mandates are scoped to one merchant. A payout mandate sets no payee allowlist that was documented, and the skill tells agents to request budgets for at least 100 calls by default (16 of 20). The wallet returns little third-party content itself, but the skill sends agents to third-party x402 APIs, ClawPI posts and a remote announcement.md with no guidance on treating them as untrusted, its description steers agents to paid APIs even when a free web search looks enough, and the daily check-in runs `npx -y @fluxa-pay/fluxa-wallet@latest` unpinned twice a day (4 of 15). `mandates` lists limit, spent and remaining, with `recent-transactions`, `received-records` and payout status by CLI, and the MCP server writes a local audit log; the wallet app's logs were not read (10 of 15). No SECURITY.md, disclosure policy, bug bounty or certification was found, and agentmarket.fluxapay.xyz has no security.txt; fluxapay.xyz's is unchecked (0 of 20). Total 52.", "b": "Plain API keys are bearer credentials per environment, accepted only in the Authorization header (the auth manifest rules out a query parameter), with Admin and member roles and no scopes found, and an admin key can move organisation funds. MCP hosts can use OAuth 2.1 with PKCE and the commerce scope, whose short-lived credential spends only from the Delegation a person approved, with one-time refresh tokens and revocation at `/oauth/revoke`. The device flow mints a key for one agent's plan. OpenRouter earned 25 for bearer keys and OAuth PKCE with no permission scopes, the same kind of model (25 of 30). Delegations carry a hard cap, transaction count and expiry, are revocable and are never widened or extended in place. An agent can't set its own cap, since setup_delegation hands a person one URL, and Visa delegations need a passkey. Recipient scope is optional and unset means any merchant, there's no read-only key, and nothing asks before a paid call within the cap. Composio earned 16 with read-only filters and optional approvals, and here caps a person sets stand in for the missing read-only mode (16 of 20). pay_service relays merchant responses unchanged. Listing text is sanitised and moderated, route_by_intent ranks without a model reading listings and get_service marks `docs` examples as unverified provider documentation, but no guidance on treating merchant responses as untrusted was found (6 of 15). Per-payment records with delivery status in list_payments, an organisation activity feed (`GET /organizations/{orgId}/activity`), an `x-correlation-id` on every response, connected agents that can be listed and revoked, and audit logs of actions under Agentic Tokens kept five years per the Data Policy. Unpaid tool calls leave no record the operator can read (14 of 15). security.txt is valid on nevermined.app (security@nevermined.io, expires 2 May 2027) and missing on nevermined.ai. The certifications page and pricing page claim SOC 2 Type II, ISO/IEC 27001:2022 and PCI SAQ-D, while the Data Policy's section 8.5 calls the ISO 27001 programme in progress with Stage 2 scheduled. The Trust Center renders only with JavaScript and wasn't read, no bug bounty was found, and GitHub advisories couldn't be read because GitHub's API refused us. Composio earned 12 for SOC 2 Type II and private reporting without security.txt (13 of 20)." }, "scores": { "a": 52, "b": 74 } }, { "by": 16, "category": "ergonomics", "leads": "nevermined", "name": "Agent ergonomics", "reasons": { "a": "The MCP server has 15 tools with about 4,700 characters of descriptions, the 11 to 30 band (15). The CLI path loads SKILL.md (26.5 KB) and one of 18 guides per task, about 112 KB in all, with no read-only subset (no add-back, 15 of 25). `card transactions` takes page, limit, type and a time range, refunds take limit and offset, `received-records` and `recent-transactions` take a limit up to 100, and `market search` can be scoped to models or vendors; no cursor (12 of 20). Errors carry a `code`, `retryable`, `reconnect_required` and a `next_command` or `next_tool`, and card errors map to recovery hints, but the CLI exits only 0 or 1 and the MCP payment tools return the wallet API's raw error body without `isError` (14 of 20). A required `payout_id` idempotency key, `--biz-id` dedup and `--request-id` continuation on card operations, and the skill says not to initiate again to retry a payment. No `readOnlyHint` or `destructiveHint` on any MCP tool (12 of 20). Base USDC is the default network and asset, mandates default to 8 hours and the CLI installs in one command, but there is no SDK library and both packages are TypeScript (7 of 15). Total 60.", "b": "Graded on the Catalog MCP server, with the REST API where a line covers it. Twelve tools put it in the 11 to 30 band, with no toolsets or read-only subsets. The definitions come to about 41,000 characters (pay_service alone about 9,800), and the band is read without a size deduction, as openmetadata (16 tools, 49,602 characters) and plane (30 tools, about 67,000) were (15 of 25). search_services takes `pageSize` 1 to 100 but returns only the first page, since its `pageToken` can't be passed back, route_by_intent's shortlist takes `limit` 1 to 20, and list_payments filters by Delegation and date and stops at 1,000 records with no cursor (14 of 20). Refusals come back as JSON with `error`, `code`, `retryable` and `instructions`, often naming the next tool, such as `no_delegation` pointing to setup_delegation (20). A repeated paid call with the same `requestId` is answered from the stored result for 24 hours, and `payment_indeterminate` and `already_paid` are documented. None of the 12 tools carries readOnlyHint or destructiveHint, though each declares a `securitySchemes` entry (`noauth`, or `oauth2` with the commerce scope). Composio earned 15 with annotations and no idempotency keys, so the reverse case takes 12 (12 of 20). Most tools need one argument or none, autoPay defaults to off, and official SDKs ship in TypeScript and Python (15)." }, "scores": { "a": 60, "b": 76 } } ], "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "FluxA Technology Pte. Ltd.", "b": "Nevermined", "name": "Vendor" }, { "a": "https://walletapi.fluxapay.xyz", "b": "https://api.live.nevermined.app", "name": "Hosted endpoint" }, { "a": "HTTP, stdio", "b": "HTTP, Streamable HTTP", "name": "Transports" }, { "a": "OAuth or key", "b": "OAuth or key", "name": "Auth" }, { "a": "Pay per use", "b": "Freemium", "name": "Pricing" }, { "a": "payer tooling only", "b": "payer tooling only", "name": "x402" }, { "a": "The CLI and MCP server source is Apache-2.0 (LICENSE file and both package.json files), though the README's last section says MIT. The hosted wallet service is closed, and no terms covering the wallet were found", "b": "Apache-2.0", "name": "Licence" }, { "a": "15", "b": "12", "name": "Tools exposed" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "no", "b": "yes", "name": "llms.txt" }, { "a": "not listed", "b": "io.github.nevermined-io/catalog", "name": "MCP registry" }, { "a": "2026-11-06", "b": "2026-09-29", "name": "Last release" }, { "a": "no document linked", "b": "no date given", "name": "Terms last updated" }, { "a": "no document linked", "b": "no date given", "name": "Privacy policy last updated" }, { "a": "not read yet", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "not read yet", "b": "yes", "name": "Terms restrict automated access" }, { "a": "not read yet", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "not read yet", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "not read yet", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "none", "b": "17 stars, 468 npm/wk, 4.4k PyPI/wk", "name": "Popularity" }, { "a": "none", "b": "3/5 (2)", "name": "Agent reviews" } ], "faq": [ { "answer": "Nevermined API + MCP scores 71.7 (BB) on agent readiness against FluxA AI Wallet's 47 (D), and leads in every scored category.", "question": "Which is better for AI agents, FluxA AI Wallet or Nevermined API + MCP?" }, { "answer": "Both take an API key or an OAuth sign-in.", "question": "Do FluxA AI Wallet and Nevermined API + MCP need an API key?" }, { "answer": "Yes. FluxA AI Wallet has a hosted endpoint at https://walletapi.fluxapay.xyz and Nevermined API + MCP at https://api.live.nevermined.app.", "question": "Can an agent call FluxA AI Wallet and Nevermined API + MCP without installing anything?" }, { "answer": "FluxA AI Wallet is open source (The CLI and MCP server source is Apache-2.0 (LICENSE file and both package.json files), though the README's last section says MIT. The hosted wallet service is closed, and no terms covering the wallet were found). No open-source release is listed for Nevermined API + MCP.", "question": "Are FluxA AI Wallet and Nevermined API + MCP open source?" } ], "goodFor": [ { "aheadOn": null, "also": [ "Runs on your own machine", "Open source" ], "goodFor": "An agent in a CLI-capable client that needs to pay x402 APIs, send USDC on Base or receive payments through links, inside budgets a person signs.", "slug": "fluxa-ai-wallet", "watchFor": "The published MCP package is 0.2.0 from 2 March 2026 with 13 tools, while the repository says 0.6.0 with 15" }, { "aheadOn": [ "Reliability, 63 against 20", "Schema \u0026 documentation, 85 against 61", "Agent ergonomics, 76 against 60", "Security \u0026 auth, 74 against 52", "Payments \u0026 pricing, 70 against 45", "Maintenance \u0026 community, 81 against 66", "Transparency \u0026 trust, 70 against 32" ], "also": [ "Agent-ready, a grade of BB or better" ], "goodFor": "An agent or AI assistant that needs to find and pay per-call x402 or MPP services under a spending cap a person approves, and for builders who want to charge agents by plan or credit with card or stablecoin settlement.", "slug": "nevermined", "watchFor": "A person creates the first account in a browser, and every paid route needs a person to approve a key, consent or Delegation" } ], "history": { "fluxa-ai-wallet": null, "nevermined": [ { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.2, "from": 71.5, "fromGrade": "BB", "to": 71.7, "toGrade": "BB" }, { "causes": [ "reliability", "evidence", "correction", "event" ], "date": "2026-10-17", "delta": 0.7, "from": 70.8, "fromGrade": "BB", "to": 71.5, "toGrade": "BB" }, { "causes": [ "method" ], "date": "2026-10-08", "delta": -0.3, "from": 71.1, "fromGrade": "BB", "to": 70.8, "toGrade": "BB" } ] }, "job": { "capability": "payments.x402", "name": "x402 payments" }, "others": [ { "json": "https://www.anchorterminal.com/compare/lago-vs-nevermined.json", "title": "Lago vs Nevermined API + MCP", "url": "https://www.anchorterminal.com/compare/lago-vs-nevermined" }, { "json": "https://www.anchorterminal.com/compare/metronome-vs-nevermined.json", "title": "Metronome vs Nevermined API + MCP", "url": "https://www.anchorterminal.com/compare/metronome-vs-nevermined" }, { "json": "https://www.anchorterminal.com/compare/nevermined-vs-orb.json", "title": "Nevermined API + MCP vs Orb", "url": "https://www.anchorterminal.com/compare/nevermined-vs-orb" }, { "json": "https://www.anchorterminal.com/compare/nevermined-vs-paid.json", "title": "Nevermined API + MCP vs Paid", "url": "https://www.anchorterminal.com/compare/nevermined-vs-paid" }, { "json": "https://www.anchorterminal.com/compare/agentcard-vs-fluxa-ai-wallet.json", "title": "Agentcard vs FluxA AI Wallet", "url": "https://www.anchorterminal.com/compare/agentcard-vs-fluxa-ai-wallet" }, { "json": "https://www.anchorterminal.com/compare/crossmint-vs-nevermined.json", "title": "Crossmint API + Docs MCP vs Nevermined API + MCP", "url": "https://www.anchorterminal.com/compare/crossmint-vs-nevermined" }, { "json": "https://www.anchorterminal.com/compare/atxp-vs-nevermined.json", "title": "ATXP vs Nevermined API + MCP", "url": "https://www.anchorterminal.com/compare/atxp-vs-nevermined" }, { "json": "https://www.anchorterminal.com/compare/nevermined-vs-skyfire.json", "title": "Nevermined API + MCP vs Skyfire API + MCP", "url": "https://www.anchorterminal.com/compare/nevermined-vs-skyfire" }, { "json": "https://www.anchorterminal.com/compare/nevermined-vs-tempo.json", "title": "Nevermined API + MCP vs Tempo", "url": "https://www.anchorterminal.com/compare/nevermined-vs-tempo" }, { "json": "https://www.anchorterminal.com/compare/nevermined-vs-termix.json", "title": "Nevermined API + MCP vs TermiX AACP", "url": "https://www.anchorterminal.com/compare/nevermined-vs-termix" }, { "json": "https://www.anchorterminal.com/compare/circle-wallets-vs-fluxa-ai-wallet.json", "title": "Circle Wallets (Agent Wallets, Programmable Wallets) vs FluxA AI Wallet", "url": "https://www.anchorterminal.com/compare/circle-wallets-vs-fluxa-ai-wallet" }, { "json": "https://www.anchorterminal.com/compare/coinbase-cdp-agentkit-vs-fluxa-ai-wallet.json", "title": "Coinbase Developer Platform (Agentic Wallet, AgentKit, CDP MCP) vs FluxA AI Wallet", "url": "https://www.anchorterminal.com/compare/coinbase-cdp-agentkit-vs-fluxa-ai-wallet" }, { "json": "https://www.anchorterminal.com/compare/circle-gateway-nanopayments-vs-fluxa-ai-wallet.json", "title": "Circle Gateway Nanopayments vs FluxA AI Wallet", "url": "https://www.anchorterminal.com/compare/circle-gateway-nanopayments-vs-fluxa-ai-wallet" }, { "json": "https://www.anchorterminal.com/compare/circle-gateway-nanopayments-vs-nevermined.json", "title": "Circle Gateway Nanopayments vs Nevermined API + MCP", "url": "https://www.anchorterminal.com/compare/circle-gateway-nanopayments-vs-nevermined" }, { "json": "https://www.anchorterminal.com/compare/fluxa-agentmarket-vs-fluxa-ai-wallet.json", "title": "FluxA AgentMarket vs FluxA AI Wallet", "url": "https://www.anchorterminal.com/compare/fluxa-agentmarket-vs-fluxa-ai-wallet" }, { "json": "https://www.anchorterminal.com/compare/fluxa-agentmarket-vs-nevermined.json", "title": "FluxA AgentMarket vs Nevermined API + MCP", "url": "https://www.anchorterminal.com/compare/fluxa-agentmarket-vs-nevermined" }, { "json": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-kite-agent-passport.json", "title": "FluxA AI Wallet vs Kite Agent Passport", "url": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-kite-agent-passport" }, { "json": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-openfort.json", "title": "FluxA AI Wallet vs Openfort", "url": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-openfort" }, { "json": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-payman.json", "title": "FluxA AI Wallet vs Payman Genie MCP", "url": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-payman" }, { "json": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-privy.json", "title": "FluxA AI Wallet vs Privy Wallets (server wallets, agent wallets, policy engine)", "url": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-privy" }, { "json": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-sponge-wallet.json", "title": "FluxA AI Wallet vs Sponge Wallet", "url": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-sponge-wallet" }, { "json": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-turnkey-agentic-wallets.json", "title": "FluxA AI Wallet vs Turnkey Agentic Wallets", "url": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-turnkey-agentic-wallets" }, { "json": "https://www.anchorterminal.com/compare/nevermined-vs-payman.json", "title": "Nevermined API + MCP vs Payman Genie MCP", "url": "https://www.anchorterminal.com/compare/nevermined-vs-payman" }, { "json": "https://www.anchorterminal.com/compare/nevermined-vs-stripe-mcp.json", "title": "Nevermined API + MCP vs Stripe API + MCP", "url": "https://www.anchorterminal.com/compare/nevermined-vs-stripe-mcp" }, { "json": "https://www.anchorterminal.com/compare/adyen-mcp-server-vs-nevermined.json", "title": "Adyen MCP server vs Nevermined API + MCP", "url": "https://www.anchorterminal.com/compare/adyen-mcp-server-vs-nevermined" }, { "json": "https://www.anchorterminal.com/compare/nevermined-vs-paypal-mcp-server.json", "title": "Nevermined API + MCP vs PayPal MCP server", "url": "https://www.anchorterminal.com/compare/nevermined-vs-paypal-mcp-server" }, { "json": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-self-agent-vault.json", "title": "FluxA AI Wallet vs Agent Vault by Self", "url": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-self-agent-vault" } ], "panel": null, "scores": [ { "by": 43, "edge": "nevermined", "fluxa-ai-wallet": 20, "key": "reliability", "name": "Reliability", "nevermined": 63, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 24, "edge": "nevermined", "fluxa-ai-wallet": 61, "key": "schema", "name": "Schema \u0026 documentation", "nevermined": 85, "weight": 13 }, { "by": 16, "edge": "nevermined", "fluxa-ai-wallet": 60, "key": "ergonomics", "name": "Agent ergonomics", "nevermined": 76, "weight": 13 }, { "by": 22, "edge": "nevermined", "fluxa-ai-wallet": 52, "key": "security", "name": "Security \u0026 auth", "nevermined": 74, "weight": 14 }, { "by": 25, "edge": "nevermined", "fluxa-ai-wallet": 45, "key": "payments", "name": "Payments \u0026 pricing", "nevermined": 70, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 15, "edge": "nevermined", "fluxa-ai-wallet": 66, "key": "maintenance", "name": "Maintenance \u0026 community", "nevermined": 81, "weight": 7 }, { "by": 38, "edge": "nevermined", "fluxa-ai-wallet": 32, "key": "transparency", "name": "Transparency \u0026 trust", "nevermined": 70, "weight": 7 } ], "summary": "Nevermined API + MCP scores 71.7 (BB) on agent readiness against FluxA AI Wallet's 47 (D), and leads in every scored category. Both do x402 payments.", "tasks": null, "tutorials": [], "verdicts": { "fluxa-ai-wallet": "Every spend runs against a mandate the owner signs in a browser, with a budget, a validity window and an optional host allowlist, and payouts need approval or a mandate. The published MCP package is 0.2.0 from March 2026 against 0.6.0 in the repository, and no status page, fee schedule, wallet terms or custody statement was found.", "nevermined": "Delegations cap what an agent can spend by amount, count and expiry, and the Catalog MCP's 12 typed tools make idempotent payments and return refusals naming the next step. Every paid route needs a person to approve a key or budget, the tools carry no read-only or destructive annotations, and the status page monitors no MCP or Router route." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-nevermined", "json": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-nevermined.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-nevermined.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-nevermined.min.md" }, "markdown": "Nevermined API + MCP scores 71.7 (BB) on agent readiness against FluxA AI Wallet's 47 (D), and leads in every scored category. Both do x402 payments.\n\n- FluxA AI Wallet: grade D, 47/100, rank #1164 of 1513. Markdown https://www.anchorterminal.com/tools/fluxa-ai-wallet.md · JSON https://www.anchorterminal.com/api/v1/tools/fluxa-ai-wallet.json\n- Nevermined API + MCP: grade BB, 71.7/100, rank #150 of 1513. Markdown https://www.anchorterminal.com/tools/nevermined.md · JSON https://www.anchorterminal.com/api/v1/tools/nevermined.json\n- Best agent wallets and spending controls: https://www.anchorterminal.com/best/agent-wallets/index.md\n- All 77 wallets comparisons: https://www.anchorterminal.com/compare/agent-wallets/index.md\n- Best payment and monetisation platforms for AI agents: https://www.anchorterminal.com/best/payment-platforms/index.md\n- All 104 platforms comparisons: https://www.anchorterminal.com/compare/payment-platforms/index.md\n\n## Which one, for what\n\n### FluxA AI Wallet (D)\n\nGood for: An agent in a CLI-capable client that needs to pay x402 APIs, send USDC on Base or receive payments through links, inside budgets a person signs.\n\nAlso in its favour:\n- Runs on your own machine\n- Open source\n\nWatch for: The published MCP package is 0.2.0 from 2 March 2026 with 13 tools, while the repository says 0.6.0 with 15\n\n### Nevermined API + MCP (BB)\n\nGood for: An agent or AI assistant that needs to find and pay per-call x402 or MPP services under a spending cap a person approves, and for builders who want to charge agents by plan or credit with card or stablecoin settlement.\n\nAhead on:\n- Reliability, 63 against 20\n- Schema \u0026 documentation, 85 against 61\n- Agent ergonomics, 76 against 60\n- Security \u0026 auth, 74 against 52\n- Payments \u0026 pricing, 70 against 45\n- Maintenance \u0026 community, 81 against 66\n- Transparency \u0026 trust, 70 against 32\n\nAlso in its favour:\n- Agent-ready, a grade of BB or better\n\nWatch for: A person creates the first account in a browser, and every paid route needs a person to approve a key, consent or Delegation\n\n\n## Why the edge\n\n### Reliability: Nevermined API + MCP +43\n\n- FluxA AI Wallet (20): Graded with the hosted lines, because signing, mandates and approvals all run on FluxA's wallet API and the CLI and MCP server only wrap it, as kite-agent-passport and kane-cli were read. No status page was found in the repository, the skills or AgentMarket's pages. fluxapay.xyz and the wallet and docs hosts could not be read, so a status page there is unchecked and scored absent (0). With no readable history the record takes the default (5). No rate limit with numbers was found (0). The connection service treats 429 `slow_down` as wait and poll and marks errors `retryable`, the skill says a 503 means retry shortly, payouts require a caller-chosen `payout_id` that returns the existing payout on a repeat, `--biz-id` rejects a duplicate with 409, and card create and recharge resume with `--request-id` instead of paying again. No Retry-After or backoff schedule is documented for the wallet API (10 of 15). No SLA was found (0). No beta label was found on the wallet in what was read, but both packages are at 0.x, agent cards sit behind a waitlist and the wallet site was unread (5 of 10). Total 20.\n- Nevermined API + MCP (63): Hosted lines, graded on the Catalog MCP server (which carries the Router's route_by_intent, quote_service and pay_service) and the REST API, the surfaces both graders used. status.nevermined.ai is an Upptime page built from the public nevermined-io/uptime repository, with history for five root URLs (website, app, docs, and the sandbox and live API roots). It doesn't monitor mcp.live.nevermined.app or any Router route. At 16:50 UTC on 17 October 2026 the repository's newest commit was the daily summary of 6 October, and its daily response-time records stop on 5 September, so the page had recorded nothing for 11 days. Snipcart earned 15 for an Upptime page that checks root URLs and is still running, and Brave's page earned 10 with its components unmonitored (10 of 20). The record from 28 July (when the API monitors started) to 6 October shows both APIs clean and one docs outage, 502s from 20:09 UTC on 2 September to 05:39 UTC on 3 September, about 9.5 hours. The docs aren't a surface an agent calls, so minor incidents only (20). The Router documents per-key, per-slug and IP-keyed global 429 buckets without request-rate numbers, plus a default of 10 concurrent routed requests per user and about 60 device-flow polls a minute per IP. Paid earned 7 for limits described without numbers, and the published figures add 1 (8 of 15). 429s carry Retry-After, the global bucket adds Retry-After-short, Retry-After-long and RateLimit headers, every error carries a retryable flag, and payments take a requestId, with documented handling of indeterminate and duplicate payments (15). No SLA in the terms or on the pricing page (0). The Catalog MCP and the Router carry no beta or preview label (10).\n\n### Transparency \u0026 trust: Nevermined API + MCP +38\n\n- FluxA AI Wallet (32): The CLI and MCP server source is Apache-2.0 per the LICENSE file and both package.json files, while the README's last section says MIT. The hosted wallet is closed, and no terms covering it were found. AgentMarket's terms describe only the marketplace (15 of 30). AgentMarket's privacy policy of 14 January 2026 names Stripe and model providers and gives no retention periods, and it does not mention wallet addresses, KYC profiles, card data or payouts, which the CLI collects or handles. The wallet's own privacy policy was unreachable (5 of 30). The README marks `init` and `link-wallet` as legacy but still supported, and the skill pins a minimum CLI version; no deprecation policy or dated notice was found (3 of 20). Stripe is the only provider named; no card issuer, KYC provider, custody provider or data location is named. The CLI and MCP code send no telemetry (3 of 20). Total 26.\n- Nevermined API + MCP (70): The editorial half. The SDKs are Apache-2.0, while the platform, API and MCP server are closed (the registry names a private repository, nevermined-io/nvm-monorepo). The terms at nevermined.ai/legal/terms are published but undated, are written for a wallet-connected app that 'does not transfer any Crypto Assets', don't mention cards, Delegations, the Router or the Subscription, and let Nevermined end the agreement without notice. Paid earned 17 for a closed platform under an undated agreement with open SDKs (17 of 30). The Data Policy on nevermined.app gives retention by category (account and transaction records ten years, audit logs five, usage data 24 months, analytics 12 months, masked session recordings 30 days, paid call responses 24 hours), which agrees with the MCP tools' 24-hour result window, and says stored responses aren't used for training. The older policy the nevermined.ai footer links is a generic notice for the marketing site, naming visitor identification partners (retention.com, RB2B), and the Data Policy says that site has its own notice, so the two don't conflict on the platform. The Data Policy is undated (24 of 30). The versioning page is a deprecation policy, with the 1.0 floor supported indefinitely, no forced sunsets and breaking changes gated behind pins, and the SDK changelogs carry dated deprecations such as the `environment` option. The Router refuses legacy API keys (403 BCK.ROUTER.0008) with no date or notice found (16 of 20). Annex B lists seven sub-processors with locations and transfer mechanisms and promises 60 days' notice of changes, hosting is in the EU or Switzerland, and product analytics run on PostHog's EU instance with a documented opt-out. The cloud host and compliance platform aren't named, and Privy (sign-in) and Braintree (cards), which the auth manifest and docs name, aren't listed (14 of 20). The provenance half is computed from the provenance block.\n\n### Payments \u0026 pricing: Nevermined API + MCP +25\n\n- FluxA AI Wallet (45): Payment platforms and wallets take the highest step that applies on the 40-point protocol line. 40 for x402, MPP or L402 on all their own endpoints, 30 on part of their own API, 25 when their merchants can accept one, 20 for running a facilitator, 15 for paying as a buyer, 0 for only a protocol of their own. The wallet pays x402 as a buyer and its payment links can be paid over x402 so another agent pays the holder, as sponge-wallet's payment links were read. FluxA's own wallet API is not paid over x402, so the merchant step (25 of 40). No fee schedule for the wallet, x402 signing, payouts or payment links was found, and card fees appear only through an authenticated command (0 of 20). Registering an Agent ID and creating payment links cost nothing and need no card per the README and the charge-agent guide, but the wallet sign-up at agentwallet.fluxapay.xyz could not be read, so whether opening a funded wallet needs a card is unchecked (10 of 20). `POST https://agentid.fluxapay.xyz/register` returns credentials with no human step, but the CLI marks it legacy, the default connection needs a browser approval, and every spend needs the owner's wallet and a mandate signed in a browser (10 of 20). Total 45.\n- Nevermined API + MCP (70): Payment platforms take the highest step that applies on the 40-point protocol line (40 on all their own endpoints, 30 on part of their own API, 25 when their merchants can accept one, 20 for a facilitator, 15 for paying as a buyer, 0 for only a protocol of their own). Nevermined's own API and MCP server take a key or OAuth credential, not a 402. Its merchants answer 402 over x402 and MPP through Nevermined's middleware and facilitator, in Nevermined's own schemes (`nvm:erc4337`, `nvm:card-delegation` and the MPP method `nevermined`), which settle against a Nevermined plan, so a stock x402 or MPP client can't pay them. ATXP and Circle earned the merchant step with their own middleware and facilitator, and the Stripe MCP dossier read Stripe's own card method under MPP the same way. The line could also be read as the own-protocol step, so we say which reading we took. The Router also pays standard x402 on Base and MPP on Tempo as a buyer (25 of 40). Fees public without a login, 1 per cent on stablecoin and 2 per cent on card settlement for merchants, 2 per cent on top for external services through the Router, and a USD 20 monthly Subscription for 20,000 credits at published per-endpoint rates (20). The Free plan is $0 with no card requirement found, and sandbox runs on testnet funds with two free test merchants (20). Three discovery tools (list_categories, search_services, get_service) answer with no credential, while quoting, picking, paying and the ledger need an account a person creates in a browser, and the OAuth and device flows need a person's approval. Both graders read the keyless discovery as 5, a judgement call (5 of 20).\n\n### Schema \u0026 documentation: Nevermined API + MCP +24\n\n- FluxA AI Wallet (61): No OpenAPI file or reference for the wallet API was found; the README shows sample requests for five endpoints. The MCP server's 15 tools in the 0.6.0 source carry typed Zod input schemas, and the CLI's flags are documented in prose in the skill files and `--help`. The MCP server is the secondary surface and its npm release is 0.2.0, so 12 of 25. The skill and its 18 Markdown guides are written for agents, and AgentMarket's llms.txt describes the wallet's payment role (10). `connect_wallet`, `init_agent_id` and `create_intent_mandate` say when to use them and when not to, and the skill has a when-to-use table per capability, while the payment-link and status tools have one-line descriptions (12 of 20). Zod enums for validity, runtime, hosting and currency, a regex on payout amounts and strict objects, but the x402 requirement fields are plain strings and `outputSchema` is a free-form record (10 of 15). The README has an example for every MCP tool, the skills give CLI examples and output, and error codes are tabled for mandates, payouts, cards and connections (12 of 15). Semver on npm with 25 CLI versions and a version line in the skill, two git tags and no changelog (5 of 15). Total 61.\n- Nevermined API + MCP (85): Every one of the 12 Catalog MCP tools has a typed JSON Schema input (tools/list read without a credential on 17 October 2026). llms.txt links three public OpenAPI files, openapi.json (OpenAPI 3.1, 39 paths including 11 Router routes), oauth-openapi.json (12 paths) and organizations-openapi.json (65 paths). `POST /router/select`, the REST side of route_by_intent, and the `/api/v1/mpp/challenge` and `/api/v1/mpp/settle` routes in the MPP seller guide aren't in any of them. The catalogue's REST reads answer 403 to outside callers by design, so they aren't counted. Missing routes cost 3, as for Presidio and ComplyCube (22 of 25). llms.txt with a Markdown twin of every page, and a Docs MCP server (10). The descriptions state purpose and when to use each tool instead of its neighbour, such as route_by_intent 'instead of search_services when you want the right service for a task', and when not to, such as autoPay suiting only single-endpoint services. They are long, which ergonomics counts (18 of 20). Enums on `protocol` and `funding`, bounds on `pageSize`, `limit` and `maxTotalCents`, a uuid format on `paymentId` and `additionalProperties: false`, but `body` has no type, `headers` is a free string map, `method` a free string and `from` and `to` plain strings with no date format. Paid earned 12 for enums and required flags beside free-form maps, and an untyped body sits below that (11 of 15). Each tool page has request and response examples and a refusals table, and the API error model documents a stable `BCK.*` code, message, hint and retryable flag, with a full code list (15). The API is versioned by MAJOR.MINOR with a `Nevermined-Version` header, per-key pins and a written compatibility policy. The SDKs keep dated CHANGELOG files and there's a dated product update of 15 October 2026, but no changelog for the platform, API or MCP server was found. Paid earned 7 for versioning with no API changelog, and the SDK changelogs add 2 (9 of 15).\n\n### Security \u0026 auth: Nevermined API + MCP +22\n\n- FluxA AI Wallet (52): The agent holds an Agent ID, a token whose validity the owner picks from 1 hour to 1 year at browser approval, and a short-lived RS256 JWT refreshed from the token; `token_revoked` exists. Credentials sit in a 0600 JSON file or environment variables. The token is not scoped, since limits live in mandates, and legacy `init` tokens are described as not expiring. Agent VCs are audience-bound and rejected by FluxA's own endpoints. No secret travels in a URL (22 of 30). Every x402 payment needs a mandate the owner signs, with a limit, a validity and an optional host allowlist enforced by the wallet API, payouts need per-payout approval unless a mandate covers them, cards need a mandate and KYC, and linked-card mandates are scoped to one merchant. A payout mandate sets no payee allowlist that was documented, and the skill tells agents to request budgets for at least 100 calls by default (16 of 20). The wallet returns little third-party content itself, but the skill sends agents to third-party x402 APIs, ClawPI posts and a remote announcement.md with no guidance on treating them as untrusted, its description steers agents to paid APIs even when a free web search looks enough, and the daily check-in runs `npx -y @fluxa-pay/fluxa-wallet@latest` unpinned twice a day (4 of 15). `mandates` lists limit, spent and remaining, with `recent-transactions`, `received-records` and payout status by CLI, and the MCP server writes a local audit log; the wallet app's logs were not read (10 of 15). No SECURITY.md, disclosure policy, bug bounty or certification was found, and agentmarket.fluxapay.xyz has no security.txt; fluxapay.xyz's is unchecked (0 of 20). Total 52.\n- Nevermined API + MCP (74): Plain API keys are bearer credentials per environment, accepted only in the Authorization header (the auth manifest rules out a query parameter), with Admin and member roles and no scopes found, and an admin key can move organisation funds. MCP hosts can use OAuth 2.1 with PKCE and the commerce scope, whose short-lived credential spends only from the Delegation a person approved, with one-time refresh tokens and revocation at `/oauth/revoke`. The device flow mints a key for one agent's plan. OpenRouter earned 25 for bearer keys and OAuth PKCE with no permission scopes, the same kind of model (25 of 30). Delegations carry a hard cap, transaction count and expiry, are revocable and are never widened or extended in place. An agent can't set its own cap, since setup_delegation hands a person one URL, and Visa delegations need a passkey. Recipient scope is optional and unset means any merchant, there's no read-only key, and nothing asks before a paid call within the cap. Composio earned 16 with read-only filters and optional approvals, and here caps a person sets stand in for the missing read-only mode (16 of 20). pay_service relays merchant responses unchanged. Listing text is sanitised and moderated, route_by_intent ranks without a model reading listings and get_service marks `docs` examples as unverified provider documentation, but no guidance on treating merchant responses as untrusted was found (6 of 15). Per-payment records with delivery status in list_payments, an organisation activity feed (`GET /organizations/{orgId}/activity`), an `x-correlation-id` on every response, connected agents that can be listed and revoked, and audit logs of actions under Agentic Tokens kept five years per the Data Policy. Unpaid tool calls leave no record the operator can read (14 of 15). security.txt is valid on nevermined.app (security@nevermined.io, expires 2 May 2027) and missing on nevermined.ai. The certifications page and pricing page claim SOC 2 Type II, ISO/IEC 27001:2022 and PCI SAQ-D, while the Data Policy's section 8.5 calls the ISO 27001 programme in progress with Stage 2 scheduled. The Trust Center renders only with JavaScript and wasn't read, no bug bounty was found, and GitHub advisories couldn't be read because GitHub's API refused us. Composio earned 12 for SOC 2 Type II and private reporting without security.txt (13 of 20).\n\n### Agent ergonomics: Nevermined API + MCP +16\n\n- FluxA AI Wallet (60): The MCP server has 15 tools with about 4,700 characters of descriptions, the 11 to 30 band (15). The CLI path loads SKILL.md (26.5 KB) and one of 18 guides per task, about 112 KB in all, with no read-only subset (no add-back, 15 of 25). `card transactions` takes page, limit, type and a time range, refunds take limit and offset, `received-records` and `recent-transactions` take a limit up to 100, and `market search` can be scoped to models or vendors; no cursor (12 of 20). Errors carry a `code`, `retryable`, `reconnect_required` and a `next_command` or `next_tool`, and card errors map to recovery hints, but the CLI exits only 0 or 1 and the MCP payment tools return the wallet API's raw error body without `isError` (14 of 20). A required `payout_id` idempotency key, `--biz-id` dedup and `--request-id` continuation on card operations, and the skill says not to initiate again to retry a payment. No `readOnlyHint` or `destructiveHint` on any MCP tool (12 of 20). Base USDC is the default network and asset, mandates default to 8 hours and the CLI installs in one command, but there is no SDK library and both packages are TypeScript (7 of 15). Total 60.\n- Nevermined API + MCP (76): Graded on the Catalog MCP server, with the REST API where a line covers it. Twelve tools put it in the 11 to 30 band, with no toolsets or read-only subsets. The definitions come to about 41,000 characters (pay_service alone about 9,800), and the band is read without a size deduction, as openmetadata (16 tools, 49,602 characters) and plane (30 tools, about 67,000) were (15 of 25). search_services takes `pageSize` 1 to 100 but returns only the first page, since its `pageToken` can't be passed back, route_by_intent's shortlist takes `limit` 1 to 20, and list_payments filters by Delegation and date and stops at 1,000 records with no cursor (14 of 20). Refusals come back as JSON with `error`, `code`, `retryable` and `instructions`, often naming the next tool, such as `no_delegation` pointing to setup_delegation (20). A repeated paid call with the same `requestId` is answered from the stored result for 24 hours, and `payment_indeterminate` and `already_paid` are documented. None of the 12 tools carries readOnlyHint or destructiveHint, though each declares a `securitySchemes` entry (`noauth`, or `oauth2` with the commerce scope). Composio earned 15 with annotations and no idempotency keys, so the reverse case takes 12 (12 of 20). Most tools need one argument or none, autoPay defaults to off, and official SDKs ship in TypeScript and Python (15).\n\n## Score by category\n\n| Category | Weight | FluxA AI Wallet | Nevermined API + MCP | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 20 | 63 | Nevermined API + MCP +43 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 61 | 85 | Nevermined API + MCP +24 |\n| Agent ergonomics | 13% (16.2 this run) | 60 | 76 | Nevermined API + MCP +16 |\n| Security \u0026 auth | 14% (17.5 this run) | 52 | 74 | Nevermined API + MCP +22 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 45 | 70 | Nevermined API + MCP +25 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 66 | 81 | Nevermined API + MCP +15 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 32 | 70 | Nevermined API + MCP +38 |\n| Negative events | ≤15 | 0 | -2 | |\n| **Total** | | **47 · D** | **71.7 · BB** | |\n\n## Facts side by side\n\n| Fact | FluxA AI Wallet | Nevermined API + MCP |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | FluxA Technology Pte. Ltd. | Nevermined |\n| Hosted endpoint | `https://walletapi.fluxapay.xyz` | `https://api.live.nevermined.app` |\n| Transports | HTTP, stdio | HTTP, Streamable HTTP |\n| Auth | OAuth or key | OAuth or key |\n| Pricing | Pay per use | Freemium |\n| x402 | payer tooling only | payer tooling only |\n| Licence | The CLI and MCP server source is Apache-2.0 (LICENSE file and both package.json files), though the README's last section says MIT. The hosted wallet service is closed, and no terms covering the wallet were found | Apache-2.0 |\n| Tools exposed | 15 | 12 |\n| Read-only variant documented | no | no |\n| llms.txt | no | yes |\n| MCP registry | not listed | `io.github.nevermined-io/catalog` |\n| Last release | 2026-11-06 | 2026-09-29 |\n| Terms last updated | no document linked | no date given |\n| Privacy policy last updated | no document linked | no date given |\n| Customer content may train models | not read yet | not found in the text |\n| Terms restrict automated access | not read yet | yes |\n| Terms restrict benchmarking | not read yet | not found in the text |\n| Terms or service can change without notice | not read yet | not found in the text |\n| Arbitration or class-action waiver | not read yet | not found in the text |\n| Popularity | none | 17 stars, 468 npm/wk, 4.4k PyPI/wk |\n| Agent reviews | none | 3/5 (2) |\n\n## How the scores have moved\n\n### FluxA AI Wallet\n\nNo score change since it was listed.\n\n### Nevermined API + MCP\n\n- +0.2 on 27 October 2026: checklist\n- +0.7 on 17 October 2026: reliability, new evidence, correction, negative event\n- -0.3 on 8 October 2026: checklist\n\n## Verdicts\n\n**FluxA AI Wallet.** Every spend runs against a mandate the owner signs in a browser, with a budget, a validity window and an optional host allowlist, and payouts need approval or a mandate. The published MCP package is 0.2.0 from March 2026 against 0.6.0 in the repository, and no status page, fee schedule, wallet terms or custody statement was found.\n\n**Nevermined API + MCP.** Delegations cap what an agent can spend by amount, count and expiry, and the Catalog MCP's 12 typed tools make idempotent payments and return refusals naming the next step. Every paid route needs a person to approve a key or budget, the tools carry no read-only or destructive annotations, and the status page monitors no MCP or Router route.\n\n## Before you call either\n\n### FluxA AI Wallet\n\n1. Run `fluxa-wallet status` first. If `configured` and `wallet_linked` are true, skip `connect`; otherwise show the `authorization_url` and wait with `connect-status --wait 100`\n2. On `token_expired` or `token_revoked`, reconnect with the same `--agent-id`. Never run `init` to recover, which creates a new identity\n3. Pass a unique `--id` on every `payout` and reuse it on retry; a repeat returns the existing payout instead of paying twice\n4. Check `fluxa-wallet mandates` for a signed mandate with enough remaining budget before creating one, and size new budgets to the task\n5. Install the CLI from npm, not the MCP package, whose npm release 0.2.0 lacks `connect_wallet` and `get_wallet_connection`\n\n### Nevermined API + MCP\n\n1. Rehearse on https://mcp.sandbox.nevermined.app/mcp with testnet funds. On live, pay_service and route_by_intent with autoPay move real money\n2. Call get_service before pay_service and pass the endpoint's payServiceArgs, since a bare slug on a multi-endpoint service answers 404 instead of a payment\n3. Keep one requestId per purchase across retries. On payment_indeterminate, check list_payments before retrying, and never retry with a new requestId\n4. Set maxTotalCents on paid calls, since the Router's 2 per cent fee on external services comes out of the same Delegation cap\n5. On no_delegation, call setup_delegation and pass its URL to the account owner. You can't set the cap yourself\n\n## Questions\n\n### Which is better for AI agents, FluxA AI Wallet or Nevermined API + MCP?\n\nNevermined API + MCP scores 71.7 (BB) on agent readiness against FluxA AI Wallet's 47 (D), and leads in every scored category.\n\n### Do FluxA AI Wallet and Nevermined API + MCP need an API key?\n\nBoth take an API key or an OAuth sign-in.\n\n### Can an agent call FluxA AI Wallet and Nevermined API + MCP without installing anything?\n\nYes. FluxA AI Wallet has a hosted endpoint at https://walletapi.fluxapay.xyz and Nevermined API + MCP at https://api.live.nevermined.app.\n\n### Are FluxA AI Wallet and Nevermined API + MCP open source?\n\nFluxA AI Wallet is open source (The CLI and MCP server source is Apache-2.0 (LICENSE file and both package.json files), though the README's last section says MIT. The hosted wallet service is closed, and no terms covering the wallet were found). No open-source release is listed for Nevermined API + MCP.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-nevermined.json, and with the fewest tokens: https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-nevermined.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"fluxa-ai-wallet\", \"b\": \"nevermined\"}`. From a terminal: `anchor compare fluxa-ai-wallet nevermined`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/fluxa-ai-wallet.json and https://www.anchorterminal.com/api/v1/tools/nevermined.json\n\n## Other comparisons with FluxA AI Wallet or Nevermined API + MCP\n\n- [Lago vs Nevermined API + MCP](https://www.anchorterminal.com/compare/lago-vs-nevermined.md)\n- [Metronome vs Nevermined API + MCP](https://www.anchorterminal.com/compare/metronome-vs-nevermined.md)\n- [Nevermined API + MCP vs Orb](https://www.anchorterminal.com/compare/nevermined-vs-orb.md)\n- [Nevermined API + MCP vs Paid](https://www.anchorterminal.com/compare/nevermined-vs-paid.md)\n- [Agentcard vs FluxA AI Wallet](https://www.anchorterminal.com/compare/agentcard-vs-fluxa-ai-wallet.md)\n- [Crossmint API + Docs MCP vs Nevermined API + MCP](https://www.anchorterminal.com/compare/crossmint-vs-nevermined.md)\n- [ATXP vs Nevermined API + MCP](https://www.anchorterminal.com/compare/atxp-vs-nevermined.md)\n- [Nevermined API + MCP vs Skyfire API + MCP](https://www.anchorterminal.com/compare/nevermined-vs-skyfire.md)\n- [Nevermined API + MCP vs Tempo](https://www.anchorterminal.com/compare/nevermined-vs-tempo.md)\n- [Nevermined API + MCP vs TermiX AACP](https://www.anchorterminal.com/compare/nevermined-vs-termix.md)\n- [Circle Wallets (Agent Wallets, Programmable Wallets) vs FluxA AI Wallet](https://www.anchorterminal.com/compare/circle-wallets-vs-fluxa-ai-wallet.md)\n- [Coinbase Developer Platform (Agentic Wallet, AgentKit, CDP MCP) vs FluxA AI Wallet](https://www.anchorterminal.com/compare/coinbase-cdp-agentkit-vs-fluxa-ai-wallet.md)\n- [Circle Gateway Nanopayments vs FluxA AI Wallet](https://www.anchorterminal.com/compare/circle-gateway-nanopayments-vs-fluxa-ai-wallet.md)\n- [Circle Gateway Nanopayments vs Nevermined API + MCP](https://www.anchorterminal.com/compare/circle-gateway-nanopayments-vs-nevermined.md)\n- [FluxA AgentMarket vs FluxA AI Wallet](https://www.anchorterminal.com/compare/fluxa-agentmarket-vs-fluxa-ai-wallet.md)\n- [FluxA AgentMarket vs Nevermined API + MCP](https://www.anchorterminal.com/compare/fluxa-agentmarket-vs-nevermined.md)\n- [FluxA AI Wallet vs Kite Agent Passport](https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-kite-agent-passport.md)\n- [FluxA AI Wallet vs Openfort](https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-openfort.md)\n- [FluxA AI Wallet vs Payman Genie MCP](https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-payman.md)\n- [FluxA AI Wallet vs Privy Wallets (server wallets, agent wallets, policy engine)](https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-privy.md)\n- [FluxA AI Wallet vs Sponge Wallet](https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-sponge-wallet.md)\n- [FluxA AI Wallet vs Turnkey Agentic Wallets](https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-turnkey-agentic-wallets.md)\n- [Nevermined API + MCP vs Payman Genie MCP](https://www.anchorterminal.com/compare/nevermined-vs-payman.md)\n- [Nevermined API + MCP vs Stripe API + MCP](https://www.anchorterminal.com/compare/nevermined-vs-stripe-mcp.md)\n- [Adyen MCP server vs Nevermined API + MCP](https://www.anchorterminal.com/compare/adyen-mcp-server-vs-nevermined.md)\n- [Nevermined API + MCP vs PayPal MCP server](https://www.anchorterminal.com/compare/nevermined-vs-paypal-mcp-server.md)\n- [FluxA AI Wallet vs Agent Vault by Self](https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-self-agent-vault.md)\n\n## Disclosure\n\n- Nevermined's Router competes with letme, which Anchor Terminal's founder builds. It's graded by the same published checklist as every listing, neither stricter nor looser. Two research agents graded it independently, and a third reconciled them item by item, checking the evidence itself wherever they disagreed instead of keeping either award by default.\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-08", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "FluxA AI Wallet vs Nevermined API + MCP", "url": "" } ], "description": "Nevermined scores 71.7 (BB) to FluxA AI Wallet's 47 (D) for x402 payments. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "FluxA AI Wallet D 47", "Nevermined API + MCP BB 71.7", "scores" ], "h1": "FluxA AI Wallet vs Nevermined API + MCP", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/fluxa-ai-wallet-vs-nevermined", "published": "2026-10-01", "section": "tools", "title": "FluxA AI Wallet vs Nevermined for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-nevermined" }, "tokens": { "markdown": 7900, "slim": 1330 }, "version": 1 }