FluxA AI Wallet vs Openfort

FluxA AI Wallet 20

Graded with the hosted lines, because signing, mandates and approvals all run on FluxA's wallet API and the CLI and MCP server only wrap it, as kite-agent-passport and kane-cli were read. No status page was found in the repository, the skills or AgentMarket's pages. fluxapay.xyz and the wallet and docs hosts could not be read, so a status page there is unchecked and scored absent (0). With no readable history the record takes the default (5). No rate limit with numbers was found (0). The connection service treats 429 slow_down as wait and poll and marks errors retryable, the skill says a 503 means retry shortly, payouts require a caller-chosen payout_id that returns the existing payout on a repeat, --biz-id rejects a duplicate with 409, and card create and recharge resume with --request-id instead of paying again. No Retry-After or backoff schedule is documented for the wallet API (10 of 15). No SLA was found (0). No beta label was found on the wallet in what was read, but both packages are at 0.x, agent cards sit behind a waitlist and the wallet site was unread (5 of 10). Total 20.

Openfort 88

Hosted lines. Status page at status.openfort.io on Better Stack with six components and 90-day bars (20). The previous incidents view reports no incidents for September, October or November 2026, and the 9 October check found none for August either. Three maintenance windows in September (1st and 15th of 10 and 14 minutes, 28th). The API bar reads 99.994 per cent, a few minutes down that no incident entry explains (28 of 30). Rate limits published per plan, 100 to 1,200 requests a minute (15). A 429 carries Retry-After, the errors page asks for exponential backoff on 5xx and says to re-read a resource before retrying a write. No idempotency key is documented, though the Node SDK sends an X-Idempotency-Key header (12 of 15). The pricing page lists SLA guarantees on Enterprise and the terms say an SLA may be negotiated in an order form. None is published (5 of 10). The API is generally available with an OpenAPI file at 1.0.0. The Node SDK is 0.13.3 and the CLI 0.2.2 (8 of 10). Limits, errors and terms per the 9 October check, not re-read on 1 November.

FluxA AI Wallet 32

The CLI and MCP server source is Apache-2.0 per the LICENSE file and both package.json files, while the README's last section says MIT. The hosted wallet is closed, and no terms covering it were found. AgentMarket's terms describe only the marketplace (15 of 30). AgentMarket's privacy policy of 14 January 2026 names Stripe and model providers and gives no retention periods, and it does not mention wallet addresses, KYC profiles, card data or payouts, which the CLI collects or handles. The wallet's own privacy policy was unreachable (5 of 30). The README marks init and link-wallet as legacy but still supported, and the skill pins a minimum CLI version; no deprecation policy or dated notice was found (3 of 20). Stripe is the only provider named; no card issuer, KYC provider, custody provider or data location is named. The CLI and MCP code send no telemetry (3 of 20). Total 26.

Openfort 71

Closed service under developer terms that name the entity. The Node SDK and OpenSigner are MIT, and the CLI states no licence (20 of 30). The privacy policy of 4 September 2026 gives retention periods and names Google Cloud, PostHog and Sentry. It says Openfort does not store private keys and also lists encrypted key material among what it holds, and the docs index calls backend wallets custodial while the terms call them non-custodial. No DPA found (18 of 30). llms.txt states that /v1 changes are additive and a deprecated endpoint keeps working at least 90 days after a changelog notice. We read that summary, not the full policy page, and found no dated deprecation notice (15 of 20). Processors and a United States base are in the privacy policy. Payment processors are unnamed and there is no sub-processor list with locations (11 of 20).

FluxA AI Wallet 61

No OpenAPI file or reference for the wallet API was found; the README shows sample requests for five endpoints. The MCP server's 15 tools in the 0.6.0 source carry typed Zod input schemas, and the CLI's flags are documented in prose in the skill files and --help. The MCP server is the secondary surface and its npm release is 0.2.0, so 12 of 25. The skill and its 18 Markdown guides are written for agents, and AgentMarket's llms.txt describes the wallet's payment role (10). connect_wallet, init_agent_id and create_intent_mandate say when to use them and when not to, and the skill has a when-to-use table per capability, while the payment-link and status tools have one-line descriptions (12 of 20). Zod enums for validity, runtime, hosting and currency, a regex on payout amounts and strict objects, but the x402 requirement fields are plain strings and outputSchema is a free-form record (10 of 15). The README has an example for every MCP tool, the skills give CLI examples and output, and error codes are tabled for mandates, payouts, cards and connections (12 of 15). Semver on npm with 25 CLI versions and a version line in the skill, two git tags and no changelog (5 of 15). Total 61.

Openfort 89

Public OpenAPI 3.0.3 file with 94 operations on 80 paths (25). llms.txt, a docs index, a full-text file and a Markdown twin of every docs page (10). All 94 operations carry a summary or description, and the guides say what each policy operation does and does not check (16 of 20). Policy rules are typed by operation and criterion, and the API refuses a criterion that cannot match its operation (13 of 15). 86 of 94 operations carry examples, and the errors page has the envelope and a status table. Only two error types exist and the error.code values are not listed (12 of 15). Path versioning, a versioning policy and a dated changelog. llms.txt says every endpoint lives under /v1 while the OpenAPI file has /v2 and /iam/v2 paths (13 of 15).

FluxA AI Wallet 66

@fluxa-pay/fluxa-wallet 0.6.0 was published on 6 November 2026, one day before this check (30). Eight CLI releases since 10 August 2026, among them 0.5.2 on 14 October, 0.5.3 on 25 October and 0.5.6, 0.5.7 and 0.6.0 between 3 and 6 November (20). The repository merged 43 pull requests, all from the organisation's own branches, and commits run weekly. Issues and outside pull requests could not be read because the GitHub API refused the session. Discord and a support address are linked from AgentMarket and were not tested (8 of 25). Graded as an API, the line asks for current official SDKs. The CLI is current, but there is no SDK library and the MCP package on npm has not been published since 2 March 2026 (5 of 15). 68 node:test cases exist with no CI workflow, neither npm package declares its repository, and the MCP package's last release lags the source by eight months (3 of 10). Total 66.

Openfort 87

Node SDK 0.13.3 on 23 October 2026, a fix for requests failing on Cloudflare Workers (30). The newest changelog entry is 28 September. In the 90 days from 3 August we counted changelog entries on 28 August and 28 September, Node SDK 0.12.0 to 0.13.3 (seven tags from 31 August to 23 October, 0.13.2 a dependency bump that counts half) and CLI 0.2.2 on 7 September (20). The one outside issue in the 30 most recent items on the Node SDK repository was closed in four days with a reply, and three outside pull requests from May and June were merged on 25 September, per the 9 October check, not re-read on 1 November (GitHub's pages answered 403). Support is a Telegram group and plan response times of 24 to 48 hours (15 of 25). Current official SDKs. No entry in the MCP registry (15). CI runs a build, type check and pnpm audit, Dependabot is active. Both packages are below 1.0 (7 of 10).

FluxA AI Wallet 45

Payment platforms and wallets take the highest step that applies on the 40-point protocol line. 40 for x402, MPP or L402 on all their own endpoints, 30 on part of their own API, 25 when their merchants can accept one, 20 for running a facilitator, 15 for paying as a buyer, 0 for only a protocol of their own. The wallet pays x402 as a buyer and its payment links can be paid over x402 so another agent pays the holder, as sponge-wallet's payment links were read. FluxA's own wallet API is not paid over x402, so the merchant step (25 of 40). No fee schedule for the wallet, x402 signing, payouts or payment links was found, and card fees appear only through an authenticated command (0 of 20). Registering an Agent ID and creating payment links cost nothing and need no card per the README and the charge-agent guide, but the wallet sign-up at agentwallet.fluxapay.xyz could not be read, so whether opening a funded wallet needs a card is unchecked (10 of 20). POST https://agentid.fluxapay.xyz/register returns credentials with no human step, but the CLI marks it legacy, the default connection needs a browser approval, and every spend needs the owner's wallet and a mandate signed in a browser (10 of 20). Total 45.

Openfort 60

Wallets take the highest step that applies on the 40-point protocol line, as for the other wallet listings. Openfort wallets pay over x402 and MPP as a buyer, per the docs recipes and the product page, and its own API is not paid over either, so the buyer step (15 of 40). Per-operation prices on every plan are public without a login (20). Free plan of 2,000 operations a month with no card (20). A person signs up in the dashboard or approves openfort login in a browser once, after which the CLI creates wallets and policies (5 of 20).

FluxA AI Wallet 52

The agent holds an Agent ID, a token whose validity the owner picks from 1 hour to 1 year at browser approval, and a short-lived RS256 JWT refreshed from the token; token_revoked exists. Credentials sit in a 0600 JSON file or environment variables. The token is not scoped, since limits live in mandates, and legacy init tokens are described as not expiring. Agent VCs are audience-bound and rejected by FluxA's own endpoints. No secret travels in a URL (22 of 30). Every x402 payment needs a mandate the owner signs, with a limit, a validity and an optional host allowlist enforced by the wallet API, payouts need per-payout approval unless a mandate covers them, cards need a mandate and KYC, and linked-card mandates are scoped to one merchant. A payout mandate sets no payee allowlist that was documented, and the skill tells agents to request budgets for at least 100 calls by default (16 of 20). The wallet returns little third-party content itself, but the skill sends agents to third-party x402 APIs, ClawPI posts and a remote announcement.md with no guidance on treating them as untrusted, its description steers agents to paid APIs even when a free web search looks enough, and the daily check-in runs npx -y @fluxa-pay/fluxa-wallet@latest unpinned twice a day (4 of 15). mandates lists limit, spent and remaining, with recent-transactions, received-records and payout status by CLI, and the MCP server writes a local audit log; the wallet app's logs were not read (10 of 15). No SECURITY.md, disclosure policy, bug bounty or certification was found, and agentmarket.fluxapay.xyz has no security.txt; fluxapay.xyz's is unchecked (0 of 20). Total 52.

Openfort 65

Secret keys carry 26 named scopes and can be rolled, test and live are isolated, and backend signing needs a second credential, a wallet secret that signs an ES256 JWT with a nonce and request hash and can be rotated. A key made without a scope list includes accounts:sign and accounts:export (26 of 30). The policy engine rejects what no rule matches and policies can be scoped to one wallet, and session keys are limited on-chain. For an EVM backend send the engine sees only a hash, so address, value and calldata rules bind only if the caller pre-flights, and no approval step or rolling cap was found (11 of 20). The product page says an injected prompt can attempt a transaction but cannot take a key, and the docs advise one policy-bounded wallet per agent and a tool allowlist. The CLI MCP server lists key export tools that return the private key (7 of 15). API logs in the dashboard, webhooks, a request id on every response and emails on 500s (11 of 15). Five named audits and a security contact. No security.txt, no bug bounty found and no SOC 2, which the vendor states (10 of 20).