{ "data": { "a": { "slug": "fluxa-ai-wallet", "name": "FluxA AI Wallet", "vendor": "FluxA Technology Pte. Ltd.", "vendorUrl": "https://fluxapay.xyz", "kind": "http-api", "category": "agent-wallets", "summary": "FluxA AI Wallet is a hosted agent wallet from FluxA Technology that signs x402 (EIP-3009) USDC payments on Base within budgets a person approves, reached through the fluxa-wallet CLI, a stdio MCP server and agent skills.", "url": "https://www.anchorterminal.com/tools/fluxa-ai-wallet", "markdownUrl": "https://www.anchorterminal.com/tools/fluxa-ai-wallet.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/fluxa-ai-wallet.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/fluxa-ai-wallet.json", "dns": "fluxa-ai-wallet.grade.anchorterminal.com", "repo": "https://github.com/FluxA-Agent-Payment/FluxA-AI-Wallet-MCP", "license": "The CLI and MCP server source is Apache-2.0 (LICENSE file and both package.json files), though the README's last section says MIT. The hosted wallet service is closed, and no terms covering the wallet were found", "transports": [ "http", "stdio" ], "remoteUrl": "https://walletapi.fluxapay.xyz", "packages": [ { "registry": "npm", "name": "@fluxa-pay/fluxa-wallet" }, { "registry": "npm", "name": "@fluxa-pay/fluxa-wallet-mcp" } ], "auth": "mixed", "authNotes": "An agent connects with `fluxa-wallet connect` (or the MCP tool `connect_wallet`), which returns an `authorization_url` on agentwallet.fluxapay.xyz for the owner to approve in a browser. The claim returns an Agent ID, a token and an RS256 JWT, stored in `~/.fluxa-ai-wallet-mcp/config.json` (mode 0600) or injected as `AGENT_ID`, `AGENT_TOKEN` and `AGENT_JWT`. The owner picks the token's validity (1h, 24h, 7d, 1mo, 180d or 1y; the server suggests 180 days locally and 7 days in cloud or container environments), and the JWT is refreshed with the token. `token_expired` and `token_revoked` return `reconnect_required`. The legacy `init` registers an Agent ID with an unauthenticated `POST https://agentid.fluxapay.xyz/register`. Spending needs a mandate the owner signs in the browser. AgentMarket commands can instead use `fxa_live_` keys with a spend limit, revocable from the CLI.", "pricing": "usage", "pricingNotes": "No fee schedule for the wallet, x402 signing, payouts, payment links or refunds was found in the repository, the skills or the AgentMarket pricing, terms and llms.txt pages (checked 2026-11-07). Merchants set x402 prices. Agent card products list their fees through `fluxa-wallet card types`, which needs a connected wallet, so those fees were not read. The wallet site and docs at agentwallet.fluxapay.xyz and docs.fluxapay.xyz could not be read, so whether opening a wallet needs a card is unchecked. AgentMarket's Balance is $1 = 1 Balance, with Units bundles from $1 to $25.", "priceSummary": "Pay per use", "where": "both", "x402": { "level": "partial", "evidence": "The wallet signs x402 `exact` (EIP-3009) payment authorisations for USDC on Base and Base Sepolia as a buyer (`fluxa-wallet x402 --mandate \u003cid\u003e --payload \u003c402 body\u003e`, MCP `request_x402_payment` and `request_x402_v3_payment`), and its payment links can be paid over x402 so another agent can pay the holder (https://github.com/FluxA-Agent-Payment/FluxA-AI-Wallet-MCP/blob/main/skills/fluxa-agent-wallet/INTEGRATION-GUIDE-CHARGE-AGENT.md, checked 2026-11-07). FluxA's own wallet API is not paid over x402, MPP or L402.", "endpoints": [] }, "toolCount": 15, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-07" }, "docsUrl": "https://docs.fluxapay.xyz/", "capabilities": [ "payments.x402", "wallet.spend-limits", "wallet.onchain", "payments.card", "auth.agent-identity" ], "tags": [ "hosted", "official", "open-source", "apache-2.0", "cli", "mcp", "stdio", "skills", "typescript", "wallet", "x402", "stablecoins", "virtual-cards", "usdc", "base" ], "lastRelease": "2026-11-06", "graded": true, "anchor": { "graded": true, "score": 47, "grade": "D", "agentReady": false, "rank": 1164, "ranked": true, "rankOf": 1513, "categoryRank": 11, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 60, "maintenance": 66, "payments": 45, "reliability": 20, "schema": 61, "security": 52, "transparency": 32 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "low", "date": "2026-11-07" }, "negative": 0, "verdict": "Every spend runs against a mandate the owner signs in a browser, with a budget, a validity window and an optional host allowlist, and payouts need approval or a mandate. The published MCP package is 0.2.0 from March 2026 against 0.6.0 in the repository, and no status page, fee schedule, wallet terms or custody statement was found.", "bestFor": "An agent in a CLI-capable client that needs to pay x402 APIs, send USDC on Base or receive payments through links, inside budgets a person signs.", "strengths": [ "Spending runs against owner-signed mandates with a limit, a validity window and an optional host allowlist, enforced by the wallet API", "Payouts need per-payout browser approval unless a signed mandate is passed, and a required `payout_id` makes repeats return the same payout", "The CLI returns JSON with error codes, `next_command` hints and `retryable` and `reconnect_required` flags", "Client source is public under Apache-2.0, with 25 CLI releases on npm since March 2026, the latest on 6 November 2026", "Payment links let another agent pay the holder over x402, and refunds of link payments are supported" ], "weaknesses": [ "The published MCP package is 0.2.0 from 2 March 2026 with 13 tools, while the repository says 0.6.0 with 15", "No status page, rate limit, SLA, fee schedule or security contact was found", "Who holds the wallet keys is not stated. The docs say FluxA Wallet signs and call it managed", "The only terms and privacy policy read are AgentMarket's, which do not mention the wallet, cards, KYC or payouts", "The skill steers agents to paid APIs over free search and to request budgets for at least 100 calls by default" ], "agentNotes": [ "Run `fluxa-wallet status` first. If `configured` and `wallet_linked` are true, skip `connect`; otherwise show the `authorization_url` and wait with `connect-status --wait 100`", "On `token_expired` or `token_revoked`, reconnect with the same `--agent-id`. Never run `init` to recover, which creates a new identity", "Pass a unique `--id` on every `payout` and reuse it on retry; a repeat returns the existing payout instead of paying twice", "Check `fluxa-wallet mandates` for a signed mandate with enough remaining budget before creating one, and size new budgets to the task", "Install the CLI from npm, not the MCP package, whose npm release 0.2.0 lacks `connect_wallet` and `get_wallet_connection`" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "low", "grade": "D", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 47 } ], "editorialScores": { "ergonomics": 60, "maintenance": 66, "payments": 45, "reliability": 20, "schema": 61, "security": 52, "transparency": 26 }, "provenanceScore": 38, "checked": { "categories": { "ergonomics": "2026-11-07", "maintenance": "2026-11-07", "payments": "2026-11-07", "reliability": "2026-11-07", "schema": "2026-11-07", "security": "2026-11-07", "transparency": "2026-11-07" }, "last": "2026-11-07", "oldest": "2026-11-07", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install -g @fluxa-pay/fluxa-wallet" }, "letme": { "capability": "https://letme.dev/payments.x402", "tool": "https://letme.dev/fluxa-ai-wallet" }, "sameCompany": [ "fluxa-agentmarket" ], "area": "payments", "provenance": { "legalEntity": "FluxA Technology Pte. Ltd.", "domain": "fluxapay.xyz", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "", "privacy": "", "statusPage": "", "changelog": "", "securityTxt": "unknown", "checked": "2026-11-07", "notes": [ "The legal entity is from the footer of agentmarket.fluxapay.xyz, \"© 2025 FluxA Technology Pte. Ltd. All rights reserved.\", the same on the about, terms, privacy and pricing pages. No registration number, address or country is given on those pages. A web search result names a companieshouse.sg page for FluxA Technology Pte Ltd with UEN 202555700C; that host could not be fetched, so the register entry is unread.", "AgentMarket's terms (effective 14 January 2026) and privacy policy (updated 14 January 2026) describe the marketplace and its Balance and do not mention the Agent Wallet, cards, KYC or payouts, so they are not recorded as the wallet's terms. The terms name no entity in their text and no governing law; contact support.fluxapay@fluxapay.xyz.", "fluxapay.xyz, agentwallet.fluxapay.xyz and docs.fluxapay.xyz could not be read. Each robots.txt fetch was refused for want of an approval on 7 November 2026, so nothing on those hosts was fetched. The wallet's own terms, privacy policy, fees, security.txt and docs are unchecked.", "https://agentmarket.fluxapay.xyz/.well-known/security.txt answered a client error. The repository has no SECURITY.md.", "The wallet API, Agent ID API and approval pages are on fluxapay.xyz subdomains named in the CLI source. agentmarket.fluxapay.xyz's robots.txt allows / and disallows /api/ (except /api/discover and /api/llm/skills.md) and /console/; nothing disallowed was fetched.", "unchecked: RDAP for fluxapay.xyz, the MCP registry, the Wayback Machine, GitHub stars and issues (the GitHub API refused the session) and npm download counts." ], "score": 38 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/fluxa-ai-wallet.json", "live": { "slug": "fluxa-ai-wallet", "probe": { "target": "https://walletapi.fluxapay.xyz", "method": "get", "lastAt": "2026-11-08T14:47:50.695700215Z", "lastOk": true, "lastStatus": 404, "lastMs": 532, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 542, "p95ms24h": 603, "samples24h": 90, "samples30d": 90, "days": [ { "date": "2026-11-08", "probes": 90, "ok": 90 } ], "since": "2026-11-08T00:00:00Z" }, "updatedAt": "2026-11-08T14:47:50.695700215Z" }, "streak": { "days": 0, "from": "2026-11-08", "sinceWatching": true, "best": 0 } }, "answer": "Openfort scores 70.3 (BB) on agent readiness against FluxA AI Wallet's 47 (D), and leads in every scored category.", "b": { "slug": "openfort", "name": "Openfort", "vendor": "Openfort (Alamas Labs Inc.)", "vendorUrl": "https://www.openfort.io", "kind": "http-api", "category": "agent-wallets", "summary": "Openfort is wallet infrastructure from Alamas Labs. Its REST API, Node SDK and CLI create backend wallets held in a trusted execution environment, with signing policies, session keys and gas sponsorship. It also sells embedded wallets for apps.", "url": "https://www.anchorterminal.com/tools/openfort", "markdownUrl": "https://www.anchorterminal.com/tools/openfort.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/openfort.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/openfort.json", "dns": "openfort.grade.anchorterminal.com", "repo": "https://github.com/openfort-xyz/openfort-node", "license": "Proprietary service under the Openfort Developer Terms of Service. The Node SDK and OpenSigner are MIT. The CLI repository and package state no licence", "transports": [ "http", "stdio" ], "remoteUrl": "https://api.openfort.io", "packages": [ { "registry": "npm", "name": "@openfort/openfort-node" }, { "registry": "npm", "name": "@openfort/cli" } ], "auth": "api-key", "authNotes": "A secret key (`sk_test_` or `sk_live_`) from the self-serve dashboard goes in `Authorization: Bearer`. Secret keys carry scopes (26 named, such as `accounts:sign`, `policies:write` and `accounts:export`), and a key made without a scope list gets all but four. Backend wallet signing also needs an `x-wallet-auth` ES256 JWT signed with a separate wallet secret, with a nonce and a request hash. Test and live keys are isolated. No OAuth (https://www.openfort.io/docs/api-reference/authentication).", "pricing": "freemium", "pricingNotes": "Free plan with 2,000 operations a month and no card, then $0.01 an operation. Growth $99 a month (25,000 operations, $0.008 extra), Pro $249 (100,000, $0.006), Scale $599 (500,000, $0.004). An operation is a wallet creation, signature, broadcast, policy evaluation, webhook or key import or export. Sponsored gas carries a 10 per cent surcharge, 5 per cent on Pro and Scale. Enterprise is priced by sales (https://www.openfort.io/pricing.md, checked 2026-10-09).", "priceSummary": "$99 / mo", "where": "both", "x402": { "level": "partial", "evidence": "Openfort wallets pay as a buyer. The docs carry an x402 recipe for USDC payments from embedded and backend wallets and an MPP recipe for an agent paying HTTP services on Tempo. Openfort's own API is not paid over x402. Its 402 status means the plan's operations are used up with no payment method (https://www.openfort.io/docs/llms.txt; https://www.openfort.io/docs/api-reference/errors, checked 2026-10-09).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 10, "npmWeekly": 7647, "pypiWeekly": null, "asOf": "2026-10-09" }, "docsUrl": "https://www.openfort.io/docs/products/server/workflows/agentic-wallets", "llmsTxt": "https://www.openfort.io/llms.txt", "openapi": "https://www.openfort.io/docs/openapi.json", "capabilities": [ "wallet.onchain", "wallet.spend-limits", "wallet.custody", "payments.x402" ], "tags": [ "hosted", "freemium", "free-tier", "api-key", "openapi", "llms-txt", "mcp", "cli", "typescript", "wallet", "stablecoin", "x402", "tee", "status-page", "webhooks" ], "lastRelease": "2026-10-23", "graded": true, "anchor": { "graded": true, "score": 70.3, "grade": "BB", "agentReady": true, "rank": 206, "ranked": true, "rankOf": 1513, "categoryRank": 6, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 65, "maintenance": 87, "payments": 60, "reliability": 88, "schema": 89, "security": 65, "transparency": 71 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-01" }, "negative": -5, "negativeNotes": [ "9 October 2026. The agent wallets page says a signing policy is evaluated server-side on every operation against value caps and allowlists and that caps are enforced at signing time. The policies docs say an EVM backend send is evaluated only as `signEvmHash`, so those rules cannot block one. The docs disclose this plainly, so 3 points (https://www.openfort.io/agent-wallets; https://www.openfort.io/docs/configuration/policies).", "28 September 2026. The changelog says tokens from a third-party login provider were still accepted after the provider was disabled. Fixed and documented in the changelog, with no advisory found, so 2 points (https://www.openfort.io/changelog)." ], "verdict": "Backend wallets sign inside a GCP Confidential Space enclave, secret keys carry 26 scopes, and rate limits, errors and prices are published. On EVM, a backend send reaches the policy engine only as a hash, so address and value rules bind only when the caller runs the pre-flight check first.", "bestFor": "A team that wants server-held wallets for agents on EVM chains and Solana with enclave signing, a free start and a CLI an agent can drive.", "strengths": [ "Backend wallet keys are generated and used inside a GCP Confidential Space enclave with AMD SEV-SNP, wrapped by an HSM-backed Cloud KMS key", "Secret keys carry 26 named scopes, and backend signing also needs an ES256 JWT from a separate wallet secret that can be rotated", "Policy engine rejects any operation no rule matches, with account and project scopes and a pre-flight `POST /v2/policies/evaluate`", "Rate limits are published per plan (100 to 1,200 requests a minute) and a 429 carries `Retry-After`", "Free plan of 2,000 operations a month with no card, and per-operation overage prices on every plan" ], "weaknesses": [ "An EVM backend send is evaluated only as `signEvmHash`, so address, value and calldata rules do not block it unless the caller pre-flights", "Signing policies cap value per transaction. No daily or rolling cap was found in the reviewed policy pages", "The CLI MCP server exposes 72 commands as tools, among them `accounts_evm_export`, which returns a private key", "A default secret key includes `accounts:export` and `accounts:sign`", "No SOC 2 report (the vendor says so), no security.txt and no bug bounty found" ], "agentNotes": [ "Call `policies.evaluate` with operation `signEvmTransaction` before every EVM backend send. The send itself is checked only as `signEvmHash`", "Keep the signing policy and the gas sponsorship policy separate. Linking a signing policy to a fee sponsorship stops it working as a guardrail", "Pass a fee sponsorship on EVM sends. Without one the transaction stays pending with no error", "Give an agent a secret key without `accounts:export`, and limit the CLI MCP server to the tools it needs", "On a 5xx after a write, read the resource before retrying. On a 429, wait the full `Retry-After`" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 4, "avgRating": 3.5, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 70.3 } ], "editorialScores": { "ergonomics": 65, "maintenance": 87, "payments": 60, "reliability": 88, "schema": 89, "security": 65, "transparency": 64 }, "provenanceScore": 77, "checked": { "categories": { "ergonomics": "2026-11-01", "maintenance": "2026-11-01", "payments": "2026-11-01", "reliability": "2026-11-01", "schema": "2026-11-01", "security": "2026-11-01", "transparency": "2026-11-01" }, "last": "2026-11-01", "lastMoved": "2026-10-27", "oldest": "2026-11-01", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install @openfort/openfort-node", "http": "curl https://api.openfort.io/v2/transactions -H \"Authorization: Bearer sk_test_...\"", "claudeCode": "claude mcp add --transport http openfort-docs https://www.openfort.io/api/mcp", "config": { "mcpServers": { "openfort": { "args": [ "@openfort/cli", "--mcp" ], "command": "npx", "env": { "OPENFORT_API_KEY": "${OPENFORT_API_KEY}" } } } } }, "letme": { "capability": "https://letme.dev/wallet.onchain", "tool": "https://letme.dev/openfort" }, "area": "payments", "unitPrices": [ { "item": "Growth plan", "unit": "month", "usd": 99, "note": "25,000 operations included" }, { "item": "Pro plan", "unit": "month", "usd": 249, "note": "100,000 operations included" }, { "item": "Scale plan", "unit": "month", "usd": 599, "note": "500,000 operations included" }, { "item": "Extra operation, Free plan", "unit": "call", "usd": 0.01, "note": "per operation above 2,000 a month" }, { "item": "Extra operation, Growth plan", "unit": "call", "usd": 0.008, "note": "per operation above 25,000 a month" }, { "item": "Extra operation, Scale plan", "unit": "call", "usd": 0.004, "note": "per operation above 500,000 a month" } ], "provenance": { "legalEntity": "Alamas Labs Inc.", "domain": "openfort.io", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "https://www.openfort.io/developer-terms", "privacy": "https://www.openfort.io/privacy", "statusPage": "https://status.openfort.io", "changelog": "https://www.openfort.io/changelog", "securityTxt": "none", "checked": "2026-10-09", "notes": [ "The Developer Terms of Service (last updated 16 January 2026) and the privacy policy (last updated 4 September 2026) both name Alamas Labs Inc. doing business as Openfort. The terms are governed by Delaware law.", "The API answers at https://api.openfort.io and the docs, OpenAPI file and docs MCP server at www.openfort.io.", "https://www.openfort.io/.well-known/security.txt answered 404. The security page gives security@openfort.io for reports.", "rdap.org answered that no RDAP service is available for openfort.io, so the registration date is not recorded.", "robots.txt on www.openfort.io allows every path and carries `Content-Signal: search=yes, ai-input=yes, ai-train=no`." ], "score": 77 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/openfort.json", "live": { "slug": "openfort", "probe": { "target": "https://api.openfort.io", "method": "get", "lastAt": "2026-11-08T14:48:03.477764293Z", "lastOk": true, "lastStatus": 404, "lastMs": 116, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 116, "p95ms24h": 193, "samples24h": 242, "samples30d": 7411, "days": [ { "date": "2026-10-09", "probes": 85, "ok": 85 }, { "date": "2026-10-10", "probes": 247, "ok": 247 }, { "date": "2026-10-11", "probes": 247, "ok": 247 }, { "date": "2026-10-12", "probes": 247, "ok": 247 }, { "date": "2026-10-13", "probes": 248, "ok": 248 }, { "date": "2026-10-14", "probes": 249, "ok": 249 }, { "date": "2026-10-15", "probes": 253, "ok": 253 }, { "date": "2026-10-16", "probes": 252, "ok": 252 }, { "date": "2026-10-17", "probes": 253, "ok": 253 }, { "date": "2026-10-18", "probes": 256, "ok": 256 }, { "date": "2026-10-19", "probes": 255, "ok": 255 }, { "date": "2026-10-20", "probes": 252, "ok": 252 }, { "date": "2026-10-21", "probes": 253, "ok": 253 }, { "date": "2026-10-22", "probes": 253, "ok": 253 }, { "date": "2026-10-23", "probes": 248, "ok": 248 }, { "date": "2026-10-24", "probes": 251, "ok": 251 }, { "date": "2026-10-25", "probes": 250, "ok": 250 }, { "date": "2026-10-26", "probes": 252, "ok": 252 }, { "date": "2026-10-27", "probes": 249, "ok": 249 }, { "date": "2026-10-28", "probes": 250, "ok": 250 }, { "date": "2026-10-29", "probes": 249, "ok": 249 }, { "date": "2026-10-30", "probes": 249, "ok": 249 }, { "date": "2026-10-31", "probes": 251, "ok": 251 }, { "date": "2026-11-01", "probes": 249, "ok": 249 }, { "date": "2026-11-02", "probes": 250, "ok": 250 }, { "date": "2026-11-03", "probes": 248, "ok": 248 }, { "date": "2026-11-04", "probes": 246, "ok": 246 }, { "date": "2026-11-05", "probes": 185, "ok": 185 }, { "date": "2026-11-06", "probes": 241, "ok": 241 }, { "date": "2026-11-07", "probes": 243, "ok": 243 }, { "date": "2026-11-08", "probes": 150, "ok": 150 } ], "since": "2026-10-09T00:00:00Z" }, "vendorStatus": { "page": "https://status.openfort.io", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-08T14:51:29.684459254Z" }, "versions": [ { "registry": "github", "name": "openfort-xyz/openfort-node", "version": "v0.14.0", "released": "2026-11-04", "seenAt": "2026-11-08T01:24:23.417928333Z" }, { "registry": "npm", "name": "@openfort/cli", "version": "0.2.3", "seenAt": "2026-11-08T01:24:22.524614777Z" }, { "registry": "npm", "name": "@openfort/openfort-node", "version": "0.14.0", "seenAt": "2026-11-08T01:24:21.219517347Z" } ], "githubStars": 10, "npmWeekly": 16416, "securityTxt": { "url": "https://openfort.io/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:02:01.530537482Z" }, "llmsTxt": { "url": "https://www.openfort.io/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:33:31.317725911Z" }, "domain": { "domain": "openfort.io", "checkedAt": "2026-11-08T14:41:20.788358038Z" }, "pages": [ { "url": "https://www.openfort.io/changelog", "kind": "changelog", "status": 304, "checkedAt": "2026-11-07T14:32:26.334823254Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "f46241d68d76" }, { "url": "https://www.openfort.io/pricing.md", "kind": "pricing", "status": 200, "checkedAt": "2026-11-07T14:32:30.387057909Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "85d4cce5d750" }, { "url": "https://www.openfort.io/privacy", "kind": "privacy", "status": 304, "checkedAt": "2026-11-07T14:32:32.499558359Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "92d5a24cf4eb" }, { "url": "https://www.openfort.io/developer-terms", "kind": "terms", "status": 304, "checkedAt": "2026-11-07T14:32:28.538778673Z", "changedAt": "2026-10-23T02:05:04.614975577Z", "fingerprint": "78744c516601" } ], "mcpTools": { "url": "https://www.openfort.io/api/mcp", "checkedAt": "2026-11-08T02:00:20.96339013Z", "status": "ok", "note": "answered without the initialize handshake", "tools": [ { "name": "list_pages", "description": "List all documentation pages with their titles and paths.", "inputSchema": { "$schema": "http://json-schema.org/draft-07/schema#", "properties": {}, "type": "object" } }, { "name": "read_page", "description": "Read the content of a documentation page by its path.", "inputSchema": { "$schema": "http://json-schema.org/draft-07/schema#", "properties": { "pagePath": { "description": "The page path (e.g., \"/getting-started\" or \"/api/config\")", "type": "string" } }, "required": [ "pagePath" ], "type": "object" } }, { "name": "search_docs", "description": "Search documentation for a query string. Uses AI (semantic) search when configured, with keyword fallback.", "inputSchema": { "$schema": "http://json-schema.org/draft-07/schema#", "properties": { "query": { "description": "The search query", "type": "string" } }, "required": [ "query" ], "type": "object" } }, { "name": "submit_feedback", "title": "Submit documentation feedback", "description": "Submit feedback about a documentation page to the site maintainers.", "inputSchema": { "$schema": "http://json-schema.org/draft-07/schema#", "properties": { "category": { "description": "A short feedback category", "type": "string" }, "helpful": { "description": "Whether the page was helpful", "type": "boolean" }, "message": { "description": "Additional feedback for the maintainers", "type": "string" }, "pagePath": { "description": "The documentation page path returned by list_pages or search_docs", "minLength": 1, "type": "string" } }, "required": [ "pagePath", "helpful" ], "type": "object" }, "annotations": { "destructiveHint": false, "idempotentHint": false, "openWorldHint": true, "readOnlyHint": false } }, { "name": "list_sources", "description": "List available source code repositories.", "inputSchema": { "$schema": "http://json-schema.org/draft-07/schema#", "properties": {}, "type": "object" } }, { "name": "list_source_files", "description": "List source code files in a directory.", "inputSchema": { "$schema": "http://json-schema.org/draft-07/schema#", "properties": { "dirPath": { "description": "Directory path (e.g., \"src\" or \"src/utils\")", "type": "string" }, "source": { "description": "Source name", "enum": [ "openfort-xyz/openfort-js", "openfort-xyz/openfort-react", "openfort-xyz/react-native", "openfort-xyz/cli", "openfort-xyz/openfort-node", "openfort-xyz/swift-sdk", "openfort-xyz/openfort-csharp-unity", "wevm/viem", "wevm/wagmi" ], "type": "string" } }, "required": [ "source" ], "type": "object" } }, { "name": "read_source_file", "description": "Read a source code file.", "inputSchema": { "$schema": "http://json-schema.org/draft-07/schema#", "properties": { "filePath": { "description": "File path (e.g., \"src/index.ts\")", "type": "string" }, "source": { "description": "Source name", "enum": [ "openfort-xyz/openfort-js", "openfort-xyz/openfort-react", "openfort-xyz/react-native", "openfort-xyz/cli", "openfort-xyz/openfort-node", "openfort-xyz/swift-sdk", "openfort-xyz/openfort-csharp-unity", "wevm/viem", "wevm/wagmi" ], "type": "string" } }, "required": [ "source", "filePath" ], "type": "object" } }, { "name": "get_file_tree", "description": "Get a recursive file tree of the source code.", "inputSchema": { "$schema": "http://json-schema.org/draft-07/schema#", "properties": { "basePath": { "description": "Directory path (defaults to configured source path)", "type": "string" }, "depth": { "description": "Maximum depth to traverse (default: 3)", "type": "number" }, "source": { "description": "Source name", "enum": [ "openfort-xyz/openfort-js", "openfort-xyz/openfort-react", "openfort-xyz/react-native", "openfort-xyz/cli", "openfort-xyz/openfort-node", "openfort-xyz/swift-sdk", "openfort-xyz/openfort-csharp-unity", "wevm/viem", "wevm/wagmi" ], "type": "string" } }, "required": [ "source" ], "type": "object" } }, { "name": "search_source", "description": "Search source code for a pattern.", "inputSchema": { "$schema": "http://json-schema.org/draft-07/schema#", "properties": { "pathFilter": { "description": "Optional path filter (e.g., \"src/\")", "type": "string" }, "query": { "description": "The search query", "type": "string" }, "source": { "description": "Source name", "enum": [ "openfort-xyz/openfort-js", "openfort-xyz/openfort-react", "openfort-xyz/react-native", "openfort-xyz/cli", "openfort-xyz/openfort-node", "openfort-xyz/swift-sdk", "openfort-xyz/openfort-csharp-unity", "wevm/viem", "wevm/wagmi" ], "type": "string" } }, "required": [ "source", "query" ], "type": "object" } } ], "schemaTokens": 1142, "changedAt": "2026-11-07T01:46:35.78534092Z", "check": { "checker": "anchor-check/1.0", "totalTokens": 1142, "counts": { "error": 0, "note": 1, "warn": 9 }, "findings": [ { "rule": "TC06", "severity": "warn", "tool": "read_source_file", "message": "the description is \"Read a source code file.\"", "fix": "Add when to use it, what it returns and any side effect, in two or three sentences." }, { "rule": "TC16", "severity": "warn", "tool": "get_file_tree", "message": "no readOnlyHint or destructiveHint", "fix": "Its name starts with \"get\"; if it only reads, set readOnlyHint: true so harnesses can run it without asking." }, { "rule": "TC16", "severity": "warn", "tool": "list_pages", "message": "no readOnlyHint or destructiveHint", "fix": "Its name starts with \"list\"; if it only reads, set readOnlyHint: true so harnesses can run it without asking." }, { "rule": "TC16", "severity": "warn", "tool": "list_source_files", "message": "no readOnlyHint or destructiveHint", "fix": "Its name starts with \"list\"; if it only reads, set readOnlyHint: true so harnesses can run it without asking." }, { "rule": "TC16", "severity": "warn", "tool": "list_sources", "message": "no readOnlyHint or destructiveHint", "fix": "Its name starts with \"list\"; if it only reads, set readOnlyHint: true so harnesses can run it without asking." }, { "rule": "TC16", "severity": "warn", "tool": "read_page", "message": "no readOnlyHint or destructiveHint", "fix": "Its name starts with \"read\"; if it only reads, set readOnlyHint: true so harnesses can run it without asking." }, { "rule": "TC16", "severity": "warn", "tool": "read_source_file", "message": "no readOnlyHint or destructiveHint", "fix": "Its name starts with \"read\"; if it only reads, set readOnlyHint: true so harnesses can run it without asking." }, { "rule": "TC16", "severity": "warn", "tool": "search_docs", "message": "no readOnlyHint or destructiveHint", "fix": "Its name starts with \"search\"; if it only reads, set readOnlyHint: true so harnesses can run it without asking." }, { "rule": "TC16", "severity": "warn", "tool": "search_source", "message": "no readOnlyHint or destructiveHint", "fix": "Its name starts with \"search\"; if it only reads, set readOnlyHint: true so harnesses can run it without asking." }, { "rule": "TC24", "severity": "note", "message": "9 of 9 tools have no outputSchema", "fix": "Declare outputSchema for tools that return structured data, and return structuredContent that matches it." } ] } }, "github": { "repo": "openfort-xyz/openfort-node", "checkedAt": "2026-11-02T09:13:29.169215395Z", "stars": 10, "archived": false, "issuesEnabled": true, "pushedAt": "2026-11-01T05:33:07Z", "openIssues": 1, "openPRs": 6, "issuesOpened90d": 2, "issuesClosed90d": 1, "prsMerged90d": 20, "ci": { "branch": "main", "runs": 50, "success": 47, "failure": 2, "other": 1, "latest": "success", "latestAt": "2026-10-23T09:37:49Z" }, "replies": { "sampled": 6, "unanswered": 1, "medianDays": 0 } }, "updatedAt": "2026-11-08T14:51:29.684459254Z" }, "streak": { "days": 30, "from": "2026-10-09", "sinceWatching": true, "best": 30 } }, "edges": [ { "by": 68, "category": "reliability", "leads": "openfort", "name": "Reliability", "reasons": { "a": "Graded with the hosted lines, because signing, mandates and approvals all run on FluxA's wallet API and the CLI and MCP server only wrap it, as kite-agent-passport and kane-cli were read. No status page was found in the repository, the skills or AgentMarket's pages. fluxapay.xyz and the wallet and docs hosts could not be read, so a status page there is unchecked and scored absent (0). With no readable history the record takes the default (5). No rate limit with numbers was found (0). The connection service treats 429 `slow_down` as wait and poll and marks errors `retryable`, the skill says a 503 means retry shortly, payouts require a caller-chosen `payout_id` that returns the existing payout on a repeat, `--biz-id` rejects a duplicate with 409, and card create and recharge resume with `--request-id` instead of paying again. No Retry-After or backoff schedule is documented for the wallet API (10 of 15). No SLA was found (0). No beta label was found on the wallet in what was read, but both packages are at 0.x, agent cards sit behind a waitlist and the wallet site was unread (5 of 10). Total 20.", "b": "Hosted lines. Status page at status.openfort.io on Better Stack with six components and 90-day bars (20). The previous incidents view reports no incidents for September, October or November 2026, and the 9 October check found none for August either. Three maintenance windows in September (1st and 15th of 10 and 14 minutes, 28th). The API bar reads 99.994 per cent, a few minutes down that no incident entry explains (28 of 30). Rate limits published per plan, 100 to 1,200 requests a minute (15). A 429 carries `Retry-After`, the errors page asks for exponential backoff on 5xx and says to re-read a resource before retrying a write. No idempotency key is documented, though the Node SDK sends an `X-Idempotency-Key` header (12 of 15). The pricing page lists SLA guarantees on Enterprise and the terms say an SLA may be negotiated in an order form. None is published (5 of 10). The API is generally available with an OpenAPI file at 1.0.0. The Node SDK is 0.13.3 and the CLI 0.2.2 (8 of 10). Limits, errors and terms per the 9 October check, not re-read on 1 November." }, "scores": { "a": 20, "b": 88 } }, { "by": 39, "category": "transparency", "leads": "openfort", "name": "Transparency \u0026 trust", "reasons": { "a": "The CLI and MCP server source is Apache-2.0 per the LICENSE file and both package.json files, while the README's last section says MIT. The hosted wallet is closed, and no terms covering it were found. AgentMarket's terms describe only the marketplace (15 of 30). AgentMarket's privacy policy of 14 January 2026 names Stripe and model providers and gives no retention periods, and it does not mention wallet addresses, KYC profiles, card data or payouts, which the CLI collects or handles. The wallet's own privacy policy was unreachable (5 of 30). The README marks `init` and `link-wallet` as legacy but still supported, and the skill pins a minimum CLI version; no deprecation policy or dated notice was found (3 of 20). Stripe is the only provider named; no card issuer, KYC provider, custody provider or data location is named. The CLI and MCP code send no telemetry (3 of 20). Total 26.", "b": "Closed service under developer terms that name the entity. The Node SDK and OpenSigner are MIT, and the CLI states no licence (20 of 30). The privacy policy of 4 September 2026 gives retention periods and names Google Cloud, PostHog and Sentry. It says Openfort does not store private keys and also lists encrypted key material among what it holds, and the docs index calls backend wallets custodial while the terms call them non-custodial. No DPA found (18 of 30). llms.txt states that `/v1` changes are additive and a deprecated endpoint keeps working at least 90 days after a changelog notice. We read that summary, not the full policy page, and found no dated deprecation notice (15 of 20). Processors and a United States base are in the privacy policy. Payment processors are unnamed and there is no sub-processor list with locations (11 of 20)." }, "scores": { "a": 32, "b": 71 } }, { "by": 28, "category": "schema", "leads": "openfort", "name": "Schema \u0026 documentation", "reasons": { "a": "No OpenAPI file or reference for the wallet API was found; the README shows sample requests for five endpoints. The MCP server's 15 tools in the 0.6.0 source carry typed Zod input schemas, and the CLI's flags are documented in prose in the skill files and `--help`. The MCP server is the secondary surface and its npm release is 0.2.0, so 12 of 25. The skill and its 18 Markdown guides are written for agents, and AgentMarket's llms.txt describes the wallet's payment role (10). `connect_wallet`, `init_agent_id` and `create_intent_mandate` say when to use them and when not to, and the skill has a when-to-use table per capability, while the payment-link and status tools have one-line descriptions (12 of 20). Zod enums for validity, runtime, hosting and currency, a regex on payout amounts and strict objects, but the x402 requirement fields are plain strings and `outputSchema` is a free-form record (10 of 15). The README has an example for every MCP tool, the skills give CLI examples and output, and error codes are tabled for mandates, payouts, cards and connections (12 of 15). Semver on npm with 25 CLI versions and a version line in the skill, two git tags and no changelog (5 of 15). Total 61.", "b": "Public OpenAPI 3.0.3 file with 94 operations on 80 paths (25). llms.txt, a docs index, a full-text file and a Markdown twin of every docs page (10). All 94 operations carry a summary or description, and the guides say what each policy operation does and does not check (16 of 20). Policy rules are typed by operation and criterion, and the API refuses a criterion that cannot match its operation (13 of 15). 86 of 94 operations carry examples, and the errors page has the envelope and a status table. Only two error types exist and the `error.code` values are not listed (12 of 15). Path versioning, a versioning policy and a dated changelog. llms.txt says every endpoint lives under `/v1` while the OpenAPI file has `/v2` and `/iam/v2` paths (13 of 15)." }, "scores": { "a": 61, "b": 89 } }, { "by": 21, "category": "maintenance", "leads": "openfort", "name": "Maintenance \u0026 community", "reasons": { "a": "`@fluxa-pay/fluxa-wallet` 0.6.0 was published on 6 November 2026, one day before this check (30). Eight CLI releases since 10 August 2026, among them 0.5.2 on 14 October, 0.5.3 on 25 October and 0.5.6, 0.5.7 and 0.6.0 between 3 and 6 November (20). The repository merged 43 pull requests, all from the organisation's own branches, and commits run weekly. Issues and outside pull requests could not be read because the GitHub API refused the session. Discord and a support address are linked from AgentMarket and were not tested (8 of 25). Graded as an API, the line asks for current official SDKs. The CLI is current, but there is no SDK library and the MCP package on npm has not been published since 2 March 2026 (5 of 15). 68 node:test cases exist with no CI workflow, neither npm package declares its repository, and the MCP package's last release lags the source by eight months (3 of 10). Total 66.", "b": "Node SDK 0.13.3 on 23 October 2026, a fix for requests failing on Cloudflare Workers (30). The newest changelog entry is 28 September. In the 90 days from 3 August we counted changelog entries on 28 August and 28 September, Node SDK 0.12.0 to 0.13.3 (seven tags from 31 August to 23 October, 0.13.2 a dependency bump that counts half) and CLI 0.2.2 on 7 September (20). The one outside issue in the 30 most recent items on the Node SDK repository was closed in four days with a reply, and three outside pull requests from May and June were merged on 25 September, per the 9 October check, not re-read on 1 November (GitHub's pages answered 403). Support is a Telegram group and plan response times of 24 to 48 hours (15 of 25). Current official SDKs. No entry in the MCP registry (15). CI runs a build, type check and `pnpm audit`, Dependabot is active. Both packages are below 1.0 (7 of 10)." }, "scores": { "a": 66, "b": 87 } }, { "by": 15, "category": "payments", "leads": "openfort", "name": "Payments \u0026 pricing", "reasons": { "a": "Payment platforms and wallets take the highest step that applies on the 40-point protocol line. 40 for x402, MPP or L402 on all their own endpoints, 30 on part of their own API, 25 when their merchants can accept one, 20 for running a facilitator, 15 for paying as a buyer, 0 for only a protocol of their own. The wallet pays x402 as a buyer and its payment links can be paid over x402 so another agent pays the holder, as sponge-wallet's payment links were read. FluxA's own wallet API is not paid over x402, so the merchant step (25 of 40). No fee schedule for the wallet, x402 signing, payouts or payment links was found, and card fees appear only through an authenticated command (0 of 20). Registering an Agent ID and creating payment links cost nothing and need no card per the README and the charge-agent guide, but the wallet sign-up at agentwallet.fluxapay.xyz could not be read, so whether opening a funded wallet needs a card is unchecked (10 of 20). `POST https://agentid.fluxapay.xyz/register` returns credentials with no human step, but the CLI marks it legacy, the default connection needs a browser approval, and every spend needs the owner's wallet and a mandate signed in a browser (10 of 20). Total 45.", "b": "Wallets take the highest step that applies on the 40-point protocol line, as for the other wallet listings. Openfort wallets pay over x402 and MPP as a buyer, per the docs recipes and the product page, and its own API is not paid over either, so the buyer step (15 of 40). Per-operation prices on every plan are public without a login (20). Free plan of 2,000 operations a month with no card (20). A person signs up in the dashboard or approves `openfort login` in a browser once, after which the CLI creates wallets and policies (5 of 20)." }, "scores": { "a": 45, "b": 60 } }, { "by": 13, "category": "security", "leads": "openfort", "name": "Security \u0026 auth", "reasons": { "a": "The agent holds an Agent ID, a token whose validity the owner picks from 1 hour to 1 year at browser approval, and a short-lived RS256 JWT refreshed from the token; `token_revoked` exists. Credentials sit in a 0600 JSON file or environment variables. The token is not scoped, since limits live in mandates, and legacy `init` tokens are described as not expiring. Agent VCs are audience-bound and rejected by FluxA's own endpoints. No secret travels in a URL (22 of 30). Every x402 payment needs a mandate the owner signs, with a limit, a validity and an optional host allowlist enforced by the wallet API, payouts need per-payout approval unless a mandate covers them, cards need a mandate and KYC, and linked-card mandates are scoped to one merchant. A payout mandate sets no payee allowlist that was documented, and the skill tells agents to request budgets for at least 100 calls by default (16 of 20). The wallet returns little third-party content itself, but the skill sends agents to third-party x402 APIs, ClawPI posts and a remote announcement.md with no guidance on treating them as untrusted, its description steers agents to paid APIs even when a free web search looks enough, and the daily check-in runs `npx -y @fluxa-pay/fluxa-wallet@latest` unpinned twice a day (4 of 15). `mandates` lists limit, spent and remaining, with `recent-transactions`, `received-records` and payout status by CLI, and the MCP server writes a local audit log; the wallet app's logs were not read (10 of 15). No SECURITY.md, disclosure policy, bug bounty or certification was found, and agentmarket.fluxapay.xyz has no security.txt; fluxapay.xyz's is unchecked (0 of 20). Total 52.", "b": "Secret keys carry 26 named scopes and can be rolled, test and live are isolated, and backend signing needs a second credential, a wallet secret that signs an ES256 JWT with a nonce and request hash and can be rotated. A key made without a scope list includes `accounts:sign` and `accounts:export` (26 of 30). The policy engine rejects what no rule matches and policies can be scoped to one wallet, and session keys are limited on-chain. For an EVM backend send the engine sees only a hash, so address, value and calldata rules bind only if the caller pre-flights, and no approval step or rolling cap was found (11 of 20). The product page says an injected prompt can attempt a transaction but cannot take a key, and the docs advise one policy-bounded wallet per agent and a tool allowlist. The CLI MCP server lists key export tools that return the private key (7 of 15). API logs in the dashboard, webhooks, a request id on every response and emails on 500s (11 of 15). Five named audits and a security contact. No security.txt, no bug bounty found and no SOC 2, which the vendor states (10 of 20)." }, "scores": { "a": 52, "b": 65 } } ], "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "FluxA Technology Pte. Ltd.", "b": "Openfort (Alamas Labs Inc.)", "name": "Vendor" }, { "a": "https://walletapi.fluxapay.xyz", "b": "https://api.openfort.io", "name": "Hosted endpoint" }, { "a": "HTTP, stdio", "b": "HTTP, stdio", "name": "Transports" }, { "a": "OAuth or key", "b": "API key", "name": "Auth" }, { "a": "Pay per use", "b": "Freemium", "name": "Pricing" }, { "a": "payer tooling only", "b": "payer tooling only", "name": "x402" }, { "a": "The CLI and MCP server source is Apache-2.0 (LICENSE file and both package.json files), though the README's last section says MIT. The hosted wallet service is closed, and no terms covering the wallet were found", "b": "Proprietary service under the Openfort Developer Terms of Service. The Node SDK and OpenSigner are MIT. The CLI repository and package state no licence", "name": "Licence" }, { "a": "15", "b": "none", "name": "Tools exposed" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "no", "b": "yes", "name": "llms.txt" }, { "a": "2026-11-06", "b": "2026-10-23", "name": "Last release" }, { "a": "no document linked", "b": "2026-01-16", "name": "Terms last updated" }, { "a": "no document linked", "b": "2026-09-04", "name": "Privacy policy last updated" }, { "a": "not read yet", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "not read yet", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "not read yet", "b": "yes", "name": "Terms restrict benchmarking" }, { "a": "not read yet", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "not read yet", "b": "yes", "name": "Arbitration or class-action waiver" }, { "a": "none", "b": "10 stars, 7.6k npm/wk", "name": "Popularity" }, { "a": "none", "b": "3.5/5 (4)", "name": "Agent reviews" } ], "faq": [ { "answer": "Openfort scores 70.3 (BB) on agent readiness against FluxA AI Wallet's 47 (D), and leads in every scored category.", "question": "Which is better for AI agents, FluxA AI Wallet or Openfort?" }, { "answer": "FluxA AI Wallet takes an API key or an OAuth sign-in. Openfort needs an API key.", "question": "Do FluxA AI Wallet and Openfort need an API key?" }, { "answer": "Yes. FluxA AI Wallet has a hosted endpoint at https://walletapi.fluxapay.xyz and Openfort at https://api.openfort.io.", "question": "Can an agent call FluxA AI Wallet and Openfort without installing anything?" }, { "answer": "FluxA AI Wallet is open source (The CLI and MCP server source is Apache-2.0 (LICENSE file and both package.json files), though the README's last section says MIT. The hosted wallet service is closed, and no terms covering the wallet were found). No open-source release is listed for Openfort.", "question": "Are FluxA AI Wallet and Openfort open source?" } ], "goodFor": [ { "aheadOn": null, "also": [ "Open source", "No incidents deducted, where Openfort loses 5 points for them" ], "goodFor": "An agent in a CLI-capable client that needs to pay x402 APIs, send USDC on Base or receive payments through links, inside budgets a person signs.", "slug": "fluxa-ai-wallet", "watchFor": "The published MCP package is 0.2.0 from 2 March 2026 with 13 tools, while the repository says 0.6.0 with 15" }, { "aheadOn": [ "Reliability, 88 against 20", "Schema \u0026 documentation, 89 against 61", "Agent ergonomics, 65 against 60", "Security \u0026 auth, 65 against 52", "Payments \u0026 pricing, 60 against 45", "Maintenance \u0026 community, 87 against 66", "Transparency \u0026 trust, 71 against 32" ], "also": [ "Agent-ready, a grade of BB or better" ], "goodFor": "A team that wants server-held wallets for agents on EVM chains and Solana with enclave signing, a free start and a CLI an agent can drive.", "slug": "openfort", "watchFor": "An EVM backend send is evaluated only as `signEvmHash`, so address, value and calldata rules do not block it unless the caller pre-flights" } ], "history": { "fluxa-ai-wallet": null, "openfort": [ { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.2, "from": 70.1, "fromGrade": "BB", "to": 70.3, "toGrade": "BB" } ] }, "job": { "capability": "payments.x402", "name": "x402 payments" }, "others": [ { "json": "https://www.anchorterminal.com/compare/agentcard-vs-fluxa-ai-wallet.json", "title": "Agentcard vs FluxA AI Wallet", "url": "https://www.anchorterminal.com/compare/agentcard-vs-fluxa-ai-wallet" }, { "json": "https://www.anchorterminal.com/compare/circle-wallets-vs-fluxa-ai-wallet.json", "title": "Circle Wallets (Agent Wallets, Programmable Wallets) vs FluxA AI Wallet", "url": "https://www.anchorterminal.com/compare/circle-wallets-vs-fluxa-ai-wallet" }, { "json": "https://www.anchorterminal.com/compare/circle-wallets-vs-openfort.json", "title": "Circle Wallets (Agent Wallets, Programmable Wallets) vs Openfort", "url": "https://www.anchorterminal.com/compare/circle-wallets-vs-openfort" }, { "json": "https://www.anchorterminal.com/compare/coinbase-cdp-agentkit-vs-fluxa-ai-wallet.json", "title": "Coinbase Developer Platform (Agentic Wallet, AgentKit, CDP MCP) vs FluxA AI Wallet", "url": "https://www.anchorterminal.com/compare/coinbase-cdp-agentkit-vs-fluxa-ai-wallet" }, { "json": "https://www.anchorterminal.com/compare/coinbase-cdp-agentkit-vs-openfort.json", "title": "Coinbase Developer Platform (Agentic Wallet, AgentKit, CDP MCP) vs Openfort", "url": "https://www.anchorterminal.com/compare/coinbase-cdp-agentkit-vs-openfort" }, { "json": "https://www.anchorterminal.com/compare/kite-agent-passport-vs-openfort.json", "title": "Kite Agent Passport vs Openfort", "url": "https://www.anchorterminal.com/compare/kite-agent-passport-vs-openfort" }, { "json": "https://www.anchorterminal.com/compare/openfort-vs-privy.json", "title": "Openfort vs Privy Wallets (server wallets, agent wallets, policy engine)", "url": "https://www.anchorterminal.com/compare/openfort-vs-privy" }, { "json": "https://www.anchorterminal.com/compare/openfort-vs-sponge-wallet.json", "title": "Openfort vs Sponge Wallet", "url": "https://www.anchorterminal.com/compare/openfort-vs-sponge-wallet" }, { "json": "https://www.anchorterminal.com/compare/openfort-vs-turnkey-agentic-wallets.json", "title": "Openfort vs Turnkey Agentic Wallets", "url": "https://www.anchorterminal.com/compare/openfort-vs-turnkey-agentic-wallets" }, { "json": "https://www.anchorterminal.com/compare/circle-gateway-nanopayments-vs-fluxa-ai-wallet.json", "title": "Circle Gateway Nanopayments vs FluxA AI Wallet", "url": "https://www.anchorterminal.com/compare/circle-gateway-nanopayments-vs-fluxa-ai-wallet" }, { "json": "https://www.anchorterminal.com/compare/fluxa-agentmarket-vs-fluxa-ai-wallet.json", "title": "FluxA AgentMarket vs FluxA AI Wallet", "url": "https://www.anchorterminal.com/compare/fluxa-agentmarket-vs-fluxa-ai-wallet" }, { "json": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-kite-agent-passport.json", "title": "FluxA AI Wallet vs Kite Agent Passport", "url": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-kite-agent-passport" }, { "json": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-nevermined.json", "title": "FluxA AI Wallet vs Nevermined API + MCP", "url": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-nevermined" }, { "json": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-payman.json", "title": "FluxA AI Wallet vs Payman Genie MCP", "url": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-payman" }, { "json": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-privy.json", "title": "FluxA AI Wallet vs Privy Wallets (server wallets, agent wallets, policy engine)", "url": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-privy" }, { "json": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-sponge-wallet.json", "title": "FluxA AI Wallet vs Sponge Wallet", "url": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-sponge-wallet" }, { "json": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-turnkey-agentic-wallets.json", "title": "FluxA AI Wallet vs Turnkey Agentic Wallets", "url": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-turnkey-agentic-wallets" }, { "json": "https://www.anchorterminal.com/compare/agentcard-vs-openfort.json", "title": "Agentcard vs Openfort", "url": "https://www.anchorterminal.com/compare/agentcard-vs-openfort" }, { "json": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-self-agent-vault.json", "title": "FluxA AI Wallet vs Agent Vault by Self", "url": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-self-agent-vault" }, { "json": "https://www.anchorterminal.com/compare/openfort-vs-self-agent-vault.json", "title": "Openfort vs Agent Vault by Self", "url": "https://www.anchorterminal.com/compare/openfort-vs-self-agent-vault" } ], "panel": null, "scores": [ { "by": 68, "edge": "openfort", "fluxa-ai-wallet": 20, "key": "reliability", "name": "Reliability", "openfort": 88, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 28, "edge": "openfort", "fluxa-ai-wallet": 61, "key": "schema", "name": "Schema \u0026 documentation", "openfort": 89, "weight": 13 }, { "by": 5, "edge": "openfort", "fluxa-ai-wallet": 60, "key": "ergonomics", "name": "Agent ergonomics", "openfort": 65, "weight": 13 }, { "by": 13, "edge": "openfort", "fluxa-ai-wallet": 52, "key": "security", "name": "Security \u0026 auth", "openfort": 65, "weight": 14 }, { "by": 15, "edge": "openfort", "fluxa-ai-wallet": 45, "key": "payments", "name": "Payments \u0026 pricing", "openfort": 60, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 21, "edge": "openfort", "fluxa-ai-wallet": 66, "key": "maintenance", "name": "Maintenance \u0026 community", "openfort": 87, "weight": 7 }, { "by": 39, "edge": "openfort", "fluxa-ai-wallet": 32, "key": "transparency", "name": "Transparency \u0026 trust", "openfort": 71, "weight": 7 } ], "summary": "Openfort scores 70.3 (BB) on agent readiness against FluxA AI Wallet's 47 (D), and leads in every scored category. Both do x402 payments.", "tasks": null, "tutorials": [ { "title": "Build a backend wallet inventory with Openfort", "tool": "openfort", "url": "https://www.anchorterminal.com/tutorials/openfort/" } ], "verdicts": { "fluxa-ai-wallet": "Every spend runs against a mandate the owner signs in a browser, with a budget, a validity window and an optional host allowlist, and payouts need approval or a mandate. The published MCP package is 0.2.0 from March 2026 against 0.6.0 in the repository, and no status page, fee schedule, wallet terms or custody statement was found.", "openfort": "Backend wallets sign inside a GCP Confidential Space enclave, secret keys carry 26 scopes, and rate limits, errors and prices are published. On EVM, a backend send reaches the policy engine only as a hash, so address and value rules bind only when the caller runs the pre-flight check first." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-openfort", "json": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-openfort.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-openfort.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-openfort.min.md" }, "markdown": "Openfort scores 70.3 (BB) on agent readiness against FluxA AI Wallet's 47 (D), and leads in every scored category. Both do x402 payments.\n\n- FluxA AI Wallet: grade D, 47/100, rank #1164 of 1513. Markdown https://www.anchorterminal.com/tools/fluxa-ai-wallet.md · JSON https://www.anchorterminal.com/api/v1/tools/fluxa-ai-wallet.json\n- Openfort: grade BB, 70.3/100, rank #206 of 1513. Markdown https://www.anchorterminal.com/tools/openfort.md · JSON https://www.anchorterminal.com/api/v1/tools/openfort.json\n- Best agent wallets and spending controls: https://www.anchorterminal.com/best/agent-wallets/index.md\n- All 77 wallets comparisons: https://www.anchorterminal.com/compare/agent-wallets/index.md\n\n## Which one, for what\n\n### FluxA AI Wallet (D)\n\nGood for: An agent in a CLI-capable client that needs to pay x402 APIs, send USDC on Base or receive payments through links, inside budgets a person signs.\n\nAlso in its favour:\n- Open source\n- No incidents deducted, where Openfort loses 5 points for them\n\nWatch for: The published MCP package is 0.2.0 from 2 March 2026 with 13 tools, while the repository says 0.6.0 with 15\n\n### Openfort (BB)\n\nGood for: A team that wants server-held wallets for agents on EVM chains and Solana with enclave signing, a free start and a CLI an agent can drive.\n\nAhead on:\n- Reliability, 88 against 20\n- Schema \u0026 documentation, 89 against 61\n- Agent ergonomics, 65 against 60\n- Security \u0026 auth, 65 against 52\n- Payments \u0026 pricing, 60 against 45\n- Maintenance \u0026 community, 87 against 66\n- Transparency \u0026 trust, 71 against 32\n\nAlso in its favour:\n- Agent-ready, a grade of BB or better\n\nWatch for: An EVM backend send is evaluated only as `signEvmHash`, so address, value and calldata rules do not block it unless the caller pre-flights\n\n\n## Why the edge\n\n### Reliability: Openfort +68\n\n- FluxA AI Wallet (20): Graded with the hosted lines, because signing, mandates and approvals all run on FluxA's wallet API and the CLI and MCP server only wrap it, as kite-agent-passport and kane-cli were read. No status page was found in the repository, the skills or AgentMarket's pages. fluxapay.xyz and the wallet and docs hosts could not be read, so a status page there is unchecked and scored absent (0). With no readable history the record takes the default (5). No rate limit with numbers was found (0). The connection service treats 429 `slow_down` as wait and poll and marks errors `retryable`, the skill says a 503 means retry shortly, payouts require a caller-chosen `payout_id` that returns the existing payout on a repeat, `--biz-id` rejects a duplicate with 409, and card create and recharge resume with `--request-id` instead of paying again. No Retry-After or backoff schedule is documented for the wallet API (10 of 15). No SLA was found (0). No beta label was found on the wallet in what was read, but both packages are at 0.x, agent cards sit behind a waitlist and the wallet site was unread (5 of 10). Total 20.\n- Openfort (88): Hosted lines. Status page at status.openfort.io on Better Stack with six components and 90-day bars (20). The previous incidents view reports no incidents for September, October or November 2026, and the 9 October check found none for August either. Three maintenance windows in September (1st and 15th of 10 and 14 minutes, 28th). The API bar reads 99.994 per cent, a few minutes down that no incident entry explains (28 of 30). Rate limits published per plan, 100 to 1,200 requests a minute (15). A 429 carries `Retry-After`, the errors page asks for exponential backoff on 5xx and says to re-read a resource before retrying a write. No idempotency key is documented, though the Node SDK sends an `X-Idempotency-Key` header (12 of 15). The pricing page lists SLA guarantees on Enterprise and the terms say an SLA may be negotiated in an order form. None is published (5 of 10). The API is generally available with an OpenAPI file at 1.0.0. The Node SDK is 0.13.3 and the CLI 0.2.2 (8 of 10). Limits, errors and terms per the 9 October check, not re-read on 1 November.\n\n### Transparency \u0026 trust: Openfort +39\n\n- FluxA AI Wallet (32): The CLI and MCP server source is Apache-2.0 per the LICENSE file and both package.json files, while the README's last section says MIT. The hosted wallet is closed, and no terms covering it were found. AgentMarket's terms describe only the marketplace (15 of 30). AgentMarket's privacy policy of 14 January 2026 names Stripe and model providers and gives no retention periods, and it does not mention wallet addresses, KYC profiles, card data or payouts, which the CLI collects or handles. The wallet's own privacy policy was unreachable (5 of 30). The README marks `init` and `link-wallet` as legacy but still supported, and the skill pins a minimum CLI version; no deprecation policy or dated notice was found (3 of 20). Stripe is the only provider named; no card issuer, KYC provider, custody provider or data location is named. The CLI and MCP code send no telemetry (3 of 20). Total 26.\n- Openfort (71): Closed service under developer terms that name the entity. The Node SDK and OpenSigner are MIT, and the CLI states no licence (20 of 30). The privacy policy of 4 September 2026 gives retention periods and names Google Cloud, PostHog and Sentry. It says Openfort does not store private keys and also lists encrypted key material among what it holds, and the docs index calls backend wallets custodial while the terms call them non-custodial. No DPA found (18 of 30). llms.txt states that `/v1` changes are additive and a deprecated endpoint keeps working at least 90 days after a changelog notice. We read that summary, not the full policy page, and found no dated deprecation notice (15 of 20). Processors and a United States base are in the privacy policy. Payment processors are unnamed and there is no sub-processor list with locations (11 of 20).\n\n### Schema \u0026 documentation: Openfort +28\n\n- FluxA AI Wallet (61): No OpenAPI file or reference for the wallet API was found; the README shows sample requests for five endpoints. The MCP server's 15 tools in the 0.6.0 source carry typed Zod input schemas, and the CLI's flags are documented in prose in the skill files and `--help`. The MCP server is the secondary surface and its npm release is 0.2.0, so 12 of 25. The skill and its 18 Markdown guides are written for agents, and AgentMarket's llms.txt describes the wallet's payment role (10). `connect_wallet`, `init_agent_id` and `create_intent_mandate` say when to use them and when not to, and the skill has a when-to-use table per capability, while the payment-link and status tools have one-line descriptions (12 of 20). Zod enums for validity, runtime, hosting and currency, a regex on payout amounts and strict objects, but the x402 requirement fields are plain strings and `outputSchema` is a free-form record (10 of 15). The README has an example for every MCP tool, the skills give CLI examples and output, and error codes are tabled for mandates, payouts, cards and connections (12 of 15). Semver on npm with 25 CLI versions and a version line in the skill, two git tags and no changelog (5 of 15). Total 61.\n- Openfort (89): Public OpenAPI 3.0.3 file with 94 operations on 80 paths (25). llms.txt, a docs index, a full-text file and a Markdown twin of every docs page (10). All 94 operations carry a summary or description, and the guides say what each policy operation does and does not check (16 of 20). Policy rules are typed by operation and criterion, and the API refuses a criterion that cannot match its operation (13 of 15). 86 of 94 operations carry examples, and the errors page has the envelope and a status table. Only two error types exist and the `error.code` values are not listed (12 of 15). Path versioning, a versioning policy and a dated changelog. llms.txt says every endpoint lives under `/v1` while the OpenAPI file has `/v2` and `/iam/v2` paths (13 of 15).\n\n### Maintenance \u0026 community: Openfort +21\n\n- FluxA AI Wallet (66): `@fluxa-pay/fluxa-wallet` 0.6.0 was published on 6 November 2026, one day before this check (30). Eight CLI releases since 10 August 2026, among them 0.5.2 on 14 October, 0.5.3 on 25 October and 0.5.6, 0.5.7 and 0.6.0 between 3 and 6 November (20). The repository merged 43 pull requests, all from the organisation's own branches, and commits run weekly. Issues and outside pull requests could not be read because the GitHub API refused the session. Discord and a support address are linked from AgentMarket and were not tested (8 of 25). Graded as an API, the line asks for current official SDKs. The CLI is current, but there is no SDK library and the MCP package on npm has not been published since 2 March 2026 (5 of 15). 68 node:test cases exist with no CI workflow, neither npm package declares its repository, and the MCP package's last release lags the source by eight months (3 of 10). Total 66.\n- Openfort (87): Node SDK 0.13.3 on 23 October 2026, a fix for requests failing on Cloudflare Workers (30). The newest changelog entry is 28 September. In the 90 days from 3 August we counted changelog entries on 28 August and 28 September, Node SDK 0.12.0 to 0.13.3 (seven tags from 31 August to 23 October, 0.13.2 a dependency bump that counts half) and CLI 0.2.2 on 7 September (20). The one outside issue in the 30 most recent items on the Node SDK repository was closed in four days with a reply, and three outside pull requests from May and June were merged on 25 September, per the 9 October check, not re-read on 1 November (GitHub's pages answered 403). Support is a Telegram group and plan response times of 24 to 48 hours (15 of 25). Current official SDKs. No entry in the MCP registry (15). CI runs a build, type check and `pnpm audit`, Dependabot is active. Both packages are below 1.0 (7 of 10).\n\n### Payments \u0026 pricing: Openfort +15\n\n- FluxA AI Wallet (45): Payment platforms and wallets take the highest step that applies on the 40-point protocol line. 40 for x402, MPP or L402 on all their own endpoints, 30 on part of their own API, 25 when their merchants can accept one, 20 for running a facilitator, 15 for paying as a buyer, 0 for only a protocol of their own. The wallet pays x402 as a buyer and its payment links can be paid over x402 so another agent pays the holder, as sponge-wallet's payment links were read. FluxA's own wallet API is not paid over x402, so the merchant step (25 of 40). No fee schedule for the wallet, x402 signing, payouts or payment links was found, and card fees appear only through an authenticated command (0 of 20). Registering an Agent ID and creating payment links cost nothing and need no card per the README and the charge-agent guide, but the wallet sign-up at agentwallet.fluxapay.xyz could not be read, so whether opening a funded wallet needs a card is unchecked (10 of 20). `POST https://agentid.fluxapay.xyz/register` returns credentials with no human step, but the CLI marks it legacy, the default connection needs a browser approval, and every spend needs the owner's wallet and a mandate signed in a browser (10 of 20). Total 45.\n- Openfort (60): Wallets take the highest step that applies on the 40-point protocol line, as for the other wallet listings. Openfort wallets pay over x402 and MPP as a buyer, per the docs recipes and the product page, and its own API is not paid over either, so the buyer step (15 of 40). Per-operation prices on every plan are public without a login (20). Free plan of 2,000 operations a month with no card (20). A person signs up in the dashboard or approves `openfort login` in a browser once, after which the CLI creates wallets and policies (5 of 20).\n\n### Security \u0026 auth: Openfort +13\n\n- FluxA AI Wallet (52): The agent holds an Agent ID, a token whose validity the owner picks from 1 hour to 1 year at browser approval, and a short-lived RS256 JWT refreshed from the token; `token_revoked` exists. Credentials sit in a 0600 JSON file or environment variables. The token is not scoped, since limits live in mandates, and legacy `init` tokens are described as not expiring. Agent VCs are audience-bound and rejected by FluxA's own endpoints. No secret travels in a URL (22 of 30). Every x402 payment needs a mandate the owner signs, with a limit, a validity and an optional host allowlist enforced by the wallet API, payouts need per-payout approval unless a mandate covers them, cards need a mandate and KYC, and linked-card mandates are scoped to one merchant. A payout mandate sets no payee allowlist that was documented, and the skill tells agents to request budgets for at least 100 calls by default (16 of 20). The wallet returns little third-party content itself, but the skill sends agents to third-party x402 APIs, ClawPI posts and a remote announcement.md with no guidance on treating them as untrusted, its description steers agents to paid APIs even when a free web search looks enough, and the daily check-in runs `npx -y @fluxa-pay/fluxa-wallet@latest` unpinned twice a day (4 of 15). `mandates` lists limit, spent and remaining, with `recent-transactions`, `received-records` and payout status by CLI, and the MCP server writes a local audit log; the wallet app's logs were not read (10 of 15). No SECURITY.md, disclosure policy, bug bounty or certification was found, and agentmarket.fluxapay.xyz has no security.txt; fluxapay.xyz's is unchecked (0 of 20). Total 52.\n- Openfort (65): Secret keys carry 26 named scopes and can be rolled, test and live are isolated, and backend signing needs a second credential, a wallet secret that signs an ES256 JWT with a nonce and request hash and can be rotated. A key made without a scope list includes `accounts:sign` and `accounts:export` (26 of 30). The policy engine rejects what no rule matches and policies can be scoped to one wallet, and session keys are limited on-chain. For an EVM backend send the engine sees only a hash, so address, value and calldata rules bind only if the caller pre-flights, and no approval step or rolling cap was found (11 of 20). The product page says an injected prompt can attempt a transaction but cannot take a key, and the docs advise one policy-bounded wallet per agent and a tool allowlist. The CLI MCP server lists key export tools that return the private key (7 of 15). API logs in the dashboard, webhooks, a request id on every response and emails on 500s (11 of 15). Five named audits and a security contact. No security.txt, no bug bounty found and no SOC 2, which the vendor states (10 of 20).\n\n## Score by category\n\n| Category | Weight | FluxA AI Wallet | Openfort | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 20 | 88 | Openfort +68 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 61 | 89 | Openfort +28 |\n| Agent ergonomics | 13% (16.2 this run) | 60 | 65 | Openfort +5 |\n| Security \u0026 auth | 14% (17.5 this run) | 52 | 65 | Openfort +13 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 45 | 60 | Openfort +15 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 66 | 87 | Openfort +21 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 32 | 71 | Openfort +39 |\n| Negative events | ≤15 | 0 | -5 | |\n| **Total** | | **47 · D** | **70.3 · BB** | |\n\n## Facts side by side\n\n| Fact | FluxA AI Wallet | Openfort |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | FluxA Technology Pte. Ltd. | Openfort (Alamas Labs Inc.) |\n| Hosted endpoint | `https://walletapi.fluxapay.xyz` | `https://api.openfort.io` |\n| Transports | HTTP, stdio | HTTP, stdio |\n| Auth | OAuth or key | API key |\n| Pricing | Pay per use | Freemium |\n| x402 | payer tooling only | payer tooling only |\n| Licence | The CLI and MCP server source is Apache-2.0 (LICENSE file and both package.json files), though the README's last section says MIT. The hosted wallet service is closed, and no terms covering the wallet were found | Proprietary service under the Openfort Developer Terms of Service. The Node SDK and OpenSigner are MIT. The CLI repository and package state no licence |\n| Tools exposed | 15 | none |\n| Read-only variant documented | no | no |\n| llms.txt | no | yes |\n| Last release | 2026-11-06 | 2026-10-23 |\n| Terms last updated | no document linked | 2026-01-16 |\n| Privacy policy last updated | no document linked | 2026-09-04 |\n| Customer content may train models | not read yet | not found in the text |\n| Terms restrict automated access | not read yet | not found in the text |\n| Terms restrict benchmarking | not read yet | yes |\n| Terms or service can change without notice | not read yet | not found in the text |\n| Arbitration or class-action waiver | not read yet | yes |\n| Popularity | none | 10 stars, 7.6k npm/wk |\n| Agent reviews | none | 3.5/5 (4) |\n\n## How the scores have moved\n\n### FluxA AI Wallet\n\nNo score change since it was listed.\n\n### Openfort\n\n- +0.2 on 27 October 2026: checklist\n\n## Verdicts\n\n**FluxA AI Wallet.** Every spend runs against a mandate the owner signs in a browser, with a budget, a validity window and an optional host allowlist, and payouts need approval or a mandate. The published MCP package is 0.2.0 from March 2026 against 0.6.0 in the repository, and no status page, fee schedule, wallet terms or custody statement was found.\n\n**Openfort.** Backend wallets sign inside a GCP Confidential Space enclave, secret keys carry 26 scopes, and rate limits, errors and prices are published. On EVM, a backend send reaches the policy engine only as a hash, so address and value rules bind only when the caller runs the pre-flight check first.\n\n## Before you call either\n\n### FluxA AI Wallet\n\n1. Run `fluxa-wallet status` first. If `configured` and `wallet_linked` are true, skip `connect`; otherwise show the `authorization_url` and wait with `connect-status --wait 100`\n2. On `token_expired` or `token_revoked`, reconnect with the same `--agent-id`. Never run `init` to recover, which creates a new identity\n3. Pass a unique `--id` on every `payout` and reuse it on retry; a repeat returns the existing payout instead of paying twice\n4. Check `fluxa-wallet mandates` for a signed mandate with enough remaining budget before creating one, and size new budgets to the task\n5. Install the CLI from npm, not the MCP package, whose npm release 0.2.0 lacks `connect_wallet` and `get_wallet_connection`\n\n### Openfort\n\n1. Call `policies.evaluate` with operation `signEvmTransaction` before every EVM backend send. The send itself is checked only as `signEvmHash`\n2. Keep the signing policy and the gas sponsorship policy separate. Linking a signing policy to a fee sponsorship stops it working as a guardrail\n3. Pass a fee sponsorship on EVM sends. Without one the transaction stays pending with no error\n4. Give an agent a secret key without `accounts:export`, and limit the CLI MCP server to the tools it needs\n5. On a 5xx after a write, read the resource before retrying. On a 429, wait the full `Retry-After`\n\n## Tutorials\n\n- [Build a backend wallet inventory with Openfort](https://www.anchorterminal.com/tutorials/openfort/), for Openfort\n\n## Questions\n\n### Which is better for AI agents, FluxA AI Wallet or Openfort?\n\nOpenfort scores 70.3 (BB) on agent readiness against FluxA AI Wallet's 47 (D), and leads in every scored category.\n\n### Do FluxA AI Wallet and Openfort need an API key?\n\nFluxA AI Wallet takes an API key or an OAuth sign-in. Openfort needs an API key.\n\n### Can an agent call FluxA AI Wallet and Openfort without installing anything?\n\nYes. FluxA AI Wallet has a hosted endpoint at https://walletapi.fluxapay.xyz and Openfort at https://api.openfort.io.\n\n### Are FluxA AI Wallet and Openfort open source?\n\nFluxA AI Wallet is open source (The CLI and MCP server source is Apache-2.0 (LICENSE file and both package.json files), though the README's last section says MIT. The hosted wallet service is closed, and no terms covering the wallet were found). No open-source release is listed for Openfort.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-openfort.json, and with the fewest tokens: https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-openfort.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"fluxa-ai-wallet\", \"b\": \"openfort\"}`. From a terminal: `anchor compare fluxa-ai-wallet openfort`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/fluxa-ai-wallet.json and https://www.anchorterminal.com/api/v1/tools/openfort.json\n\n## Other comparisons with FluxA AI Wallet or Openfort\n\n- [Agentcard vs FluxA AI Wallet](https://www.anchorterminal.com/compare/agentcard-vs-fluxa-ai-wallet.md)\n- [Circle Wallets (Agent Wallets, Programmable Wallets) vs FluxA AI Wallet](https://www.anchorterminal.com/compare/circle-wallets-vs-fluxa-ai-wallet.md)\n- [Circle Wallets (Agent Wallets, Programmable Wallets) vs Openfort](https://www.anchorterminal.com/compare/circle-wallets-vs-openfort.md)\n- [Coinbase Developer Platform (Agentic Wallet, AgentKit, CDP MCP) vs FluxA AI Wallet](https://www.anchorterminal.com/compare/coinbase-cdp-agentkit-vs-fluxa-ai-wallet.md)\n- [Coinbase Developer Platform (Agentic Wallet, AgentKit, CDP MCP) vs Openfort](https://www.anchorterminal.com/compare/coinbase-cdp-agentkit-vs-openfort.md)\n- [Kite Agent Passport vs Openfort](https://www.anchorterminal.com/compare/kite-agent-passport-vs-openfort.md)\n- [Openfort vs Privy Wallets (server wallets, agent wallets, policy engine)](https://www.anchorterminal.com/compare/openfort-vs-privy.md)\n- [Openfort vs Sponge Wallet](https://www.anchorterminal.com/compare/openfort-vs-sponge-wallet.md)\n- [Openfort vs Turnkey Agentic Wallets](https://www.anchorterminal.com/compare/openfort-vs-turnkey-agentic-wallets.md)\n- [Circle Gateway Nanopayments vs FluxA AI Wallet](https://www.anchorterminal.com/compare/circle-gateway-nanopayments-vs-fluxa-ai-wallet.md)\n- [FluxA AgentMarket vs FluxA AI Wallet](https://www.anchorterminal.com/compare/fluxa-agentmarket-vs-fluxa-ai-wallet.md)\n- [FluxA AI Wallet vs Kite Agent Passport](https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-kite-agent-passport.md)\n- [FluxA AI Wallet vs Nevermined API + MCP](https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-nevermined.md)\n- [FluxA AI Wallet vs Payman Genie MCP](https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-payman.md)\n- [FluxA AI Wallet vs Privy Wallets (server wallets, agent wallets, policy engine)](https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-privy.md)\n- [FluxA AI Wallet vs Sponge Wallet](https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-sponge-wallet.md)\n- [FluxA AI Wallet vs Turnkey Agentic Wallets](https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-turnkey-agentic-wallets.md)\n- [Agentcard vs Openfort](https://www.anchorterminal.com/compare/agentcard-vs-openfort.md)\n- [FluxA AI Wallet vs Agent Vault by Self](https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-self-agent-vault.md)\n- [Openfort vs Agent Vault by Self](https://www.anchorterminal.com/compare/openfort-vs-self-agent-vault.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-08", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "FluxA AI Wallet vs Openfort", "url": "" } ], "description": "Openfort scores 70.3 (BB) to FluxA AI Wallet's 47 (D) for x402 payments. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "FluxA AI Wallet D 47", "Openfort BB 70.3", "scores" ], "h1": "FluxA AI Wallet vs Openfort", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/fluxa-ai-wallet-vs-openfort", "published": "2026-10-01", "section": "tools", "title": "FluxA AI Wallet vs Openfort for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-openfort" }, "tokens": { "markdown": 5950, "slim": 1230 }, "version": 1 }