# FluxA AI Wallet vs Openfort

> Openfort scores 70.3 (BB) to FluxA AI Wallet's 47 (D) for x402 payments. Prices, MCP, x402, uptime and agent notes side by side.

- Canonical: https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-openfort
- Markdown: https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-openfort.md (~5,950 tokens)
- Site index for agents: https://www.anchorterminal.com/llms.txt (the key docs and every listing in one file, at most 16 MB, about 4 million tokens: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key)
- DNS: dig +short TXT <slug>.grade.anchorterminal.com (the grade as a DNS TXT record, for a sandbox with no HTTP where names still resolve; also top., best.<category>. and <a>.vs.<b>. under the zone, and the same under grade.letme.dev)
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)
- Updated: 2026-11-07

Openfort scores 70.3 (BB) on agent readiness against FluxA AI Wallet's 47 (D), and leads in every scored category. Both do x402 payments.

- FluxA AI Wallet: grade D, 47/100, rank #1164 of 1513. Markdown https://www.anchorterminal.com/tools/fluxa-ai-wallet.md · JSON https://www.anchorterminal.com/api/v1/tools/fluxa-ai-wallet.json
- Openfort: grade BB, 70.3/100, rank #206 of 1513. Markdown https://www.anchorterminal.com/tools/openfort.md · JSON https://www.anchorterminal.com/api/v1/tools/openfort.json
- Best agent wallets and spending controls: https://www.anchorterminal.com/best/agent-wallets/index.md
- All 77 wallets comparisons: https://www.anchorterminal.com/compare/agent-wallets/index.md

## Which one, for what

### FluxA AI Wallet (D)

Good for: An agent in a CLI-capable client that needs to pay x402 APIs, send USDC on Base or receive payments through links, inside budgets a person signs.

Also in its favour:
- Open source
- No incidents deducted, where Openfort loses 5 points for them

Watch for: The published MCP package is 0.2.0 from 2 March 2026 with 13 tools, while the repository says 0.6.0 with 15

### Openfort (BB)

Good for: A team that wants server-held wallets for agents on EVM chains and Solana with enclave signing, a free start and a CLI an agent can drive.

Ahead on:
- Reliability, 88 against 20
- Schema & documentation, 89 against 61
- Agent ergonomics, 65 against 60
- Security & auth, 65 against 52
- Payments & pricing, 60 against 45
- Maintenance & community, 87 against 66
- Transparency & trust, 71 against 32

Also in its favour:
- Agent-ready, a grade of BB or better

Watch for: An EVM backend send is evaluated only as `signEvmHash`, so address, value and calldata rules do not block it unless the caller pre-flights


## Why the edge

### Reliability: Openfort +68

- FluxA AI Wallet (20): Graded with the hosted lines, because signing, mandates and approvals all run on FluxA's wallet API and the CLI and MCP server only wrap it, as kite-agent-passport and kane-cli were read. No status page was found in the repository, the skills or AgentMarket's pages. fluxapay.xyz and the wallet and docs hosts could not be read, so a status page there is unchecked and scored absent (0). With no readable history the record takes the default (5). No rate limit with numbers was found (0). The connection service treats 429 `slow_down` as wait and poll and marks errors `retryable`, the skill says a 503 means retry shortly, payouts require a caller-chosen `payout_id` that returns the existing payout on a repeat, `--biz-id` rejects a duplicate with 409, and card create and recharge resume with `--request-id` instead of paying again. No Retry-After or backoff schedule is documented for the wallet API (10 of 15). No SLA was found (0). No beta label was found on the wallet in what was read, but both packages are at 0.x, agent cards sit behind a waitlist and the wallet site was unread (5 of 10). Total 20.
- Openfort (88): Hosted lines. Status page at status.openfort.io on Better Stack with six components and 90-day bars (20). The previous incidents view reports no incidents for September, October or November 2026, and the 9 October check found none for August either. Three maintenance windows in September (1st and 15th of 10 and 14 minutes, 28th). The API bar reads 99.994 per cent, a few minutes down that no incident entry explains (28 of 30). Rate limits published per plan, 100 to 1,200 requests a minute (15). A 429 carries `Retry-After`, the errors page asks for exponential backoff on 5xx and says to re-read a resource before retrying a write. No idempotency key is documented, though the Node SDK sends an `X-Idempotency-Key` header (12 of 15). The pricing page lists SLA guarantees on Enterprise and the terms say an SLA may be negotiated in an order form. None is published (5 of 10). The API is generally available with an OpenAPI file at 1.0.0. The Node SDK is 0.13.3 and the CLI 0.2.2 (8 of 10). Limits, errors and terms per the 9 October check, not re-read on 1 November.

### Transparency & trust: Openfort +39

- FluxA AI Wallet (32): The CLI and MCP server source is Apache-2.0 per the LICENSE file and both package.json files, while the README's last section says MIT. The hosted wallet is closed, and no terms covering it were found. AgentMarket's terms describe only the marketplace (15 of 30). AgentMarket's privacy policy of 14 January 2026 names Stripe and model providers and gives no retention periods, and it does not mention wallet addresses, KYC profiles, card data or payouts, which the CLI collects or handles. The wallet's own privacy policy was unreachable (5 of 30). The README marks `init` and `link-wallet` as legacy but still supported, and the skill pins a minimum CLI version; no deprecation policy or dated notice was found (3 of 20). Stripe is the only provider named; no card issuer, KYC provider, custody provider or data location is named. The CLI and MCP code send no telemetry (3 of 20). Total 26.
- Openfort (71): Closed service under developer terms that name the entity. The Node SDK and OpenSigner are MIT, and the CLI states no licence (20 of 30). The privacy policy of 4 September 2026 gives retention periods and names Google Cloud, PostHog and Sentry. It says Openfort does not store private keys and also lists encrypted key material among what it holds, and the docs index calls backend wallets custodial while the terms call them non-custodial. No DPA found (18 of 30). llms.txt states that `/v1` changes are additive and a deprecated endpoint keeps working at least 90 days after a changelog notice. We read that summary, not the full policy page, and found no dated deprecation notice (15 of 20). Processors and a United States base are in the privacy policy. Payment processors are unnamed and there is no sub-processor list with locations (11 of 20).

### Schema & documentation: Openfort +28

- FluxA AI Wallet (61): No OpenAPI file or reference for the wallet API was found; the README shows sample requests for five endpoints. The MCP server's 15 tools in the 0.6.0 source carry typed Zod input schemas, and the CLI's flags are documented in prose in the skill files and `--help`. The MCP server is the secondary surface and its npm release is 0.2.0, so 12 of 25. The skill and its 18 Markdown guides are written for agents, and AgentMarket's llms.txt describes the wallet's payment role (10). `connect_wallet`, `init_agent_id` and `create_intent_mandate` say when to use them and when not to, and the skill has a when-to-use table per capability, while the payment-link and status tools have one-line descriptions (12 of 20). Zod enums for validity, runtime, hosting and currency, a regex on payout amounts and strict objects, but the x402 requirement fields are plain strings and `outputSchema` is a free-form record (10 of 15). The README has an example for every MCP tool, the skills give CLI examples and output, and error codes are tabled for mandates, payouts, cards and connections (12 of 15). Semver on npm with 25 CLI versions and a version line in the skill, two git tags and no changelog (5 of 15). Total 61.
- Openfort (89): Public OpenAPI 3.0.3 file with 94 operations on 80 paths (25). llms.txt, a docs index, a full-text file and a Markdown twin of every docs page (10). All 94 operations carry a summary or description, and the guides say what each policy operation does and does not check (16 of 20). Policy rules are typed by operation and criterion, and the API refuses a criterion that cannot match its operation (13 of 15). 86 of 94 operations carry examples, and the errors page has the envelope and a status table. Only two error types exist and the `error.code` values are not listed (12 of 15). Path versioning, a versioning policy and a dated changelog. llms.txt says every endpoint lives under `/v1` while the OpenAPI file has `/v2` and `/iam/v2` paths (13 of 15).

### Maintenance & community: Openfort +21

- FluxA AI Wallet (66): `@fluxa-pay/fluxa-wallet` 0.6.0 was published on 6 November 2026, one day before this check (30). Eight CLI releases since 10 August 2026, among them 0.5.2 on 14 October, 0.5.3 on 25 October and 0.5.6, 0.5.7 and 0.6.0 between 3 and 6 November (20). The repository merged 43 pull requests, all from the organisation's own branches, and commits run weekly. Issues and outside pull requests could not be read because the GitHub API refused the session. Discord and a support address are linked from AgentMarket and were not tested (8 of 25). Graded as an API, the line asks for current official SDKs. The CLI is current, but there is no SDK library and the MCP package on npm has not been published since 2 March 2026 (5 of 15). 68 node:test cases exist with no CI workflow, neither npm package declares its repository, and the MCP package's last release lags the source by eight months (3 of 10). Total 66.
- Openfort (87): Node SDK 0.13.3 on 23 October 2026, a fix for requests failing on Cloudflare Workers (30). The newest changelog entry is 28 September. In the 90 days from 3 August we counted changelog entries on 28 August and 28 September, Node SDK 0.12.0 to 0.13.3 (seven tags from 31 August to 23 October, 0.13.2 a dependency bump that counts half) and CLI 0.2.2 on 7 September (20). The one outside issue in the 30 most recent items on the Node SDK repository was closed in four days with a reply, and three outside pull requests from May and June were merged on 25 September, per the 9 October check, not re-read on 1 November (GitHub's pages answered 403). Support is a Telegram group and plan response times of 24 to 48 hours (15 of 25). Current official SDKs. No entry in the MCP registry (15). CI runs a build, type check and `pnpm audit`, Dependabot is active. Both packages are below 1.0 (7 of 10).

### Payments & pricing: Openfort +15

- FluxA AI Wallet (45): Payment platforms and wallets take the highest step that applies on the 40-point protocol line. 40 for x402, MPP or L402 on all their own endpoints, 30 on part of their own API, 25 when their merchants can accept one, 20 for running a facilitator, 15 for paying as a buyer, 0 for only a protocol of their own. The wallet pays x402 as a buyer and its payment links can be paid over x402 so another agent pays the holder, as sponge-wallet's payment links were read. FluxA's own wallet API is not paid over x402, so the merchant step (25 of 40). No fee schedule for the wallet, x402 signing, payouts or payment links was found, and card fees appear only through an authenticated command (0 of 20). Registering an Agent ID and creating payment links cost nothing and need no card per the README and the charge-agent guide, but the wallet sign-up at agentwallet.fluxapay.xyz could not be read, so whether opening a funded wallet needs a card is unchecked (10 of 20). `POST https://agentid.fluxapay.xyz/register` returns credentials with no human step, but the CLI marks it legacy, the default connection needs a browser approval, and every spend needs the owner's wallet and a mandate signed in a browser (10 of 20). Total 45.
- Openfort (60): Wallets take the highest step that applies on the 40-point protocol line, as for the other wallet listings. Openfort wallets pay over x402 and MPP as a buyer, per the docs recipes and the product page, and its own API is not paid over either, so the buyer step (15 of 40). Per-operation prices on every plan are public without a login (20). Free plan of 2,000 operations a month with no card (20). A person signs up in the dashboard or approves `openfort login` in a browser once, after which the CLI creates wallets and policies (5 of 20).

### Security & auth: Openfort +13

- FluxA AI Wallet (52): The agent holds an Agent ID, a token whose validity the owner picks from 1 hour to 1 year at browser approval, and a short-lived RS256 JWT refreshed from the token; `token_revoked` exists. Credentials sit in a 0600 JSON file or environment variables. The token is not scoped, since limits live in mandates, and legacy `init` tokens are described as not expiring. Agent VCs are audience-bound and rejected by FluxA's own endpoints. No secret travels in a URL (22 of 30). Every x402 payment needs a mandate the owner signs, with a limit, a validity and an optional host allowlist enforced by the wallet API, payouts need per-payout approval unless a mandate covers them, cards need a mandate and KYC, and linked-card mandates are scoped to one merchant. A payout mandate sets no payee allowlist that was documented, and the skill tells agents to request budgets for at least 100 calls by default (16 of 20). The wallet returns little third-party content itself, but the skill sends agents to third-party x402 APIs, ClawPI posts and a remote announcement.md with no guidance on treating them as untrusted, its description steers agents to paid APIs even when a free web search looks enough, and the daily check-in runs `npx -y @fluxa-pay/fluxa-wallet@latest` unpinned twice a day (4 of 15). `mandates` lists limit, spent and remaining, with `recent-transactions`, `received-records` and payout status by CLI, and the MCP server writes a local audit log; the wallet app's logs were not read (10 of 15). No SECURITY.md, disclosure policy, bug bounty or certification was found, and agentmarket.fluxapay.xyz has no security.txt; fluxapay.xyz's is unchecked (0 of 20). Total 52.
- Openfort (65): Secret keys carry 26 named scopes and can be rolled, test and live are isolated, and backend signing needs a second credential, a wallet secret that signs an ES256 JWT with a nonce and request hash and can be rotated. A key made without a scope list includes `accounts:sign` and `accounts:export` (26 of 30). The policy engine rejects what no rule matches and policies can be scoped to one wallet, and session keys are limited on-chain. For an EVM backend send the engine sees only a hash, so address, value and calldata rules bind only if the caller pre-flights, and no approval step or rolling cap was found (11 of 20). The product page says an injected prompt can attempt a transaction but cannot take a key, and the docs advise one policy-bounded wallet per agent and a tool allowlist. The CLI MCP server lists key export tools that return the private key (7 of 15). API logs in the dashboard, webhooks, a request id on every response and emails on 500s (11 of 15). Five named audits and a security contact. No security.txt, no bug bounty found and no SOC 2, which the vendor states (10 of 20).

## Score by category

| Category | Weight | FluxA AI Wallet | Openfort | Edge |
| --- | --- | --- | --- | --- |
| Reliability | 16% (20 this run) | 20 | 88 | Openfort +68 |
| Performance | 10%, pending | pending | pending | not scored in this run |
| Schema & documentation | 13% (16.2 this run) | 61 | 89 | Openfort +28 |
| Agent ergonomics | 13% (16.2 this run) | 60 | 65 | Openfort +5 |
| Security & auth | 14% (17.5 this run) | 52 | 65 | Openfort +13 |
| Payments & pricing | 10% (12.5 this run) | 45 | 60 | Openfort +15 |
| Task success | 10%, pending | pending | pending | not scored in this run |
| Maintenance & community | 7% (8.8 this run) | 66 | 87 | Openfort +21 |
| Transparency & trust | 7% (8.8 this run) | 32 | 71 | Openfort +39 |
| Negative events | ≤15 | 0 | -5 | |
| **Total** | | **47 · D** | **70.3 · BB** | |

## Facts side by side

| Fact | FluxA AI Wallet | Openfort |
| --- | --- | --- |
| Kind | HTTP API | HTTP API |
| Vendor | FluxA Technology Pte. Ltd. | Openfort (Alamas Labs Inc.) |
| Hosted endpoint | `https://walletapi.fluxapay.xyz` | `https://api.openfort.io` |
| Transports | HTTP, stdio | HTTP, stdio |
| Auth | OAuth or key | API key |
| Pricing | Pay per use | Freemium |
| x402 | payer tooling only | payer tooling only |
| Licence | The CLI and MCP server source is Apache-2.0 (LICENSE file and both package.json files), though the README's last section says MIT. The hosted wallet service is closed, and no terms covering the wallet were found | Proprietary service under the Openfort Developer Terms of Service. The Node SDK and OpenSigner are MIT. The CLI repository and package state no licence |
| Tools exposed | 15 | none |
| Read-only variant documented | no | no |
| llms.txt | no | yes |
| Last release | 2026-11-06 | 2026-10-23 |
| Terms last updated | no document linked | 2026-01-16 |
| Privacy policy last updated | no document linked | 2026-09-04 |
| Customer content may train models | not read yet | not found in the text |
| Terms restrict automated access | not read yet | not found in the text |
| Terms restrict benchmarking | not read yet | yes |
| Terms or service can change without notice | not read yet | not found in the text |
| Arbitration or class-action waiver | not read yet | yes |
| Popularity | none | 10 stars, 7.6k npm/wk |
| Agent reviews | none | 3.5/5 (4) |

## How the scores have moved

### FluxA AI Wallet

No score change since it was listed.

### Openfort

- +0.2 on 27 October 2026: checklist

## Verdicts

**FluxA AI Wallet.** Every spend runs against a mandate the owner signs in a browser, with a budget, a validity window and an optional host allowlist, and payouts need approval or a mandate. The published MCP package is 0.2.0 from March 2026 against 0.6.0 in the repository, and no status page, fee schedule, wallet terms or custody statement was found.

**Openfort.** Backend wallets sign inside a GCP Confidential Space enclave, secret keys carry 26 scopes, and rate limits, errors and prices are published. On EVM, a backend send reaches the policy engine only as a hash, so address and value rules bind only when the caller runs the pre-flight check first.

## Before you call either

### FluxA AI Wallet

1. Run `fluxa-wallet status` first. If `configured` and `wallet_linked` are true, skip `connect`; otherwise show the `authorization_url` and wait with `connect-status --wait 100`
2. On `token_expired` or `token_revoked`, reconnect with the same `--agent-id`. Never run `init` to recover, which creates a new identity
3. Pass a unique `--id` on every `payout` and reuse it on retry; a repeat returns the existing payout instead of paying twice
4. Check `fluxa-wallet mandates` for a signed mandate with enough remaining budget before creating one, and size new budgets to the task
5. Install the CLI from npm, not the MCP package, whose npm release 0.2.0 lacks `connect_wallet` and `get_wallet_connection`

### Openfort

1. Call `policies.evaluate` with operation `signEvmTransaction` before every EVM backend send. The send itself is checked only as `signEvmHash`
2. Keep the signing policy and the gas sponsorship policy separate. Linking a signing policy to a fee sponsorship stops it working as a guardrail
3. Pass a fee sponsorship on EVM sends. Without one the transaction stays pending with no error
4. Give an agent a secret key without `accounts:export`, and limit the CLI MCP server to the tools it needs
5. On a 5xx after a write, read the resource before retrying. On a 429, wait the full `Retry-After`

## Tutorials

- [Build a backend wallet inventory with Openfort](https://www.anchorterminal.com/tutorials/openfort/), for Openfort

## Questions

### Which is better for AI agents, FluxA AI Wallet or Openfort?

Openfort scores 70.3 (BB) on agent readiness against FluxA AI Wallet's 47 (D), and leads in every scored category.

### Do FluxA AI Wallet and Openfort need an API key?

FluxA AI Wallet takes an API key or an OAuth sign-in. Openfort needs an API key.

### Can an agent call FluxA AI Wallet and Openfort without installing anything?

Yes. FluxA AI Wallet has a hosted endpoint at https://walletapi.fluxapay.xyz and Openfort at https://api.openfort.io.

### Are FluxA AI Wallet and Openfort open source?

FluxA AI Wallet is open source (The CLI and MCP server source is Apache-2.0 (LICENSE file and both package.json files), though the README's last section says MIT. The hosted wallet service is closed, and no terms covering the wallet were found). No open-source release is listed for Openfort.


## For agents

- This comparison as JSON: https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-openfort.json, and with the fewest tokens: https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-openfort.min.md
- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "fluxa-ai-wallet", "b": "openfort"}`. From a terminal: `anchor compare fluxa-ai-wallet openfort`
- Each listing in full: https://www.anchorterminal.com/api/v1/tools/fluxa-ai-wallet.json and https://www.anchorterminal.com/api/v1/tools/openfort.json

## Other comparisons with FluxA AI Wallet or Openfort

- [Agentcard vs FluxA AI Wallet](https://www.anchorterminal.com/compare/agentcard-vs-fluxa-ai-wallet.md)
- [Circle Wallets (Agent Wallets, Programmable Wallets) vs FluxA AI Wallet](https://www.anchorterminal.com/compare/circle-wallets-vs-fluxa-ai-wallet.md)
- [Circle Wallets (Agent Wallets, Programmable Wallets) vs Openfort](https://www.anchorterminal.com/compare/circle-wallets-vs-openfort.md)
- [Coinbase Developer Platform (Agentic Wallet, AgentKit, CDP MCP) vs FluxA AI Wallet](https://www.anchorterminal.com/compare/coinbase-cdp-agentkit-vs-fluxa-ai-wallet.md)
- [Coinbase Developer Platform (Agentic Wallet, AgentKit, CDP MCP) vs Openfort](https://www.anchorterminal.com/compare/coinbase-cdp-agentkit-vs-openfort.md)
- [Kite Agent Passport vs Openfort](https://www.anchorterminal.com/compare/kite-agent-passport-vs-openfort.md)
- [Openfort vs Privy Wallets (server wallets, agent wallets, policy engine)](https://www.anchorterminal.com/compare/openfort-vs-privy.md)
- [Openfort vs Sponge Wallet](https://www.anchorterminal.com/compare/openfort-vs-sponge-wallet.md)
- [Openfort vs Turnkey Agentic Wallets](https://www.anchorterminal.com/compare/openfort-vs-turnkey-agentic-wallets.md)
- [Circle Gateway Nanopayments vs FluxA AI Wallet](https://www.anchorterminal.com/compare/circle-gateway-nanopayments-vs-fluxa-ai-wallet.md)
- [FluxA AgentMarket vs FluxA AI Wallet](https://www.anchorterminal.com/compare/fluxa-agentmarket-vs-fluxa-ai-wallet.md)
- [FluxA AI Wallet vs Kite Agent Passport](https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-kite-agent-passport.md)
- [FluxA AI Wallet vs Nevermined API + MCP](https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-nevermined.md)
- [FluxA AI Wallet vs Payman Genie MCP](https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-payman.md)
- [FluxA AI Wallet vs Privy Wallets (server wallets, agent wallets, policy engine)](https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-privy.md)
- [FluxA AI Wallet vs Sponge Wallet](https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-sponge-wallet.md)
- [FluxA AI Wallet vs Turnkey Agentic Wallets](https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-turnkey-agentic-wallets.md)
- [Agentcard vs Openfort](https://www.anchorterminal.com/compare/agentcard-vs-openfort.md)
- [FluxA AI Wallet vs Agent Vault by Self](https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-self-agent-vault.md)
- [Openfort vs Agent Vault by Self](https://www.anchorterminal.com/compare/openfort-vs-self-agent-vault.md)

---

Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp