FluxA AI Wallet vs Payman Genie MCP

FluxA AI Wallet 66

@fluxa-pay/fluxa-wallet 0.6.0 was published on 6 November 2026, one day before this check (30). Eight CLI releases since 10 August 2026, among them 0.5.2 on 14 October, 0.5.3 on 25 October and 0.5.6, 0.5.7 and 0.6.0 between 3 and 6 November (20). The repository merged 43 pull requests, all from the organisation's own branches, and commits run weekly. Issues and outside pull requests could not be read because the GitHub API refused the session. Discord and a support address are linked from AgentMarket and were not tested (8 of 25). Graded as an API, the line asks for current official SDKs. The CLI is current, but there is no SDK library and the MCP package on npm has not been published since 2 March 2026 (5 of 15). 68 node:test cases exist with no CI workflow, neither npm package declares its repository, and the MCP package's last release lags the source by eight months (3 of 10). Total 66.

Payman Genie MCP 30

The bridge's newest tagged release is v0.2.1 (14 September 2026), 51 days before 4 November (20). Since 6 August the repository has two tagged releases, v0.2.0 and v0.2.1, both on 14 September; the 0.3.0 and 0.4.0 version bumps of 18 September carry no tag or changelog entry, so they don't count as releases, and no commit has landed since 18 September (0). Two merged pull requests and no changelog. The older developer platform looks abandoned, with docs.paymanai.com failing on a Cloudflare 526 and the payman-ts SDK last released on 18 September 2025, per the 1 October check, not re-read on 4 November (5). No current SDK, and the official MCP registry wasn't read first-hand (0). A Node test suite with a fake authorisation server, but no CI workflow in the repository (5). 20+0+5+0+5 = 30.

FluxA AI Wallet 52

The agent holds an Agent ID, a token whose validity the owner picks from 1 hour to 1 year at browser approval, and a short-lived RS256 JWT refreshed from the token; token_revoked exists. Credentials sit in a 0600 JSON file or environment variables. The token is not scoped, since limits live in mandates, and legacy init tokens are described as not expiring. Agent VCs are audience-bound and rejected by FluxA's own endpoints. No secret travels in a URL (22 of 30). Every x402 payment needs a mandate the owner signs, with a limit, a validity and an optional host allowlist enforced by the wallet API, payouts need per-payout approval unless a mandate covers them, cards need a mandate and KYC, and linked-card mandates are scoped to one merchant. A payout mandate sets no payee allowlist that was documented, and the skill tells agents to request budgets for at least 100 calls by default (16 of 20). The wallet returns little third-party content itself, but the skill sends agents to third-party x402 APIs, ClawPI posts and a remote announcement.md with no guidance on treating them as untrusted, its description steers agents to paid APIs even when a free web search looks enough, and the daily check-in runs npx -y @fluxa-pay/fluxa-wallet@latest unpinned twice a day (4 of 15). mandates lists limit, spent and remaining, with recent-transactions, received-records and payout status by CLI, and the MCP server writes a local audit log; the wallet app's logs were not read (10 of 15). No SECURITY.md, disclosure policy, bug bounty or certification was found, and agentmarket.fluxapay.xyz has no security.txt; fluxapay.xyz's is unchecked (0 of 20). Total 52.

Payman Genie MCP 80

OAuth 2.1 with S256 PKCE, scopes genie:ask and genie:self, one-hour access tokens, refresh tokens rotated on every use and revoked through RFC 7009 on logout. Dynamic client registration is now documented (30). The owner sets per-payment, daily and monthly limits and approved payees, payments over an ask-me threshold need a six-digit code or passkey, and approvals happen in Genie, never in the chat. The assistant can grant itself read access only, and full access needs the owner (20). The agent passes the person's words to another agent; limits and out-of-band approval sit behind it, but we found no prompt-injection guidance as such (10). Genie says every decision is logged in an activity history (12). "AICPA SOC 2 certified" on the site and a Vanta trust centre we couldn't render, no security.txt per the 30 September check, and no disclosure policy or bug bounty found (8). No advisory for @paymanai/genie-mcp-stdio or any Payman package on osv.dev on 4 November. Genie holds no funds; money stays at the bank, card wallet or Coinbase, and we found no licence claim. The developer page, home page and trust centre readings are per the 1 October check, not re-read on 4 November (paymanai.com hosts are paused on the terms). 30+20+10+12+8 = 80.

FluxA AI Wallet 32

The CLI and MCP server source is Apache-2.0 per the LICENSE file and both package.json files, while the README's last section says MIT. The hosted wallet is closed, and no terms covering it were found. AgentMarket's terms describe only the marketplace (15 of 30). AgentMarket's privacy policy of 14 January 2026 names Stripe and model providers and gives no retention periods, and it does not mention wallet addresses, KYC profiles, card data or payouts, which the CLI collects or handles. The wallet's own privacy policy was unreachable (5 of 30). The README marks init and link-wallet as legacy but still supported, and the skill pins a minimum CLI version; no deprecation policy or dated notice was found (3 of 20). Stripe is the only provider named; no card issuer, KYC provider, custody provider or data location is named. The CLI and MCP code send no telemetry (3 of 20). Total 26.

Payman Genie MCP 46

Bridge under MIT, Genie closed under published terms (updated 1 November 2026) and an API licence (15). Privacy policy updated 21 September 2026 names Payman AI, Inc. in Durango, Colorado, gives no retention periods and no DPA, and says anonymised or aggregated data is used to train AI models (12). No deprecation notice for the old developer platform even though its docs no longer load (0). Stripe, Google and unnamed identity-verification and credit-bureau providers are named, with transfers "including the United States" (6). The privacy policy is per the 1 October check, not re-read on 4 November. 15+12+0+6 = 33.

FluxA AI Wallet 45

Payment platforms and wallets take the highest step that applies on the 40-point protocol line. 40 for x402, MPP or L402 on all their own endpoints, 30 on part of their own API, 25 when their merchants can accept one, 20 for running a facilitator, 15 for paying as a buyer, 0 for only a protocol of their own. The wallet pays x402 as a buyer and its payment links can be paid over x402 so another agent pays the holder, as sponge-wallet's payment links were read. FluxA's own wallet API is not paid over x402, so the merchant step (25 of 40). No fee schedule for the wallet, x402 signing, payouts or payment links was found, and card fees appear only through an authenticated command (0 of 20). Registering an Agent ID and creating payment links cost nothing and need no card per the README and the charge-agent guide, but the wallet sign-up at agentwallet.fluxapay.xyz could not be read, so whether opening a funded wallet needs a card is unchecked (10 of 20). POST https://agentid.fluxapay.xyz/register returns credentials with no human step, but the CLI marks it legacy, the default connection needs a browser approval, and every spend needs the owner's wallet and a mandate signed in a browser (10 of 20). Total 45.

Payman Genie MCP 35

Payment platforms and wallets take the highest step that applies on the 40-point protocol line. 40 for x402, MPP or L402 on all their own endpoints, 30 on part of their own API, 25 when their merchants can accept one, 20 for running a facilitator, 15 for paying as a buyer, 0 for only a protocol of their own. Genie pays x402 APIs from a daily agent budget the owner sets, the buyer step (15 of 40). Payman has no way to accept x402 or MPP, and Genie itself isn't paid over either. No price list for Genie anywhere we looked (0). Free signup with no card or bank details (20). A person signs up and signs in through a browser (0).

FluxA AI Wallet 60

The MCP server has 15 tools with about 4,700 characters of descriptions, the 11 to 30 band (15). The CLI path loads SKILL.md (26.5 KB) and one of 18 guides per task, about 112 KB in all, with no read-only subset (no add-back, 15 of 25). card transactions takes page, limit, type and a time range, refunds take limit and offset, received-records and recent-transactions take a limit up to 100, and market search can be scoped to models or vendors; no cursor (12 of 20). Errors carry a code, retryable, reconnect_required and a next_command or next_tool, and card errors map to recovery hints, but the CLI exits only 0 or 1 and the MCP payment tools return the wallet API's raw error body without isError (14 of 20). A required payout_id idempotency key, --biz-id dedup and --request-id continuation on card operations, and the skill says not to initiate again to retry a payment. No readOnlyHint or destructiveHint on any MCP tool (12 of 20). Base USDC is the default network and asset, mandates default to 8 hours and the CLI installs in one command, but there is no SDK library and both packages are TypeScript (7 of 15). Total 60.

Payman Genie MCP 68

One money tool and four small self-service tools (get_genie_agent, rename_genie_agent, grant_genie_read_access, request_genie_access) (25). Answers are natural-language messages with no size or filter controls (5). The status field (done, needs_input, needs_approval, refused, error) tells the agent what to do next (18). Retry rules separate safe and unsafe failures, and done is documented as not proof of settlement. We couldn't check tool annotations (12). One required parameter, but no SDK; Genie is MCP only, plus the stdio bridge (8). Per the 1 October check, not re-read on 4 November (paymanai.com hosts are paused on the terms of 1 November 2026).

FluxA AI Wallet 20

Graded with the hosted lines, because signing, mandates and approvals all run on FluxA's wallet API and the CLI and MCP server only wrap it, as kite-agent-passport and kane-cli were read. No status page was found in the repository, the skills or AgentMarket's pages. fluxapay.xyz and the wallet and docs hosts could not be read, so a status page there is unchecked and scored absent (0). With no readable history the record takes the default (5). No rate limit with numbers was found (0). The connection service treats 429 slow_down as wait and poll and marks errors retryable, the skill says a 503 means retry shortly, payouts require a caller-chosen payout_id that returns the existing payout on a repeat, --biz-id rejects a duplicate with 409, and card create and recharge resume with --request-id instead of paying again. No Retry-After or backoff schedule is documented for the wallet API (10 of 15). No SLA was found (0). No beta label was found on the wallet in what was read, but both packages are at 0.x, agent cards sit behind a waitlist and the wallet site was unread (5 of 10). Total 20.

Payman Genie MCP 25

No status page found for Genie or Payman (0), so no incident history to read (5). No rate limits published (0). The developer page says to retry an error only after NOTHING_RAN or BUSY and never after OUTCOME_UNKNOWN, which is safe-retry guidance for money-moving calls, but there's no 429 or Retry-After behaviour (12 of 15). No SLA (0). Genie is sold as a live product with no beta label, while the stdio bridge is at 0.4.0 (8 of 10). Per the 1 October check, not re-read on 4 November (paymanai.com hosts are paused on the terms of 1 November 2026). 0+5+0+12+0+8 = 25.