FluxA AI Wallet vs Turnkey Agentic Wallets

FluxA AI Wallet 20

Graded with the hosted lines, because signing, mandates and approvals all run on FluxA's wallet API and the CLI and MCP server only wrap it, as kite-agent-passport and kane-cli were read. No status page was found in the repository, the skills or AgentMarket's pages. fluxapay.xyz and the wallet and docs hosts could not be read, so a status page there is unchecked and scored absent (0). With no readable history the record takes the default (5). No rate limit with numbers was found (0). The connection service treats 429 slow_down as wait and poll and marks errors retryable, the skill says a 503 means retry shortly, payouts require a caller-chosen payout_id that returns the existing payout on a repeat, --biz-id rejects a duplicate with 409, and card create and recharge resume with --request-id instead of paying again. No Retry-After or backoff schedule is documented for the wallet API (10 of 15). No SLA was found (0). No beta label was found on the wallet in what was read, but both packages are at 0.x, agent cards sit behind a waitlist and the wallet site was unread (5 of 10). Total 20.

Turnkey Agentic Wallets 83

Status page at turnkey-status.com on Atlassian Statuspage with 23 components and 90-day uptime bars (20). Between 3 August and 1 November 2026 it lists nine incidents. Signing endpoints, sign_raw_payload and sign_transaction among them, returned elevated errors for 5 hours 9 minutes on 27 August (00:44 to 05:53 EDT), marked minor, with "a subset of signing requests" rejected. SMS authentication had issues from 6 August and was resolved at 02:36 EDT on 7 August, marked critical, on the Authentication (SMS) component, outside the path an agent's API key uses. Webhook delays (15 August, 15 September) and broadcast failures traced to upstream RPC providers (31 August, 2 September) were partial. Three incidents since 17 October, SMS and email OTP delays of 45 minutes on 28 October, new Earn vault deployments blocked from 28 to 29 October and Aave V3 vaults hidden from Earn discovery on 29 and 30 October, are marked with no impact and leave signing untouched. The 27 July request failures have left the window. Read the way partial and degraded incidents on resend and pinecone were read on 1 November, a subset of requests on one path counts as minor, as stripe-mcp's payout errors of 6 August and pinecone's control-plane errors of 1 September did, so minor incidents only, 20 rather than the between-band 12 earlier checks gave (20). Rate limits are published as 1 request a second on Free and Pay-as-you-go, 3 on Pro and up to 60 on Enterprise, with 10 a second for each sub-organisation and separate buckets for broadcast and balance calls (15). The docs describe 429 handling with exponential backoff and jitter and say submissions are idempotent by body fingerprint, but "The API does not return rate-limit or Retry-After headers" (13 of 15). SLAs are listed on the Enterprise plan with no published terms (5 of 10). The API is generally available and the agent skills are at 1.0.0 (10). 20+20+15+13+5+10 = 83.

FluxA AI Wallet 32

The CLI and MCP server source is Apache-2.0 per the LICENSE file and both package.json files, while the README's last section says MIT. The hosted wallet is closed, and no terms covering it were found. AgentMarket's terms describe only the marketplace (15 of 30). AgentMarket's privacy policy of 14 January 2026 names Stripe and model providers and gives no retention periods, and it does not mention wallet addresses, KYC profiles, card data or payouts, which the CLI collects or handles. The wallet's own privacy policy was unreachable (5 of 30). The README marks init and link-wallet as legacy but still supported, and the skill pins a minimum CLI version; no deprecation policy or dated notice was found (3 of 20). Stripe is the only provider named; no card issuer, KYC provider, custody provider or data location is named. The CLI and MCP code send no telemetry (3 of 20). Total 26.

Turnkey Agentic Wallets 73

A closed service under published terms of service, updated 6 August 2026, with the SDKs, CLI and agent skills under Apache-2.0 and QuorumOS open source (18 of 30). The privacy policy, updated 29 June 2026, names Turnkey Global, Inc., says Turnkey is a processor for its business customers' users and lists categories of service providers. It gives no retention periods, and the data processing terms were not read because the trust centre is drawn by script (17 of 30). Deprecated activity types are marked in the docs with migration guides, with no dates or notice period found (7 of 20). The docs say subprocessors and their locations are in the trust centre, which we couldn't read. The status page names AWS SES and SNS in us-east-1, Cloudflare and Alchemy as dependencies (8 of 20).

FluxA AI Wallet 52

The agent holds an Agent ID, a token whose validity the owner picks from 1 hour to 1 year at browser approval, and a short-lived RS256 JWT refreshed from the token; token_revoked exists. Credentials sit in a 0600 JSON file or environment variables. The token is not scoped, since limits live in mandates, and legacy init tokens are described as not expiring. Agent VCs are audience-bound and rejected by FluxA's own endpoints. No secret travels in a URL (22 of 30). Every x402 payment needs a mandate the owner signs, with a limit, a validity and an optional host allowlist enforced by the wallet API, payouts need per-payout approval unless a mandate covers them, cards need a mandate and KYC, and linked-card mandates are scoped to one merchant. A payout mandate sets no payee allowlist that was documented, and the skill tells agents to request budgets for at least 100 calls by default (16 of 20). The wallet returns little third-party content itself, but the skill sends agents to third-party x402 APIs, ClawPI posts and a remote announcement.md with no guidance on treating them as untrusted, its description steers agents to paid APIs even when a free web search looks enough, and the daily check-in runs npx -y @fluxa-pay/fluxa-wallet@latest unpinned twice a day (4 of 15). mandates lists limit, spent and remaining, with recent-transactions, received-records and payout status by CLI, and the MCP server writes a local audit log; the wallet app's logs were not read (10 of 15). No SECURITY.md, disclosure policy, bug bounty or certification was found, and agentmarket.fluxapay.xyz has no security.txt; fluxapay.xyz's is unchecked (0 of 20). Total 52.

Turnkey Agentic Wallets 85

Each user holds P-256 API key pairs whose private half is generated by the customer and never sent to Turnkey. Keys can be created with an expiry, a user has up to ten of each kind, deleting the user revokes access at once, and no secret travels in a URL. Scope comes from policies, not from the key itself (28 of 30). Policies deny by default, DENY beats ALLOW, a non-root user starts with no permissions, read access needs no policy, and consensus expressions can require a named person to approve. Root users bypass the policy engine. The documented policy language has conditions on a single transaction only. The generated SDK clients and the Swagger definitions also carry Velocity Controls (create, get, list and delete), rolling-window sums or counts of asset transfers that policies reference as controls.<identifier>, but no docs page describes them (the docs indexes read on 1 November don't name them) and the Swagger has no paths for them, so they earn nothing here (17 of 20). The skills page warns that models can misread instructions and that policies are the technical control, and the terms say the same. No guidance on untrusted content in balances or token data was found (9 of 15). Every action is an activity recording who approved it, readable by query and delivered by signed webhooks (13 of 15). SOC 2 Type II per the docs (the trust centre pointer page per the 8 October check, not re-read on 1 November), a bug bounty of up to $50,000 with safe harbour, a security.txt with a PGP key and no Expires field, a published whitepaper and the enclave operating system QuorumOS open source (18 of 20).

FluxA AI Wallet 61

No OpenAPI file or reference for the wallet API was found; the README shows sample requests for five endpoints. The MCP server's 15 tools in the 0.6.0 source carry typed Zod input schemas, and the CLI's flags are documented in prose in the skill files and --help. The MCP server is the secondary surface and its npm release is 0.2.0, so 12 of 25. The skill and its 18 Markdown guides are written for agents, and AgentMarket's llms.txt describes the wallet's payment role (10). connect_wallet, init_agent_id and create_intent_mandate say when to use them and when not to, and the skill has a when-to-use table per capability, while the payment-link and status tools have one-line descriptions (12 of 20). Zod enums for validity, runtime, hosting and currency, a regex on payout amounts and strict objects, but the x402 requirement fields are plain strings and outputSchema is a free-form record (10 of 15). The README has an example for every MCP tool, the skills give CLI examples and output, and error codes are tabled for mandates, payouts, cards and connections (12 of 15). Semver on npm with 25 CLI versions and a version line in the skill, two git tags and no changelog (5 of 15). Total 61.

Turnkey Agentic Wallets 79

A public Swagger 2.0 document at docs.turnkey.com/public_api.swagger.json with 198 paths, 74 queries and 123 submissions on 1 November (25). llms.txt, llms-full.txt and a Markdown twin of every docs page (10). Operation descriptions in the spec are one line each, such as "Sign a transaction.", while the guides and the nine agent skills say when to use each call and when not to (13 of 20). The spec has 185 enums and required fields on every request, but 64-bit numbers travel as strings and policy condition and consensus are free-form strings in Turnkey's own expression language (11 of 15). The errors page lists 32 turnkeyErrorCode values and a table of messages with HTTP codes and fixes, though the spec documents only the 200 response for each path (12 of 15). Paths sit under /public/v1 and activity types carry version suffixes, but no changelog for the API was found in the docs. Changes appear only in the SDK changelogs on GitHub, such as the 8.7.0 entry of 16 October recording that the API no longer accepts Bitcoin for fiat on-ramp quotes (8 of 15).

FluxA AI Wallet 60

The MCP server has 15 tools with about 4,700 characters of descriptions, the 11 to 30 band (15). The CLI path loads SKILL.md (26.5 KB) and one of 18 guides per task, about 112 KB in all, with no read-only subset (no add-back, 15 of 25). card transactions takes page, limit, type and a time range, refunds take limit and offset, received-records and recent-transactions take a limit up to 100, and market search can be scoped to models or vendors; no cursor (12 of 20). Errors carry a code, retryable, reconnect_required and a next_command or next_tool, and card errors map to recovery hints, but the CLI exits only 0 or 1 and the MCP payment tools return the wallet API's raw error body without isError (14 of 20). A required payout_id idempotency key, --biz-id dedup and --request-id continuation on card operations, and the skill says not to initiate again to retry a payment. No readOnlyHint or destructiveHint on any MCP tool (12 of 20). Base USDC is the default network and asset, mandates default to 8 hours and the CLI installs in one command, but there is no SDK library and both packages are TypeScript (7 of 15). Total 60.

Turnkey Agentic Wallets 77

There is no MCP server for wallet actions; the MCP server at docs.turnkey.com/mcp has two read-only tools, search_turnkey and query_docs_filesystem_turnkey, both over the docs (listed again on 1 November). An agent calls the API through an SDK, the CLI or the skills, and responses can't be trimmed by field (15 of 25). List queries take cursor pagination with a limit of 1 to 100 and filters by activity status and type (17 of 20). Errors carry a category code and a readable message with documented fixes, wrapped in a gRPC status the docs say not to rely on (16 of 20). Submissions are idempotent by a hash of the POST body, and the docs explain that changing timestampMs creates a new activity. No MCP annotations apply (18 of 20). Server SDKs exist for TypeScript, Go, Ruby, Rust and Python, with wallet and policy helpers in the first three, but every request needs a P-256 signature in an X-Stamp header and submissions need an activity envelope (11 of 15). The SDK reference is per the 8 October check, not re-read on 1 November.

FluxA AI Wallet 66

@fluxa-pay/fluxa-wallet 0.6.0 was published on 6 November 2026, one day before this check (30). Eight CLI releases since 10 August 2026, among them 0.5.2 on 14 October, 0.5.3 on 25 October and 0.5.6, 0.5.7 and 0.6.0 between 3 and 6 November (20). The repository merged 43 pull requests, all from the organisation's own branches, and commits run weekly. Issues and outside pull requests could not be read because the GitHub API refused the session. Discord and a support address are linked from AgentMarket and were not tested (8 of 25). Graded as an API, the line asks for current official SDKs. The CLI is current, but there is no SDK library and the MCP package on npm has not been published since 2 March 2026 (5 of 15). 68 node:test cases exist with no CI workflow, neither npm package declares its repository, and the MCP package's last release lags the source by eight months (3 of 10). Total 66.

Turnkey Agentic Wallets 83

The SDK repository tagged v2026.10.3 on 19 October (@turnkey/sdk-server 8.7.1, a fix for an invalid activity type) and v2026.10.4 on 23 October 2026, whose release commit sets @turnkey/sdk-server to 8.8.0 (an optional per-secret requestContext on secret export) (30). Sixteen dated release tags between 6 August and 23 October (20). The service is closed, with dashboard chat, email and a community Slack for support, and pull requests merged up to 30 October. We didn't test a support channel and no API changelog was found (10 of 15). Current official SDKs in TypeScript, Go, Ruby, Rust and Python (15). Public CI workflows, dependency patches merged on 27 and 28 October and Renovate on the skills repository. The CLI's last tag is May 2025 (8 of 10). Total 83.