{ "data": { "a": { "slug": "fluxa-ai-wallet", "name": "FluxA AI Wallet", "vendor": "FluxA Technology Pte. Ltd.", "vendorUrl": "https://fluxapay.xyz", "kind": "http-api", "category": "agent-wallets", "summary": "FluxA AI Wallet is a hosted agent wallet from FluxA Technology that signs x402 (EIP-3009) USDC payments on Base within budgets a person approves, reached through the fluxa-wallet CLI, a stdio MCP server and agent skills.", "url": "https://www.anchorterminal.com/tools/fluxa-ai-wallet", "markdownUrl": "https://www.anchorterminal.com/tools/fluxa-ai-wallet.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/fluxa-ai-wallet.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/fluxa-ai-wallet.json", "dns": "fluxa-ai-wallet.grade.anchorterminal.com", "repo": "https://github.com/FluxA-Agent-Payment/FluxA-AI-Wallet-MCP", "license": "The CLI and MCP server source is Apache-2.0 (LICENSE file and both package.json files), though the README's last section says MIT. The hosted wallet service is closed, and no terms covering the wallet were found", "transports": [ "http", "stdio" ], "remoteUrl": "https://walletapi.fluxapay.xyz", "packages": [ { "registry": "npm", "name": "@fluxa-pay/fluxa-wallet" }, { "registry": "npm", "name": "@fluxa-pay/fluxa-wallet-mcp" } ], "auth": "mixed", "authNotes": "An agent connects with `fluxa-wallet connect` (or the MCP tool `connect_wallet`), which returns an `authorization_url` on agentwallet.fluxapay.xyz for the owner to approve in a browser. The claim returns an Agent ID, a token and an RS256 JWT, stored in `~/.fluxa-ai-wallet-mcp/config.json` (mode 0600) or injected as `AGENT_ID`, `AGENT_TOKEN` and `AGENT_JWT`. The owner picks the token's validity (1h, 24h, 7d, 1mo, 180d or 1y; the server suggests 180 days locally and 7 days in cloud or container environments), and the JWT is refreshed with the token. `token_expired` and `token_revoked` return `reconnect_required`. The legacy `init` registers an Agent ID with an unauthenticated `POST https://agentid.fluxapay.xyz/register`. Spending needs a mandate the owner signs in the browser. AgentMarket commands can instead use `fxa_live_` keys with a spend limit, revocable from the CLI.", "pricing": "usage", "pricingNotes": "No fee schedule for the wallet, x402 signing, payouts, payment links or refunds was found in the repository, the skills or the AgentMarket pricing, terms and llms.txt pages (checked 2026-11-07). Merchants set x402 prices. Agent card products list their fees through `fluxa-wallet card types`, which needs a connected wallet, so those fees were not read. The wallet site and docs at agentwallet.fluxapay.xyz and docs.fluxapay.xyz could not be read, so whether opening a wallet needs a card is unchecked. AgentMarket's Balance is $1 = 1 Balance, with Units bundles from $1 to $25.", "priceSummary": "Pay per use", "where": "both", "x402": { "level": "partial", "evidence": "The wallet signs x402 `exact` (EIP-3009) payment authorisations for USDC on Base and Base Sepolia as a buyer (`fluxa-wallet x402 --mandate \u003cid\u003e --payload \u003c402 body\u003e`, MCP `request_x402_payment` and `request_x402_v3_payment`), and its payment links can be paid over x402 so another agent can pay the holder (https://github.com/FluxA-Agent-Payment/FluxA-AI-Wallet-MCP/blob/main/skills/fluxa-agent-wallet/INTEGRATION-GUIDE-CHARGE-AGENT.md, checked 2026-11-07). FluxA's own wallet API is not paid over x402, MPP or L402.", "endpoints": [] }, "toolCount": 15, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-07" }, "docsUrl": "https://docs.fluxapay.xyz/", "capabilities": [ "payments.x402", "wallet.spend-limits", "wallet.onchain", "payments.card", "auth.agent-identity" ], "tags": [ "hosted", "official", "open-source", "apache-2.0", "cli", "mcp", "stdio", "skills", "typescript", "wallet", "x402", "stablecoins", "virtual-cards", "usdc", "base" ], "lastRelease": "2026-11-06", "graded": true, "anchor": { "graded": true, "score": 47, "grade": "D", "agentReady": false, "rank": 1164, "ranked": true, "rankOf": 1513, "categoryRank": 11, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 60, "maintenance": 66, "payments": 45, "reliability": 20, "schema": 61, "security": 52, "transparency": 32 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "low", "date": "2026-11-07" }, "negative": 0, "verdict": "Every spend runs against a mandate the owner signs in a browser, with a budget, a validity window and an optional host allowlist, and payouts need approval or a mandate. The published MCP package is 0.2.0 from March 2026 against 0.6.0 in the repository, and no status page, fee schedule, wallet terms or custody statement was found.", "bestFor": "An agent in a CLI-capable client that needs to pay x402 APIs, send USDC on Base or receive payments through links, inside budgets a person signs.", "strengths": [ "Spending runs against owner-signed mandates with a limit, a validity window and an optional host allowlist, enforced by the wallet API", "Payouts need per-payout browser approval unless a signed mandate is passed, and a required `payout_id` makes repeats return the same payout", "The CLI returns JSON with error codes, `next_command` hints and `retryable` and `reconnect_required` flags", "Client source is public under Apache-2.0, with 25 CLI releases on npm since March 2026, the latest on 6 November 2026", "Payment links let another agent pay the holder over x402, and refunds of link payments are supported" ], "weaknesses": [ "The published MCP package is 0.2.0 from 2 March 2026 with 13 tools, while the repository says 0.6.0 with 15", "No status page, rate limit, SLA, fee schedule or security contact was found", "Who holds the wallet keys is not stated. The docs say FluxA Wallet signs and call it managed", "The only terms and privacy policy read are AgentMarket's, which do not mention the wallet, cards, KYC or payouts", "The skill steers agents to paid APIs over free search and to request budgets for at least 100 calls by default" ], "agentNotes": [ "Run `fluxa-wallet status` first. If `configured` and `wallet_linked` are true, skip `connect`; otherwise show the `authorization_url` and wait with `connect-status --wait 100`", "On `token_expired` or `token_revoked`, reconnect with the same `--agent-id`. Never run `init` to recover, which creates a new identity", "Pass a unique `--id` on every `payout` and reuse it on retry; a repeat returns the existing payout instead of paying twice", "Check `fluxa-wallet mandates` for a signed mandate with enough remaining budget before creating one, and size new budgets to the task", "Install the CLI from npm, not the MCP package, whose npm release 0.2.0 lacks `connect_wallet` and `get_wallet_connection`" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "low", "grade": "D", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 47 } ], "editorialScores": { "ergonomics": 60, "maintenance": 66, "payments": 45, "reliability": 20, "schema": 61, "security": 52, "transparency": 26 }, "provenanceScore": 38, "checked": { "categories": { "ergonomics": "2026-11-07", "maintenance": "2026-11-07", "payments": "2026-11-07", "reliability": "2026-11-07", "schema": "2026-11-07", "security": "2026-11-07", "transparency": "2026-11-07" }, "last": "2026-11-07", "oldest": "2026-11-07", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install -g @fluxa-pay/fluxa-wallet" }, "letme": { "capability": "https://letme.dev/payments.x402", "tool": "https://letme.dev/fluxa-ai-wallet" }, "sameCompany": [ "fluxa-agentmarket" ], "area": "payments", "provenance": { "legalEntity": "FluxA Technology Pte. Ltd.", "domain": "fluxapay.xyz", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "", "privacy": "", "statusPage": "", "changelog": "", "securityTxt": "unknown", "checked": "2026-11-07", "notes": [ "The legal entity is from the footer of agentmarket.fluxapay.xyz, \"© 2025 FluxA Technology Pte. Ltd. All rights reserved.\", the same on the about, terms, privacy and pricing pages. No registration number, address or country is given on those pages. A web search result names a companieshouse.sg page for FluxA Technology Pte Ltd with UEN 202555700C; that host could not be fetched, so the register entry is unread.", "AgentMarket's terms (effective 14 January 2026) and privacy policy (updated 14 January 2026) describe the marketplace and its Balance and do not mention the Agent Wallet, cards, KYC or payouts, so they are not recorded as the wallet's terms. The terms name no entity in their text and no governing law; contact support.fluxapay@fluxapay.xyz.", "fluxapay.xyz, agentwallet.fluxapay.xyz and docs.fluxapay.xyz could not be read. Each robots.txt fetch was refused for want of an approval on 7 November 2026, so nothing on those hosts was fetched. The wallet's own terms, privacy policy, fees, security.txt and docs are unchecked.", "https://agentmarket.fluxapay.xyz/.well-known/security.txt answered a client error. The repository has no SECURITY.md.", "The wallet API, Agent ID API and approval pages are on fluxapay.xyz subdomains named in the CLI source. agentmarket.fluxapay.xyz's robots.txt allows / and disallows /api/ (except /api/discover and /api/llm/skills.md) and /console/; nothing disallowed was fetched.", "unchecked: RDAP for fluxapay.xyz, the MCP registry, the Wayback Machine, GitHub stars and issues (the GitHub API refused the session) and npm download counts." ], "score": 38 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/fluxa-ai-wallet.json", "live": { "slug": "fluxa-ai-wallet", "probe": { "target": "https://walletapi.fluxapay.xyz", "method": "get", "lastAt": "2026-11-08T14:47:50.695700215Z", "lastOk": true, "lastStatus": 404, "lastMs": 532, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 542, "p95ms24h": 603, "samples24h": 90, "samples30d": 90, "days": [ { "date": "2026-11-08", "probes": 90, "ok": 90 } ], "since": "2026-11-08T00:00:00Z" }, "updatedAt": "2026-11-08T14:47:50.695700215Z" }, "streak": { "days": 0, "from": "2026-11-08", "sinceWatching": true, "best": 0 } }, "answer": "Turnkey Agentic Wallets scores 74.7 (BB) on agent readiness against FluxA AI Wallet's 47 (D), and leads in every scored category.", "b": { "slug": "turnkey-agentic-wallets", "name": "Turnkey Agentic Wallets", "vendor": "Turnkey Global, Inc.", "vendorUrl": "https://www.turnkey.com", "kind": "http-api", "category": "agent-wallets", "summary": "Turnkey's signing API gives an AI agent its own non-root user and P-256 key over a company wallet. Policies evaluated in secure enclaves set what the agent may sign, and can require a person's approval.", "url": "https://www.anchorterminal.com/tools/turnkey-agentic-wallets", "markdownUrl": "https://www.anchorterminal.com/tools/turnkey-agentic-wallets.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/turnkey-agentic-wallets.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/turnkey-agentic-wallets.json", "dns": "turnkey-agentic-wallets.grade.anchorterminal.com", "repo": "https://github.com/tkhq/turnkey-agent-skills", "license": "Proprietary service under Turnkey's terms of service. The SDKs, the CLI and the agent skills on GitHub are Apache-2.0", "transports": [ "http" ], "remoteUrl": "https://api.turnkey.com", "packages": [ { "registry": "npm", "name": "@turnkey/sdk-server" }, { "registry": "npm", "name": "@turnkey/viem" }, { "registry": "pypi", "name": "turnkey-http" } ], "auth": "api-key", "authNotes": "Self-serve. A person creates an organisation at app.turnkey.com with an email address and a passkey, then registers a P-256 public key. Every request is a JSON POST signed with that key in an `X-Stamp` header. There are no bearer tokens. An agent gets its own non-root user and key, created through the API by a root user, and can do only what policies allow.", "pricing": "freemium", "pricingNotes": "25 free signatures a month on Pay as You Go, then $0.10 a signature. Pro is $99 a month and $0.05 a signature. Enterprise is custom, from $0.0015 a signature, and adds gas sponsorship, SLAs and up to 250 policies. The free allowance needs no card, so an agent can start without a contract. Transaction management and swaps are priced per transaction on request (https://www.turnkey.com/pricing, checked 2026-10-08).", "priceSummary": "$0.10 / call", "where": "hosted", "x402": { "level": "partial", "evidence": "Turnkey documents paying over x402 and MPP as a buyer. A viem account from `@turnkey/viem` signs in the enclave and is passed to the `@x402/fetch` or `mppx` client. Turnkey's own API is not paid over either protocol (https://docs.turnkey.com/solutions/company-wallets/agentic-payments, checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": 304389, "pypiWeekly": 11903, "asOf": "2026-10-08" }, "docsUrl": "https://docs.turnkey.com/solutions/company-wallets/agentic-wallets", "llmsTxt": "https://docs.turnkey.com/llms.txt", "openapi": "https://docs.turnkey.com/public_api.swagger.json", "capabilities": [ "wallet.onchain", "wallet.spend-limits", "wallet.custody", "payments.x402" ], "tags": [ "hosted", "freemium", "free-tier", "openapi", "llms-txt", "typescript", "go", "python", "rust", "ruby", "wallet", "policy-engine", "x402", "status-page", "bug-bounty", "soc2", "closed-source", "webhooks", "skills" ], "lastRelease": "2026-10-23", "graded": true, "anchor": { "graded": true, "score": 74.7, "grade": "BB", "agentReady": true, "rank": 77, "ranked": true, "rankOf": 1513, "categoryRank": 1, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 77, "maintenance": 83, "payments": 58, "reliability": 83, "schema": 79, "security": 85, "transparency": 73 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-01" }, "negative": -3, "negativeNotes": [ "2026-10-16. `@turnkey/sdk-server` 8.7.0 and `@turnkey/http` 6.7.0, minor releases, rename `deleteVelocityControl` to `deleteVelocityControls` and `chainCaip2` to `caip2` on Earn intents, and remove `FiatOnRampBlockchainNetwork.BITCOIN` because \"the API no longer accepts it\". Each is called out in the changelog on the day, and no advance notice was found in the SDK changelogs or the docs, which keep no API changelog. A breaking change in a minor release without notice, so 3 points, the floor, by the founder's rule of 1 November 2026, as temporal's SDK minors were read in this run. https://github.com/tkhq/sdk/blob/main/packages/sdk-server/CHANGELOG.md" ], "verdict": "An agent gets a non-root user that can sign nothing until a policy allows it, with DENY rules taking precedence and human co-approval available. Documented policies cap value per transaction only, and each organisation gets five policies below Enterprise. Signing endpoints returned elevated errors for five hours on 27 August 2026.", "bestFor": "A company that wants agents to sign from its own wallets under rules checked in an enclave, with a person co-approving large transactions, across EVM, Solana, Bitcoin, Tron and other chains.", "strengths": [ "Non-root users have no permissions until an ALLOW policy exists, and any matching DENY policy wins", "Consensus expressions can require the agent and a named person to approve before the enclave signs", "API private keys are generated by the customer and never sent to Turnkey. Keys can carry an expiry", "Submissions are idempotent by request body, so a retry with the same body returns the same activity", "Public Swagger 2.0 spec with 198 paths, llms.txt, a full-text docs feed and nine Apache-2.0 agent skills" ], "weaknesses": [ "Documented policy conditions cap value per transaction only. Rolling-window Velocity Controls appear in the SDK clients but not in the docs", "Free, Pay as You Go and Pro organisations are limited to five policies and a default of 1 to 3 requests a second", "Root users bypass the policy engine entirely, and the first user of a new organisation is root", "Signing endpoints returned elevated errors from 00:44 to 05:53 EDT on 27 August 2026", "429 responses carry no `Retry-After` header, and the terms forbid benchmarking and availability monitoring" ], "agentNotes": [ "Use a non-root user's key. Refuse root credentials for unattended work, because root bypasses every policy", "Scope every signing ALLOW policy by `wallet.id` or `wallet_account.address`, or it covers every key the user can reach", "Check the activity status on each response. `ACTIVITY_STATUS_CONSENSUS_NEEDED` means a person must approve within 24 hours", "Retry with the identical body to stay idempotent. Changing `timestampMs` creates a new activity", "Back off with jitter on 429 and poll `get_activity` sparingly, since polling counts against the same 1 to 3 requests a second" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 4, "avgRating": 3, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 74.7 } ], "editorialScores": { "ergonomics": 77, "maintenance": 83, "payments": 58, "reliability": 83, "schema": 79, "security": 85, "transparency": 50 }, "provenanceScore": 95, "checked": { "categories": { "ergonomics": "2026-11-01", "maintenance": "2026-11-01", "payments": "2026-11-01", "reliability": "2026-11-01", "schema": "2026-11-01", "security": "2026-11-01", "transparency": "2026-11-01" }, "last": "2026-11-01", "lastMoved": "2026-11-01", "oldest": "2026-11-01", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install @turnkey/sdk-server", "claudeCode": "claude mcp add --transport http turnkey https://docs.turnkey.com/mcp" }, "letme": { "capability": "https://letme.dev/wallet.onchain", "tool": "https://letme.dev/turnkey-agentic-wallets" }, "area": "payments", "unitPrices": [ { "item": "Signature, Pay as You Go", "unit": "call", "usd": 0.1, "note": "after 25 free signatures a month" }, { "item": "Pro plan", "unit": "month", "usd": 99, "note": "monthly minimum, up to 2,000 wallets" }, { "item": "Signature, Pro", "unit": "call", "usd": 0.05, "note": "per signature on the Pro plan" } ], "provenance": { "legalEntity": "Turnkey Global, Inc.", "domain": "turnkey.com", "domainRegistered": "1994-12-20", "endpointOnVendorDomain": true, "terms": "https://www.turnkey.com/legal/terms", "privacy": "https://www.turnkey.com/legal/privacy", "statusPage": "https://www.turnkey-status.com", "changelog": "https://github.com/tkhq/sdk/blob/main/packages/sdk-server/CHANGELOG.md", "securityTxt": "valid", "checked": "2026-10-08", "notes": [ "The terms of service (updated 6 August 2026) are the agreement for the services and the API. They name Turnkey Global, Inc., give 15 W. 18th Street, New York as the notice address and choose New York law.", "The terms have a section on automated and AI-mediated access. It treats agents using a customer's credentials as authorised users and makes the customer responsible for their actions.", "The privacy policy (updated 29 June 2026) covers the services and says Turnkey is a processor where it serves a business customer's users.", "The API answers at api.turnkey.com. The status page is on a second domain, turnkey-status.com, hosted by Atlassian Statuspage.", "www.turnkey.com/.well-known/security.txt gives a policy URL, a contact form, security@turnkey.com and a PGP key. It has no Expires field.", "No changelog for the API was found in the docs. The link is the server SDK's changelog on GitHub.", "RDAP for turnkey.com gives a registration date of 1994-12-20." ], "score": 95 }, "requirements": { "setupChecked": true, "complianceChecked": true, "card": "paid-only", "freeTier": true, "minutes": 20, "credential": "api-key", "euResidency": "unknown", "trainsOnData": "unknown", "zeroRetention": "unknown", "certifications": [ "SOC 2 Type II" ], "selfHost": "no" }, "pageJsonUrl": "https://www.anchorterminal.com/tools/turnkey-agentic-wallets.json", "live": { "slug": "turnkey-agentic-wallets", "probe": { "target": "https://api.turnkey.com", "method": "get", "lastAt": "2026-11-08T14:48:16.707015051Z", "lastOk": true, "lastStatus": 404, "lastMs": 71, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 80, "p95ms24h": 177, "samples24h": 242, "samples30d": 7495, "days": [ { "date": "2026-10-09", "probes": 169, "ok": 169 }, { "date": "2026-10-10", "probes": 247, "ok": 247 }, { "date": "2026-10-11", "probes": 247, "ok": 247 }, { "date": "2026-10-12", "probes": 247, "ok": 247 }, { "date": "2026-10-13", "probes": 248, "ok": 248 }, { "date": "2026-10-14", "probes": 249, "ok": 249 }, { "date": "2026-10-15", "probes": 253, "ok": 253 }, { "date": "2026-10-16", "probes": 252, "ok": 252 }, { "date": "2026-10-17", "probes": 253, "ok": 253 }, { "date": "2026-10-18", "probes": 256, "ok": 256 }, { "date": "2026-10-19", "probes": 255, "ok": 255 }, { "date": "2026-10-20", "probes": 252, "ok": 252 }, { "date": "2026-10-21", "probes": 253, "ok": 253 }, { "date": "2026-10-22", "probes": 253, "ok": 253 }, { "date": "2026-10-23", "probes": 248, "ok": 248 }, { "date": "2026-10-24", "probes": 251, "ok": 251 }, { "date": "2026-10-25", "probes": 250, "ok": 250 }, { "date": "2026-10-26", "probes": 252, "ok": 252 }, { "date": "2026-10-27", "probes": 249, "ok": 249 }, { "date": "2026-10-28", "probes": 250, "ok": 250 }, { "date": "2026-10-29", "probes": 249, "ok": 249 }, { "date": "2026-10-30", "probes": 249, "ok": 249 }, { "date": "2026-10-31", "probes": 251, "ok": 251 }, { "date": "2026-11-01", "probes": 249, "ok": 249 }, { "date": "2026-11-02", "probes": 250, "ok": 250 }, { "date": "2026-11-03", "probes": 248, "ok": 248 }, { "date": "2026-11-04", "probes": 246, "ok": 246 }, { "date": "2026-11-05", "probes": 185, "ok": 185 }, { "date": "2026-11-06", "probes": 241, "ok": 241 }, { "date": "2026-11-07", "probes": 243, "ok": 243 }, { "date": "2026-11-08", "probes": 150, "ok": 150 } ], "since": "2026-10-09T00:00:00Z" }, "vendorStatus": { "page": "https://www.turnkey-status.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-08T14:51:54.065912676Z" }, "versions": [ { "registry": "github", "name": "tkhq/turnkey-agent-skills", "version": "v1.0.0", "released": "2026-05-19", "seenAt": "2026-11-08T01:45:47.496246956Z" }, { "registry": "npm", "name": "@turnkey/sdk-server", "version": "8.9.0", "seenAt": "2026-11-08T01:45:43.568823061Z" }, { "registry": "npm", "name": "@turnkey/viem", "version": "0.14.49", "seenAt": "2026-11-08T01:45:45.993893161Z" }, { "registry": "pypi", "name": "turnkey-http", "version": "0.2.2", "released": "2026-10-21", "seenAt": "2026-11-08T01:45:47.308840385Z" } ], "githubStars": 2, "npmWeekly": 463284, "pypiWeekly": 11087, "securityTxt": { "url": "https://turnkey.com/.well-known/security.txt", "state": "valid", "checkedAt": "2026-11-07T16:00:54.595875515Z" }, "llmsTxt": { "url": "https://docs.turnkey.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:34:12.211768053Z" }, "domain": { "domain": "turnkey.com", "registered": "1994-12-20", "source": "https://rdap.verisign.com/com/v1/domain/turnkey.com", "checkedAt": "2026-11-08T14:40:56.596292655Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/tkhq/sdk/main/packages/sdk-server/CHANGELOG.md", "kind": "changelog", "status": 304, "checkedAt": "2026-11-07T14:23:47.018170534Z", "changedAt": "2026-11-03T08:01:47.042313887Z", "fingerprint": "993036189411" }, { "url": "https://www.turnkey.com/pricing", "kind": "pricing", "status": 304, "checkedAt": "2026-11-07T14:36:10.230131982Z", "changedAt": "2026-11-05T13:19:24.342820756Z", "fingerprint": "85af7221ae8d" }, { "url": "https://www.turnkey.com/legal/privacy", "kind": "privacy", "status": 304, "checkedAt": "2026-11-07T14:36:06.168230967Z", "changedAt": "2026-10-30T06:01:50.52482444Z", "fingerprint": "eba73fbe72f1" }, { "url": "https://www.turnkey.com/legal/terms", "kind": "terms", "status": 304, "checkedAt": "2026-11-07T14:36:08.270583914Z", "changedAt": "2026-10-30T06:01:53.042364091Z", "fingerprint": "a7b7a3508b4d" } ], "mcpTools": { "url": "https://docs.turnkey.com/mcp", "checkedAt": "2026-11-08T02:02:41.36692856Z", "status": "ok", "protocol": "2026-07-28", "tools": [ { "name": "search_turnkey", "title": "Search documentation", "description": "Search across the Turnkey knowledge base to find relevant information, code examples, API references, and guides. Use this tool when you need to answer questions about Turnkey, find specific documentation, understand how features work, or locate implementation details. The search returns contextual content with titles and direct links to the documentation pages. If you need the full content of a specific page, use the query_docs_filesystem tool to `head` or `cat` the page path (append `.mdx` to the path returned from search — e.g. a result at `/some/page` is read with `head -200 /some/page.mdx`).", "inputSchema": { "additionalProperties": false, "properties": { "query": { "description": "Search query", "type": "string" } }, "required": [ "query" ], "type": "object" }, "annotations": { "destructiveHint": false, "idempotentHint": true, "openWorldHint": false, "readOnlyHint": true, "title": "Search documentation" } }, { "name": "query_docs_filesystem_turnkey", "title": "Query documentation filesystem", "description": "Run a read-only shell-like query against a virtualized, in-memory filesystem rooted at `/` that contains ONLY the Turnkey documentation pages and OpenAPI specs. This is NOT a shell on any real machine — nothing runs on the user's computer, the server host, or any network. The filesystem is a sandbox backed by documentation chunks.\n\nThis is how you read documentation pages: there is no separate \"get page\" tool. To read a page, pass its `.mdx` path to `head` or `cat` — a page at the URL path `/some/page` lives at `/some/page.mdx`. To search the docs with exact keyword or regex matches, use `rg`. To understand the docs structure, use `tree` or `ls`.\n\n**Paths are specific to this site — never guess them.** Discover real paths with `tree / -L 2`, `ls /`, or the search tool before reading. If a path does not exist, that only means the guess was wrong; it does NOT mean the topic is undocumented — use `rg -il \"keyword\" /` to find where it is covered.\n\n**Workflow:** Start with the search tool for broad or conceptual queries like \"how to authenticate\" or \"rate limiting\". Use this tool when you need exact keyword/regex matching, structural exploration, or to read the full content of a specific page by path.\n\nSupported commands: rg (ripgrep), grep, find, tree, ls, cat, head, tail, stat, wc, sort, uniq, cut, sed, awk, jq, plus basic text utilities. No writes, no network, no process control. Run `--help` on any command for usage.\n\nEach call is STATELESS: the working directory always resets to `/` and no shell variables, aliases, or history carry over between calls. If you need to operate in a subdirectory, chain commands in one call with `\u0026\u0026` or pass absolute paths (e.g., `cd /some-directory \u0026\u0026 ls` or `ls /some-directory`). Do NOT assume that `cd` in one call affects the next call.\n\nExamples (replace the placeholder paths with real ones from `tree` or search):\n- `tree / -L 2` — see the top-level directory layout\n- `rg -il \"rate limit\" /` — find all files mentioning \"rate limit\"\n- `rg -C 3 \"apiKey\" /some-directory/` — show matches with 3 lines of context around each hit\n- `head -80 /some/page.mdx` — read the top 80 lines of a specific page\n- `head -80 /page-one.mdx /page-two.mdx /section/page-three.mdx` — read multiple pages in one call\n- `cat /some/page.mdx` — read a full page when you need everything\n- `cat /openapi/scripts/openapi-gen/proxy_api_openapi.json | jq '.paths | keys'` — list OpenAPI endpoints\n\nOpenAPI specs for this site are mounted at: `/openapi/scripts/openapi-gen/proxy_api_openapi.json`, `/openapi/scripts/openapi-gen/openapi.json`, `/openapi/scripts/openapi-gen/test-openapi.json`, `/openapi/package-lock.json`. Use them to answer questions about endpoints, request/response schemas, parameters, and authentication.\n\nOutput is truncated to 30KB per call. Prefer targeted `rg -C` or `head -N` over broad `cat` on large files. To read only the relevant sections of a large file, use `rg -C 3 \"pattern\" /path/file.mdx`. Batch multiple file reads into a single `head` or `cat` call whenever possible.\n\nWhen referencing pages in your response to the user, convert filesystem paths to URL paths by removing the `.mdx` extension. For example, `/some/page.mdx` becomes `/some/page`.", "inputSchema": { "additionalProperties": false, "properties": { "command": { "description": "A shell command to run against the virtualized documentation filesystem (e.g., `rg -il \"keyword\" /`, `tree / -L 2`, `head -80 /path/file.mdx`).", "type": "string" } }, "required": [ "command" ], "type": "object" }, "annotations": { "destructiveHint": false, "idempotentHint": true, "openWorldHint": false, "readOnlyHint": true, "title": "Query documentation filesystem" } }, { "name": "submit_feedback", "title": "Submit documentation feedback", "description": "Report a problem with this documentation site so the docs team can fix it. Use when a documentation page is incorrect, outdated, confusing, incomplete, or has a broken example. This is for feedback about the documentation content itself — not for product support requests or feedback about this tool or assistant.", "inputSchema": { "additionalProperties": false, "properties": { "feedback": { "description": "A clear description of the documentation issue or suggestion — what is incorrect, outdated, missing, or confusing.", "minLength": 1, "type": "string" }, "path": { "description": "The URL path of the documentation page the feedback is about (the page you were reading, without the `.mdx` extension).", "minLength": 1, "type": "string" } }, "required": [ "path", "feedback" ], "type": "object" }, "annotations": { "destructiveHint": false, "idempotentHint": false, "openWorldHint": true, "readOnlyHint": false, "title": "Submit documentation feedback" } } ], "schemaTokens": 1446, "changedAt": "2026-11-07T01:48:48.897111016Z", "check": { "checker": "anchor-check/1.0", "totalTokens": 1446, "counts": { "error": 0, "note": 1, "warn": 1 }, "findings": [ { "rule": "TC07", "severity": "warn", "tool": "query_docs_filesystem_turnkey", "message": "the description is about 811 tokens", "fix": "Keep the description to what a model needs to choose and call the tool; move the manual to a resource or the docs." }, { "rule": "TC24", "severity": "note", "message": "3 of 3 tools have no outputSchema", "fix": "Declare outputSchema for tools that return structured data, and return structuredContent that matches it." } ] } }, "github": { "repo": "tkhq/turnkey-agent-skills", "checkedAt": "2026-11-02T09:31:59.853992718Z", "stars": 2, "archived": false, "issuesEnabled": true, "pushedAt": "2026-09-17T19:46:10Z", "openIssues": 2, "openPRs": 4, "issuesOpened90d": 1, "issuesClosed90d": 0, "prsMerged90d": 0, "ci": { "branch": "main", "runs": 31, "success": 31, "failure": 0, "other": 0, "latest": "success", "latestAt": "2026-05-19T03:54:21Z" }, "replies": { "sampled": 2, "unanswered": 2 } }, "updatedAt": "2026-11-08T14:51:54.065912676Z" }, "streak": { "days": 30, "from": "2026-10-09", "sinceWatching": true, "best": 30 } }, "edges": [ { "by": 63, "category": "reliability", "leads": "turnkey-agentic-wallets", "name": "Reliability", "reasons": { "a": "Graded with the hosted lines, because signing, mandates and approvals all run on FluxA's wallet API and the CLI and MCP server only wrap it, as kite-agent-passport and kane-cli were read. No status page was found in the repository, the skills or AgentMarket's pages. fluxapay.xyz and the wallet and docs hosts could not be read, so a status page there is unchecked and scored absent (0). With no readable history the record takes the default (5). No rate limit with numbers was found (0). The connection service treats 429 `slow_down` as wait and poll and marks errors `retryable`, the skill says a 503 means retry shortly, payouts require a caller-chosen `payout_id` that returns the existing payout on a repeat, `--biz-id` rejects a duplicate with 409, and card create and recharge resume with `--request-id` instead of paying again. No Retry-After or backoff schedule is documented for the wallet API (10 of 15). No SLA was found (0). No beta label was found on the wallet in what was read, but both packages are at 0.x, agent cards sit behind a waitlist and the wallet site was unread (5 of 10). Total 20.", "b": "Status page at turnkey-status.com on Atlassian Statuspage with 23 components and 90-day uptime bars (20). Between 3 August and 1 November 2026 it lists nine incidents. Signing endpoints, `sign_raw_payload` and `sign_transaction` among them, returned elevated errors for 5 hours 9 minutes on 27 August (00:44 to 05:53 EDT), marked minor, with \"a subset of signing requests\" rejected. SMS authentication had issues from 6 August and was resolved at 02:36 EDT on 7 August, marked critical, on the Authentication (SMS) component, outside the path an agent's API key uses. Webhook delays (15 August, 15 September) and broadcast failures traced to upstream RPC providers (31 August, 2 September) were partial. Three incidents since 17 October, SMS and email OTP delays of 45 minutes on 28 October, new Earn vault deployments blocked from 28 to 29 October and Aave V3 vaults hidden from Earn discovery on 29 and 30 October, are marked with no impact and leave signing untouched. The 27 July request failures have left the window. Read the way partial and degraded incidents on resend and pinecone were read on 1 November, a subset of requests on one path counts as minor, as stripe-mcp's payout errors of 6 August and pinecone's control-plane errors of 1 September did, so minor incidents only, 20 rather than the between-band 12 earlier checks gave (20). Rate limits are published as 1 request a second on Free and Pay-as-you-go, 3 on Pro and up to 60 on Enterprise, with 10 a second for each sub-organisation and separate buckets for broadcast and balance calls (15). The docs describe 429 handling with exponential backoff and jitter and say submissions are idempotent by body fingerprint, but \"The API does not return rate-limit or `Retry-After` headers\" (13 of 15). SLAs are listed on the Enterprise plan with no published terms (5 of 10). The API is generally available and the agent skills are at 1.0.0 (10). 20+20+15+13+5+10 = 83." }, "scores": { "a": 20, "b": 83 } }, { "by": 41, "category": "transparency", "leads": "turnkey-agentic-wallets", "name": "Transparency \u0026 trust", "reasons": { "a": "The CLI and MCP server source is Apache-2.0 per the LICENSE file and both package.json files, while the README's last section says MIT. The hosted wallet is closed, and no terms covering it were found. AgentMarket's terms describe only the marketplace (15 of 30). AgentMarket's privacy policy of 14 January 2026 names Stripe and model providers and gives no retention periods, and it does not mention wallet addresses, KYC profiles, card data or payouts, which the CLI collects or handles. The wallet's own privacy policy was unreachable (5 of 30). The README marks `init` and `link-wallet` as legacy but still supported, and the skill pins a minimum CLI version; no deprecation policy or dated notice was found (3 of 20). Stripe is the only provider named; no card issuer, KYC provider, custody provider or data location is named. The CLI and MCP code send no telemetry (3 of 20). Total 26.", "b": "A closed service under published terms of service, updated 6 August 2026, with the SDKs, CLI and agent skills under Apache-2.0 and QuorumOS open source (18 of 30). The privacy policy, updated 29 June 2026, names Turnkey Global, Inc., says Turnkey is a processor for its business customers' users and lists categories of service providers. It gives no retention periods, and the data processing terms were not read because the trust centre is drawn by script (17 of 30). Deprecated activity types are marked in the docs with migration guides, with no dates or notice period found (7 of 20). The docs say subprocessors and their locations are in the trust centre, which we couldn't read. The status page names AWS SES and SNS in us-east-1, Cloudflare and Alchemy as dependencies (8 of 20)." }, "scores": { "a": 32, "b": 73 } }, { "by": 33, "category": "security", "leads": "turnkey-agentic-wallets", "name": "Security \u0026 auth", "reasons": { "a": "The agent holds an Agent ID, a token whose validity the owner picks from 1 hour to 1 year at browser approval, and a short-lived RS256 JWT refreshed from the token; `token_revoked` exists. Credentials sit in a 0600 JSON file or environment variables. The token is not scoped, since limits live in mandates, and legacy `init` tokens are described as not expiring. Agent VCs are audience-bound and rejected by FluxA's own endpoints. No secret travels in a URL (22 of 30). Every x402 payment needs a mandate the owner signs, with a limit, a validity and an optional host allowlist enforced by the wallet API, payouts need per-payout approval unless a mandate covers them, cards need a mandate and KYC, and linked-card mandates are scoped to one merchant. A payout mandate sets no payee allowlist that was documented, and the skill tells agents to request budgets for at least 100 calls by default (16 of 20). The wallet returns little third-party content itself, but the skill sends agents to third-party x402 APIs, ClawPI posts and a remote announcement.md with no guidance on treating them as untrusted, its description steers agents to paid APIs even when a free web search looks enough, and the daily check-in runs `npx -y @fluxa-pay/fluxa-wallet@latest` unpinned twice a day (4 of 15). `mandates` lists limit, spent and remaining, with `recent-transactions`, `received-records` and payout status by CLI, and the MCP server writes a local audit log; the wallet app's logs were not read (10 of 15). No SECURITY.md, disclosure policy, bug bounty or certification was found, and agentmarket.fluxapay.xyz has no security.txt; fluxapay.xyz's is unchecked (0 of 20). Total 52.", "b": "Each user holds P-256 API key pairs whose private half is generated by the customer and never sent to Turnkey. Keys can be created with an expiry, a user has up to ten of each kind, deleting the user revokes access at once, and no secret travels in a URL. Scope comes from policies, not from the key itself (28 of 30). Policies deny by default, DENY beats ALLOW, a non-root user starts with no permissions, read access needs no policy, and consensus expressions can require a named person to approve. Root users bypass the policy engine. The documented policy language has conditions on a single transaction only. The generated SDK clients and the Swagger definitions also carry Velocity Controls (create, get, list and delete), rolling-window sums or counts of asset transfers that policies reference as `controls.\u003cidentifier\u003e`, but no docs page describes them (the docs indexes read on 1 November don't name them) and the Swagger has no paths for them, so they earn nothing here (17 of 20). The skills page warns that models can misread instructions and that policies are the technical control, and the terms say the same. No guidance on untrusted content in balances or token data was found (9 of 15). Every action is an activity recording who approved it, readable by query and delivered by signed webhooks (13 of 15). SOC 2 Type II per the docs (the trust centre pointer page per the 8 October check, not re-read on 1 November), a bug bounty of up to $50,000 with safe harbour, a security.txt with a PGP key and no Expires field, a published whitepaper and the enclave operating system QuorumOS open source (18 of 20)." }, "scores": { "a": 52, "b": 85 } }, { "by": 18, "category": "schema", "leads": "turnkey-agentic-wallets", "name": "Schema \u0026 documentation", "reasons": { "a": "No OpenAPI file or reference for the wallet API was found; the README shows sample requests for five endpoints. The MCP server's 15 tools in the 0.6.0 source carry typed Zod input schemas, and the CLI's flags are documented in prose in the skill files and `--help`. The MCP server is the secondary surface and its npm release is 0.2.0, so 12 of 25. The skill and its 18 Markdown guides are written for agents, and AgentMarket's llms.txt describes the wallet's payment role (10). `connect_wallet`, `init_agent_id` and `create_intent_mandate` say when to use them and when not to, and the skill has a when-to-use table per capability, while the payment-link and status tools have one-line descriptions (12 of 20). Zod enums for validity, runtime, hosting and currency, a regex on payout amounts and strict objects, but the x402 requirement fields are plain strings and `outputSchema` is a free-form record (10 of 15). The README has an example for every MCP tool, the skills give CLI examples and output, and error codes are tabled for mandates, payouts, cards and connections (12 of 15). Semver on npm with 25 CLI versions and a version line in the skill, two git tags and no changelog (5 of 15). Total 61.", "b": "A public Swagger 2.0 document at docs.turnkey.com/public_api.swagger.json with 198 paths, 74 queries and 123 submissions on 1 November (25). llms.txt, llms-full.txt and a Markdown twin of every docs page (10). Operation descriptions in the spec are one line each, such as \"Sign a transaction.\", while the guides and the nine agent skills say when to use each call and when not to (13 of 20). The spec has 185 enums and required fields on every request, but 64-bit numbers travel as strings and policy `condition` and `consensus` are free-form strings in Turnkey's own expression language (11 of 15). The errors page lists 32 `turnkeyErrorCode` values and a table of messages with HTTP codes and fixes, though the spec documents only the 200 response for each path (12 of 15). Paths sit under `/public/v1` and activity types carry version suffixes, but no changelog for the API was found in the docs. Changes appear only in the SDK changelogs on GitHub, such as the 8.7.0 entry of 16 October recording that the API no longer accepts Bitcoin for fiat on-ramp quotes (8 of 15)." }, "scores": { "a": 61, "b": 79 } }, { "by": 17, "category": "ergonomics", "leads": "turnkey-agentic-wallets", "name": "Agent ergonomics", "reasons": { "a": "The MCP server has 15 tools with about 4,700 characters of descriptions, the 11 to 30 band (15). The CLI path loads SKILL.md (26.5 KB) and one of 18 guides per task, about 112 KB in all, with no read-only subset (no add-back, 15 of 25). `card transactions` takes page, limit, type and a time range, refunds take limit and offset, `received-records` and `recent-transactions` take a limit up to 100, and `market search` can be scoped to models or vendors; no cursor (12 of 20). Errors carry a `code`, `retryable`, `reconnect_required` and a `next_command` or `next_tool`, and card errors map to recovery hints, but the CLI exits only 0 or 1 and the MCP payment tools return the wallet API's raw error body without `isError` (14 of 20). A required `payout_id` idempotency key, `--biz-id` dedup and `--request-id` continuation on card operations, and the skill says not to initiate again to retry a payment. No `readOnlyHint` or `destructiveHint` on any MCP tool (12 of 20). Base USDC is the default network and asset, mandates default to 8 hours and the CLI installs in one command, but there is no SDK library and both packages are TypeScript (7 of 15). Total 60.", "b": "There is no MCP server for wallet actions; the MCP server at docs.turnkey.com/mcp has two read-only tools, `search_turnkey` and `query_docs_filesystem_turnkey`, both over the docs (listed again on 1 November). An agent calls the API through an SDK, the CLI or the skills, and responses can't be trimmed by field (15 of 25). List queries take cursor pagination with a limit of 1 to 100 and filters by activity status and type (17 of 20). Errors carry a category code and a readable message with documented fixes, wrapped in a gRPC status the docs say not to rely on (16 of 20). Submissions are idempotent by a hash of the POST body, and the docs explain that changing `timestampMs` creates a new activity. No MCP annotations apply (18 of 20). Server SDKs exist for TypeScript, Go, Ruby, Rust and Python, with wallet and policy helpers in the first three, but every request needs a P-256 signature in an `X-Stamp` header and submissions need an activity envelope (11 of 15). The SDK reference is per the 8 October check, not re-read on 1 November." }, "scores": { "a": 60, "b": 77 } }, { "by": 17, "category": "maintenance", "leads": "turnkey-agentic-wallets", "name": "Maintenance \u0026 community", "reasons": { "a": "`@fluxa-pay/fluxa-wallet` 0.6.0 was published on 6 November 2026, one day before this check (30). Eight CLI releases since 10 August 2026, among them 0.5.2 on 14 October, 0.5.3 on 25 October and 0.5.6, 0.5.7 and 0.6.0 between 3 and 6 November (20). The repository merged 43 pull requests, all from the organisation's own branches, and commits run weekly. Issues and outside pull requests could not be read because the GitHub API refused the session. Discord and a support address are linked from AgentMarket and were not tested (8 of 25). Graded as an API, the line asks for current official SDKs. The CLI is current, but there is no SDK library and the MCP package on npm has not been published since 2 March 2026 (5 of 15). 68 node:test cases exist with no CI workflow, neither npm package declares its repository, and the MCP package's last release lags the source by eight months (3 of 10). Total 66.", "b": "The SDK repository tagged v2026.10.3 on 19 October (`@turnkey/sdk-server` 8.7.1, a fix for an invalid activity type) and v2026.10.4 on 23 October 2026, whose release commit sets `@turnkey/sdk-server` to 8.8.0 (an optional per-secret `requestContext` on secret export) (30). Sixteen dated release tags between 6 August and 23 October (20). The service is closed, with dashboard chat, email and a community Slack for support, and pull requests merged up to 30 October. We didn't test a support channel and no API changelog was found (10 of 15). Current official SDKs in TypeScript, Go, Ruby, Rust and Python (15). Public CI workflows, dependency patches merged on 27 and 28 October and Renovate on the skills repository. The CLI's last tag is May 2025 (8 of 10). Total 83." }, "scores": { "a": 66, "b": 83 } } ], "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "FluxA Technology Pte. Ltd.", "b": "Turnkey Global, Inc.", "name": "Vendor" }, { "a": "https://walletapi.fluxapay.xyz", "b": "https://api.turnkey.com", "name": "Hosted endpoint" }, { "a": "HTTP, stdio", "b": "HTTP", "name": "Transports" }, { "a": "OAuth or key", "b": "API key", "name": "Auth" }, { "a": "Pay per use", "b": "Freemium", "name": "Pricing" }, { "a": "payer tooling only", "b": "payer tooling only", "name": "x402" }, { "a": "The CLI and MCP server source is Apache-2.0 (LICENSE file and both package.json files), though the README's last section says MIT. The hosted wallet service is closed, and no terms covering the wallet were found", "b": "Proprietary service under Turnkey's terms of service. The SDKs, the CLI and the agent skills on GitHub are Apache-2.0", "name": "Licence" }, { "a": "15", "b": "none", "name": "Tools exposed" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "no", "b": "yes", "name": "llms.txt" }, { "a": "2026-11-06", "b": "2026-10-23", "name": "Last release" }, { "a": "no document linked", "b": "2026-08-06", "name": "Terms last updated" }, { "a": "no document linked", "b": "2026-06-29", "name": "Privacy policy last updated" }, { "a": "not read yet", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "not read yet", "b": "yes", "name": "Terms restrict automated access" }, { "a": "not read yet", "b": "yes", "name": "Terms restrict benchmarking" }, { "a": "not read yet", "b": "yes", "name": "Terms or service can change without notice" }, { "a": "not read yet", "b": "yes", "name": "Arbitration or class-action waiver" }, { "a": "none", "b": "304k npm/wk, 12k PyPI/wk", "name": "Popularity" }, { "a": "none", "b": "3/5 (4)", "name": "Agent reviews" } ], "faq": [ { "answer": "Turnkey Agentic Wallets scores 74.7 (BB) on agent readiness against FluxA AI Wallet's 47 (D), and leads in every scored category.", "question": "Which is better for AI agents, FluxA AI Wallet or Turnkey Agentic Wallets?" }, { "answer": "FluxA AI Wallet takes an API key or an OAuth sign-in. Turnkey Agentic Wallets needs an API key.", "question": "Do FluxA AI Wallet and Turnkey Agentic Wallets need an API key?" }, { "answer": "Yes. FluxA AI Wallet has a hosted endpoint at https://walletapi.fluxapay.xyz and Turnkey Agentic Wallets at https://api.turnkey.com.", "question": "Can an agent call FluxA AI Wallet and Turnkey Agentic Wallets without installing anything?" }, { "answer": "FluxA AI Wallet is open source (The CLI and MCP server source is Apache-2.0 (LICENSE file and both package.json files), though the README's last section says MIT. The hosted wallet service is closed, and no terms covering the wallet were found). No open-source release is listed for Turnkey Agentic Wallets.", "question": "Are FluxA AI Wallet and Turnkey Agentic Wallets open source?" } ], "goodFor": [ { "aheadOn": null, "also": [ "Runs on your own machine", "Open source", "No incidents deducted, where Turnkey Agentic Wallets loses 3 points for them" ], "goodFor": "An agent in a CLI-capable client that needs to pay x402 APIs, send USDC on Base or receive payments through links, inside budgets a person signs.", "slug": "fluxa-ai-wallet", "watchFor": "The published MCP package is 0.2.0 from 2 March 2026 with 13 tools, while the repository says 0.6.0 with 15" }, { "aheadOn": [ "Reliability, 83 against 20", "Schema \u0026 documentation, 79 against 61", "Agent ergonomics, 77 against 60", "Security \u0026 auth, 85 against 52", "Payments \u0026 pricing, 58 against 45", "Maintenance \u0026 community, 83 against 66", "Transparency \u0026 trust, 73 against 32" ], "also": [ "Agent-ready, a grade of BB or better" ], "goodFor": "A company that wants agents to sign from its own wallets under rules checked in an enclave, with a person co-approving large transactions, across EVM, Solana, Bitcoin, Tron and other chains.", "slug": "turnkey-agentic-wallets", "watchFor": "Documented policy conditions cap value per transaction only. Rolling-window Velocity Controls appear in the SDK clients but not in the docs" } ], "history": { "fluxa-ai-wallet": null, "turnkey-agentic-wallets": [ { "causes": [ "correction", "event" ], "date": "2026-11-01", "delta": -1.4, "from": 76.1, "fromGrade": "BB", "to": 74.7, "toGrade": "BB" }, { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.1, "from": 76, "fromGrade": "BB", "to": 76.1, "toGrade": "BB" } ] }, "job": { "capability": "payments.x402", "name": "x402 payments" }, "others": [ { "json": "https://www.anchorterminal.com/compare/agentcard-vs-fluxa-ai-wallet.json", "title": "Agentcard vs FluxA AI Wallet", "url": "https://www.anchorterminal.com/compare/agentcard-vs-fluxa-ai-wallet" }, { "json": "https://www.anchorterminal.com/compare/circle-wallets-vs-fluxa-ai-wallet.json", "title": "Circle Wallets (Agent Wallets, Programmable Wallets) vs FluxA AI Wallet", "url": "https://www.anchorterminal.com/compare/circle-wallets-vs-fluxa-ai-wallet" }, { "json": "https://www.anchorterminal.com/compare/circle-wallets-vs-turnkey-agentic-wallets.json", "title": "Circle Wallets (Agent Wallets, Programmable Wallets) vs Turnkey Agentic Wallets", "url": "https://www.anchorterminal.com/compare/circle-wallets-vs-turnkey-agentic-wallets" }, { "json": "https://www.anchorterminal.com/compare/coinbase-cdp-agentkit-vs-fluxa-ai-wallet.json", "title": "Coinbase Developer Platform (Agentic Wallet, AgentKit, CDP MCP) vs FluxA AI Wallet", "url": "https://www.anchorterminal.com/compare/coinbase-cdp-agentkit-vs-fluxa-ai-wallet" }, { "json": "https://www.anchorterminal.com/compare/coinbase-cdp-agentkit-vs-turnkey-agentic-wallets.json", "title": "Coinbase Developer Platform (Agentic Wallet, AgentKit, CDP MCP) vs Turnkey Agentic Wallets", "url": "https://www.anchorterminal.com/compare/coinbase-cdp-agentkit-vs-turnkey-agentic-wallets" }, { "json": "https://www.anchorterminal.com/compare/kite-agent-passport-vs-turnkey-agentic-wallets.json", "title": "Kite Agent Passport vs Turnkey Agentic Wallets", "url": "https://www.anchorterminal.com/compare/kite-agent-passport-vs-turnkey-agentic-wallets" }, { "json": "https://www.anchorterminal.com/compare/openfort-vs-turnkey-agentic-wallets.json", "title": "Openfort vs Turnkey Agentic Wallets", "url": "https://www.anchorterminal.com/compare/openfort-vs-turnkey-agentic-wallets" }, { "json": "https://www.anchorterminal.com/compare/privy-vs-turnkey-agentic-wallets.json", "title": "Privy Wallets (server wallets, agent wallets, policy engine) vs Turnkey Agentic Wallets", "url": "https://www.anchorterminal.com/compare/privy-vs-turnkey-agentic-wallets" }, { "json": "https://www.anchorterminal.com/compare/sponge-wallet-vs-turnkey-agentic-wallets.json", "title": "Sponge Wallet vs Turnkey Agentic Wallets", "url": "https://www.anchorterminal.com/compare/sponge-wallet-vs-turnkey-agentic-wallets" }, { "json": "https://www.anchorterminal.com/compare/circle-gateway-nanopayments-vs-fluxa-ai-wallet.json", "title": "Circle Gateway Nanopayments vs FluxA AI Wallet", "url": "https://www.anchorterminal.com/compare/circle-gateway-nanopayments-vs-fluxa-ai-wallet" }, { "json": "https://www.anchorterminal.com/compare/fluxa-agentmarket-vs-fluxa-ai-wallet.json", "title": "FluxA AgentMarket vs FluxA AI Wallet", "url": "https://www.anchorterminal.com/compare/fluxa-agentmarket-vs-fluxa-ai-wallet" }, { "json": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-kite-agent-passport.json", "title": "FluxA AI Wallet vs Kite Agent Passport", "url": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-kite-agent-passport" }, { "json": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-nevermined.json", "title": "FluxA AI Wallet vs Nevermined API + MCP", "url": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-nevermined" }, { "json": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-openfort.json", "title": "FluxA AI Wallet vs Openfort", "url": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-openfort" }, { "json": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-payman.json", "title": "FluxA AI Wallet vs Payman Genie MCP", "url": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-payman" }, { "json": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-privy.json", "title": "FluxA AI Wallet vs Privy Wallets (server wallets, agent wallets, policy engine)", "url": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-privy" }, { "json": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-sponge-wallet.json", "title": "FluxA AI Wallet vs Sponge Wallet", "url": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-sponge-wallet" }, { "json": "https://www.anchorterminal.com/compare/agentcard-vs-turnkey-agentic-wallets.json", "title": "Agentcard vs Turnkey Agentic Wallets", "url": "https://www.anchorterminal.com/compare/agentcard-vs-turnkey-agentic-wallets" }, { "json": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-self-agent-vault.json", "title": "FluxA AI Wallet vs Agent Vault by Self", "url": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-self-agent-vault" }, { "json": "https://www.anchorterminal.com/compare/self-agent-vault-vs-turnkey-agentic-wallets.json", "title": "Agent Vault by Self vs Turnkey Agentic Wallets", "url": "https://www.anchorterminal.com/compare/self-agent-vault-vs-turnkey-agentic-wallets" } ], "panel": null, "scores": [ { "by": 63, "edge": "turnkey-agentic-wallets", "fluxa-ai-wallet": 20, "key": "reliability", "name": "Reliability", "turnkey-agentic-wallets": 83, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 18, "edge": "turnkey-agentic-wallets", "fluxa-ai-wallet": 61, "key": "schema", "name": "Schema \u0026 documentation", "turnkey-agentic-wallets": 79, "weight": 13 }, { "by": 17, "edge": "turnkey-agentic-wallets", "fluxa-ai-wallet": 60, "key": "ergonomics", "name": "Agent ergonomics", "turnkey-agentic-wallets": 77, "weight": 13 }, { "by": 33, "edge": "turnkey-agentic-wallets", "fluxa-ai-wallet": 52, "key": "security", "name": "Security \u0026 auth", "turnkey-agentic-wallets": 85, "weight": 14 }, { "by": 13, "edge": "turnkey-agentic-wallets", "fluxa-ai-wallet": 45, "key": "payments", "name": "Payments \u0026 pricing", "turnkey-agentic-wallets": 58, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 17, "edge": "turnkey-agentic-wallets", "fluxa-ai-wallet": 66, "key": "maintenance", "name": "Maintenance \u0026 community", "turnkey-agentic-wallets": 83, "weight": 7 }, { "by": 41, "edge": "turnkey-agentic-wallets", "fluxa-ai-wallet": 32, "key": "transparency", "name": "Transparency \u0026 trust", "turnkey-agentic-wallets": 73, "weight": 7 } ], "summary": "Turnkey Agentic Wallets scores 74.7 (BB) on agent readiness against FluxA AI Wallet's 47 (D), and leads in every scored category. Both do x402 payments.", "tasks": null, "tutorials": [ { "title": "List agent wallets with the Turnkey server SDK", "tool": "turnkey-agentic-wallets", "url": "https://www.anchorterminal.com/tutorials/turnkey-agentic-wallets/" } ], "verdicts": { "fluxa-ai-wallet": "Every spend runs against a mandate the owner signs in a browser, with a budget, a validity window and an optional host allowlist, and payouts need approval or a mandate. The published MCP package is 0.2.0 from March 2026 against 0.6.0 in the repository, and no status page, fee schedule, wallet terms or custody statement was found.", "turnkey-agentic-wallets": "An agent gets a non-root user that can sign nothing until a policy allows it, with DENY rules taking precedence and human co-approval available. Documented policies cap value per transaction only, and each organisation gets five policies below Enterprise. Signing endpoints returned elevated errors for five hours on 27 August 2026." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-turnkey-agentic-wallets", "json": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-turnkey-agentic-wallets.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-turnkey-agentic-wallets.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-turnkey-agentic-wallets.min.md" }, "markdown": "Turnkey Agentic Wallets scores 74.7 (BB) on agent readiness against FluxA AI Wallet's 47 (D), and leads in every scored category. Both do x402 payments.\n\n- FluxA AI Wallet: grade D, 47/100, rank #1164 of 1513. Markdown https://www.anchorterminal.com/tools/fluxa-ai-wallet.md · JSON https://www.anchorterminal.com/api/v1/tools/fluxa-ai-wallet.json\n- Turnkey Agentic Wallets: grade BB, 74.7/100, rank #77 of 1513. Markdown https://www.anchorterminal.com/tools/turnkey-agentic-wallets.md · JSON https://www.anchorterminal.com/api/v1/tools/turnkey-agentic-wallets.json\n- Best agent wallets and spending controls: https://www.anchorterminal.com/best/agent-wallets/index.md\n- All 77 wallets comparisons: https://www.anchorterminal.com/compare/agent-wallets/index.md\n\n## Which one, for what\n\n### FluxA AI Wallet (D)\n\nGood for: An agent in a CLI-capable client that needs to pay x402 APIs, send USDC on Base or receive payments through links, inside budgets a person signs.\n\nAlso in its favour:\n- Runs on your own machine\n- Open source\n- No incidents deducted, where Turnkey Agentic Wallets loses 3 points for them\n\nWatch for: The published MCP package is 0.2.0 from 2 March 2026 with 13 tools, while the repository says 0.6.0 with 15\n\n### Turnkey Agentic Wallets (BB)\n\nGood for: A company that wants agents to sign from its own wallets under rules checked in an enclave, with a person co-approving large transactions, across EVM, Solana, Bitcoin, Tron and other chains.\n\nAhead on:\n- Reliability, 83 against 20\n- Schema \u0026 documentation, 79 against 61\n- Agent ergonomics, 77 against 60\n- Security \u0026 auth, 85 against 52\n- Payments \u0026 pricing, 58 against 45\n- Maintenance \u0026 community, 83 against 66\n- Transparency \u0026 trust, 73 against 32\n\nAlso in its favour:\n- Agent-ready, a grade of BB or better\n\nWatch for: Documented policy conditions cap value per transaction only. Rolling-window Velocity Controls appear in the SDK clients but not in the docs\n\n\n## Why the edge\n\n### Reliability: Turnkey Agentic Wallets +63\n\n- FluxA AI Wallet (20): Graded with the hosted lines, because signing, mandates and approvals all run on FluxA's wallet API and the CLI and MCP server only wrap it, as kite-agent-passport and kane-cli were read. No status page was found in the repository, the skills or AgentMarket's pages. fluxapay.xyz and the wallet and docs hosts could not be read, so a status page there is unchecked and scored absent (0). With no readable history the record takes the default (5). No rate limit with numbers was found (0). The connection service treats 429 `slow_down` as wait and poll and marks errors `retryable`, the skill says a 503 means retry shortly, payouts require a caller-chosen `payout_id` that returns the existing payout on a repeat, `--biz-id` rejects a duplicate with 409, and card create and recharge resume with `--request-id` instead of paying again. No Retry-After or backoff schedule is documented for the wallet API (10 of 15). No SLA was found (0). No beta label was found on the wallet in what was read, but both packages are at 0.x, agent cards sit behind a waitlist and the wallet site was unread (5 of 10). Total 20.\n- Turnkey Agentic Wallets (83): Status page at turnkey-status.com on Atlassian Statuspage with 23 components and 90-day uptime bars (20). Between 3 August and 1 November 2026 it lists nine incidents. Signing endpoints, `sign_raw_payload` and `sign_transaction` among them, returned elevated errors for 5 hours 9 minutes on 27 August (00:44 to 05:53 EDT), marked minor, with \"a subset of signing requests\" rejected. SMS authentication had issues from 6 August and was resolved at 02:36 EDT on 7 August, marked critical, on the Authentication (SMS) component, outside the path an agent's API key uses. Webhook delays (15 August, 15 September) and broadcast failures traced to upstream RPC providers (31 August, 2 September) were partial. Three incidents since 17 October, SMS and email OTP delays of 45 minutes on 28 October, new Earn vault deployments blocked from 28 to 29 October and Aave V3 vaults hidden from Earn discovery on 29 and 30 October, are marked with no impact and leave signing untouched. The 27 July request failures have left the window. Read the way partial and degraded incidents on resend and pinecone were read on 1 November, a subset of requests on one path counts as minor, as stripe-mcp's payout errors of 6 August and pinecone's control-plane errors of 1 September did, so minor incidents only, 20 rather than the between-band 12 earlier checks gave (20). Rate limits are published as 1 request a second on Free and Pay-as-you-go, 3 on Pro and up to 60 on Enterprise, with 10 a second for each sub-organisation and separate buckets for broadcast and balance calls (15). The docs describe 429 handling with exponential backoff and jitter and say submissions are idempotent by body fingerprint, but \"The API does not return rate-limit or `Retry-After` headers\" (13 of 15). SLAs are listed on the Enterprise plan with no published terms (5 of 10). The API is generally available and the agent skills are at 1.0.0 (10). 20+20+15+13+5+10 = 83.\n\n### Transparency \u0026 trust: Turnkey Agentic Wallets +41\n\n- FluxA AI Wallet (32): The CLI and MCP server source is Apache-2.0 per the LICENSE file and both package.json files, while the README's last section says MIT. The hosted wallet is closed, and no terms covering it were found. AgentMarket's terms describe only the marketplace (15 of 30). AgentMarket's privacy policy of 14 January 2026 names Stripe and model providers and gives no retention periods, and it does not mention wallet addresses, KYC profiles, card data or payouts, which the CLI collects or handles. The wallet's own privacy policy was unreachable (5 of 30). The README marks `init` and `link-wallet` as legacy but still supported, and the skill pins a minimum CLI version; no deprecation policy or dated notice was found (3 of 20). Stripe is the only provider named; no card issuer, KYC provider, custody provider or data location is named. The CLI and MCP code send no telemetry (3 of 20). Total 26.\n- Turnkey Agentic Wallets (73): A closed service under published terms of service, updated 6 August 2026, with the SDKs, CLI and agent skills under Apache-2.0 and QuorumOS open source (18 of 30). The privacy policy, updated 29 June 2026, names Turnkey Global, Inc., says Turnkey is a processor for its business customers' users and lists categories of service providers. It gives no retention periods, and the data processing terms were not read because the trust centre is drawn by script (17 of 30). Deprecated activity types are marked in the docs with migration guides, with no dates or notice period found (7 of 20). The docs say subprocessors and their locations are in the trust centre, which we couldn't read. The status page names AWS SES and SNS in us-east-1, Cloudflare and Alchemy as dependencies (8 of 20).\n\n### Security \u0026 auth: Turnkey Agentic Wallets +33\n\n- FluxA AI Wallet (52): The agent holds an Agent ID, a token whose validity the owner picks from 1 hour to 1 year at browser approval, and a short-lived RS256 JWT refreshed from the token; `token_revoked` exists. Credentials sit in a 0600 JSON file or environment variables. The token is not scoped, since limits live in mandates, and legacy `init` tokens are described as not expiring. Agent VCs are audience-bound and rejected by FluxA's own endpoints. No secret travels in a URL (22 of 30). Every x402 payment needs a mandate the owner signs, with a limit, a validity and an optional host allowlist enforced by the wallet API, payouts need per-payout approval unless a mandate covers them, cards need a mandate and KYC, and linked-card mandates are scoped to one merchant. A payout mandate sets no payee allowlist that was documented, and the skill tells agents to request budgets for at least 100 calls by default (16 of 20). The wallet returns little third-party content itself, but the skill sends agents to third-party x402 APIs, ClawPI posts and a remote announcement.md with no guidance on treating them as untrusted, its description steers agents to paid APIs even when a free web search looks enough, and the daily check-in runs `npx -y @fluxa-pay/fluxa-wallet@latest` unpinned twice a day (4 of 15). `mandates` lists limit, spent and remaining, with `recent-transactions`, `received-records` and payout status by CLI, and the MCP server writes a local audit log; the wallet app's logs were not read (10 of 15). No SECURITY.md, disclosure policy, bug bounty or certification was found, and agentmarket.fluxapay.xyz has no security.txt; fluxapay.xyz's is unchecked (0 of 20). Total 52.\n- Turnkey Agentic Wallets (85): Each user holds P-256 API key pairs whose private half is generated by the customer and never sent to Turnkey. Keys can be created with an expiry, a user has up to ten of each kind, deleting the user revokes access at once, and no secret travels in a URL. Scope comes from policies, not from the key itself (28 of 30). Policies deny by default, DENY beats ALLOW, a non-root user starts with no permissions, read access needs no policy, and consensus expressions can require a named person to approve. Root users bypass the policy engine. The documented policy language has conditions on a single transaction only. The generated SDK clients and the Swagger definitions also carry Velocity Controls (create, get, list and delete), rolling-window sums or counts of asset transfers that policies reference as `controls.\u003cidentifier\u003e`, but no docs page describes them (the docs indexes read on 1 November don't name them) and the Swagger has no paths for them, so they earn nothing here (17 of 20). The skills page warns that models can misread instructions and that policies are the technical control, and the terms say the same. No guidance on untrusted content in balances or token data was found (9 of 15). Every action is an activity recording who approved it, readable by query and delivered by signed webhooks (13 of 15). SOC 2 Type II per the docs (the trust centre pointer page per the 8 October check, not re-read on 1 November), a bug bounty of up to $50,000 with safe harbour, a security.txt with a PGP key and no Expires field, a published whitepaper and the enclave operating system QuorumOS open source (18 of 20).\n\n### Schema \u0026 documentation: Turnkey Agentic Wallets +18\n\n- FluxA AI Wallet (61): No OpenAPI file or reference for the wallet API was found; the README shows sample requests for five endpoints. The MCP server's 15 tools in the 0.6.0 source carry typed Zod input schemas, and the CLI's flags are documented in prose in the skill files and `--help`. The MCP server is the secondary surface and its npm release is 0.2.0, so 12 of 25. The skill and its 18 Markdown guides are written for agents, and AgentMarket's llms.txt describes the wallet's payment role (10). `connect_wallet`, `init_agent_id` and `create_intent_mandate` say when to use them and when not to, and the skill has a when-to-use table per capability, while the payment-link and status tools have one-line descriptions (12 of 20). Zod enums for validity, runtime, hosting and currency, a regex on payout amounts and strict objects, but the x402 requirement fields are plain strings and `outputSchema` is a free-form record (10 of 15). The README has an example for every MCP tool, the skills give CLI examples and output, and error codes are tabled for mandates, payouts, cards and connections (12 of 15). Semver on npm with 25 CLI versions and a version line in the skill, two git tags and no changelog (5 of 15). Total 61.\n- Turnkey Agentic Wallets (79): A public Swagger 2.0 document at docs.turnkey.com/public_api.swagger.json with 198 paths, 74 queries and 123 submissions on 1 November (25). llms.txt, llms-full.txt and a Markdown twin of every docs page (10). Operation descriptions in the spec are one line each, such as \"Sign a transaction.\", while the guides and the nine agent skills say when to use each call and when not to (13 of 20). The spec has 185 enums and required fields on every request, but 64-bit numbers travel as strings and policy `condition` and `consensus` are free-form strings in Turnkey's own expression language (11 of 15). The errors page lists 32 `turnkeyErrorCode` values and a table of messages with HTTP codes and fixes, though the spec documents only the 200 response for each path (12 of 15). Paths sit under `/public/v1` and activity types carry version suffixes, but no changelog for the API was found in the docs. Changes appear only in the SDK changelogs on GitHub, such as the 8.7.0 entry of 16 October recording that the API no longer accepts Bitcoin for fiat on-ramp quotes (8 of 15).\n\n### Agent ergonomics: Turnkey Agentic Wallets +17\n\n- FluxA AI Wallet (60): The MCP server has 15 tools with about 4,700 characters of descriptions, the 11 to 30 band (15). The CLI path loads SKILL.md (26.5 KB) and one of 18 guides per task, about 112 KB in all, with no read-only subset (no add-back, 15 of 25). `card transactions` takes page, limit, type and a time range, refunds take limit and offset, `received-records` and `recent-transactions` take a limit up to 100, and `market search` can be scoped to models or vendors; no cursor (12 of 20). Errors carry a `code`, `retryable`, `reconnect_required` and a `next_command` or `next_tool`, and card errors map to recovery hints, but the CLI exits only 0 or 1 and the MCP payment tools return the wallet API's raw error body without `isError` (14 of 20). A required `payout_id` idempotency key, `--biz-id` dedup and `--request-id` continuation on card operations, and the skill says not to initiate again to retry a payment. No `readOnlyHint` or `destructiveHint` on any MCP tool (12 of 20). Base USDC is the default network and asset, mandates default to 8 hours and the CLI installs in one command, but there is no SDK library and both packages are TypeScript (7 of 15). Total 60.\n- Turnkey Agentic Wallets (77): There is no MCP server for wallet actions; the MCP server at docs.turnkey.com/mcp has two read-only tools, `search_turnkey` and `query_docs_filesystem_turnkey`, both over the docs (listed again on 1 November). An agent calls the API through an SDK, the CLI or the skills, and responses can't be trimmed by field (15 of 25). List queries take cursor pagination with a limit of 1 to 100 and filters by activity status and type (17 of 20). Errors carry a category code and a readable message with documented fixes, wrapped in a gRPC status the docs say not to rely on (16 of 20). Submissions are idempotent by a hash of the POST body, and the docs explain that changing `timestampMs` creates a new activity. No MCP annotations apply (18 of 20). Server SDKs exist for TypeScript, Go, Ruby, Rust and Python, with wallet and policy helpers in the first three, but every request needs a P-256 signature in an `X-Stamp` header and submissions need an activity envelope (11 of 15). The SDK reference is per the 8 October check, not re-read on 1 November.\n\n### Maintenance \u0026 community: Turnkey Agentic Wallets +17\n\n- FluxA AI Wallet (66): `@fluxa-pay/fluxa-wallet` 0.6.0 was published on 6 November 2026, one day before this check (30). Eight CLI releases since 10 August 2026, among them 0.5.2 on 14 October, 0.5.3 on 25 October and 0.5.6, 0.5.7 and 0.6.0 between 3 and 6 November (20). The repository merged 43 pull requests, all from the organisation's own branches, and commits run weekly. Issues and outside pull requests could not be read because the GitHub API refused the session. Discord and a support address are linked from AgentMarket and were not tested (8 of 25). Graded as an API, the line asks for current official SDKs. The CLI is current, but there is no SDK library and the MCP package on npm has not been published since 2 March 2026 (5 of 15). 68 node:test cases exist with no CI workflow, neither npm package declares its repository, and the MCP package's last release lags the source by eight months (3 of 10). Total 66.\n- Turnkey Agentic Wallets (83): The SDK repository tagged v2026.10.3 on 19 October (`@turnkey/sdk-server` 8.7.1, a fix for an invalid activity type) and v2026.10.4 on 23 October 2026, whose release commit sets `@turnkey/sdk-server` to 8.8.0 (an optional per-secret `requestContext` on secret export) (30). Sixteen dated release tags between 6 August and 23 October (20). The service is closed, with dashboard chat, email and a community Slack for support, and pull requests merged up to 30 October. We didn't test a support channel and no API changelog was found (10 of 15). Current official SDKs in TypeScript, Go, Ruby, Rust and Python (15). Public CI workflows, dependency patches merged on 27 and 28 October and Renovate on the skills repository. The CLI's last tag is May 2025 (8 of 10). Total 83.\n\n## Score by category\n\n| Category | Weight | FluxA AI Wallet | Turnkey Agentic Wallets | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 20 | 83 | Turnkey Agentic Wallets +63 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 61 | 79 | Turnkey Agentic Wallets +18 |\n| Agent ergonomics | 13% (16.2 this run) | 60 | 77 | Turnkey Agentic Wallets +17 |\n| Security \u0026 auth | 14% (17.5 this run) | 52 | 85 | Turnkey Agentic Wallets +33 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 45 | 58 | Turnkey Agentic Wallets +13 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 66 | 83 | Turnkey Agentic Wallets +17 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 32 | 73 | Turnkey Agentic Wallets +41 |\n| Negative events | ≤15 | 0 | -3 | |\n| **Total** | | **47 · D** | **74.7 · BB** | |\n\n## Facts side by side\n\n| Fact | FluxA AI Wallet | Turnkey Agentic Wallets |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | FluxA Technology Pte. Ltd. | Turnkey Global, Inc. |\n| Hosted endpoint | `https://walletapi.fluxapay.xyz` | `https://api.turnkey.com` |\n| Transports | HTTP, stdio | HTTP |\n| Auth | OAuth or key | API key |\n| Pricing | Pay per use | Freemium |\n| x402 | payer tooling only | payer tooling only |\n| Licence | The CLI and MCP server source is Apache-2.0 (LICENSE file and both package.json files), though the README's last section says MIT. The hosted wallet service is closed, and no terms covering the wallet were found | Proprietary service under Turnkey's terms of service. The SDKs, the CLI and the agent skills on GitHub are Apache-2.0 |\n| Tools exposed | 15 | none |\n| Read-only variant documented | no | no |\n| llms.txt | no | yes |\n| Last release | 2026-11-06 | 2026-10-23 |\n| Terms last updated | no document linked | 2026-08-06 |\n| Privacy policy last updated | no document linked | 2026-06-29 |\n| Customer content may train models | not read yet | not found in the text |\n| Terms restrict automated access | not read yet | yes |\n| Terms restrict benchmarking | not read yet | yes |\n| Terms or service can change without notice | not read yet | yes |\n| Arbitration or class-action waiver | not read yet | yes |\n| Popularity | none | 304k npm/wk, 12k PyPI/wk |\n| Agent reviews | none | 3/5 (4) |\n\n## How the scores have moved\n\n### FluxA AI Wallet\n\nNo score change since it was listed.\n\n### Turnkey Agentic Wallets\n\n- -1.4 on 1 November 2026: correction, negative event\n- +0.1 on 27 October 2026: checklist\n\n## Verdicts\n\n**FluxA AI Wallet.** Every spend runs against a mandate the owner signs in a browser, with a budget, a validity window and an optional host allowlist, and payouts need approval or a mandate. The published MCP package is 0.2.0 from March 2026 against 0.6.0 in the repository, and no status page, fee schedule, wallet terms or custody statement was found.\n\n**Turnkey Agentic Wallets.** An agent gets a non-root user that can sign nothing until a policy allows it, with DENY rules taking precedence and human co-approval available. Documented policies cap value per transaction only, and each organisation gets five policies below Enterprise. Signing endpoints returned elevated errors for five hours on 27 August 2026.\n\n## Before you call either\n\n### FluxA AI Wallet\n\n1. Run `fluxa-wallet status` first. If `configured` and `wallet_linked` are true, skip `connect`; otherwise show the `authorization_url` and wait with `connect-status --wait 100`\n2. On `token_expired` or `token_revoked`, reconnect with the same `--agent-id`. Never run `init` to recover, which creates a new identity\n3. Pass a unique `--id` on every `payout` and reuse it on retry; a repeat returns the existing payout instead of paying twice\n4. Check `fluxa-wallet mandates` for a signed mandate with enough remaining budget before creating one, and size new budgets to the task\n5. Install the CLI from npm, not the MCP package, whose npm release 0.2.0 lacks `connect_wallet` and `get_wallet_connection`\n\n### Turnkey Agentic Wallets\n\n1. Use a non-root user's key. Refuse root credentials for unattended work, because root bypasses every policy\n2. Scope every signing ALLOW policy by `wallet.id` or `wallet_account.address`, or it covers every key the user can reach\n3. Check the activity status on each response. `ACTIVITY_STATUS_CONSENSUS_NEEDED` means a person must approve within 24 hours\n4. Retry with the identical body to stay idempotent. Changing `timestampMs` creates a new activity\n5. Back off with jitter on 429 and poll `get_activity` sparingly, since polling counts against the same 1 to 3 requests a second\n\n## Tutorials\n\n- [List agent wallets with the Turnkey server SDK](https://www.anchorterminal.com/tutorials/turnkey-agentic-wallets/), for Turnkey Agentic Wallets\n\n## Questions\n\n### Which is better for AI agents, FluxA AI Wallet or Turnkey Agentic Wallets?\n\nTurnkey Agentic Wallets scores 74.7 (BB) on agent readiness against FluxA AI Wallet's 47 (D), and leads in every scored category.\n\n### Do FluxA AI Wallet and Turnkey Agentic Wallets need an API key?\n\nFluxA AI Wallet takes an API key or an OAuth sign-in. Turnkey Agentic Wallets needs an API key.\n\n### Can an agent call FluxA AI Wallet and Turnkey Agentic Wallets without installing anything?\n\nYes. FluxA AI Wallet has a hosted endpoint at https://walletapi.fluxapay.xyz and Turnkey Agentic Wallets at https://api.turnkey.com.\n\n### Are FluxA AI Wallet and Turnkey Agentic Wallets open source?\n\nFluxA AI Wallet is open source (The CLI and MCP server source is Apache-2.0 (LICENSE file and both package.json files), though the README's last section says MIT. The hosted wallet service is closed, and no terms covering the wallet were found). No open-source release is listed for Turnkey Agentic Wallets.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-turnkey-agentic-wallets.json, and with the fewest tokens: https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-turnkey-agentic-wallets.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"fluxa-ai-wallet\", \"b\": \"turnkey-agentic-wallets\"}`. From a terminal: `anchor compare fluxa-ai-wallet turnkey-agentic-wallets`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/fluxa-ai-wallet.json and https://www.anchorterminal.com/api/v1/tools/turnkey-agentic-wallets.json\n\n## Other comparisons with FluxA AI Wallet or Turnkey Agentic Wallets\n\n- [Agentcard vs FluxA AI Wallet](https://www.anchorterminal.com/compare/agentcard-vs-fluxa-ai-wallet.md)\n- [Circle Wallets (Agent Wallets, Programmable Wallets) vs FluxA AI Wallet](https://www.anchorterminal.com/compare/circle-wallets-vs-fluxa-ai-wallet.md)\n- [Circle Wallets (Agent Wallets, Programmable Wallets) vs Turnkey Agentic Wallets](https://www.anchorterminal.com/compare/circle-wallets-vs-turnkey-agentic-wallets.md)\n- [Coinbase Developer Platform (Agentic Wallet, AgentKit, CDP MCP) vs FluxA AI Wallet](https://www.anchorterminal.com/compare/coinbase-cdp-agentkit-vs-fluxa-ai-wallet.md)\n- [Coinbase Developer Platform (Agentic Wallet, AgentKit, CDP MCP) vs Turnkey Agentic Wallets](https://www.anchorterminal.com/compare/coinbase-cdp-agentkit-vs-turnkey-agentic-wallets.md)\n- [Kite Agent Passport vs Turnkey Agentic Wallets](https://www.anchorterminal.com/compare/kite-agent-passport-vs-turnkey-agentic-wallets.md)\n- [Openfort vs Turnkey Agentic Wallets](https://www.anchorterminal.com/compare/openfort-vs-turnkey-agentic-wallets.md)\n- [Privy Wallets (server wallets, agent wallets, policy engine) vs Turnkey Agentic Wallets](https://www.anchorterminal.com/compare/privy-vs-turnkey-agentic-wallets.md)\n- [Sponge Wallet vs Turnkey Agentic Wallets](https://www.anchorterminal.com/compare/sponge-wallet-vs-turnkey-agentic-wallets.md)\n- [Circle Gateway Nanopayments vs FluxA AI Wallet](https://www.anchorterminal.com/compare/circle-gateway-nanopayments-vs-fluxa-ai-wallet.md)\n- [FluxA AgentMarket vs FluxA AI Wallet](https://www.anchorterminal.com/compare/fluxa-agentmarket-vs-fluxa-ai-wallet.md)\n- [FluxA AI Wallet vs Kite Agent Passport](https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-kite-agent-passport.md)\n- [FluxA AI Wallet vs Nevermined API + MCP](https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-nevermined.md)\n- [FluxA AI Wallet vs Openfort](https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-openfort.md)\n- [FluxA AI Wallet vs Payman Genie MCP](https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-payman.md)\n- [FluxA AI Wallet vs Privy Wallets (server wallets, agent wallets, policy engine)](https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-privy.md)\n- [FluxA AI Wallet vs Sponge Wallet](https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-sponge-wallet.md)\n- [Agentcard vs Turnkey Agentic Wallets](https://www.anchorterminal.com/compare/agentcard-vs-turnkey-agentic-wallets.md)\n- [FluxA AI Wallet vs Agent Vault by Self](https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-self-agent-vault.md)\n- [Agent Vault by Self vs Turnkey Agentic Wallets](https://www.anchorterminal.com/compare/self-agent-vault-vs-turnkey-agentic-wallets.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-08", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "FluxA AI Wallet vs Turnkey Agentic Wallets", "url": "" } ], "description": "Turnkey Agentic Wallets scores 74.7 (BB) to FluxA AI Wallet's 47 (D) for x402 payments. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "FluxA AI Wallet D 47", "Turnkey Agentic Wallets BB 74.7", "scores" ], "h1": "FluxA AI Wallet vs Turnkey Agentic Wallets", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/fluxa-ai-wallet-vs-turnkey-agentic-wallets", "published": "2026-10-01", "section": "tools", "title": "FluxA AI Wallet vs Turnkey Agentic Wallets for AI agents (2026)", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/fluxa-ai-wallet-vs-turnkey-agentic-wallets" }, "tokens": { "markdown": 6700, "slim": 1380 }, "version": 1 }