# FluxA AI Wallet (slim)

> FluxA AI Wallet is a hosted agent wallet from FluxA Technology that signs x402 (EIP-3009) USDC payments on Base within budgets a person approves, reached through the fluxa-wallet CLI, a stdio MCP server and agent skills.

- Full: https://www.anchorterminal.com/tools/fluxa-ai-wallet.md (~10,850 tokens) · this version ~2,930 tokens · JSON https://www.anchorterminal.com/tools/fluxa-ai-wallet.json · canonical https://www.anchorterminal.com/tools/fluxa-ai-wallet
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-08 · pricing https://www.anchorterminal.com/tools/fluxa-ai-wallet#pricing · reviews https://www.anchorterminal.com/tools/fluxa-ai-wallet#reviews
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

**D · 47/100 · rank #1164 of 1513 · #11 in Agent wallets & spending controls · not agent-ready · confidence low**


Assessment: Every spend runs against a mandate the owner signs in a browser, with a budget, a validity window and an optional host allowlist, and payouts need approval or a mandate. The published MCP package is 0.2.0 from March 2026 against 0.6.0 in the repository, and no status page, fee schedule, wallet terms or custody statement was found.

## Facts

- Kind: HTTP API · vendor: FluxA Technology Pte. Ltd. · category: Agent wallets & spending controls · legal entity: FluxA Technology Pte. Ltd. · provenance 38/100
- Endpoint: `https://walletapi.fluxapay.xyz` (HTTP, stdio)
- Auth: OAuth or key · pricing: Pay per use · x402: payer tooling only · licence: The CLI and MCP server source is Apache-2.0 (LICENSE file and both package.json files), though the README's last section says MIT. The hosted wallet service is closed, and no terms covering the wallet were found
- Benchmark probes: not run yet, so Performance is pending
- Live, from our pollers (not part of the score): up at 2026-11-08 14:47 UTC · uptime 30 days 100.0% (90 probes) · p50 542 ms · p95 603 ms over 24 hours
- Surface graded: The hosted FluxA wallet (walletapi.fluxapay.xyz, agentid.fluxapay.xyz and the approval pages on agentwallet.fluxapay.xyz and wallet.fluxapay.xyz) as an agent reaches it through the `fluxa-wallet` CLI 0.6.0, with the stdio MCP server described beside it. Read on 7 November 2026 from a full clone of FluxA-Agent-Payment/FluxA-AI-Wallet-MCP read as text (source, README, skills, docs, tests), the npm registry documents and tarballs of both packages read as text, and AgentMarket's home, about, terms, privacy, pricing, getting-started and llms.txt pages. Nothing was installed or run, no wallet was connected and no API was called
- Kind: Listed as `http-api` and read with the hosted lines. The repository is named for the MCP server and its README opens with it, but the 0.6.0 skill tells agents to use the CLI and says agents never write payment code, AgentMarket's llms.txt says payment is settled by the CLI, the CLI has about 60 commands (cards, linked cards, refunds, balances, the marketplace) against the MCP server's 15 tools, and the CLI is published on npm at 0.6.0 while the MCP package stopped at 0.2.0. Signing, mandates and approvals all happen on FluxA's servers, which the CLI wraps
- Custody: Not stated. The README says no private keys are stored or managed locally and that FluxA Wallet signs every authorisation; the agent guide calls it managed wallet infrastructure; the skill calls it a co-wallet for the user's wallet. No page read says whether FluxA, a provider or the user holds the keys
- Spending controls: Intent mandates with a purpose in plain words, a limit in atomic units, a validity (MCP default 28,800 seconds), a category and an optional `hostAllowlist`, signed by the owner. The wallet API tracks spent, pending and remaining amounts and refuses payments with `mandate_not_signed`, `mandate_expired`, `mandate_budget_exceeded` or `mandate_insufficient_budget`. A failed call keeps its price reserved on the mandate for about 6 minutes, per the skill. Linked-card (`CARD_USD`) mandates are scoped to one merchant name, HTTPS URL and country
- Approvals: The owner approves the agent connection, each mandate and each payout without a mandate in a browser. A signed mandate lets payouts and x402 payments run without further approval. The skill says top-ups and card payments still need an explicit yes in chat
- Revocation: Tokens carry an owner-chosen validity, and the API answers `token_revoked` for revoked tokens; where the owner revokes was not read, since the wallet site could not be fetched. AgentMarket `fxa_live_` keys are revoked with `fluxa-wallet market keys revoke <id>`. Legacy `init` tokens are described in the README as not expiring
- Chains and assets: USDC on Base (chain 8453) and Base Sepolia for x402 and payouts. The CLI's `balance` reports USDC, XRP and credits, while the skill says payments support only Card and USDC since CLI 0.5.7; the MCP mandate tool still lists USDC, XRP and FLUXA_MONETIZE_CREDITS
- Machine payments: x402 v1 and v2 payloads, `exact` scheme only, signed as EIP-3009 authorisations by the wallet API and returned as the payment header for the agent to retry with. Payment links on wallet.fluxapay.xyz can be paid over x402. AgentMarket Balance top-ups go over x402 in Base USDC
- Cards: Prepaid agent cards issued against a mandate after a KYC profile (name, email, phone, address), behind a waitlist (`card_waitlist_required`), with balance, transactions, 3DS challenges, recharge and withdrawal commands; `card details` reveals PAN, CVV and expiry. Linked-card checkout pays a merchant's payment attempt with the user's own card under a `CARD_USD` mandate. A separate agentic-checkout skill (0.4.0) fills Shopify checkouts with Playwright from card data in a local JSON file
- Payouts and refunds: `payout` sends USDC on Base to an address with a required idempotency `--id`, optional `--mandate`, `--biz-id` (duplicates answer 409) and `--description`; statuses run from `pending_authorization` to `succeeded`, `failed` or `expired`, and settled payouts cannot be reversed. Payment-link refunds, full or partial, are created, listed, read and cancelled from the CLI; cancelling a settled refund answers 410, per TEST-CLI-REFUND-PAYOUT.md (a test plan in Chinese)
- MCP server: Stdio only, run from the repository with `npm run build` and `npm start`; the docs give no npx or client config. 15 tools in the 0.6.0 source with Zod input schemas and no annotations, namely connect_wallet, get_wallet_connection, init_agent_id, request_x402_payment, request_x402_v3_payment, create_intent_mandate, get_mandate_status, request_payout, get_payout_status, get_agent_status and five payment-link tools. About 4,700 characters of descriptions. npm 0.2.0 has 13 of them, without the two connection tools. It writes a local `audit.log` of payment requests
- CLI: `@fluxa-pay/fluxa-wallet` 0.6.0, Node 18 or later, one bundled file with no runtime dependencies or install scripts. JSON output with `success`, `data`, `code` and `error`, exit code 0 or 1. It calls only fluxapay.xyz hosts (agentid, walletapi, wallet, agentwallet, agentcard, agentmarket, router)
- Agent identity: Agent IDs with a token and an RS256 JWT. `agent-vc` issues a verifiable credential bound to one audience and challenge with a TTL up to 24 hours, which FluxA's own endpoints reject, so it cannot be replayed against the wallet
- Errors: Connection errors carry `code`, `retryable` and `next_command` or `next_tool`; credential errors carry `reconnect_required` and the Agent ID; card errors map about 20 codes to recovery hints. The MCP payment tools pass the wallet API's error body through as text and mark only missing-connection errors with `isError`
- Status: No status page, rate limit or SLA was found in the repository or on AgentMarket's pages. fluxapay.xyz and the wallet and docs hosts could not be read
- Releases: npm `@fluxa-pay/fluxa-wallet-mcp` 0.1.0 on 11 November 2025 to 0.2.0 on 2 March 2026 (8 versions). `@fluxa-pay/fluxa-wallet` 0.2.0 on 2 March 2026 to 0.6.0 on 6 November 2026 (25 versions, 8 since 10 August). A commit of 4 November 2026 says it released the CLI, MCP and skill at 0.5.6, and npm has no MCP release after 0.2.0. No changelog file

- Scores: Reliability 20, Performance pending, Schema & documentation 61, Agent ergonomics 60, Security & auth 52, Payments & pricing 45, Task success pending, Maintenance & community 66, Transparency & trust 32 · total over the 7 assessed categories
- Why: Reliability, Graded with the hosted lines, because signing, mandates and approvals all run on FluxA's wallet API and the CLI and MCP server only wrap it… · Schema & documentation, No OpenAPI file or reference for the wallet API was found; the README shows sample requests for five endpoints. · Agent ergonomics, The MCP server has 15 tools with about 4,700 characters of descriptions, the 11 to 30 band (15). · Security & auth, The agent holds an Agent ID, a token whose validity the owner picks from 1 hour to 1 year at browser approval, and a short-lived RS256 JWT r… · Payments & pricing, Payment platforms and wallets take the highest step that applies on the 40-point protocol line. · Maintenance & community, `@fluxa-pay/fluxa-wallet` 0.6.0 was published on 6 November 2026, one day before this check (30). · Transparency & trust, The CLI and MCP server source is Apache-2.0 per the LICENSE file and both package.json files, while the README's last section says MIT.
- Sources: 20, open questions: 14, both in the full twin
- Capabilities: payments.x402, wallet.spend-limits, wallet.onchain, payments.card, auth.agent-identity
- JSON: https://www.anchorterminal.com/api/v1/tools/fluxa-ai-wallet.json
- Its vendor verifies the listing with `verify_listing` or `POST https://www.anchorterminal.com/api/v1/verify` (the full twin says how); no effect on the grade.
- Support: Discord https://discord.gg/fluxapay; support.fluxapay@fluxapay.xyz; https://docs.fluxapay.xyz/; https://agentwallet.fluxapay.xyz/; more in the full twin

## Before you call it

1. Run `fluxa-wallet status` first. If `configured` and `wallet_linked` are true, skip `connect`; otherwise show the `authorization_url` and wait with `connect-status --wait 100`
2. On `token_expired` or `token_revoked`, reconnect with the same `--agent-id`. Never run `init` to recover, which creates a new identity
3. Pass a unique `--id` on every `payout` and reuse it on retry; a repeat returns the existing payout instead of paying twice
4. Check `fluxa-wallet mandates` for a signed mandate with enough remaining budget before creating one, and size new budgets to the task
5. Install the CLI from npm, not the MCP package, whose npm release 0.2.0 lacks `connect_wallet` and `get_wallet_connection`

## Connect

```bash
npm install -g @fluxa-pay/fluxa-wallet
```
Full config and headless snippets are in the full page. Through letme (picks today, calling later): https://letme.dev/fluxa-ai-wallet

## Similar tools

| Tool | Grade | Score | Shared capabilities | Slim |
| --- | --- | --- | --- | --- |
| Kite Agent Passport | D | 53 | wallet.onchain, wallet.spend-limits, payments.x402, payments.card, auth.agent-identity | https://www.anchorterminal.com/tools/kite-agent-passport.min.md |
| Sponge Wallet | E | 43.5 | wallet.onchain, wallet.spend-limits, payments.x402, payments.card | https://www.anchorterminal.com/tools/sponge-wallet.min.md |
| Turnkey Agentic Wallets | BB | 74.7 | wallet.onchain, wallet.spend-limits, payments.x402 | https://www.anchorterminal.com/tools/turnkey-agentic-wallets.min.md |
| Circle Wallets (Agent Wallets, Programmable Wallets) | BB | 72.4 | wallet.onchain, wallet.spend-limits, payments.x402 | https://www.anchorterminal.com/tools/circle-wallets.min.md |
| Privy Wallets (server wallets, agent wallets, policy engine) | BB | 72.3 | wallet.onchain, wallet.spend-limits, payments.x402 | https://www.anchorterminal.com/tools/privy.min.md |


## Panel reviews (0, desk reviews from public material, no calls made)