{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-04", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "tool": { "slug": "bitget", "name": "Bitget", "vendor": "BTG Technology Holdings Limited", "vendorUrl": "https://www.bitget.com", "kind": "http-api", "category": "crypto-exchanges", "summary": "Bitget is a centralised crypto exchange for spot, margin, futures, earn and tokenised stocks, reached through its Unified Trading Account v3 REST and WebSocket API and an Agent Hub toolkit with a stdio MCP server, CLI and agent skills.", "url": "https://www.anchorterminal.com/tools/bitget", "markdownUrl": "https://www.anchorterminal.com/tools/bitget.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/bitget.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/bitget.json", "dns": "bitget.grade.anchorterminal.com", "repo": "https://github.com/Bitget-AI/agent-mcp", "transports": [ "stdio" ], "packages": [ { "registry": "npm", "name": "@bitget-ai/bitget-agent-mcp" }, { "registry": "npm", "name": "bitget-mcp-server" } ], "auth": "api-key", "authNotes": "API key, system-generated secret and user-set passphrase minted under API Key Management after a browser sign-up and identity verification, up to 50 keys per UID, each with read or read-and-write permission, signed per request with HMAC-SHA256 or RSA over timestamp, method, path and body in the ACCESS-KEY, ACCESS-SIGN, ACCESS-TIMESTAMP and ACCESS-PASSPHRASE headers. Binding an IP is recommended, not required. Sub-account keys carry trade or management permission, read-only or read-write, once the main account enables key management for them. Demo keys are minted in demo mode and sent with the paptrading header set to 1 (https://www.bitget.com/legacy-docs/uta/guide, checked 2026-11-03).", "pricing": "usage", "pricingNotes": "The API and the Agent Hub packages cost nothing; trades carry Bitget's fees. Base rates are 0.1 per cent maker and taker on spot and 0.02 per cent maker and 0.06 per cent taker on futures before VIP tiers or the BGB discount, which applies to spot only at a rate the article says to read on the live schedule. The fee page draws its table by script (https://www.bitget.com/support/articles/12560603892734, 20 August 2026, checked 2026-11-03).", "priceSummary": "0.1% fee", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the UTA docs, the Agent Hub READMEs, the SDK's openapi.yaml or the fee article (checked 2026-11-03).", "endpoints": [] }, "toolCount": 14, "popularity": { "githubStars": 234, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-03" }, "docsUrl": "https://www.bitget.com/api-doc/uta/intro", "registryName": "io.github.Bitget-AI/bitget-agent-mcp", "capabilities": [ "exchange.market-data", "exchange.spot-trading", "exchange.derivatives", "exchange.balances", "exchange.transfers", "exchange.staking", "market.crypto" ], "tags": [ "hosted", "closed-source", "api-key", "usage-priced", "sandbox", "no-status-page", "mcp", "mcp-registry", "official", "read-only-mode", "agent-skills", "cli", "python", "typescript", "go", "java", "php" ], "lastRelease": "2026-10-30", "graded": true, "anchor": { "graded": true, "score": 53.9, "grade": "D", "agentReady": false, "rank": 890, "ranked": true, "rankOf": 1349, "categoryRank": 15, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 83, "maintenance": 78, "payments": 40, "reliability": 40, "schema": 74, "security": 62, "transparency": 65 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 40, "points": 8, "reason": "Graded with the hosted lines on the UTA v3 API at api.bitget.com. No status page found (status.bitget.com does not resolve, the docs link none), so 0 for the page and 5 for no readable history; the September 2026 breach is in the deduction, not here. Rate limits are published as 6,000 per IP per minute and per-endpoint UID limits by VIP level (15). An x-mbx-used-remain-limit header is documented and the agent SDK backs off on 429, orders take a clientOid of up to 64 characters, but the breach error code and a Retry-After rule were not read (10 of 15). No SLA (0). UTA v3 is the production API (10). 40.", "checked": "2026-11-03" }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 74, "points": 12.03, "reason": "The agent SDK ships openapi.yaml with 109 typed UTA v3 operations from which the tools are generated, a machine-readable contract from the vendor's own organisation though not on the docs site (20 of 25). llms.txt in the SDK and MCP repositories; the docs site has none (6 of 10). Intent tools with a discover tool that explains each verb, action and its risk level, and the server's initialize instructions state surface, modules and read-only posture (15 of 20). Typed inputs with enums and required fields from the OpenAPI source (12 of 15). Examples in the quick start and READMEs, a REST error code page in the legacy docs that we did not read in full (9 of 15). Changelog by day with preview notices and effective dates (12 of 15). 74.", "checked": "2026-11-03" }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 83, "points": 13.49, "reason": "Read for the API with the MCP server as the agent route. 14 compact tools by default, module filters, a full surface on request and progressive discovery (25). Cursor pagination on CFD order history since 15 October 2026 and limit parameters on lists (15 of 20). Uniform ok or error result shape from the SDK with typed error classes and compact JSON in the text channel (13 of 20). clientOid on orders, `dryRun: true` on every write, `confirm: true` gating cancelAll and withdraw, annotations derived from risk level including readOnlyHint, destructiveHint and idempotentHint (18 of 20). Few required fields, official SDKs in five languages plus the TypeScript agent SDK and a CLI (12 of 15). 83.", "checked": "2026-11-03" }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 62, "points": 10.85, "reason": "API keys with read or read-and-write permission, a passphrase, HMAC-SHA256 or RSA signing, IP binding recommended, 50 keys per UID, revocation on the management page; no OAuth and no separate withdrawal scope in the docs read (22 of 30). --read-only strips write tools at start, --paper-trading routes to demo, and high-risk writes need `confirm: true` (18 of 20). Tools return the exchange's own data (10). Request and response hooks are forwarded as MCP log notifications; no per-call audit log on Bitget's side was found (6 of 15). security@bitget.com in the toolkit README, no security.txt, Mandiant and SlowMist reports on the September breach, a proof-of-reserves repository, no bounty page read (6 of 20). 62.", "checked": "2026-11-03" }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 40, "points": 5, "reason": "No machine payment protocol (0). Base spot and futures rates are stated in a help article without login, the tier table draws by script (20). Market data needs no key, demo trading costs nothing and no card is asked for at sign-up (20). A person registers, verifies identity and mints the key in a browser (0). 40.", "checked": "2026-11-03" }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 78, "points": 6.83, "reason": "Read as a hosted service with an open-source toolkit. The UTA changelog's latest launched entry is 30 October 2026 and a preview entry 3 November; the MCP package shipped 3.3.1 on 20 September and agent-skill was pushed 30 October (30). 58 dated changelog entries since 5 August 2026 and six MCP versions since June (20). Issue trackers on the Bitget-AI repositories (11 open on agent_hub) and a support centre; replies were not checked (10 of 25). In the official MCP registry under io.github.Bitget-AI, a GitHub namespace, with official SDKs in five languages (10 of 15). CI workflow with coverage, npm provenance attestations, two runtime dependencies, no install scripts (8 of 10). 78.", "checked": "2026-11-03" }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 65, "points": 5.69, "note": "editorial 53, provenance 76", "reason": "The editorial half. A closed hosted service with clear terms naming BTG Technology Holdings Limited; the toolkit is MIT (15 of 30). The privacy notice names the controller and EEA representative, gives 7-year and up to 10-year retention for compliance and litigation, and names recipients by category only (18 of 30). Deprecations and parameter changes carry effective dates (delta mode deprecated 27 August, symbol and category required from 30 September, snapshot changes with demo and live dates) but no written policy (15 of 20). Recipients by category, transfers under Seychelles law with no locations or provider names (5 of 20). 53.", "checked": "2026-11-03" } ], "assessment": { "date": "2026-11-03", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "Read for the API with the MCP server as the agent route. 14 compact tools by default, module filters, a full surface on request and progressive discovery (25). Cursor pagination on CFD order history since 15 October 2026 and limit parameters on lists (15 of 20). Uniform ok or error result shape from the SDK with typed error classes and compact JSON in the text channel (13 of 20). clientOid on orders, `dryRun: true` on every write, `confirm: true` gating cancelAll and withdraw, annotations derived from risk level including readOnlyHint, destructiveHint and idempotentHint (18 of 20). Few required fields, official SDKs in five languages plus the TypeScript agent SDK and a CLI (12 of 15). 83.", "maintenance": "Read as a hosted service with an open-source toolkit. The UTA changelog's latest launched entry is 30 October 2026 and a preview entry 3 November; the MCP package shipped 3.3.1 on 20 September and agent-skill was pushed 30 October (30). 58 dated changelog entries since 5 August 2026 and six MCP versions since June (20). Issue trackers on the Bitget-AI repositories (11 open on agent_hub) and a support centre; replies were not checked (10 of 25). In the official MCP registry under io.github.Bitget-AI, a GitHub namespace, with official SDKs in five languages (10 of 15). CI workflow with coverage, npm provenance attestations, two runtime dependencies, no install scripts (8 of 10). 78.", "payments": "No machine payment protocol (0). Base spot and futures rates are stated in a help article without login, the tier table draws by script (20). Market data needs no key, demo trading costs nothing and no card is asked for at sign-up (20). A person registers, verifies identity and mints the key in a browser (0). 40.", "reliability": "Graded with the hosted lines on the UTA v3 API at api.bitget.com. No status page found (status.bitget.com does not resolve, the docs link none), so 0 for the page and 5 for no readable history; the September 2026 breach is in the deduction, not here. Rate limits are published as 6,000 per IP per minute and per-endpoint UID limits by VIP level (15). An x-mbx-used-remain-limit header is documented and the agent SDK backs off on 429, orders take a clientOid of up to 64 characters, but the breach error code and a Retry-After rule were not read (10 of 15). No SLA (0). UTA v3 is the production API (10). 40.", "schema": "The agent SDK ships openapi.yaml with 109 typed UTA v3 operations from which the tools are generated, a machine-readable contract from the vendor's own organisation though not on the docs site (20 of 25). llms.txt in the SDK and MCP repositories; the docs site has none (6 of 10). Intent tools with a discover tool that explains each verb, action and its risk level, and the server's initialize instructions state surface, modules and read-only posture (15 of 20). Typed inputs with enums and required fields from the OpenAPI source (12 of 15). Examples in the quick start and READMEs, a REST error code page in the legacy docs that we did not read in full (9 of 15). Changelog by day with preview notices and effective dates (12 of 15). 74.", "security": "API keys with read or read-and-write permission, a passphrase, HMAC-SHA256 or RSA signing, IP binding recommended, 50 keys per UID, revocation on the management page; no OAuth and no separate withdrawal scope in the docs read (22 of 30). --read-only strips write tools at start, --paper-trading routes to demo, and high-risk writes need `confirm: true` (18 of 20). Tools return the exchange's own data (10). Request and response hooks are forwarded as MCP log notifications; no per-call audit log on Bitget's side was found (6 of 15). security@bitget.com in the toolkit README, no security.txt, Mandiant and SlowMist reports on the September breach, a proof-of-reserves repository, no bounty page read (6 of 20). 62.", "transparency": "The editorial half. A closed hosted service with clear terms naming BTG Technology Holdings Limited; the toolkit is MIT (15 of 30). The privacy notice names the controller and EEA representative, gives 7-year and up to 10-year retention for compliance and litigation, and names recipients by category only (18 of 30). Deprecations and parameter changes carry effective dates (delta mode deprecated 27 August, symbol and category required from 30 September, snapshot changes with demo and live dates) but no written policy (15 of 20). Recipients by category, transfers under Seychelles law with no locations or provider names (5 of 20). 53." }, "sources": [ { "what": "robots.txt", "url": "https://www.bitget.com/robots.txt", "seen": "2026-11-03" }, { "what": "UTA quick start, legacy docs (hosts, headers, signing, keys, demo trading, rate limits, SDKs)", "url": "https://www.bitget.com/legacy-docs/uta/guide", "seen": "2026-11-03" }, { "what": "VIP rate limit rules, legacy docs", "url": "https://www.bitget.com/legacy-docs/uta/rate-limit/", "seen": "2026-11-03" }, { "what": "UTA changelog, legacy docs", "url": "https://www.bitget.com/legacy-docs/uta/changelog", "seen": "2026-11-03" }, { "what": "api-doc site (answers the UTA overview for every path)", "url": "https://www.bitget.com/api-doc/uta/intro", "seen": "2026-11-03" }, { "what": "Agent Hub MCP page on bitget.com (bitget-mcp-server, 58 tools, links to Bitget-AI/agent_hub)", "url": "https://www.bitget.com/en/activity-hub/agent-hub/mcp", "seen": "2026-11-03" }, { "what": "Support article, Agent Hub upgrade with skills and CLI (9 March 2026)", "url": "https://www.bitget.com/support/articles/12560603867888", "seen": "2026-11-03" }, { "what": "agent-mcp README", "url": "https://raw.githubusercontent.com/Bitget-AI/agent-mcp/main/README.md", "seen": "2026-11-03" }, { "what": "agent-mcp and agent-sdk source, server.json, CHANGELOG, openapi.yaml, CI workflow, shallow clones", "url": "https://github.com/Bitget-AI/agent-mcp", "seen": "2026-11-03" }, { "what": "agent_hub README", "url": "https://raw.githubusercontent.com/Bitget-AI/agent_hub/main/README.md", "seen": "2026-11-03" }, { "what": "Bitget-AI GitHub organisation and repositories", "url": "https://api.github.com/orgs/Bitget-AI/repos?per_page=100\u0026sort=updated", "seen": "2026-11-03" }, { "what": "npm registry, @bitget-ai/bitget-agent-mcp (versions, maintainer, scripts)", "url": "https://registry.npmjs.org/@bitget-ai%2fbitget-agent-mcp", "seen": "2026-11-03" }, { "what": "npm registry, bitget-mcp-server (versions, maintainer)", "url": "https://registry.npmjs.org/bitget-mcp-server", "seen": "2026-11-03" }, { "what": "official MCP registry search", "url": "https://registry.modelcontextprotocol.io/v0/servers?search=bitget", "seen": "2026-11-03" }, { "what": "Terms of Use (20 October 2026)", "url": "https://www.bitget.com/support/articles/360014944032-terms-of-use", "seen": "2026-11-03" }, { "what": "Privacy notice (5 December 2025)", "url": "https://www.bitget.com/support/articles/360015150651", "seen": "2026-11-03" }, { "what": "Trading fees FAQ (20 August 2026)", "url": "https://www.bitget.com/support/articles/12560603892734", "seen": "2026-11-03" }, { "what": "Bitget hack explained, timeline and response (27 September 2026, updated 20 October)", "url": "https://www.bitget.com/academy/12560603896113", "seen": "2026-11-03" }, { "what": "Support notice, withdrawals resumed in phases (26 September 2026)", "url": "https://www.bitget.com/support/articles/12560603896110", "seen": "2026-11-03" }, { "what": "RDAP for bitget.com", "url": "https://rdap.verisign.com/com/v1/domain/bitget.com", "seen": "2026-11-03" }, { "what": "security.txt (404)", "url": "https://www.bitget.com/.well-known/security.txt", "seen": "2026-11-03" } ], "openQuestions": [ "unchecked: the current api-doc site (every path answered the UTA overview), the REST error code page in full, the rate-limit breach code and any Retry-After rule, and the API management page's permission options beyond read and read-and-write, so a withdrawal scope may exist that the docs read do not show.", "unchecked: the fee tier table and the BGB discount rate (script-drawn), issue responsiveness on the Bitget-AI repositories, and the tools as served by the MCP server (no session opened; counts from the README, server.json and source).", "Two official servers. The Agent Hub page on bitget.com documents bitget-mcp-server 1.1.0 (V2 API, 58 tools, repository under a personal GitHub account, maintainer digmouse) while GitHub and npm carry @bitget-ai/bitget-agent-mcp 3.3.1 (UTA v3). The listing grades the v3 server, which the Agent Hub README calls the current one. Recorded as drift, not deducted.", "Deduction -8 for the September 2026 breach, a security incident within 12 months, fixed and documented with a public root cause and third-party reports, user balances covered per Bitget, so below the top of the range.", "Kind http-api, because the docs lead with the UTA REST and WebSocket API and the MCP server is stdio only, one package in the Agent Hub toolkit.", "firstReleased is 2018-10-19, the creation date of the oldest repository in the BitgetLimited account (WebSocket-JAVA-Demo); Bitget's blog says the exchange was established in 2018 without a day.", "Our own products. It doesn't do LocalGhost's or letme's job; it is one exchange's trading API. Graded the normal way." ] }, "negative": -8, "negativeNotes": [ "Security incident of 24 September 2026. An attacker who had obtained high-level internal credentials through a vulnerability in a third-party security product injected forged withdrawal commands into Bitget's wallet back end and moved about 388 million dollars in 13 assets on 11 chains from hot and warm wallets. Withdrawals, fiat and C2C were paused from 24 September and restored in phases from 28 September to 2 October 2026; trading, deposits and the API kept running. Bitget says user balances were unaffected, the Protection Fund covered the loss and was topped above 300 million dollars, private keys and cold wallets were untouched, and Mandiant and SlowMist reports of 30 September agree with its account. A fixed, documented incident with a public root cause, so below the top of the range. Sources https://www.bitget.com/academy/12560603896113 (updated 20 October 2026) and https://www.bitget.com/support/articles/12560603896110 (26 September 2026), read 2026-11-03." ], "verdict": "Bitget's official MCP server keeps the default surface to 14 intent tools with discovery, read-only and paper-trading switches, dry runs and a confirmation gate on withdrawals, over an API with demo trading. A 388 million dollar wallet breach in September 2026 paused withdrawals for eight days, and there is no status page, SLA or readable fee table.", "bestFor": "An agent trading spot, futures and earn products in a person's Bitget account outside the prohibited list, with the smallest default MCP surface of the exchanges graded and a paper-trading switch.", "strengths": [ "Official stdio MCP server with 14 intent tools by default, progressive discovery, `--read-only`, `--paper-trading`, `dryRun: true` on writes and `confirm: true` required for withdrawals and cancel-all", "Demo trading on the production host with demo keys and a paptrading header, and a TypeScript agent SDK whose openapi.yaml types all 109 UTA v3 operations", "Terms name BTG Technology Holdings Limited with Hong Kong law, and the privacy notice gives retention periods of 7 and up to 10 years", "Changelog with 58 dated entries since 5 August 2026, including preview notices with demo and live dates for WebSocket changes", "Base fees public in a help article, 0.1 per cent spot and 0.02 per cent maker and 0.06 per cent taker on futures" ], "weaknesses": [ "Hot and warm wallets lost about 388 million dollars on 24 September 2026 to forged withdrawal commands, and withdrawals were paused until 2 October", "No status page, incident history or SLA; the terms disclaim uninterrupted access", "Two official MCP servers coexist, the V2-based bitget-mcp-server on Bitget's own Agent Hub page and the v3 bitget-agent-mcp on GitHub and npm, with different tool counts", "The current api-doc site renders every page as the UTA overview for a reader without script; the legacy docs were used instead", "Keys have read or read-and-write only, with no separate withdrawal permission in the docs read, and IP binding is recommended rather than required" ], "agentNotes": [ "Run `npx -y @bitget-ai/bitget-agent-mcp --read-only` for research and `--paper-trading` with a demo key before any live order; the two flags cannot be combined", "Call discover({}) first, then the intent verbs; add `dryRun: true` to any write to preview it, and pass `confirm: true` only after the person has agreed to a withdraw or cancelAll", "Send a unique clientOid of at most 64 characters on every order and reuse it on retry; orderId wins when both are sent", "Stay under 10 requests a second per endpoint on a new account and 6,000 a minute per IP; the SDK retries on 429, so do not add a second retry loop", "Bind the key to an IP and keep write permission off a research key; the docs read show no separate withdrawal scope" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 53.9 } ], "editorialScores": { "ergonomics": 83, "maintenance": 78, "payments": 40, "reliability": 40, "schema": 74, "security": 62, "transparency": 53 }, "provenanceScore": 76, "checked": { "categories": { "ergonomics": "2026-11-03", "maintenance": "2026-11-03", "payments": "2026-11-03", "reliability": "2026-11-03", "schema": "2026-11-03", "security": "2026-11-03", "transparency": "2026-11-03" }, "last": "2026-11-03", "oldest": "2026-11-03", "stale": false, "staleAfterDays": 90 }, "scoreHistory": [ { "date": "2026-11-03", "grade": "D", "kind": "listed", "method": "0.7", "score": 53.9 } ] }, "connect": { "install": "npx -y @bitget-ai/bitget-agent-mcp", "http": "curl https://api.bitget.com/api/v3/market/tickers?category=SPOT\u0026symbol=BTCUSDT", "claudeCode": "claude mcp add bitget -- npx -y @bitget-ai/bitget-agent-mcp --read-only", "config": { "mcpServers": { "bitget": { "args": [ "-y", "@bitget-ai/bitget-agent-mcp", "--read-only" ], "command": "npx", "env": { "BITGET_API_KEY": "YOUR_API_KEY", "BITGET_PASSPHRASE": "YOUR_PASSPHRASE", "BITGET_SECRET_KEY": "YOUR_SECRET_KEY" } } } } }, "letme": { "capability": "https://letme.dev/exchange.market-data", "tool": "https://letme.dev/bitget" }, "notable": [ "Official MCP server `@bitget-ai/bitget-agent-mcp` 3.3.1 (npm, MIT, stdio, 20 September 2026) from github.com/Bitget-AI/agent-mcp, a thin adapter over `@bitget-ai/bitget-agent-sdk` with 14 intent tools by default (12 verbs plus discover and raw) over 89 UTA v3 operations, `--surface full` for one tool per endpoint, `--modules`, `--read-only`, `--paper-trading` for the demo environment, `dryRun: true` on every write and `confirm: true` required for cancelAll and withdraw (https://raw.githubusercontent.com/Bitget-AI/agent-mcp/main/README.md)", "Bitget's own Agent Hub page documents the earlier server `bitget-mcp-server` 1.1.0 (58 tools in 9 modules over the V2 API, npm, 17 March 2026) and links github.com/Bitget-AI/agent_hub, which ties the Bitget-AI GitHub organisation to the exchange; a support article of 9 March 2026 announced the Agent Hub upgrade with skills and a CLI (https://www.bitget.com/en/activity-hub/agent-hub/mcp and https://www.bitget.com/support/articles/12560603867888)", "In the official MCP registry as io.github.Bitget-AI/bitget-agent-mcp 3.0.2 (17 August 2026), a GitHub namespace, stdio with BITGET_API_KEY, BITGET_SECRET_KEY and BITGET_PASSPHRASE as secrets (https://registry.modelcontextprotocol.io/v0/servers?search=bitget)", "Rate limits of 6,000 requests per IP per minute on the common domain, per-endpoint UID limits that rise with VIP level (10 a second by default, 60 at VIP 1, 100 at VIP 3 and above) and an x-mbx-used-remain-limit response header; REST and WebSocket share the quota (https://www.bitget.com/legacy-docs/uta/guide and https://www.bitget.com/legacy-docs/uta/rate-limit/)", "Demo trading through demo keys and the paptrading: 1 header on api.bitget.com, with WebSocket at wspap.bitget.com; the agent SDK's openapi.yaml (109 operations) documents clientOid up to 64 characters on orders (https://www.bitget.com/legacy-docs/uta/guide)", "On 24 September 2026 an attacker with internal credentials obtained through a third-party product injected forged withdrawal commands and moved about 388 million dollars from hot and warm wallets; withdrawals, fiat and C2C paused and resumed in phases from 28 September to 2 October, trading and deposits ran throughout, and Bitget says user balances were unaffected and the Protection Fund covered the loss (https://www.bitget.com/academy/12560603896113, updated 20 October 2026)", "Terms of Use (BTG Technology Holdings Limited, last updated 20 October 2026, Hong Kong law, HKIAC arbitration) list about 30 prohibited countries including the United States, Canada, Japan, Singapore, Hong Kong, France, Germany, Austria, Malaysia, Thailand and Russia, and bar bots and automated devices that copy platform content (https://www.bitget.com/support/articles/360014944032-terms-of-use)" ], "area": "payments", "details": [ { "label": "Surface listed", "value": "The Unified Trading Account v3 REST and WebSocket API at api.bitget.com, read from bitget.com/legacy-docs (the api-doc site renders only its overview for our reader), the support centre, the Agent Hub page, the Bitget-AI and BitgetLimited GitHub accounts, npm and the MCP registry on 3 November 2026. No account was made, no key minted and no MCP session opened" }, { "label": "MCP server", "value": "Official, two generations. `@bitget-ai/bitget-agent-mcp` 3.3.1 (github.com/Bitget-AI/agent-mcp, MIT, stdio, Node 20) over the UTA v3 API: 14 tools by default (market, order, position, strategy_order, account_overview, account_config, repayment, transfer_funds, deposit, withdraw, funds_records, subaccount, discover, raw; loan and tax with their modules), `--surface full` adds one tool per endpoint, annotations derived from a read, write or high risk level. In the official MCP registry as io.github.Bitget-AI/bitget-agent-mcp 3.0.2. The Agent Hub page on bitget.com still documents `bitget-mcp-server` 1.1.0 (58 tools in 9 modules over the V2 API, maintainer digmouse, repository under a personal account). No hosted endpoint" }, { "label": "Key permissions", "value": "Read or read-and-write per key, up to 50 keys per UID, passphrase set by the user and not recoverable, IP binding recommended. Sub-account keys with unified account trade or management permission, each read-only or read-write, once the main account enables API key management. No separate withdrawal or transfer permission appears in the docs read; the Agent Hub READMEs tell users to disable withdrawal access, so the management page may offer it" }, { "label": "Rate limits", "value": "6,000 requests per IP per minute on api.bitget.com, limits per endpoint per UID rising with VIP level (10 a second default, 60 at VIP 1, 80 at VIP 2, 100 at VIP 3 to 7), REST and WebSocket sharing quota, x-mbx-used-remain-limit on responses. WebSocket 300 connection requests per IP per 5 minutes and 100 connections per IP. The error code for a breach was not read; the agent SDK backs off and retries on 429" }, { "label": "Testnet and demo", "value": "Demo trading on api.bitget.com with a demo API key and the paptrading header set to 1, WebSocket at wss://wspap.bitget.com/v3/ws/public and /private. The MCP server's --paper-trading flag adds the header" }, { "label": "Fees", "value": "Base spot 0.1 per cent maker and taker, base futures 0.02 per cent maker and 0.06 per cent taker, before VIP tiers; BGB offsets spot fees at a rate shown on the live schedule, which draws by script" }, { "label": "FIX and WebSocket", "value": "No FIX API in the docs read. WebSocket public and private channels at ws.bitget.com with order placement and modification over the socket, an SBE feed for institutions, and preview notices for snapshot changes dated for demo and live" }, { "label": "Countries", "value": "The terms' Prohibited Countries are Austria, Belarus, Canada, Cuba, France, Germany, Hong Kong, Iran, Japan, Kazakhstan, Malaysia, North Korea, Russia, Singapore, Sudan, the United States with its territories and outlying islands, Iraq, Libya, Yemen, Afghanistan, the Central African Republic, the Democratic Republic of the Congo, Guinea-Bissau, Haiti, Lebanon, Somalia, South Sudan, Thailand, and the Crimea, Luhansk, Donetsk, Kherson and Zaporizhzhia regions of Ukraine, plus any location Bitget designates" }, { "label": "Terms on automated trading", "value": "Clause 11.1(ix) bars deep linking, web crawlers, bots, spiders and other automatic devices used to obtain or copy platform content, and 11.1(xiv)(c) bars bypassing robot exclusion headers; API keys are treated as account credentials and no clause limits API trading. Clause 13.1 disclaims continuous access and clause 16.1 caps liability at three months of fees" }, { "label": "Security incident", "value": "On 24 September 2026 at 18:31 UTC forged withdrawal commands from a compromised internal credential moved about 388 million dollars in 13 assets on 11 chains from 12 hot and warm wallet addresses; withdrawals blocked at 19:05 and signing shut at 21:44, root cause found 25 September, Mandiant and SlowMist reports 30 September, BTC withdrawals back 28 September and all assets, fiat and C2C by 2 October. Private keys and cold wallets not affected per Bitget; the Protection Fund was topped above 300 million dollars" }, { "label": "Other agent surfaces", "value": "`bgc` CLI (bitget-agent-cli) with read-only and paper-trading modes, bitget-agent-skill for Claude Code, Codex and OpenClaw, bitget-signal market-analysis skills needing no key, bitget-agent-installer, and official SDKs in Java, Python, Node.js, Go and PHP under BitgetLimited/v3-bitget-api-sdk" }, { "label": "Legal entity", "value": "BTG Technology Holdings Limited per the terms and the privacy notice, Hong Kong law and HKIAC arbitration; the privacy notice applies the Seychelles Data Protection Act 2023 and names BTGT Europe Limited, UAB as EEA representative. Press releases are datelined Victoria, Seychelles" } ], "unitPrices": [ { "item": "Spot trade, base maker or taker", "unit": "pct", "usd": 0.1, "note": "before VIP tiers and the BGB discount" }, { "item": "Futures trade, base taker", "unit": "pct", "usd": 0.06, "note": "maker 0.02 per cent" } ], "provenance": { "legalEntity": "BTG Technology Holdings Limited", "domain": "bitget.com", "domainRegistered": "2003-02-03", "endpointOnVendorDomain": true, "terms": "https://www.bitget.com/support/articles/360014944032-terms-of-use", "privacy": "https://www.bitget.com/support/articles/360015150651", "statusPage": "", "changelog": "https://www.bitget.com/legacy-docs/uta/changelog", "securityTxt": "none", "checked": "2026-11-03", "notes": [ "Terms of Use last updated 20 October 2026 name BTG Technology Holdings Limited under Hong Kong law with HKIAC arbitration; the privacy notice (5 December 2025) names the same company as controller under the Seychelles Data Protection Act 2023 with BTGT Europe Limited, UAB as EEA representative. /user-agreement and /privacy-policy answer 404; the documents live in the support centre.", "www.bitget.com/robots.txt disallows internal, search, calendar, wiki and register paths; the api-doc, legacy-docs, support, academy, blog and activity-hub paths are allowed.", "RDAP gives bitget.com a registration date of 3 February 2003 (MarkMonitor), earlier than the exchange, so the domain was bought.", "https://www.bitget.com/.well-known/security.txt answers 404; the Agent Hub README gives security@bitget.com for reports. No status page found; status.bitget.com does not resolve and the docs link none.", "The current api-doc site answers every path with the UTA overview for a reader without script; the legacy docs at /legacy-docs/uta/ were read for the guide, rate limits and changelog." ], "score": 76, "checks": [ { "check": "Legal entity named", "value": "BTG Technology Holdings Limited", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "bitget.com, registered 2003-02-03 (23 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "bitget.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 6 of the 7 things a reader expects, and has 2 clauses that cost points", "points": 5.1, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 7 of the 8 things a reader expects", "points": 9.3, "max": 10, "state": "part" }, { "check": "Status page", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "People named", "value": "1 named with their role, none with a public profile", "points": 7, "max": 10, "state": "part" }, { "check": "Support route", "value": "help pages, a community", "points": 5, "max": 5, "state": "ok" } ], "policies": [ { "kind": "terms", "url": "https://www.bitget.com/support/articles/360014944032-terms-of-use", "state": "read", "readAt": "2026-11-03", "statedDate": "2026-10-20", "words": 14808, "points": 5.1, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last updated: October 20, 2026", "says": "Last updated 2026-10-20" }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "…on a class, collective, consolidated, or representative basis, such claims must be litigated in a civil court of competent jurisdiction and not in arbitration, and the parties agree that litigation of those claims should be stayed pending the outcome of any individual claims in arbitration." }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "Notwithstanding any other clause in these Terms, you hereby acknowledge and agree that in no event will Bitget or any of its Affiliates be responsible or liable to you or any other person or entity for:" }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "5.16 You may terminate your Account at any time by following the account termination procedures as prescribed by us from time to time." }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": true, "quote": "Changes to these Terms will be published on the Website and may also be notified to users separately by email, through the app or by such other means as Bitget determines at its discretion.", "says": "Says it gives notice of a change" }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "You will not offer direct market access to the Platform to any other party, including through the use of a sub-account, unless and until such other party has completed identity verification deemed appropriate by us and has separately onboarded onto the Platform." }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": false } ], "toKnow": [ { "key": "terms.automated", "label": "Restricts automated access", "found": true, "quote": "(ix) (a) use any deep linking, web crawlers, bots, spiders or other automatic devices, programs, scripts, algorithms or methods, or any similar or equivalent manual processes to access, obtain, copy or monitor any part of the Platform", "costsPoints": true }, { "key": "terms.nonotice", "label": "Says the terms or the service can change without notice", "found": true, "quote": "8.1 Bitget may at any time modify, suspend or discontinue any portion or feature of the Services without prior notice to or any consent from you and without assigning any reason for that action.", "costsPoints": true }, { "key": "terms.cutoff", "label": "Says access can be ended without notice or for any reason", "found": true, "quote": "If you decline to provide the requested information, or otherwise do not comply in a timely manner, we reserve the right to suspend or terminate your access to your Account, or to all or part of the Services immediately, without notice." }, { "key": "terms.arbitration", "label": "Requires arbitration or waives class actions", "found": true, "quote": "Without prejudice to the generality of the foregoing, you agree that claims shall be resolved exclusively by way of binding arbitration;" } ], "notes": [ { "date": "2026-11-03", "text": "Liability is capped at the fees the customer paid to Bitget in the three months before the event, and only for gross negligence, wilful misconduct, fraud or material continuing breach.", "quote": "Bitget and its Affiliates will not be liable to you for any amounts in aggregate exceeding the total amount of fees paid by you to Bitget in the three (3) month period immediately preceding the event giving rise to the loss." }, { "date": "2026-11-03", "text": "Any IP rights the customer creates under the terms, including User Materials, are assigned to Bitget on the day they are created.", "quote": "The User-created IP Rights shall automatically vest in us on the date on which it is created." }, { "date": "2026-11-03", "text": "The Services may not be used for resale or commercial purposes, including transactions on behalf of other persons or entities, unless Bitget agrees in writing.", "quote": "(ii) use Services for resale or commercial purposes, including transactions on behalf of other persons or entities, unless expressly agreed by us in writing;" } ] }, { "kind": "privacy", "url": "https://www.bitget.com/support/articles/360015150651", "state": "read", "readAt": "2026-11-03", "statedDate": "2025-12-05", "words": 6841, "points": 9.3, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last Updated: December 5, 2025", "says": "Last updated 2025-12-05" }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "Depending on whether and how you use our Services, Site, or App, we will collect, use, store, and transfer different types of personal data, including but not limited to:" }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "retained only for as long as necessary to fulfill the purposes for which it was collected;", "says": "For as long as needed, with no period named" }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "This may include products, services, or applications provided directly by Bitget or by third-party service providers whose products, services, or applications are integrated with or hosted on our Site and App (collectively, the \"Services\");" }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": false }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "you also have the right to object where we are processing your personal data for direct marketing purposes;" }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "Our Data Protection Officer (\"DPO\") is responsible for overseeing matters in relation to this Privacy Notice.", "says": "Names a data protection officer" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "In cases where no adequacy decision has been adopted, we will implement appropriate safeguards, such as standard contractual clauses or binding corporate rules, to ensure that your personal data continues to benefit from protection consistent with Seychelles data protection requirements.", "says": "Relies on standard contractual clauses" } ] } ] }, "humans": { "slug": "bitget", "checked": "2026-11-03", "company": "BTG Technology Holdings Limited", "people": [ { "name": "Gracy Chen", "role": "Chief Executive Officer, Bitget, since May 2024", "bio": "Gracy Chen joined Bitget in June 2022 as its first managing director and became chief executive in May 2024, succeeding Sandra Lou. She hosted the company's live session after the September 2026 wallet breach.", "bioSources": [ "https://www.bitget.com/blog/articles/bitget-appoints-gracy-chen-as-ceo", "https://www.bitget.com/support/articles/12560603896110" ], "page": "/people/gracy-chen/" } ], "peopleNote": "Bitget's about page answered 404, so the role comes from Bitget's blog post of 21 May 2024 announcing Gracy Chen as CEO, which also says the exchange was established in 2018 and names Sandra Lou as the chief executive she succeeded without giving Lou's title or calling her a founder. No founder is named on a page we read, so the roster is incomplete. The terms of use name BTG Technology Holdings Limited under Hong Kong law and the privacy notice names the same company under the Seychelles Data Protection Act; no page read states who owns it, so ownership is recorded as unknown. Investors were looked for on the blog, in the terms and in two web searches; Dragonfly's 10 million dollar strategic investment of April 2023 is reported by The Block and Fortune and recorded, while earlier rounds named only by aggregators (Consensus Labs and Collinstar Capital in 2018, Anlan Capital and SNK in 2020) are left out.", "companySocial": { "linkedin": "https://www.linkedin.com/company/bitget-global/", "x": "https://x.com/bitgetglobal", "github": "https://github.com/Bitget-AI" }, "support": { "urls": [ "https://www.bitget.com/support", "https://www.bitget.com/en/activity-hub/agent-hub/mcp" ], "community": [ { "label": "Bitget Discord", "url": "https://discord.com/invite/bitget", "kind": "discord" }, { "label": "Bitget on Telegram", "url": "https://t.me/BitgetENOfficial", "kind": "telegram" }, { "label": "Agent Hub issues", "url": "https://github.com/Bitget-AI/agent_hub/issues", "kind": "github" } ], "contactEmails": [ "security@bitget.com", "legal@bitget.com", "dpo@bitget.com" ] }, "sources": [ "https://www.bitget.com/blog/articles/bitget-appoints-gracy-chen-as-ceo", "https://www.bitget.com/support/articles/360014944032-terms-of-use", "https://www.bitget.com/support/articles/360015150651", "https://www.bitget.com/support/articles/12560603896110", "https://raw.githubusercontent.com/Bitget-AI/agent_hub/main/README.md", "https://www.theblock.co/post/224702/dragonfly-invests-bitget" ], "ownership": { "status": "unknown", "checked": "2026-11-03", "sources": [ "https://www.bitget.com/support/articles/360014944032-terms-of-use", "https://www.bitget.com/support/articles/360015150651" ] }, "investors": [ { "name": "Dragonfly", "kind": "vc", "rounds": [ "Strategic investment, April 2023" ], "lead": true, "url": "https://www.dragonfly.xyz", "source": "https://www.theblock.co/post/224702/dragonfly-invests-bitget", "quote": "Dragonfly invests $10 million in derivatives exchange Bitget", "page": "/investors/dragonfly/" } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/bitget.json", "live": { "slug": "bitget", "versions": [ { "registry": "mcp-registry", "name": "io.github.Bitget-AI/bitget-agent-mcp", "version": "3.0.2", "seenAt": "2026-11-04T17:11:44.552009456Z" } ], "securityTxt": { "url": "https://bitget.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-04T15:53:53.864777414Z" }, "updatedAt": "2026-11-04T17:11:44.552009456Z" } } }