{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-04", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "tool": { "slug": "bybit", "name": "Bybit", "vendor": "Bybit", "vendorUrl": "https://www.bybit.com", "kind": "http-api", "category": "crypto-exchanges", "summary": "Bybit is a centralised crypto exchange for spot, perpetual and futures contracts, options and earn products, reached through its V5 REST and WebSocket API, a FIX order-entry gateway and an official stdio MCP server published from its GitHub organisation.", "url": "https://www.anchorterminal.com/tools/bybit", "markdownUrl": "https://www.anchorterminal.com/tools/bybit.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/bybit.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/bybit.json", "dns": "bybit.grade.anchorterminal.com", "repo": "https://github.com/bybit-exchange/trading-mcp", "transports": [ "stdio" ], "packages": [ { "registry": "npm", "name": "bybit-official-trading-server" }, { "registry": "pypi", "name": "pybit" } ], "auth": "api-key", "authNotes": "API key minted on the API management page after a browser sign-up and identity verification, signed per request with HMAC-SHA256 (system-generated secret) or RSA-SHA256 (self-generated key pair) in the X-BAPI-API-KEY, X-BAPI-TIMESTAMP, X-BAPI-SIGN and X-BAPI-RECV-WINDOW headers. Permissions are granted per group (ContractTrade, Spot, Wallet with a separate Withdraw value, Options, Derivatives, Exchange, Earn, Affiliate, BlockTrade) with a readOnly flag, and keys can be bound to IP addresses. A key with no IP binding expires 90 days after creation and can be extended on the management page with email and 2FA codes. Keys for testnet come from testnet.bybit.com and keys for demo trading from the production account in demo mode (https://bybit-exchange.github.io/docs/v5/user/apikey-info and https://bybit-exchange.github.io/docs/faq, checked 2026-11-03).", "pricing": "usage", "pricingNotes": "The API and the MCP server cost nothing; trades carry Bybit's fees. At VIP 0 the spot fee is 0.1 per cent maker and taker, perpetual and futures contracts 0.02 per cent maker and 0.055 per cent taker, options 0.02 per cent maker and 0.03 per cent taker, with lower tiers by 30-day volume or asset balance and a note that rates vary by region. Fiat pairs, the Adventure Zone, xStocks and pre-market perpetuals have their own tables (https://www.bybit.com/en/help-center/article/Trading-Fee-Structure, last updated 2 September 2026, read 2026-11-03).", "priceSummary": "0.1% fee", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the V5 docs, the MCP server's README or source, or the fee schedule (checked 2026-11-03). Trading fees are taken from the account balance.", "endpoints": [] }, "toolCount": 398, "popularity": { "githubStars": 43, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-03" }, "docsUrl": "https://bybit-exchange.github.io/docs/v5/intro", "capabilities": [ "exchange.market-data", "exchange.spot-trading", "exchange.derivatives", "exchange.balances", "exchange.transfers", "exchange.staking", "market.crypto" ], "tags": [ "hosted", "closed-source", "api-key", "usage-priced", "sandbox", "no-status-page", "mcp", "official", "python", "typescript", "go", "java", "dotnet" ], "lastRelease": "2026-10-30", "graded": true, "anchor": { "graded": true, "score": 57.3, "grade": "C", "agentReady": false, "rank": 745, "ranked": true, "rankOf": 1349, "categoryRank": 11, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 66, "maintenance": 66, "payments": 40, "reliability": 45, "schema": 73, "security": 60, "transparency": 51 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 45, "points": 9, "reason": "Graded with the hosted lines on the V5 API at api.bybit.com. No status page found (status.bybit.com does not resolve, the docs link none), so 0 for the page and 5 for no readable history. Rate limits are published per endpoint and per UID with numbers, plus a 600 per 5 second IP limit (15). Every response carries X-Bapi-Limit, X-Bapi-Limit-Status and X-Bapi-Limit-Reset-Timestamp, retCode 10006 and HTTP 403 are documented with a wait rule, and orders take a unique orderLinkId that amend and cancel accept (15). No SLA (0). V5 is the current production API, not a beta (10). 45.", "checked": "2026-11-03" }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 73, "points": 11.86, "reason": "No OpenAPI or other machine-readable contract for the REST API; the MCP server's 398 tools have zod schemas turned into JSON Schema, so the contract exists for the MCP surface only (12 of 25). No llms.txt; the docs are a public Docusaurus repository (bybit-exchange/docs) whose MDX source an agent can read (5 of 10). The MCP tool descriptions state purpose, rules and an agent hint per tool, and the API reference gives one page per endpoint (15 of 20). Parameters are typed with enums such as category and orderType and required flags (12 of 15). Request and response examples on each endpoint page and an error code page of about 750 codes with text (14 of 15). A dated changelog with 24 entries in the last 90 days, versioned V3 to V5 (15). 73.", "checked": "2026-11-03" }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 66, "points": 10.73, "reason": "Read for the API with the MCP server beside it. The MCP server has 398 tools in one list with no toolset, module or read-only switch (5 of 25, nothing added back). V5 reads take limit and cursor and category filters (15 of 20). retCode and retMsg on every response with a code list an agent can branch on, though create-order answers before the order is final and the docs say to confirm over WebSocket (14 of 20). orderLinkId makes order retries safe and every MCP tool carries readOnlyHint and destructiveHint (17 of 20). Five required fields on an order, official SDKs in Python, Go, Java and .NET (15). 66.", "checked": "2026-11-03" }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 60, "points": 10.5, "reason": "API keys scoped by product group with a readOnly flag, a separate Withdraw value, IP binding, a 90-day expiry for unbound keys, HMAC or RSA signing, and revocation on the management page; no OAuth (24 of 30). A read-only key and a withdrawal-free key are first-class, but the MCP server has no read-only mode and relies on the client's approval prompt for writes (14 of 20). Tools return the exchange's own data, not third-party text (10). The API key info endpoint shows permissions, IPs and expiry, and an IP change log exists for institutional accounts, but no per-call audit log was found (7 of 15). No security.txt on bybit.com or the docs host, no disclosure policy or bug bounty found on a page we could read, proof-of-reserves articles in the help centre (5 of 20). 60.", "checked": "2026-11-03" }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 40, "points": 5, "reason": "No machine payment protocol (0). The fee schedule is public without login, with VIP 0 maker and taker rates per product and the tier criteria (20). Reading market data needs no key and the demo environment costs nothing, no card is asked for at sign-up (20). A person must register, pass identity verification and mint the key in a browser (0). 40.", "checked": "2026-11-03" }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 66, "points": 5.78, "reason": "Read as a hosted service with an open-source MCP server. The MCP package shipped 2.1.26 on 30 October 2026 and the V5 changelog's latest entry is 29 October (30). 31 npm versions since 16 April 2026, 11 of them in the last 90 days, and 24 changelog entries in the same window (20). The trading-mcp repository has 4 open issues and 18 forks; whether issues get answers was not checked, and the API has no public forum we could read (10 of 25). Not in the official MCP registry (0). The package has four dependencies, no install scripts, a publish workflow and no test workflow (6 of 10). 66.", "checked": "2026-11-03" }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 51, "points": 4.46, "note": "editorial 27, provenance 75", "reason": "The editorial half. A closed hosted service. The terms read are the UAE entity's PDF served from bybit.com, clear on API use and availability, but the global terms page renders by script and was not read; the MCP server is MIT (12 of 30). The privacy policy was not read, so data handling is unscored (5 of 30). The changelog dates removals and response changes but gives no notice period or deprecation policy (10 of 20). No subprocessor list or data location statement was read (0 of 20). 27.", "checked": "2026-11-03" } ], "assessment": { "date": "2026-11-03", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "Read for the API with the MCP server beside it. The MCP server has 398 tools in one list with no toolset, module or read-only switch (5 of 25, nothing added back). V5 reads take limit and cursor and category filters (15 of 20). retCode and retMsg on every response with a code list an agent can branch on, though create-order answers before the order is final and the docs say to confirm over WebSocket (14 of 20). orderLinkId makes order retries safe and every MCP tool carries readOnlyHint and destructiveHint (17 of 20). Five required fields on an order, official SDKs in Python, Go, Java and .NET (15). 66.", "maintenance": "Read as a hosted service with an open-source MCP server. The MCP package shipped 2.1.26 on 30 October 2026 and the V5 changelog's latest entry is 29 October (30). 31 npm versions since 16 April 2026, 11 of them in the last 90 days, and 24 changelog entries in the same window (20). The trading-mcp repository has 4 open issues and 18 forks; whether issues get answers was not checked, and the API has no public forum we could read (10 of 25). Not in the official MCP registry (0). The package has four dependencies, no install scripts, a publish workflow and no test workflow (6 of 10). 66.", "payments": "No machine payment protocol (0). The fee schedule is public without login, with VIP 0 maker and taker rates per product and the tier criteria (20). Reading market data needs no key and the demo environment costs nothing, no card is asked for at sign-up (20). A person must register, pass identity verification and mint the key in a browser (0). 40.", "reliability": "Graded with the hosted lines on the V5 API at api.bybit.com. No status page found (status.bybit.com does not resolve, the docs link none), so 0 for the page and 5 for no readable history. Rate limits are published per endpoint and per UID with numbers, plus a 600 per 5 second IP limit (15). Every response carries X-Bapi-Limit, X-Bapi-Limit-Status and X-Bapi-Limit-Reset-Timestamp, retCode 10006 and HTTP 403 are documented with a wait rule, and orders take a unique orderLinkId that amend and cancel accept (15). No SLA (0). V5 is the current production API, not a beta (10). 45.", "schema": "No OpenAPI or other machine-readable contract for the REST API; the MCP server's 398 tools have zod schemas turned into JSON Schema, so the contract exists for the MCP surface only (12 of 25). No llms.txt; the docs are a public Docusaurus repository (bybit-exchange/docs) whose MDX source an agent can read (5 of 10). The MCP tool descriptions state purpose, rules and an agent hint per tool, and the API reference gives one page per endpoint (15 of 20). Parameters are typed with enums such as category and orderType and required flags (12 of 15). Request and response examples on each endpoint page and an error code page of about 750 codes with text (14 of 15). A dated changelog with 24 entries in the last 90 days, versioned V3 to V5 (15). 73.", "security": "API keys scoped by product group with a readOnly flag, a separate Withdraw value, IP binding, a 90-day expiry for unbound keys, HMAC or RSA signing, and revocation on the management page; no OAuth (24 of 30). A read-only key and a withdrawal-free key are first-class, but the MCP server has no read-only mode and relies on the client's approval prompt for writes (14 of 20). Tools return the exchange's own data, not third-party text (10). The API key info endpoint shows permissions, IPs and expiry, and an IP change log exists for institutional accounts, but no per-call audit log was found (7 of 15). No security.txt on bybit.com or the docs host, no disclosure policy or bug bounty found on a page we could read, proof-of-reserves articles in the help centre (5 of 20). 60.", "transparency": "The editorial half. A closed hosted service. The terms read are the UAE entity's PDF served from bybit.com, clear on API use and availability, but the global terms page renders by script and was not read; the MCP server is MIT (12 of 30). The privacy policy was not read, so data handling is unscored (5 of 30). The changelog dates removals and response changes but gives no notice period or deprecation policy (10 of 20). No subprocessor list or data location statement was read (0 of 20). 27." }, "sources": [ { "what": "robots.txt (www.bybit.com, read with curl after WebFetch timed out three times; bybit-exchange.github.io has none)", "url": "https://www.bybit.com/robots.txt", "seen": "2026-11-03" }, { "what": "V5 API introduction, products, hosts and SDK list", "url": "https://bybit-exchange.github.io/docs/v5/intro", "seen": "2026-11-03" }, { "what": "V5 rate limits", "url": "https://bybit-exchange.github.io/docs/v5/rate-limit", "seen": "2026-11-03" }, { "what": "API key info endpoint (permission groups, readOnly, ips, expiredAt)", "url": "https://bybit-exchange.github.io/docs/v5/user/apikey-info", "seen": "2026-11-03" }, { "what": "Demo trading", "url": "https://bybit-exchange.github.io/docs/v5/demo", "seen": "2026-11-03" }, { "what": "FAQ (90-day expiry of unbound keys, testnet keys, domains)", "url": "https://bybit-exchange.github.io/docs/faq", "seen": "2026-11-03" }, { "what": "FIX API guide", "url": "https://bybit-exchange.github.io/docs/fix-api/guide", "seen": "2026-11-03" }, { "what": "Create order (orderLinkId, asynchronous confirmation)", "url": "https://bybit-exchange.github.io/docs/v5/order/create-order", "seen": "2026-11-03" }, { "what": "Error codes", "url": "https://bybit-exchange.github.io/docs/v5/error", "seen": "2026-11-03" }, { "what": "V5 changelog", "url": "https://bybit-exchange.github.io/docs/changelog/v5", "seen": "2026-11-03" }, { "what": "Trading fee structure (help centre, read with curl)", "url": "https://www.bybit.com/en/help-center/article/Trading-Fee-Structure", "seen": "2026-11-03" }, { "what": "General terms and conditions PDF served from bybit.com (UAE entity, 23 January 2026)", "url": "https://www.bybit.com/common-static/compliance/legal/BYBIT/b2e1c94c53ee5e12e165919de919337e.pdf", "seen": "2026-11-03" }, { "what": "trading-mcp README, source (tool files, annotations, stdio transport) and git history, shallow clone", "url": "https://github.com/bybit-exchange/trading-mcp", "seen": "2026-11-03" }, { "what": "npm registry, bybit-official-trading-server (versions, maintainers, dependencies, scripts)", "url": "https://registry.npmjs.org/bybit-official-trading-server", "seen": "2026-11-03" }, { "what": "bybit-exchange GitHub organisation repositories", "url": "https://api.github.com/orgs/bybit-exchange/repos?per_page=100\u0026sort=updated", "seen": "2026-11-03" }, { "what": "official MCP registry search", "url": "https://registry.modelcontextprotocol.io/v0/servers?search=bybit", "seen": "2026-11-03" }, { "what": "RDAP for bybit.com", "url": "https://rdap.verisign.com/com/v1/domain/bybit.com", "seen": "2026-11-03" }, { "what": "security.txt (404)", "url": "https://www.bybit.com/.well-known/security.txt", "seen": "2026-11-03" } ], "openQuestions": [ "unchecked: the global terms of service, privacy policy and about pages on bybit.com, which render by script; the entity, data handling and subprocessors are unscored for that reason. The terms read are the UAE-regulated entity's PDF.", "unchecked: whether Bybit runs a status page anywhere other than status.bybit.com, and whether a bug bounty or disclosure policy exists; both scored absent.", "unchecked: responsiveness on the trading-mcp repository's issues and the Telegram API group. The README's tool count (398) matches the source; the GitHub description says 382 and was not updated.", "firstReleased is 2019-10-09, the creation date of the oldest repository in the bybit-exchange organisation (api-connectors). Bybit's press boilerplate says it was founded in 2018 without a day, and the V5 API has no first-hand launch date on its pages.", "Kind http-api, because the docs lead with the V5 REST and WebSocket API and the MCP server is one package among the SDKs, stdio only, so it sits in packages rather than making the listing mcp.", "Our own products. It doesn't do LocalGhost's or letme's job; it is one exchange's trading API. Graded the normal way." ] }, "negative": 0, "verdict": "Bybit publishes per-endpoint rate limits, a demo environment, scoped keys with a read-only flag and IP binding, and an official stdio MCP server whose 398 tools carry read-only and destructive annotations. There is no status page, no OpenAPI file, no SLA, the MCP server has no toolsets, and the global terms and privacy pages are drawn by script.", "bestFor": "An agent trading spot, perpetuals, futures and options in a person's Bybit account outside the excluded jurisdictions, with a demo environment to rehearse on.", "strengths": [ "Official MCP server from Bybit's GitHub organisation with 398 generated tools, each annotated readOnlyHint, destructiveHint and openWorldHint, and market data tools that need no key", "Rate limits published per endpoint and per UID with limit, remaining and reset headers on every response, and a documented 403 ban rule for the IP limit", "API keys scoped by product group with a read-only flag, a separate Withdraw permission, IP binding and a 90-day expiry for unbound keys", "Demo trading at api-demo.bybit.com with self-served demo funds, plus a testnet with its own keys", "VIP 0 fees published without login, 0.1 per cent spot and 0.02 per cent maker and 0.055 per cent taker on contracts" ], "weaknesses": [ "No status page, incident history or SLA was found; the terms say the API is not guaranteed to be available", "No OpenAPI or llms.txt for the V5 API, and the MCP server exposes all 398 tools with no toolset, module or read-only switch", "Not in the official MCP registry; the hosted `bybit` entry there is a third party's server, not Bybit's", "The global terms, privacy policy and about pages on bybit.com render by script and were not read; the terms read are the UAE-regulated entity's PDF", "Changelog entries change response shapes and remove fields without a notice period, such as the Asset Overview restructure of 18 August 2026" ], "agentNotes": [ "Create a key with only the permission groups the task needs, set readOnly for research keys, leave Withdraw off and bind an IP, or the key expires after 90 days", "Send a unique orderLinkId on every order and reuse it when amending or cancelling, since create-order is asynchronous and confirmed over WebSocket", "Read X-Bapi-Limit-Status before bursts and wait until X-Bapi-Limit-Reset-Timestamp on retCode 10006; on HTTP 403 stop all sessions for at least 10 minutes", "Test on api-demo.bybit.com with a demo key from the production account, not on testnet demo mode, which the docs call meaningless", "Run the MCP server with BYBIT_TESTNET=true first, and only in a client that shows a per-call approval, because the server has no read-only mode of its own" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 57.3 } ], "editorialScores": { "ergonomics": 66, "maintenance": 66, "payments": 40, "reliability": 45, "schema": 73, "security": 60, "transparency": 27 }, "provenanceScore": 75, "checked": { "categories": { "ergonomics": "2026-11-03", "maintenance": "2026-11-03", "payments": "2026-11-03", "reliability": "2026-11-03", "schema": "2026-11-03", "security": "2026-11-03", "transparency": "2026-11-03" }, "last": "2026-11-03", "oldest": "2026-11-03", "stale": false, "staleAfterDays": 90 }, "scoreHistory": [ { "date": "2026-11-03", "grade": "C", "kind": "listed", "method": "0.7", "score": 57.3 } ] }, "connect": { "install": "npm install -g bybit-official-trading-server", "http": "curl https://api.bybit.com/v5/market/tickers?category=spot\u0026symbol=BTCUSDT", "claudeCode": "claude mcp add bybit -- npx -y bybit-official-trading-server@latest", "config": { "mcpServers": { "bybit": { "args": [ "-y", "bybit-official-trading-server@latest" ], "command": "npx", "env": { "BYBIT_API_KEY": "YOUR_API_KEY", "BYBIT_API_SECRET": "YOUR_API_SECRET", "BYBIT_TESTNET": "true" } } } } }, "letme": { "capability": "https://letme.dev/exchange.market-data", "tool": "https://letme.dev/bybit" }, "notable": [ "Official MCP server `bybit-official-trading-server` (npm, MIT, stdio only) from github.com/bybit-exchange/trading-mcp, 398 generated tools in 43 categories with readOnlyHint, destructiveHint and openWorldHint on every tool, 2.1.26 published 30 October 2026, maintainers bybit_api_official_account and paul.yang.by (https://registry.npmjs.org/bybit-official-trading-server)", "Not in the official MCP registry under a Bybit namespace; the only `bybit` entry on 3 November 2026 is the third-party io.github.mcp-dir/bybit-mcp hosted at api.mcp.ai (https://registry.modelcontextprotocol.io/v0/servers?search=bybit)", "V5 rate limits are published per endpoint per UID (for example 10 to 20 orders a second on create and cancel, 50 a second on order and position reads) with X-Bapi-Limit, X-Bapi-Limit-Status and X-Bapi-Limit-Reset-Timestamp headers, retCode 10006 on breach, and an IP limit of 600 requests per 5 seconds that answers 403 and asks for a 10 minute pause (https://bybit-exchange.github.io/docs/v5/rate-limit)", "Testnet at api-testnet.bybit.com with keys from testnet.bybit.com, and a separate demo trading environment at api-demo.bybit.com with demo funds applied through POST /v5/account/demo-apply-money (https://bybit-exchange.github.io/docs/v5/demo)", "FIX 4.4 order entry for spot at fix-oe.bybit.com and fix-oe-testnet.bybit.com, port 9000, TLS only, RSA keys only, whitelisted UIDs or institutional IDs arranged through a relationship manager (https://bybit-exchange.github.io/docs/fix-api/guide)", "The terms served from bybit.com (Bybit Virtual Asset Platform Operator L.L.C. S.P.C, last updated 23 January 2026) exclude the United States, the Chinese Mainland, Hong Kong, Singapore, Canada, France, the United Kingdom, Dubai, North Korea, Cuba, Iran, Uzbekistan, Russian-controlled regions of Ukraine, Sevastopol, Sudan and Syria, let users place orders through the API and give no guarantee the API is available (https://www.bybit.com/common-static/compliance/legal/BYBIT/b2e1c94c53ee5e12e165919de919337e.pdf)", "V5 changelog has 24 dated entries between 6 August and 29 October 2026, including response-shape changes shipped without a notice period (https://bybit-exchange.github.io/docs/changelog/v5)" ], "area": "payments", "details": [ { "label": "Surface listed", "value": "The V5 REST and WebSocket API at api.bybit.com, read from bybit-exchange.github.io/docs, the bybit-exchange GitHub organisation, npm, the MCP registry and the pages on bybit.com that render without script, on 3 November 2026. No account was made, no key minted and no MCP session opened" }, { "label": "MCP server", "value": "An official server. github.com/bybit-exchange/trading-mcp, npm `bybit-official-trading-server` 2.1.26 (30 October 2026), stdio only, no hosted URL. 398 tools generated from the V5 API in 43 categories (market 23 with no key, account 25, trade 12, position 12, asset 35, websocket 27 and others), each with readOnlyHint, destructiveHint and openWorldHint. Authenticates with BYBIT_API_KEY plus BYBIT_API_SECRET (HMAC) or BYBIT_API_PRIVATE_KEY_PATH (RSA); BYBIT_TESTNET switches hosts. Not in the official MCP registry; the registry's only `bybit` entry is the third-party io.github.mcp-dir/bybit-mcp" }, { "label": "Key permissions", "value": "Groups ContractTrade (Order, Position), Spot (SpotTrade), Wallet (AccountTransfer, SubMemberTransfer, SubMemberTransferList, Withdraw), Options, Derivatives, Exchange (convert history), Earn, Affiliate and BlockTrade, a readOnly flag, an IP list, and expiredAt for keys with no IP bound (90 days per the FAQ). Keys are HMAC (system secret) or RSA (self-generated, needed for FIX)" }, { "label": "Rate limits", "value": "Per UID per second by endpoint (create and cancel order 10 to 20, order and execution reads 50, wallet balance 50, withdraw create 5, sub-API creation 1), batch endpoints counted per order with partial acceptance, headers X-Bapi-Limit, X-Bapi-Limit-Status and X-Bapi-Limit-Reset-Timestamp, retCode 10006 on breach. IP limit 600 requests per 5 seconds, breach answers HTTP 403 and the docs ask for all sessions to stop for 10 minutes. WebSocket 500 connections per 5 minutes per IP" }, { "label": "Testnet and demo", "value": "Testnet api-testnet.bybit.com with keys from testnet.bybit.com and funds from the asset page. Demo trading api-demo.bybit.com and wss://stream-demo.bybit.com (private streams only) with keys from the production account in demo mode, demo funds by POST /v5/account/demo-apply-money up to 100,000 USDT per request, orders kept 7 days, default rate limits" }, { "label": "Fees", "value": "VIP 0 spot 0.1 per cent maker and taker; perpetual and futures 0.02 per cent maker, 0.055 per cent taker; options 0.02 and 0.03 per cent. Fiat pairs 0.15 maker and 0.2 taker, Adventure Zone and xStocks 0.2 per cent. Fee schedule last updated 2 September 2026, with a note that rates vary by region" }, { "label": "FIX and WebSocket", "value": "FIX 4.4 spot order entry at fix-oe.bybit.com:9000 (testnet fix-oe-testnet.bybit.com), TLS, RSA keys with the FIX API option, whitelisted UIDs only, 20 connections per UID per machine, no gap fill or session resume, shares the REST rate-limit pool. WebSocket public streams at stream.bybit.com with 1,000 market-data connections per IP per product, private streams and WebSocket trade" }, { "label": "Countries", "value": "The terms PDF served from bybit.com excludes the United States, the Chinese Mainland, Hong Kong, Singapore, Canada, France, the United Kingdom, Dubai, North Korea, Cuba, Iran, Uzbekistan, Russian-controlled regions of Ukraine, Sevastopol, Sudan and Syria. Regional hosts exist for Kazakhstan (api.bybit.kz), Brazil, Argentina, Hong Kong, Turkey and the EU per the changelog; the global terms page itself renders by script and was not read" }, { "label": "Terms on automated trading", "value": "Clause 15.1 lets a user place orders through the site, the API or any interface Bybit supports; clause 4.1 gives no guarantee that the API is available; clause 6.3(k) bans robots and scrapers that reproduce the platform's content; clause 17.8 says orders may pass automated compliance checks and manual review. No clause names trading bots" }, { "label": "Other agent surfaces", "value": "github.com/bybit-exchange/skills (natural-language trading skills, MIT, pushed 30 October 2026), trading-cli, and official SDKs pybit (Python), bybit.go.api, bybit-java-api, bybit.net.api, with new JS, PHP and Ruby repositories created July 2026" }, { "label": "Legal entity", "value": "The terms PDF served from bybit.com names Bybit Virtual Asset Platform Operator L.L.C. S.P.C, incorporated in Abu Dhabi and licensed by the CMA, under the laws of England and Wales with SIAC arbitration. Other Bybit documents name Bybit Technology Limited (the P2P terms) and press releases are datelined Dubai; the global entity could not be confirmed" } ], "unitPrices": [ { "item": "Spot trade, VIP 0 maker or taker", "unit": "pct", "usd": 0.1, "note": "crypto-crypto pairs" }, { "item": "Perpetual or futures trade, VIP 0 taker", "unit": "pct", "usd": 0.055, "note": "maker 0.02 per cent" }, { "item": "Options trade, VIP 0 taker", "unit": "pct", "usd": 0.03, "note": "maker 0.02 per cent" } ], "provenance": { "legalEntity": "Bybit Virtual Asset Platform Operator L.L.C. S.P.C", "domain": "bybit.com", "domainRegistered": "1999-08-05", "endpointOnVendorDomain": true, "terms": "https://www.bybit.com/en/terms-service", "privacy": "https://www.bybit.com/en/privacy-policy", "statusPage": "", "changelog": "https://bybit-exchange.github.io/docs/changelog/v5", "securityTxt": "none", "checked": "2026-11-03", "notes": [ "www.bybit.com answers WebFetch with a timeout; its robots.txt (read with curl) allows the help centre, legal and static paths and disallows query-string URLs and x-api endpoints. The terms and privacy pages render by script, so the terms read are the PDF at /common-static/compliance/legal/BYBIT/b2e1c94c53ee5e12e165919de919337e.pdf (Bybit Virtual Asset Platform Operator L.L.C. S.P.C, last updated 23 January 2026, English and Welsh law, SIAC arbitration). The privacy policy was not read.", "RDAP gives bybit.com a registration date of 5 August 1999 (CSC Corporate Domains), earlier than the company, so the domain was bought.", "https://www.bybit.com/.well-known/security.txt answers 404. bybit-exchange.github.io has no robots.txt and no security.txt.", "No status page found; status.bybit.com does not resolve, the docs link none, and a search found only third-party monitors.", "The V5 changelog is dated by day; the MCP server's versions are on npm. The P2P service terms on bybit.com name Bybit Technology Limited as the company." ], "score": 75, "checks": [ { "check": "Legal entity named", "value": "Bybit Virtual Asset Platform Operator L.L.C. S.P.C", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "bybit.com, registered 1999-08-05 (27 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "bybit.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "published, but our reader couldn't read it", "points": 7, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "published, but our reader couldn't read it", "points": 7, "max": 10, "state": "part" }, { "check": "Status page", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "People named", "value": "1 named with their role, none with a public profile", "points": 7, "max": 10, "state": "part" }, { "check": "Support route", "value": "help pages, a community", "points": 5, "max": 5, "state": "ok" } ], "policies": [ { "kind": "terms", "url": "https://www.bybit.com/en/terms-service", "state": "unreadable", "reason": "no answer (stream error: stream ID 3; INTERNAL_ERROR; received from peer)", "readAt": "2026-11-03", "points": 7, "max": 10 }, { "kind": "privacy", "url": "https://www.bybit.com/en/privacy-policy", "state": "unreadable", "reason": "no answer (stream error: stream ID 5; INTERNAL_ERROR; received from peer)", "readAt": "2026-11-03", "points": 7, "max": 10 } ] }, "humans": { "slug": "bybit", "checked": "2026-11-03", "company": "Bybit", "people": [ { "name": "Ben Zhou", "role": "Co-founder and CEO, Bybit", "founder": true, "bio": "Ben Zhou co-founded Bybit and has led it as chief executive since its founding in 2018. Bybit's press releases of January 2026 name him as co-founder and CEO ahead of his 2026 roadmap keynote.", "bioSources": [ "https://tools.prnewswire.com/en-us/live/20813/release/20260116EN64300" ], "page": "/people/ben-zhou/" } ], "peopleNote": "Bybit's about, press and legal pages on bybit.com render by script and could not be read, so the role comes from Bybit's own press release of 16 January 2026 distributed through PR Newswire, which names Ben Zhou as co-founder and CEO and says the company was founded in 2018. Other co-founders are not named on any page we read, so the roster may be incomplete; a March 2026 release names a departing co-CEO, Helen Liu, which was not read first-hand. The terms PDF served from bybit.com names Bybit Virtual Asset Platform Operator L.L.C. S.P.C (Abu Dhabi) and the P2P terms name Bybit Technology Limited; no page read states who owns the group. Investors were looked for in one web search and in the terms and press release; the results describe Bybit as an investor through Bybit Ventures and name no round raised by Bybit from a source we may cite, so none are recorded.", "companySocial": { "linkedin": "https://www.linkedin.com/company/bybitexchange/", "x": "https://x.com/Bybit_Official", "github": "https://github.com/bybit-exchange" }, "support": { "urls": [ "https://www.bybit.com/en/help-center/", "https://bybit-exchange.github.io/docs/faq" ], "community": [ { "label": "Bybit Discord", "url": "https://discord.gg/bybit", "kind": "discord" }, { "label": "Bybit announcements on Telegram", "url": "https://t.me/s/Bybit_Announcements", "kind": "telegram" }, { "label": "r/Bybit", "url": "https://www.reddit.com/r/Bybit/", "kind": "reddit" }, { "label": "trading-mcp issues", "url": "https://github.com/bybit-exchange/trading-mcp/issues", "kind": "github" } ], "contactEmails": [ "media@bybit.com" ] }, "sources": [ "https://tools.prnewswire.com/en-us/live/20813/release/20260116EN64300", "https://www.bybit.com/common-static/compliance/legal/BYBIT/b2e1c94c53ee5e12e165919de919337e.pdf", "https://bybit-exchange.github.io/docs/v5/intro", "https://github.com/bybit-exchange/trading-mcp", "https://api.github.com/orgs/bybit-exchange/repos?per_page=100\u0026sort=updated" ], "ownership": { "status": "unknown", "checked": "2026-11-03", "sources": [ "https://www.bybit.com/common-static/compliance/legal/BYBIT/b2e1c94c53ee5e12e165919de919337e.pdf", "https://tools.prnewswire.com/en-us/live/20813/release/20260116EN64300" ] } }, "pageJsonUrl": "https://www.anchorterminal.com/tools/bybit.json", "live": { "slug": "bybit", "securityTxt": { "url": "https://bybit.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-04T15:54:01.70982249Z" }, "updatedAt": "2026-11-04T15:54:01.70982249Z" } } }