{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-04", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "tool": { "slug": "crypto-com-exchange", "name": "Crypto.com Exchange API", "vendor": "Foris DAX Limited (Crypto.com)", "vendorUrl": "https://crypto.com/exchange", "kind": "http-api", "category": "crypto-exchanges", "summary": "Crypto.com Exchange's trading API for spot, perpetuals, margin, staking and trading bots, through REST, WebSocket and FIX with HMAC-signed API keys. Crypto.com's cdcx-cli adds an MCP server, agent skills and local paper trading.", "url": "https://www.anchorterminal.com/tools/crypto-com-exchange", "markdownUrl": "https://www.anchorterminal.com/tools/crypto-com-exchange.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/crypto-com-exchange.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/crypto-com-exchange.json", "dns": "crypto-com-exchange.grade.anchorterminal.com", "repo": "https://github.com/crypto-com/cdcx-cli", "license": "Proprietary hosted API under the Exchange terms and conditions, which our reader couldn't load. cdcx-cli, the official CLI and MCP server, is MIT or Apache-2.0", "transports": [ "stdio" ], "packages": [ { "registry": "npm", "name": "@cryptocom/cdcx-cli" } ], "auth": "api-key", "authNotes": "API key and secret created in the Exchange under Settings \u003e API Keys after a browser signup, with HMAC-SHA256 request signing. The official agent skill says IP whitelisting is recommended for production and withdrawal addresses must be pre-approved, and the App skill uses a key with no withdrawal permission; the Exchange docs' own permission list (read, trade, withdraw) sits on exchange-docs.crypto.com, which refused our reader. cdcx reads CDCX_API_KEY and CDCX_API_SECRET or a 0600 config file and has no key flag by design (https://github.com/crypto-com/crypto-agent-trading, https://github.com/crypto-com/cdcx-cli/blob/main/SECURITY.md, checked 2026-11-03).", "pricing": "usage", "pricingNotes": "The API itself costs nothing. Spot fees by 30-day volume, Level 1 (under $10,000) 0.25% maker and 0.50% taker, down to 0.08% and 0.18% at $500,000 or more, with a 3% discount for a CRO balance and 0% maker or rebates at higher CRO levels; rates reset daily at 04:00 UTC. A 0.5% liquidation fee. Derivatives fees are not on the fees page. A UAT environment (uat-api.3ona.co) and cdcx's local paper trading need no money (https://crypto.com/exchange-pro/en-US/document/fees-limits, checked 2026-11-03).", "priceSummary": "0.25% fee", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 on the Exchange pages, in cdcx-cli or the agent skills (checked 2026-11-03). Crypto.com's GitHub has an x402 facilitator client for its Developer Platform, which is a different product.", "endpoints": [] }, "toolCount": 95, "popularity": { "githubStars": 27, "npmWeekly": 59, "pypiWeekly": null, "asOf": "2026-11-03" }, "docsUrl": "https://exchange-docs.crypto.com/exchange/v1/rest-ws/index.html", "capabilities": [ "exchange.market-data", "exchange.spot-trading", "exchange.derivatives", "exchange.balances", "exchange.transfers", "exchange.staking", "market.crypto" ], "tags": [ "official", "hosted", "api-key", "mcp", "cli", "agent-skills", "sandbox", "status-page", "rust", "usage-priced" ], "lastRelease": "2026-06-18", "graded": true, "anchor": { "graded": true, "score": 46.8, "grade": "D", "agentReady": false, "rank": 1100, "ranked": true, "rankOf": 1349, "categoryRank": 20, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 50, "maintenance": 29, "payments": 40, "reliability": 50, "schema": 42, "security": 54, "transparency": 55 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 50, "points": 10, "reason": "Read with the hosted lines on the Exchange API at api.crypto.com. status.crypto.com is a Statuspage site with component history (20). Its feed for 18 August to 3 November 2026 has 25 entries; the Exchange is named in two, an 11-minute database upgrade on 18 August and a one-hour balance display issue on 6 October, while the longer disruptions (Android login on 1 and 5 October, card 3DS on 23 September, Main App predictions on 3 November) are App incidents. There is no Exchange API component, so the record may be incomplete. Minor only (20). Rate limits are documented on exchange-docs.crypto.com, which answered 403 to robots.txt and was not read (0, unchecked). 429 handling and client order ids are on the same host (0, unchecked). No SLA found (0). Generally available (10). 20 + 20 + 0 + 0 + 0 + 10 = 50.", "checked": "2026-11-03" }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 42, "points": 6.83, "reason": "An OpenAPI spec exists, since cdcx-cli generates its 95 commands and tools from it at run time, but its host (exchange-developer.crypto.com) answered 403 to robots.txt and the spec was not read; the vendor's own tooling is evidence it exists, not of its quality (15 of 25). No llms.txt on crypto.com or the Exchange pages (0). For descriptions, cdcx's tool descriptions come from the spec, which we couldn't read; the Exchange skill documents 52 endpoints in prose (8 of 20). cdcx's README says the tools carry typed parameters and enum validation, a vendor claim not checked against the spec (8 of 15). For examples, the skills and cdcx README carry worked commands, but the API's error codes and response examples sit on the unread host (6 of 15). Versioned path (v1); the API changelog and announcements page could not be read (5 of 15). 15 + 0 + 8 + 8 + 6 + 5 = 42.", "checked": "2026-11-03" }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 50, "points": 8.13, "reason": "Graded on the REST API as an agent calls it, with the MCP server noted. cdcx serves up to 95 tools, more than 30, but the default serves the `market` group alone and groups are enabled one by one, which is a read-only subset switch (5 + 10 = 15). Pagination and output controls for the API are on the unread docs host; cdcx adds `-o json|table|ndjson` (8 of 20). cdcx returns structured JSON errors and the safety gate names what is missing; the API's own error table is unread (8 of 20). cdcx's tiers (mutate needs `acknowledged: true`, dangerous needs `--allow-dangerous`), `--dry-run` and paper trading give safe rehearsal, though no MCP annotations or API idempotency keys were seen (12 of 20). No official SDK beyond the CLI; defaults in cdcx are sensible (7 of 15). 15 + 8 + 8 + 12 + 7 = 50.", "checked": "2026-11-03" }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 54, "points": 9.45, "reason": "HMAC-SHA256 API keys made with 2FA; IP whitelisting and pre-approved withdrawal addresses per the official skill, and revocation from the Exchange settings. The permission list (read, trade, withdraw) is on the unread docs host, so scopes are recorded from the skills (20 of 30). On least privilege, the App skill's key has no withdrawal permission, the Exchange skill requires user confirmation before a production trade, and cdcx refuses withdrawals and cancel-all without `--allow-dangerous`; nothing on the server side limits order size (14 of 20). The tools return exchange data, not third-party text, but no guidance on untrusted content was found (6 of 15). An account audit trail is not documented where we could read (4 of 15). No security.txt on crypto.com; cdcx has a SECURITY.md with private reporting and a three-day acknowledgement, and the organisation keeps HackerOne policy guidelines; certifications were not read (10 of 20). 20 + 14 + 6 + 4 + 10 = 54.", "checked": "2026-11-03" }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 40, "points": 5, "reason": "No machine payment protocol (0). Spot fee tiers published without login, 0.25% maker and 0.50% taker at Level 1 (20). The API is free, public market data needs no key, UAT and paper trading need no money (20). A person must sign up in a browser with identity checks and mint the key (0). 0 + 20 + 20 + 0 = 40.", "checked": "2026-11-03" }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 29, "points": 2.54, "reason": "Read as a closed service with an open CLI. The last change we could date is cdcx-cli v1.2.6 on 18 June 2026, 138 days before the check, with no commit since; the API changelog is unread (10). No three dated releases in the last 90 days (0). Five of six open items on cdcx-cli, all by collaborators or Dependabot since May, have no comment; the Exchange has a support chat and contact@crypto.com (8 of 25). Not in the official MCP registry and no official SDK beyond the CLI (5 of 15). CI tests on three operating systems with clippy and fmt; the npm wrapper's postinstall downloads the binary and two Dependabot bumps are open (6 of 10). 10 + 0 + 8 + 5 + 6 = 29.", "checked": "2026-11-03" }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 55, "points": 4.81, "note": "editorial 32, provenance 77", "reason": "The editorial half. A closed service whose terms and trading rules loaded empty for our reader; cdcx and the skills are MIT or Apache-2.0 (10 of 30). The Exchange privacy notice of 12 March 2025 names Foris DAX Limited, gives retention examples (6 years for correspondence, 5 years for EEA AML records) and provider categories, with no DPA or subprocessor list (16 of 30). No deprecation policy or notice period was found (0). Transfers outside the Cayman Islands and the EEA are stated with no countries named (6 of 20). 10 + 16 + 0 + 6 = 32.", "checked": "2026-11-03" } ], "assessment": { "date": "2026-11-03", "basis": "public evidence", "confidence": "low", "notes": { "ergonomics": "Graded on the REST API as an agent calls it, with the MCP server noted. cdcx serves up to 95 tools, more than 30, but the default serves the `market` group alone and groups are enabled one by one, which is a read-only subset switch (5 + 10 = 15). Pagination and output controls for the API are on the unread docs host; cdcx adds `-o json|table|ndjson` (8 of 20). cdcx returns structured JSON errors and the safety gate names what is missing; the API's own error table is unread (8 of 20). cdcx's tiers (mutate needs `acknowledged: true`, dangerous needs `--allow-dangerous`), `--dry-run` and paper trading give safe rehearsal, though no MCP annotations or API idempotency keys were seen (12 of 20). No official SDK beyond the CLI; defaults in cdcx are sensible (7 of 15). 15 + 8 + 8 + 12 + 7 = 50.", "maintenance": "Read as a closed service with an open CLI. The last change we could date is cdcx-cli v1.2.6 on 18 June 2026, 138 days before the check, with no commit since; the API changelog is unread (10). No three dated releases in the last 90 days (0). Five of six open items on cdcx-cli, all by collaborators or Dependabot since May, have no comment; the Exchange has a support chat and contact@crypto.com (8 of 25). Not in the official MCP registry and no official SDK beyond the CLI (5 of 15). CI tests on three operating systems with clippy and fmt; the npm wrapper's postinstall downloads the binary and two Dependabot bumps are open (6 of 10). 10 + 0 + 8 + 5 + 6 = 29.", "payments": "No machine payment protocol (0). Spot fee tiers published without login, 0.25% maker and 0.50% taker at Level 1 (20). The API is free, public market data needs no key, UAT and paper trading need no money (20). A person must sign up in a browser with identity checks and mint the key (0). 0 + 20 + 20 + 0 = 40.", "reliability": "Read with the hosted lines on the Exchange API at api.crypto.com. status.crypto.com is a Statuspage site with component history (20). Its feed for 18 August to 3 November 2026 has 25 entries; the Exchange is named in two, an 11-minute database upgrade on 18 August and a one-hour balance display issue on 6 October, while the longer disruptions (Android login on 1 and 5 October, card 3DS on 23 September, Main App predictions on 3 November) are App incidents. There is no Exchange API component, so the record may be incomplete. Minor only (20). Rate limits are documented on exchange-docs.crypto.com, which answered 403 to robots.txt and was not read (0, unchecked). 429 handling and client order ids are on the same host (0, unchecked). No SLA found (0). Generally available (10). 20 + 20 + 0 + 0 + 0 + 10 = 50.", "schema": "An OpenAPI spec exists, since cdcx-cli generates its 95 commands and tools from it at run time, but its host (exchange-developer.crypto.com) answered 403 to robots.txt and the spec was not read; the vendor's own tooling is evidence it exists, not of its quality (15 of 25). No llms.txt on crypto.com or the Exchange pages (0). For descriptions, cdcx's tool descriptions come from the spec, which we couldn't read; the Exchange skill documents 52 endpoints in prose (8 of 20). cdcx's README says the tools carry typed parameters and enum validation, a vendor claim not checked against the spec (8 of 15). For examples, the skills and cdcx README carry worked commands, but the API's error codes and response examples sit on the unread host (6 of 15). Versioned path (v1); the API changelog and announcements page could not be read (5 of 15). 15 + 0 + 8 + 8 + 6 + 5 = 42.", "security": "HMAC-SHA256 API keys made with 2FA; IP whitelisting and pre-approved withdrawal addresses per the official skill, and revocation from the Exchange settings. The permission list (read, trade, withdraw) is on the unread docs host, so scopes are recorded from the skills (20 of 30). On least privilege, the App skill's key has no withdrawal permission, the Exchange skill requires user confirmation before a production trade, and cdcx refuses withdrawals and cancel-all without `--allow-dangerous`; nothing on the server side limits order size (14 of 20). The tools return exchange data, not third-party text, but no guidance on untrusted content was found (6 of 15). An account audit trail is not documented where we could read (4 of 15). No security.txt on crypto.com; cdcx has a SECURITY.md with private reporting and a three-day acknowledgement, and the organisation keeps HackerOne policy guidelines; certifications were not read (10 of 20). 20 + 14 + 6 + 4 + 10 = 54.", "transparency": "The editorial half. A closed service whose terms and trading rules loaded empty for our reader; cdcx and the skills are MIT or Apache-2.0 (10 of 30). The Exchange privacy notice of 12 March 2025 names Foris DAX Limited, gives retention examples (6 years for correspondence, 5 years for EEA AML records) and provider categories, with no DPA or subprocessor list (16 of 30). No deprecation policy or notice period was found (0). Transfers outside the Cayman Islands and the EEA are stated with no countries named (6 of 20). 10 + 16 + 0 + 6 = 32." }, "sources": [ { "what": "robots.txt (crypto.com allows; exchange-docs.crypto.com, exchange-developer.crypto.com and static2.crypto.com answered 403; help.crypto.com allows; status.crypto.com disallows /api/)", "url": "https://crypto.com/robots.txt", "seen": "2026-11-03" }, { "what": "Exchange home page (links to fees, API, terms, privacy, status)", "url": "https://crypto.com/exchange", "seen": "2026-11-03" }, { "what": "Exchange API overview (REST, WebSocket, FIX coverage)", "url": "https://crypto.com/exchange-pro/en-US/api", "seen": "2026-11-03" }, { "what": "fees and limits", "url": "https://crypto.com/exchange-pro/en-US/document/fees-limits", "seen": "2026-11-03" }, { "what": "terms and conditions (loaded empty)", "url": "https://crypto.com/exchange-pro/en-US/document/tnc", "seen": "2026-11-03" }, { "what": "trading rules (loaded empty)", "url": "https://crypto.com/exchange-pro/en-US/document/trading-rules", "seen": "2026-11-03" }, { "what": "Exchange privacy notice (Foris DAX Limited)", "url": "https://crypto.com/uk/privacy/exchange", "seen": "2026-11-03" }, { "what": "privacy hub (regional notices)", "url": "https://crypto.com/privacy", "seen": "2026-11-03" }, { "what": "App geo-restrictions article", "url": "https://help.crypto.com/en/articles/5792178-geo-restrictions", "seen": "2026-11-03" }, { "what": "about page (founders, leadership, skill and CLI links)", "url": "https://crypto.com/about", "seen": "2026-11-03" }, { "what": "cdcx-cli repository, shallow clone (README, SECURITY.md, safety tiers, OpenAPI fetcher, environments, CI, tags)", "url": "https://github.com/crypto-com/cdcx-cli", "seen": "2026-11-03" }, { "what": "cdcx-cli repository metadata and open items", "url": "https://api.github.com/repos/crypto-com/cdcx-cli", "seen": "2026-11-03" }, { "what": "crypto-agent-trading README (agent skills)", "url": "https://raw.githubusercontent.com/crypto-com/crypto-agent-trading/main/README.md", "seen": "2026-11-03" }, { "what": "crypto-com GitHub organisation repositories and search", "url": "https://api.github.com/orgs/crypto-com/repos?per_page=100\u0026sort=updated", "seen": "2026-11-03" }, { "what": "npm @cryptocom/cdcx-cli latest and weekly downloads", "url": "https://registry.npmjs.org/@cryptocom%2fcdcx-cli/latest", "seen": "2026-11-03" }, { "what": "official MCP registry searches (crypto.com, crypto)", "url": "https://registry.modelcontextprotocol.io/v0/servers?search=crypto.com", "seen": "2026-11-03" }, { "what": "status history feed", "url": "https://status.crypto.com/history.atom", "seen": "2026-11-03" }, { "what": "security.txt (404)", "url": "https://crypto.com/.well-known/security.txt", "seen": "2026-11-03" }, { "what": "RDAP for crypto.com", "url": "https://rdap.verisign.com/com/v1/domain/crypto.com", "seen": "2026-11-03" } ], "openQuestions": [ "Kind http-api. The Exchange's own pages lead with REST, WebSocket and FIX; cdcx-cli is the official MCP route and is in `packages` and `transports`.", "The MCP server is official, local stdio in cdcx-cli, up to 95 tools generated from the OpenAPI spec, `market` group by default, safety tiers from the source. Not in the official MCP registry. No session was opened; the count is the README's and the generator's, since the spec itself could not be read.", "unchecked: everything on exchange-docs.crypto.com and exchange-developer.crypto.com (rate limits, key permissions, error codes, client order ids, idempotency, the OpenAPI spec, the API changelog), because both hosts answered 403 to robots.txt. Reliability's rate-limit and 429 lines and schema's contract line score low for that reason, not because the docs lack them.", "unchecked: the Exchange terms and conditions, trading rules and announcements pages (script-drawn, loaded empty), so the legal entity in the terms, the clauses on API use and bots, and the Exchange's restricted-country list are unconfirmed. The App's geo-restriction article is recorded as the App's list. The US Exchange terms PDF is on static2.crypto.com, which refused robots.txt.", "firstReleased is 17 April 2026, cdcx-cli's initial public release, the earliest first-hand dated evidence of the agent surface; the Exchange API itself is older and its launch date could not be read first-hand. lastRelease is cdcx v1.2.6 of 18 June 2026.", "npm `@cryptocom/cdcx-cli` is at 1.2.3 while the repository's latest tag is v1.2.6; the npm wrapper downloads the binary in a postinstall script and the two versions may track different things. Recorded, not deducted.", "unchecked: SOC 2 or ISO 27001 claims on crypto.com's security pages, the help centre's Exchange API key article (not found by search), and whether the status page posts Exchange API incidents at all.", "The legal entity is Foris DAX Limited (Cayman Islands), from the Exchange privacy notice. The terms may name a different entity by region (Foris DAX MT Limited in Malta, Foris DAX Middle East FZE), unread.", "Our own products. It doesn't do LocalGhost's or letme's job; it trades one exchange account." ] }, "negative": 0, "verdict": "Crypto.com is one of two exchanges here with an official MCP server, cdcx-cli, whose 95 generated tools are grouped by service and gated by safety tier. The API docs, OpenAPI file, terms and trading rules refused or hid from our reader, so rate limits, key permissions and the automated-trading clauses are unchecked, and cdcx has no release since June 2026.", "bestFor": "An agent trading spot or perpetuals on Crypto.com through a local MCP server with safety tiers, for a person outside the App's restricted list.", "strengths": [ "Official cdcx-cli MCP server with 95 typed tools generated from the Exchange's OpenAPI spec, enabled by service group so a session can load `market` alone", "Safety tiers in the source, where order writes need `acknowledged: true` and cancel-all, withdrawals and bot termination need `--allow-dangerous` on the server", "A UAT environment with the same API paths and a local paper-trading engine that needs no credentials", "Spot fee tiers published without login, from 0.25% maker and 0.50% taker", "Official agent skills for the Exchange and the App that require user confirmation before a production trade" ], "weaknesses": [ "exchange-docs.crypto.com and the OpenAPI host answered 403 to robots.txt, so rate limits, key permissions, errors and the changelog could not be read", "The Exchange terms, trading rules and announcements pages load empty without a browser, so clauses on bots, API use and restricted countries are unchecked", "cdcx-cli's last tag is v1.2.6 of 18 June 2026 with no commit since, five of six open items unanswered, and the npm wrapper at 1.2.3 runs a postinstall download", "Not in the official MCP registry and no official SDK beyond the CLI", "No security.txt on crypto.com, and no SLA or Exchange-API component found on the status page" ], "agentNotes": [ "Enable only the service groups the task needs with `cdcx mcp config --enable trade,account` (the default serves `market` alone), and leave `--allow-dangerous` off unless the person asks for withdrawals or cancel-all", "Rehearse on `--env uat` or `cdcx paper` first; production keys trade real funds, and the skill requires explicit user confirmation before each live order", "Put the key in CDCX_API_KEY and CDCX_API_SECRET or `~/.config/cdcx/config.toml` at 0600; there is no key flag, and the key should have no withdrawal permission and an IP allow-list", "Pass `acknowledged: true` on mutate tools and `--dry-run` while testing; read the tool's generated schema before calling, since the docs host is unreadable to agents without a browser", "Check the person's country against Crypto.com's geo-restriction article and the Exchange terms before trading; New York and about 70 countries are excluded from the App, and the Exchange list was unreadable" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "low", "grade": "D", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 46.8 } ], "editorialScores": { "ergonomics": 50, "maintenance": 29, "payments": 40, "reliability": 50, "schema": 42, "security": 54, "transparency": 32 }, "provenanceScore": 77, "checked": { "categories": { "ergonomics": "2026-11-03", "maintenance": "2026-11-03", "payments": "2026-11-03", "reliability": "2026-11-03", "schema": "2026-11-03", "security": "2026-11-03", "transparency": "2026-11-03" }, "last": "2026-11-03", "oldest": "2026-11-03", "stale": false, "staleAfterDays": 90 }, "scoreHistory": [ { "date": "2026-11-03", "grade": "D", "kind": "listed", "method": "0.7", "score": 46.8 } ] }, "connect": { "install": "curl -sSfL https://raw.githubusercontent.com/crypto-com/cdcx-cli/main/install.sh | sh", "http": "curl https://api.crypto.com/exchange/v1/public/get-tickers", "config": { "mcpServers": { "cdcx": { "args": [ "-y", "@cryptocom/cdcx-cli@latest", "mcp" ], "command": "npx", "env": { "CDCX_API_KEY": "your_api_key", "CDCX_API_SECRET": "your_api_secret" } } } } }, "letme": { "capability": "https://letme.dev/exchange.market-data", "tool": "https://letme.dev/crypto-com-exchange" }, "notable": [ "Crypto.com runs an official MCP server as part of cdcx-cli, a Rust binary in github.com/crypto-com/cdcx-cli (initial public release 17 April 2026, v1.2.6 on 18 June 2026). `cdcx mcp` serves up to 95 tools over stdio, generated at run time from the Exchange's OpenAPI spec and enabled by service group (`market` by default; `account`, `trade`, `advanced`, `margin`, `staking`, `funding`, `fiat`, `otc`, `bot` and `stream` with `cdcx mcp config --enable`), with the choice kept in ~/.config/cdcx/mcp.toml. npm wraps it as `@cryptocom/cdcx-cli` 1.2.3, whose postinstall script downloads the binary; Claude Code, Codex and Cursor plugins are in the repository (https://github.com/crypto-com/cdcx-cli)", "cdcx's safety tiers come from the source. Public endpoints are read, order creation, amendment, cancellation, margin multiplier changes, staking and subaccount transfers are mutate and need `acknowledged: true`, and cancel-all-orders, create-withdrawal, fiat withdrawals and terminating a trading bot are dangerous and refused unless the server starts with `--allow-dangerous` (crates/cdcx-core/src/safety.rs, read 2026-11-03)", "Not in the official MCP registry. Searches for crypto.com and crypto on 3 November 2026 found no server from Crypto.com (https://registry.modelcontextprotocol.io/v0/servers?search=crypto.com)", "A second official repository, crypto-com/crypto-agent-trading (February 2026), holds two SKILL.md skills, one for the Crypto.com App and one for the Exchange that documents 52 endpoints and requires explicit user confirmation before a production trade; Crypto.com's about page links both under Trading Skill Repo and CDCX CLI (https://github.com/crypto-com/crypto-agent-trading, https://crypto.com/about)", "The Exchange API docs host, exchange-docs.crypto.com, and the OpenAPI host cdcx reads from, exchange-developer.crypto.com/exchange/v1/openapi/, both answered 403 to robots.txt, so nothing on either was fetched. Rate limits, the key permission list, error codes, client order ids and the API changelog are unchecked for that reason (crates/cdcx-core/src/openapi/fetcher.rs)", "cdcx names two environments, production at api.crypto.com/exchange/v1 with wss streams and UAT at uat-api.3ona.co with uat-stream.3ona.co, selected with `--env uat`. The Exchange skill calls UAT a sandbox for institutional users (crates/cdcx-core/src/env.rs)", "The Exchange API page says REST and WebSocket cover spot, perpetuals and OTC, FIX covers spot, perpetuals and the two Predictions venues, and REST and WebSocket for Predictions are coming soon (https://crypto.com/exchange-pro/en-US/api)", "The Exchange privacy notice (last updated 12 March 2025) names Foris DAX Limited, an exempted company in the Cayman Islands (QH-354886), keeps chats and letters up to 6 years after the relationship ends and 5 years for EEA AML records, and names provider categories but no subprocessors (https://crypto.com/uk/privacy/exchange)", "The Exchange terms and conditions, trading rules and announcements pages draw their text by script and loaded empty for our reader, so the clauses on API use, bots and restricted jurisdictions are unchecked. The App's geo-restrictions article (12 May 2026) lists about 70 restricted countries and New York, and says it applies to the App (https://help.crypto.com/en/articles/5792178-geo-restrictions)", "status.crypto.com's feed for 18 August to 3 November 2026 names the Exchange in two of 25 entries, an 11-minute database upgrade on 18 August and a wallet balance display issue on 6 October; the longer disruptions (Android login, card 3DS, predictions in the Main App) are App incidents (https://status.crypto.com/history.atom)" ], "area": "payments", "details": [ { "label": "Surface listed", "value": "The hosted Exchange API at api.crypto.com/exchange/v1 as an agent calls it, read from crypto.com's Exchange pages (API overview, fees, privacy notice), the cdcx-cli and crypto-agent-trading repositories (shallow clone and READMEs), npm, status.crypto.com, the MCP registry and the help centre on 3 November 2026. The API docs host and the OpenAPI host refused robots.txt and were not fetched. No account, key, session or order" }, { "label": "MCP server", "value": "Official. `cdcx mcp` in github.com/crypto-com/cdcx-cli (Rust, MIT or Apache-2.0), stdio, 95 tools generated from the OpenAPI spec at run time, enabled by service group, with read, sensitive_read, mutate and dangerous tiers. npm `@cryptocom/cdcx-cli` 1.2.3 (repository tag v1.2.6, 18 June 2026). Authenticates with the Exchange API key and secret from the environment or config file. Not in the official MCP registry" }, { "label": "Key permissions", "value": "Keys are made under Settings \u003e API Keys with 2FA. The official skills say to recommend IP whitelisting in production, that withdrawal addresses must be pre-approved, and the App skill's key has no withdrawal permission. The permission list itself (read, trade, withdraw) is on the docs host we couldn't read" }, { "label": "Rate limits", "value": "Unchecked. They are documented on exchange-docs.crypto.com, which answered 403 to robots.txt. cdcx's README does not state them" }, { "label": "Testnet or sandbox", "value": "UAT at https://uat-api.3ona.co/exchange/v1 with wss://uat-stream.3ona.co market and user streams, selected in cdcx with `--env uat`; the Exchange skill calls it a sandbox for institutional users. cdcx also has a local paper-trading engine (`cdcx paper`) with no credentials and no MCP tools" }, { "label": "Countries served", "value": "Unchecked for the Exchange; its terms loaded empty. The App's geo-restrictions article of 12 May 2026 lists about 70 restricted countries and regions (China, Russia, Iran, Cuba, North Korea, Venezuela, Indonesia and others), New York state and five Ukrainian regions, and says it covers the App" }, { "label": "Fees at the lowest tier", "value": "Spot 0.2500% maker and 0.5000% taker under $10,000 of 30-day volume, 0.2425% and 0.4850% with a CRO balance; 0.08% and 0.18% at $500,000 or more. Derivatives fees not on the page; liquidation fee 0.5%" }, { "label": "FIX and WebSocket", "value": "REST and WebSocket for spot, perpetuals and OTC (`user.order.{instrument_name}` streams); FIX for spot, perpetuals and the Predictions DCM and FCM venues; REST and WebSocket for Predictions coming soon, per the Exchange API page" }, { "label": "Terms on automated trading", "value": "Unchecked. The terms and conditions and trading rules pages at crypto.com/exchange-pro/en-US/document/ draw their text by script and loaded empty. The Exchange API page says only that it is built for automated trading" }, { "label": "Agent skills", "value": "crypto-com/crypto-agent-trading holds a Crypto.com App skill (market buys, sells, swaps, balances, a kill switch; Apache-2.0) and an Exchange spot skill documenting 52 endpoints with order groups (OCO, OTO, OTOCO) that requires explicit user confirmation before a production trade (MIT). cdcx-cli ships 13 more skill files" }, { "label": "Legal entity", "value": "Foris DAX Limited, an exempted company in the Cayman Islands (registration QH-354886), named as the Exchange's data controller in its privacy notice of 12 March 2025. Regional affiliates (Foris DAX MT Limited in Malta, Foris DAX Middle East FZE) run local services" }, { "label": "Status", "value": "status.crypto.com, a Statuspage site shared with the App and Card; the Exchange is named in two of 25 entries since 18 August 2026 and there is no Exchange API component" } ], "unitPrices": [ { "item": "Spot maker fee, Level 1 (under $10,000 of 30-day volume)", "unit": "pct", "usd": 0.25, "note": "0.2425% with a CRO balance" }, { "item": "Spot taker fee, Level 1", "unit": "pct", "usd": 0.5, "note": "falls to 0.18% at $500,000 or more of 30-day volume" } ], "provenance": { "legalEntity": "Foris DAX Limited", "domain": "crypto.com", "domainRegistered": "1993-05-06", "endpointOnVendorDomain": true, "terms": "https://crypto.com/exchange-pro/en-US/document/tnc", "privacy": "https://crypto.com/uk/privacy/exchange", "statusPage": "https://status.crypto.com", "changelog": "", "securityTxt": "none", "checked": "2026-11-03", "notes": [ "Foris DAX Limited is named in the Exchange privacy notice (last updated 12 March 2025) as a Cayman Islands exempted company. The terms and conditions page loaded empty, so the entity in the terms is unconfirmed.", "RDAP gives crypto.com a registration date of 6 May 1993.", "https://crypto.com/.well-known/security.txt returns 404. cdcx-cli has a SECURITY.md with private vulnerability reporting through GitHub, and the crypto-com organisation has an h1-policy-guidelines repository.", "crypto.com/robots.txt allows the pages read; exchange-docs.crypto.com, exchange-developer.crypto.com and static2.crypto.com answered 403 to robots.txt and nothing on them was fetched. help.crypto.com allows with Crawl-delay 1.", "No API changelog could be read; the Exchange announcements page loaded empty." ], "score": 77, "checks": [ { "check": "Legal entity named", "value": "Foris DAX Limited", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "crypto.com, registered 1993-05-06 (33 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "crypto.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "published, but our reader couldn't read it", "points": 7, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 7 of the 8 things a reader expects", "points": 9.3, "max": 10, "state": "part" }, { "check": "Status page", "value": "status.crypto.com", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "People named", "value": "4 named with their role, none with a public profile", "points": 7, "max": 10, "state": "part" }, { "check": "Support route", "value": "a support address, help pages, a community", "points": 5, "max": 5, "state": "ok" } ], "policies": [ { "kind": "terms", "url": "https://crypto.com/exchange-pro/en-US/document/tnc", "state": "unreadable", "reason": "the page has 95 words of text without a browser, so the document is drawn by script or sits elsewhere", "readAt": "2026-11-03", "points": 7, "max": 10 }, { "kind": "privacy", "url": "https://crypto.com/uk/privacy/exchange", "state": "read", "readAt": "2026-11-03", "statedDate": "2025-03-12", "words": 6443, "points": 9.3, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": true, "quote": "LAST UPDATE: 12 MAR 2025", "says": "Last updated 2025-03-12" }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "This Privacy Notice aims to give you information on why and how we collect and process your personal data." }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "email addresses and content, chats, letters will be kept up to 6 years following the end of our relationship, in accordance with the limitation period applicable in the Cayman Islands);", "says": "Names a period of 6 years" }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "Clicking on those links or enabling those connections may allow third parties to collect or share data about you." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": false }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "This is because blockchains are public decentralised networks and blockchain technology does not generally allow for data to be deleted and your right to erasure may not be able to be fully enforced." }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "We have appointed a Data Protection Officer (“DPO”) who is responsible for overseeing questions in relation to this Privacy Notice.", "says": "Names a data protection officer" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "a specific contract approved by the European Commission which gives safeguards to the processing of personal data, the so called Standard Contractual Clauses.", "says": "Relies on standard contractual clauses" } ] } ] }, "humans": { "slug": "crypto-com-exchange", "checked": "2026-11-03", "company": "Crypto.com", "people": [ { "name": "Kris Marszalek", "role": "Co-founder and CEO, Crypto.com", "founder": true, "page": "/people/kris-marszalek/" }, { "name": "Rafael Melo", "role": "Co-founder and CFO, Crypto.com", "founder": true, "page": "/people/rafael-melo/" }, { "name": "Bobby Bao", "role": "Co-founder and Head of Crypto.com Capital, Crypto.com", "founder": true, "page": "/people/bobby-bao/" }, { "name": "Eric Anziani", "role": "President and COO, Crypto.com", "page": "/people/eric-anziani/" } ], "peopleNote": "Crypto.com's about page, read 3 November 2026, names Kris Marszalek (Co-Founder and CEO, based in Hong Kong), Rafael Melo (Co-Founder and CFO), Bobby Bao (Co-Founder, Head of Crypto.com Capital) and Eric Anziani (President and COO). The founders are the company's, not the Exchange product team's. No personal LinkedIn, X or GitHub accounts are linked from the page. The Exchange is operated by Foris DAX Limited, an exempted company in the Cayman Islands per the Exchange privacy notice, which is a private company form, so ownership is recorded as private. Investors were looked for on the about page, the Exchange pages, the privacy hub and the GitHub organisation; nothing names a funding round or backers, and no outside search was made in this pass, so a later pass should look at the company's press pages.", "companySocial": { "linkedin": "https://www.linkedin.com/company/cryptocom", "x": "https://x.com/cryptocom", "github": "https://github.com/crypto-com" }, "support": { "emails": [ "contact@crypto.com" ], "urls": [ "https://help.crypto.com/en", "https://chat.crypto.com/", "https://status.crypto.com/" ], "community": [ { "label": "Crypto.com Discord", "url": "https://discord.gg/cryptocom", "kind": "discord" }, { "label": "r/Crypto_com", "url": "https://www.reddit.com/r/Crypto_com/", "kind": "forum" }, { "label": "cdcx-cli issues", "url": "https://github.com/crypto-com/cdcx-cli/issues", "kind": "github" } ], "contactEmails": [ "contact@crypto.com" ], "contactUrls": [ "https://chat.crypto.com/" ] }, "sources": [ "https://crypto.com/about", "https://crypto.com/exchange", "https://crypto.com/exchange-pro/en-US/api", "https://crypto.com/privacy", "https://crypto.com/uk/privacy/exchange", "https://github.com/crypto-com/cdcx-cli", "https://api.github.com/orgs/crypto-com/repos?per_page=100\u0026sort=updated" ], "ownership": { "status": "private", "checked": "2026-11-03", "sources": [ "https://crypto.com/uk/privacy/exchange", "https://crypto.com/about" ] } }, "pageJsonUrl": "https://www.anchorterminal.com/tools/crypto-com-exchange.json", "live": { "slug": "crypto-com-exchange", "vendorStatus": { "page": "https://status.crypto.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-04T19:31:25.67044313Z" }, "securityTxt": { "url": "https://crypto.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-04T15:54:09.539387255Z" }, "updatedAt": "2026-11-04T19:31:25.67044313Z" } } }