{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-04", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "tool": { "slug": "deribit", "name": "Deribit", "vendor": "Deribit FZE", "vendorUrl": "https://www.deribit.com", "kind": "http-api", "category": "crypto-exchanges", "summary": "Deribit is a crypto options, futures and perpetuals exchange owned by Coinbase, with a JSON-RPC API over WebSocket and HTTP, a FIX API and a test environment at test.deribit.com.", "url": "https://www.anchorterminal.com/tools/deribit", "markdownUrl": "https://www.anchorterminal.com/tools/deribit.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/deribit.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/deribit.json", "dns": "deribit.grade.anchorterminal.com", "license": "Proprietary hosted exchange. The API is documented under the Deribit docs with an OpenAPI 3.0 file; no official client library is published", "transports": [], "packages": [], "auth": "api-key", "authNotes": "API keys are made in the account settings or with `private/create_api_key`, each with scopes `account`, `trade`, `wallet`, `block_trade` and `block_rfq` at `read`, `read_write` or `none`, plus `ip:ADDR` and `expires` limits. Tokens come from `public/auth` by `client_credentials` (key and secret), `client_signature` (HMAC-SHA256 over timestamp, nonce and data, so the secret never travels) or `refresh_token`. Self-generated Ed25519 or RSA keys let Deribit hold only the public half. The HTTP example passes `client_secret` in the query string (https://docs.deribit.com/articles/authentication, https://docs.deribit.com/articles/access-scope, checked 2026-11-03).", "pricing": "usage", "pricingNotes": "The API has no charge of its own; trades pay maker and taker fees per instrument. The fee schedule is on support.deribit.com, which answered our reader with 403, so the lowest-tier rates are unchecked. Deribit's own posts of 14 October and 2 November 2026 give VIP4 to VIP7 taker fees of 1.75 to 1.40 bps on perpetuals and futures from 19 October 2026, and 0 bps maker fees on USDC-settled linear daily options from 5 November 2026 (https://insights.deribit.com/exchange-updates/new-fee-tier-on-perpetuals-and-futures/, checked 2026-11-03).", "priceSummary": "0.02% fee", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the API docs, the OpenAPI file or the articles index (checked 2026-11-03). Accounts are funded by crypto deposit after a browser signup.", "endpoints": [] }, "toolCount": 0, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-03" }, "docsUrl": "https://docs.deribit.com/", "llmsTxt": "https://docs.deribit.com/llms.txt", "openapi": "https://docs.deribit.com/specifications/deribit_openapi.json", "capabilities": [ "exchange.derivatives", "exchange.market-data", "exchange.spot-trading", "exchange.balances", "exchange.transfers", "market.crypto" ], "tags": [ "official", "hosted", "closed-source", "openapi", "llms-txt", "api-key", "sandbox", "usage-priced", "no-status-page", "bug-bounty", "rest" ], "lastRelease": "2026-10-13", "graded": true, "anchor": { "graded": true, "score": 59, "grade": "C", "agentReady": false, "rank": 650, "ranked": true, "rankOf": 1349, "categoryRank": 9, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 74, "maintenance": 65, "payments": 25, "reliability": 45, "schema": 88, "security": 62, "transparency": 46 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 45, "points": 9, "reason": "Read with the hosted lines on the JSON-RPC API. status.deribit.com did not resolve for our reader on 3 November 2026 and Coinbase's status page showed no Deribit component, so no status page is scored, with the unchecked line below (0). No readable history (5). Rate limits are documented with numbers, 50,000 credits per sub-account refilled at 10,000 a second, and matching-engine tiers of 5 to 30 requests a second by 7-day volume (15). Error 10028 ends the session and the errors page says to back off exponentially; 10040 means retry; the 6 May 2026 release added a `nonce` for idempotent orders (15). No SLA found (0). The API is generally available; only Starbase is limited to selected clients (10). 0 + 5 + 15 + 15 + 0 + 10 = 45.", "checked": "2026-11-03" }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 88, "points": 14.3, "reason": "OpenAPI 3.0.0 for the whole JSON-RPC surface (Deribit API 2.1.1, about 1.4 million characters) plus AsyncAPI files for the WebSocket side (25). llms.txt with production and upcoming indexes, and a Markdown twin of every page (10). Each operation has a description such as \"Places a buy order for an instrument.\" with parameter notes, and the articles say when to use WebSocket subscriptions over polling, but the reference seldom says when not to use a method (13 of 20). Parameters are typed with enums (order `type` has eight values, `time_in_force` four) and required flags, with `amount` or `contracts` as a documented either-or (13 of 15). Every reference page carries an example request and response, and the errors page lists about 159 codes with retry guidance, though most operations document only a 200 response and the smaller error tables disagree with the full one on two codes (12 of 15). A versioned path (/api/v2), a production and an upcoming docs branch, and a dated changelog of 64 entries since 21 January 2020 (15). Total 88.", "checked": "2026-11-03" }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 74, "points": 12.03, "reason": "An API, read for response sizing. `public/get_order_book` takes `depth`, `get_instruments` filters by currency and kind, and history methods take `count` and `offset`, though `get_instruments` returns every instrument for a currency and costs 10,000 credits (18 of 25). Count and offset pagination, time ranges on trade and transaction logs, and WebSocket channels with interval and depth options (16 of 20). Numeric error codes with short names, a `wait` value on some errors, and sample code that branches on them (18 of 20). A `nonce` on orders since May 2026 returns the existing order on retry, a `label` lets an agent find its own orders, and 10040 marks the calls safe to retry; no MCP annotations apply (16 of 20). Few required parameters and sensible defaults (limit and good_til_cancelled), but no official SDK in any language, so every caller signs and frames JSON-RPC itself (6 of 15). Total 74.", "checked": "2026-11-03" }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 62, "points": 10.85, "reason": "Keys carry five scopes at read, read_write or none, `ip:ADDR` and `expires` limits, can be disabled, reset and removed by API, and self-generated Ed25519 or RSA keys keep the private half off Deribit. The HTTP `client_credentials` example passes `client_secret` in the query string, a documented option, so 10 off (20 of 30). `trade:read` and `wallet:none` give read-only and no-withdrawal keys and the 5 August 2025 release stopped `account:read` keys reading other keys' secrets; no per-order confirmation and the address allow-list article was unreadable (16 of 20). The API returns no untrusted content (10). `private/list_api_keys`, the transaction log and order history let an operator see what a key did, but no per-key call log was found (8 of 15). A HackerOne bug bounty per the support article title and HackerOne's customer story, neither page read first-hand (insights.deribit.com/bug-bounty answered 403), a VARA licence, and no security.txt on www.deribit.com (8 of 20). Total 62.", "checked": "2026-11-03" }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 25, "points": 3.13, "reason": "No machine payment protocol (0). The fee schedule is on support.deribit.com, which answered 403; Deribit's own posts give VIP4 to VIP7 taker fees and the 0 bps linear options maker fee, so partial prices are public but the lowest tier is unchecked (5 of 20). Public market data needs no key and the test environment is free, with no card anywhere (20). A person signs up in a browser with identity checks before any key exists (0). Total 25.", "checked": "2026-11-03" }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 65, "points": 5.69, "reason": "Read as a closed service. The JSON-RPC changelog's latest production entry is 13 October 2026 and an entry dated 5 November 2026 describes the next release; Deribit's posts of 14 October and 2 November 2026 change fees (30). Entries of 18 August, 15 September and 13 October 2026, three in 90 days (20). A public changelog and a support site; whether support answers wasn't tested and the support site refused our reader (10 of 15). No official SDK and no MCP registry entry (0). The OpenAPI and AsyncAPI files are maintained with the docs (5 of 10). Total 65.", "checked": "2026-11-03" }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 46, "points": 4.03, "note": "editorial 22, provenance 69", "reason": "The editorial half. A closed service whose terms (Deribit FZE membership terms and DRB Panama Inc. terms) sit on a support site that answered 403, with the entity confirmed on VARA's register (12 of 30). The privacy policy was not read, and nothing in the docs states retention (0 of 30). The changelog marks deprecations and the upcoming docs branch previews the next release, but removals such as `public/get_index` on 25 November 2025 carry no notice period (10 of 20). No subprocessor or data-location statement found (0 of 20). Total 22.", "checked": "2026-11-03" } ], "assessment": { "date": "2026-11-03", "basis": "public evidence", "confidence": "low", "notes": { "ergonomics": "An API, read for response sizing. `public/get_order_book` takes `depth`, `get_instruments` filters by currency and kind, and history methods take `count` and `offset`, though `get_instruments` returns every instrument for a currency and costs 10,000 credits (18 of 25). Count and offset pagination, time ranges on trade and transaction logs, and WebSocket channels with interval and depth options (16 of 20). Numeric error codes with short names, a `wait` value on some errors, and sample code that branches on them (18 of 20). A `nonce` on orders since May 2026 returns the existing order on retry, a `label` lets an agent find its own orders, and 10040 marks the calls safe to retry; no MCP annotations apply (16 of 20). Few required parameters and sensible defaults (limit and good_til_cancelled), but no official SDK in any language, so every caller signs and frames JSON-RPC itself (6 of 15). Total 74.", "maintenance": "Read as a closed service. The JSON-RPC changelog's latest production entry is 13 October 2026 and an entry dated 5 November 2026 describes the next release; Deribit's posts of 14 October and 2 November 2026 change fees (30). Entries of 18 August, 15 September and 13 October 2026, three in 90 days (20). A public changelog and a support site; whether support answers wasn't tested and the support site refused our reader (10 of 15). No official SDK and no MCP registry entry (0). The OpenAPI and AsyncAPI files are maintained with the docs (5 of 10). Total 65.", "payments": "No machine payment protocol (0). The fee schedule is on support.deribit.com, which answered 403; Deribit's own posts give VIP4 to VIP7 taker fees and the 0 bps linear options maker fee, so partial prices are public but the lowest tier is unchecked (5 of 20). Public market data needs no key and the test environment is free, with no card anywhere (20). A person signs up in a browser with identity checks before any key exists (0). Total 25.", "reliability": "Read with the hosted lines on the JSON-RPC API. status.deribit.com did not resolve for our reader on 3 November 2026 and Coinbase's status page showed no Deribit component, so no status page is scored, with the unchecked line below (0). No readable history (5). Rate limits are documented with numbers, 50,000 credits per sub-account refilled at 10,000 a second, and matching-engine tiers of 5 to 30 requests a second by 7-day volume (15). Error 10028 ends the session and the errors page says to back off exponentially; 10040 means retry; the 6 May 2026 release added a `nonce` for idempotent orders (15). No SLA found (0). The API is generally available; only Starbase is limited to selected clients (10). 0 + 5 + 15 + 15 + 0 + 10 = 45.", "schema": "OpenAPI 3.0.0 for the whole JSON-RPC surface (Deribit API 2.1.1, about 1.4 million characters) plus AsyncAPI files for the WebSocket side (25). llms.txt with production and upcoming indexes, and a Markdown twin of every page (10). Each operation has a description such as \"Places a buy order for an instrument.\" with parameter notes, and the articles say when to use WebSocket subscriptions over polling, but the reference seldom says when not to use a method (13 of 20). Parameters are typed with enums (order `type` has eight values, `time_in_force` four) and required flags, with `amount` or `contracts` as a documented either-or (13 of 15). Every reference page carries an example request and response, and the errors page lists about 159 codes with retry guidance, though most operations document only a 200 response and the smaller error tables disagree with the full one on two codes (12 of 15). A versioned path (/api/v2), a production and an upcoming docs branch, and a dated changelog of 64 entries since 21 January 2020 (15). Total 88.", "security": "Keys carry five scopes at read, read_write or none, `ip:ADDR` and `expires` limits, can be disabled, reset and removed by API, and self-generated Ed25519 or RSA keys keep the private half off Deribit. The HTTP `client_credentials` example passes `client_secret` in the query string, a documented option, so 10 off (20 of 30). `trade:read` and `wallet:none` give read-only and no-withdrawal keys and the 5 August 2025 release stopped `account:read` keys reading other keys' secrets; no per-order confirmation and the address allow-list article was unreadable (16 of 20). The API returns no untrusted content (10). `private/list_api_keys`, the transaction log and order history let an operator see what a key did, but no per-key call log was found (8 of 15). A HackerOne bug bounty per the support article title and HackerOne's customer story, neither page read first-hand (insights.deribit.com/bug-bounty answered 403), a VARA licence, and no security.txt on www.deribit.com (8 of 20). Total 62.", "transparency": "The editorial half. A closed service whose terms (Deribit FZE membership terms and DRB Panama Inc. terms) sit on a support site that answered 403, with the entity confirmed on VARA's register (12 of 30). The privacy policy was not read, and nothing in the docs states retention (0 of 30). The changelog marks deprecations and the upcoming docs branch previews the next release, but removals such as `public/get_index` on 25 November 2025 carry no notice period (10 of 20). No subprocessor or data-location statement found (0 of 20). Total 22." }, "sources": [ { "what": "API welcome page (interfaces, base URLs, test environment)", "url": "https://docs.deribit.com/", "seen": "2026-11-03" }, { "what": "docs robots.txt", "url": "https://docs.deribit.com/robots.txt", "seen": "2026-11-03" }, { "what": "docs sitemap", "url": "https://docs.deribit.com/sitemap.xml", "seen": "2026-11-03" }, { "what": "llms.txt and production index", "url": "https://docs.deribit.com/llms.txt", "seen": "2026-11-03" }, { "what": "access scopes", "url": "https://docs.deribit.com/articles/access-scope", "seen": "2026-11-03" }, { "what": "authentication (grant types, signature, query-string example)", "url": "https://docs.deribit.com/articles/authentication", "seen": "2026-11-03" }, { "what": "asymmetric API keys", "url": "https://docs.deribit.com/articles/asymmetric-api-keys", "seen": "2026-11-03" }, { "what": "rate limits", "url": "https://docs.deribit.com/articles/rate-limits", "seen": "2026-11-03" }, { "what": "error codes and retry guidance", "url": "https://docs.deribit.com/articles/errors", "seen": "2026-11-03" }, { "what": "API usage policy", "url": "https://docs.deribit.com/articles/api-usage-policy.md", "seen": "2026-11-03" }, { "what": "spot trading venues (Coinbase-routed instruments)", "url": "https://docs.deribit.com/articles/spot-trading-venues.md", "seen": "2026-11-03" }, { "what": "Coinbase International Exchange migration", "url": "https://docs.deribit.com/articles/intx-api-migration.md", "seen": "2026-11-03" }, { "what": "private/buy reference page", "url": "https://docs.deribit.com/api-reference/trading/private-buy", "seen": "2026-11-03" }, { "what": "OpenAPI file (first 100,000 characters)", "url": "https://docs.deribit.com/specifications/deribit_openapi.json", "seen": "2026-11-03" }, { "what": "JSON-RPC changelog", "url": "https://docs.deribit.com/changelogs/jsonrpc", "seen": "2026-11-03" }, { "what": "official MCP registry search", "url": "https://registry.modelcontextprotocol.io/v0/servers?search=deribit", "seen": "2026-11-03" }, { "what": "GitHub organisation (0 public repositories)", "url": "https://api.github.com/users/deribit", "seen": "2026-11-03" }, { "what": "insights.deribit.com index and robots.txt", "url": "https://insights.deribit.com/", "seen": "2026-11-03" }, { "what": "fee tier post, 14 October 2026", "url": "https://insights.deribit.com/exchange-updates/new-fee-tier-on-perpetuals-and-futures/", "seen": "2026-11-03" }, { "what": "linear options maker fee post, 2 November 2026", "url": "https://insights.deribit.com/exchange-updates/0-bps-maker-fees-on-linear-daily-options/", "seen": "2026-11-03" }, { "what": "matching engine post, 21 September 2026", "url": "https://insights.deribit.com/exchange-updates/deribits-new-matching-engine-from-milliseconds-to-microseconds/", "seen": "2026-11-03" }, { "what": "product expansion post, 16 September 2026", "url": "https://insights.deribit.com/exchange-updates/deribit-launches-its-biggest-ever-product-expansion/", "seen": "2026-11-03" }, { "what": "Deribit FZE launch post, 29 November 2024 (entities, CEO)", "url": "https://insights.deribit.com/exchange-updates/deribit-to-launch-1-jan-2025-as-a-fully-licensed-spot-and-derivatives-exchange-in-dubai-uae/", "seen": "2026-11-03" }, { "what": "VARA public register entry for Deribit FZE", "url": "https://www.vara.ae/en/licenses-and-register/public-register/deribit-fze/", "seen": "2026-11-03" }, { "what": "The Block, Coinbase completes acquisition, 14 August 2025", "url": "https://www.theblock.co/post/366957/coinbase-completes-2-9-billion-cash-and-stock-acquisition-of-deribit", "seen": "2026-11-03" }, { "what": "support site robots.txt (articles allowed; the pages answered 403)", "url": "https://support.deribit.com/robots.txt", "seen": "2026-11-03" }, { "what": "Coinbase status page history (no Deribit component)", "url": "https://status.coinbase.com/history", "seen": "2026-11-03" }, { "what": "RDAP for deribit.com", "url": "https://rdap.verisign.com/com/v1/domain/deribit.com", "seen": "2026-11-03" }, { "what": "security.txt (HTML page returned)", "url": "https://www.deribit.com/.well-known/security.txt", "seen": "2026-11-03" } ], "openQuestions": [ "unchecked: the fee schedule, the terms of service, the privacy policy, the restricted-jurisdictions list and the bug bounty article on support.deribit.com, which answered 403 to our reader (its robots.txt allows articles). Fees and countries are recorded from Deribit's own posts and a search snippet, with the lowest tier absent.", "unchecked: the status page. status.deribit.com did not resolve on 3 November 2026; third-party trackers describe one. Reliability scores it absent.", "unchecked: the HackerOne programme page and insights.deribit.com/bug-bounty (403). The programme is scored from the support article title and HackerOne's customer story, both seen only as search results.", "firstReleased is 21 January 2020, the oldest entry in the JSON-RPC changelog. Deribit itself launched in 2016 per The Block, and the GitHub organisation dates from 26 July 2016; no first-hand launch date was read.", "Judgement call, no deduction. The changelog records breaking changes without a stated notice period (the `state` field on 13 January 2026, `user.changes` on 15 September 2026), but the docs keep an upcoming branch that previews the next release, which is a form of notice; whether each change appeared there before release wasn't checked.", "The changelog entry dated 05.11.2026 describes a release two days after this check. Recorded as the next release, not as shipped.", "Which entity an agent contracts with depends on the client type (Deribit FZE for institutional and qualified investors, DRB Panama Inc. for retail) per Deribit's post of 29 November 2024; whether that split changed after the Coinbase acquisition wasn't established.", "Our own products. It doesn't do LocalGhost's or letme's job. Graded the normal way.", "Not coinbase-mcp or coinbase-advanced-trade. Deribit is Coinbase's derivatives exchange with its own API, accounts and keys." ] }, "negative": 0, "verdict": "Deribit's JSON-RPC API has scoped keys with IP and expiry limits, asymmetric signing, an OpenAPI file, numeric rate limits and a 64-entry changelog. There is no official MCP server or client library, the fee schedule, terms and privacy policy sit on a support site that refused our reader, and the status page did not resolve.", "bestFor": "An agent trading crypto options, dated futures and perpetuals for an institutional or retail Deribit account, and anyone migrated from Coinbase International Exchange.", "strengths": [ "Keys carry `account`, `trade`, `wallet`, `block_trade` and `block_rfq` scopes at read, read_write or none, with `ip:ADDR` and `expires` limits, and Ed25519 or RSA keys keep the private half off Deribit", "OpenAPI 3.0 and AsyncAPI files, llms.txt indexes and Markdown twins for every reference page", "Credit-based rate limits with numbers, per sub-account, and an errors page of about 159 codes with retry guidance (10028 back off, 10040 retry, 13009 refresh)", "A separate test environment at test.deribit.com with the same API and its own accounts and keys", "A dated JSON-RPC changelog since 2020 and an upcoming docs branch that previews the next release" ], "weaknesses": [ "No official MCP server, and the GitHub organisation has no public repositories, so no official SDK in any language", "The fee schedule, terms of service, privacy policy and restricted-jurisdictions list are on support.deribit.com, which answered 403, so the lowest-tier maker and taker fees are unchecked", "status.deribit.com did not resolve for our reader and Coinbase's status page has no Deribit component we could find, so the incident record is unchecked", "The HTTP authentication example sends `client_secret` in the query string", "Breaking changes such as the 15 September 2026 change to `user.changes` carry no notice period in the changelog" ], "agentNotes": [ "Create the key with `trade:read_write` and `wallet:none`, an `ip:` limit and an `expires` value; keep `account:read` unless the task edits subaccounts", "Authenticate with `client_signature` or an Ed25519 key over WebSocket rather than `client_credentials` over HTTP, which puts the secret in the URL", "Watch the `limits` field of `private/get_account_summary` and back off on error 10028; a session that runs out of credits is closed and must reconnect", "Send a `nonce` with orders so a retry after a timeout does not place a second order, and treat `order_not_found` on cancel as a possible fill", "Develop against https://test.deribit.com/api/v2 first; production and test need separate accounts and keys" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "low", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 59 } ], "editorialScores": { "ergonomics": 74, "maintenance": 65, "payments": 25, "reliability": 45, "schema": 88, "security": 62, "transparency": 22 }, "provenanceScore": 69, "checked": { "categories": { "ergonomics": "2026-11-03", "maintenance": "2026-11-03", "payments": "2026-11-03", "reliability": "2026-11-03", "schema": "2026-11-03", "security": "2026-11-03", "transparency": "2026-11-03" }, "last": "2026-11-03", "oldest": "2026-11-03", "stale": false, "staleAfterDays": 90 }, "scoreHistory": [ { "date": "2026-11-03", "grade": "C", "kind": "listed", "method": "0.7", "score": 59 } ] }, "connect": { "http": "curl 'https://test.deribit.com/api/v2/public/get_order_book?instrument_name=BTC-PERPETUAL\u0026depth=5'" }, "letme": { "capability": "https://letme.dev/exchange.derivatives", "tool": "https://letme.dev/deribit" }, "notable": [ "No official MCP server. The official MCP registry's search for deribit lists only io.github.mrfentmen/deribit-mcp, a third party's stdio package for index prices and tickers; Deribit's docs and its GitHub organisation (0 public repositories) have none (https://registry.modelcontextprotocol.io/v0/servers?search=deribit)", "Coinbase International Exchange consolidated into Deribit on 1 October 2026; its API keys don't work on Deribit, each migrated account needs a new Deribit key with its own IP allowlist, and open positions moved as block trades tagged Migration (https://docs.deribit.com/articles/intx-api-migration.md)", "A new matching engine moved order entry latency from a 4.7 ms median on the Classic API to 76 µs on the new binary interfaces (Starbase), which need colocation or AWS PrivateLink; the Classic JSON-RPC API stays supported (https://insights.deribit.com/exchange-updates/deribits-new-matching-engine-from-milliseconds-to-microseconds/)", "Rate limits are credits per sub-account, 50,000 with 10,000 refilled a second at 500 a request for non-matching calls, and matching-engine tiers from 5 requests a second (burst 20) under USD 1 million of 7-day volume to 30 a second (burst 100) above USD 25 million. Exceeding them returns error 10028 and ends the session (https://docs.deribit.com/articles/rate-limits)", "The JSON-RPC changelog has 64 dated entries since 21 January 2020; the release of 6 May 2026 added a `nonce` for idempotency, and the entries of 15 September and 13 October 2026 change `user.changes` position updates and MMP group limits (https://docs.deribit.com/changelogs/jsonrpc)", "Deribit FZE holds VARA licence VL/23/12/002 in Dubai, issued 1 November 2024, for exchange services including derivatives and broker-dealer services, serving institutional, qualified and retail investors; retail clients are served through DRB Panama as a broker member per Deribit's post of 29 November 2024 (https://www.vara.ae/en/licenses-and-register/public-register/deribit-fze/)", "The API usage policy monitors order-to-volume ratios (10,000 matching-engine changes per 1 BTC traded counts as high), says penalties come only after contact, and warns that excessive errors can lead to an IP ban (https://docs.deribit.com/articles/api-usage-policy.md)" ], "area": "payments", "details": [ { "label": "Surface listed", "value": "The JSON-RPC v2 API over WebSocket and HTTP at www.deribit.com/api/v2 (test.deribit.com for the test environment), read from docs.deribit.com, its OpenAPI and llms.txt files, the JSON-RPC changelog, insights.deribit.com and the VARA register on 3 November 2026. No account was made and no private method was called" }, { "label": "MCP server", "value": "None found. Checked docs.deribit.com (no mention), the deribit GitHub organisation (0 public repositories) and the official MCP registry, whose search returns only io.github.mrfentmen/deribit-mcp 1.0.2, a third party's npm stdio package for index prices and tickers that is not Deribit's" }, { "label": "Key permissions", "value": "Scopes `account`, `trade`, `wallet`, `block_trade`, `block_rfq`, each `read`, `read_write` or `none`; `wallet:read_write` covers withdrawals and deposit addresses. `ip:ADDR` limits a key to an IPv4 address or CIDR range and `expires:NUMBER` sets a lifetime. Keys are listed, disabled, reset and removed by API. Address allow-lists are documented on the support site, which refused our reader" }, { "label": "Rate limits", "value": "Per sub-account. Non-matching calls cost 500 credits from a 50,000 pool refilled at 10,000 a second (about 20 a second, burst 100); `public/get_instruments` 1 a second, subscriptions about 3.3 a second, `private/move_positions` 6 a minute. Matching engine by 7-day volume, 5 a second (burst 20) up to USD 1 million, 10 (30) above 1 million, 20 (50) above 5 million, 30 (100) above 25 million. Error 10028 `too_many_requests` ends the session" }, { "label": "Testnet", "value": "https://test.deribit.com/api/v2 and wss://test.deribit.com/ws/api/v2, the same API with separate accounts and keys. The OpenAPI file's only server entry is the test host" }, { "label": "Countries", "value": "Deribit FZE is licensed by VARA in Dubai for institutional, qualified and retail investors; retail clients are served through DRB Panama as a broker member. The restricted-jurisdictions article on support.deribit.com answered 403; its search snippet begins with Belarus (EEA and Swiss nationals exempt), Canada, Central African Republic, Congo, Cuba, Guam, Iran, Iraq, Japan, North Korea, Libya and Myanmar, and the full list is unchecked" }, { "label": "Fees", "value": "Lowest-tier maker and taker fees unchecked (support site 403). Deribit's posts give VIP4 to VIP7 taker fees of 1.75, 1.50, 1.40 and 1.40 bps on perpetuals and futures from 19 October 2026, with negative maker fees as rebates, and 0 bps maker fees on USDC-settled linear options that don't expire on a Friday from 5 November 2026 to 31 January 2027. Spot pairs routed to Coinbase Exchange omit the block trade commission field" }, { "label": "FIX and WebSocket", "value": "JSON-RPC over WebSocket is the recommended interface, with subscriptions and session tokens. A production FIX API (logon, new order single, mass quote, market data, trade capture, MMP limits) has its own changelog. Starbase adds SBE order entry, multicast market data and FIX drop copy for colocated clients only" }, { "label": "Terms on automated trading", "value": "The terms of service (Deribit FZE membership terms and DRB Panama Inc. terms) are on support.deribit.com, which answered 403. The API usage policy in the docs allows automated trading and monitors order-to-volume ratios, redundant polling, errors and pings, with rate limits or IP bans only after contact except for excessive errors" }, { "label": "Errors", "value": "JSON-RPC error objects with `code`, `message` and `data`. About 159 codes listed; 10028 too_many_requests, 10040 retry, 10041 settlement_in_progress, 13009 unauthorized, 13011 insufficient_scope, 10009 not_enough_funds. The docs' sample code backs off exponentially to 30 seconds and caps retries at three" }, { "label": "Legal entity", "value": "Deribit FZE, Dubai, VARA licence VL/23/12/002 (CMA-VASP-1000000-0017), active, issued 1 November 2024. Retail clients contract with DRB Panama Inc., which insights.deribit.com's footer links as the terms' entity. Deribit has been owned by Coinbase since 14 August 2025 per The Block; the docs title reads Deribit by Coinbase" } ], "unitPrices": [ { "item": "Perpetual and futures taker fee, VIP4 tier", "unit": "pct", "usd": 0.0175, "note": "1.75 bps from 19 October 2026 per Deribit's post of 14 October 2026. Base-tier fees unchecked" } ], "provenance": { "legalEntity": "Deribit FZE", "domain": "deribit.com", "domainRegistered": "2014-01-15", "endpointOnVendorDomain": true, "terms": "https://support.deribit.com/hc/en-us/articles/25944532191645-Deribit-Exchange-Membership-Terms-Deribit-FZE", "privacy": "", "statusPage": "", "changelog": "https://docs.deribit.com/changelogs/jsonrpc", "securityTxt": "unknown", "checked": "2026-11-03", "notes": [ "Deribit FZE is on VARA's public register, licence VL/23/12/002, active, issued 1 November 2024. Deribit's own post of 29 November 2024 says institutional and qualified investors contract with Deribit FZE and retail clients with DRB Panama, a broker member.", "The terms URL comes from a search result title (Deribit Exchange Membership Terms, Deribit FZE, version 26 January 2026); support.deribit.com answered 403 to our reader, so the terms, the privacy policy and the fee and restricted-jurisdictions articles were not read.", "RDAP gives deribit.com a registration date of 15 January 2014, registrar MarkMonitor.", "status.deribit.com did not resolve on 3 November 2026 and Coinbase's status page showed no Deribit component or incident, so no status page is recorded.", "https://www.deribit.com/.well-known/security.txt answered an HTML page with only the site title, so security.txt is unknown. Deribit's bug bounty runs on HackerOne per the support article title and HackerOne's customer story; insights.deribit.com/bug-bounty answered 403.", "docs.deribit.com/robots.txt allows everything but /cdn-cgi/ and /_next/, with Content-Signal ai-input=yes. support.deribit.com's robots.txt allows article pages; the 403 is the site's answer, not a robots rule." ], "score": 69, "checks": [ { "check": "Legal entity named", "value": "Deribit FZE", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "deribit.com, registered 2014-01-15 (12 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "deribit.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 6 of the 7 things a reader expects, and has 1 clause that costs points", "points": 7.1, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Status page", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "could not be fetched", "points": 0, "max": 10, "state": "no" }, { "check": "People named", "value": "1 named with their role, none with a public profile", "points": 7, "max": 10, "state": "part" }, { "check": "Support route", "value": "help pages", "points": 5, "max": 5, "state": "ok" } ], "policies": [ { "kind": "terms", "url": "https://support.deribit.com/hc/en-us/articles/25944532191645-Deribit-Exchange-Membership-Terms-Deribit-FZE", "state": "read", "readAt": "2026-11-03", "statedDate": "2026-08-13", "words": 22178, "points": 7.1, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": true, "quote": "PLEASE READ THESE TERMS CAREFULLY. BY ACCESSING OR MAKING USE OF DERIBIT'S WEBSITE AND/OR SERVICES YOU EXPRESSLY ACKNOWLEDGE AND AGREE TO BE BOUND BY THESE TERMS. THESE TERMS ARE APPLICABLE AS OF 13…", "says": "Last updated 2026-08-13" }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "46.7 (Governing jurisdiction) Subject to clause ‎46.8, each party to this Agreement irrevocably agrees that the Courts of the Abu Dhabi Global Market shall have exclusive jurisdiction to hear, settle and/or determine the Dispute.", "says": "Disputes go to the courts of Abu Dhabi Global Market" }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "28.4 Notwithstanding the foregoing, to the maximum extent permitted by Applicable Law, in no event shall the aggregate liability of Deribit (including our Related Parties, directors, members, employees and agents thereof) for Loss that you may suffer, exceed the fees paid by you to us during the six (6) month period p…", "says": "Capped at the fees paid in the 6 months before the claim" }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "22.3 You may at any time terminate this Agreement with immediate effect by giving written notice to us if an Event of Default occurs;" }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": true, "quote": "Amendments to this Agreement will take effect 30 days from the date of posting on the Website.", "says": "Gives 30 days of notice before a change" }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "You will not know and will not have direct access to the private keys in respect of your Virtual Assets;" }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": false } ], "toKnow": [ { "key": "terms.automated", "label": "Restricts automated access", "found": true, "quote": "you will not perform any (distributed) denial of service or other malicious attacks, or conduct any systematic or automated data collection activities (including without limitation scraping, data mining, data extraction and data harvesting) on our systems;", "costsPoints": true }, { "key": "terms.cutoff", "label": "Says access can be ended without notice or for any reason", "found": true, "quote": "20.1 We may, at our sole discretion and without liability to you, with or without prior notice and at any time, temporarily suspend your Account." } ], "notes": [ { "date": "2026-11-03", "text": "Liability is capped at the fees paid to Deribit in the six months before the act or omission.", "quote": "in no event shall the aggregate liability of Deribit (including our Related Parties, directors, members, employees and agents thereof) for Loss that you may suffer, exceed the fees paid by you to us during the six (6) month period prior to the act or omission giving rise to such liability." }, { "date": "2026-11-03", "text": "Losses of custodied assets from theft or a hack are allocated proportionally across all members who custody with Deribit.", "quote": "7.9 In the event that Virtual Assets which you custody with us are lost due to theft, a hack or other form of cyberattack, the losses will be allocated proportionally across all Members that choose to custody their Virtual Assets with us." }, { "date": "2026-11-03", "text": "Market data is for personal use only and may not be aggregated, resold, published or otherwise processed without written approval.", "quote": "You are not allowed to aggregate, resell, publish, forward or in any other way process market data and/or derived data (except for personal use) without prior written approval from us." } ] }, { "kind": "privacy", "url": "", "state": "none-found", "points": 0, "max": 10 } ] }, "humans": { "slug": "deribit", "checked": "2026-11-03", "company": "Deribit", "people": [ { "name": "Luuk Strijers", "role": "CEO, Deribit FZE", "bio": "Luuk Strijers is named as CEO of Deribit FZE in Deribit's post of 29 November 2024 announcing the Dubai-licensed entity's launch on 1 January 2025.", "bioSources": [ "https://insights.deribit.com/exchange-updates/deribit-to-launch-1-jan-2025-as-a-fully-licensed-spot-and-derivatives-exchange-in-dubai-uae/" ], "page": "/people/luuk-strijers/" } ], "peopleNote": "The founders, John Jansen and Marius Jansen, launched Deribit in 2016 and left after the Coinbase acquisition per The Block of 14 August 2025; no Deribit page read names them with a role, so they are not listed. Luuk Strijers's role comes from Deribit's own post of 29 November 2024; whether he still holds it after the acquisition wasn't established, since the Coinbase and Business Wire announcements answered 403 or timed out and deribit.com's pages draw by script. No LinkedIn or X account for him is linked from a Deribit page. Ownership from The Block's report of the completed acquisition, the docs title Deribit by Coinbase and the migration article; investors are not listed for a subsidiary.", "companySocial": { "github": "https://github.com/deribit" }, "support": { "urls": [ "https://support.deribit.com/", "https://docs.deribit.com/" ], "contactUrls": [ "https://support.deribit.com/" ] }, "sources": [ "https://insights.deribit.com/exchange-updates/deribit-to-launch-1-jan-2025-as-a-fully-licensed-spot-and-derivatives-exchange-in-dubai-uae/", "https://www.vara.ae/en/licenses-and-register/public-register/deribit-fze/", "https://www.theblock.co/post/366957/coinbase-completes-2-9-billion-cash-and-stock-acquisition-of-deribit", "https://docs.deribit.com/articles/intx-api-migration.md", "https://api.github.com/users/deribit", "https://docs.deribit.com/" ], "ownership": { "status": "subsidiary", "parent": "Coinbase Global, Inc.", "acquiredBy": "Coinbase Global, Inc.", "acquiredDate": "2025-08-14", "checked": "2026-11-03", "sources": [ "https://www.theblock.co/post/366957/coinbase-completes-2-9-billion-cash-and-stock-acquisition-of-deribit", "https://docs.deribit.com/articles/intx-api-migration.md", "https://docs.deribit.com/" ] } }, "pageJsonUrl": "https://www.anchorterminal.com/tools/deribit.json", "live": { "slug": "deribit", "securityTxt": { "url": "https://deribit.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-04T15:54:13.971728133Z" }, "updatedAt": "2026-11-04T15:54:13.971728133Z" } } }