Binance API vs Bitget

Binance API 43

The editorial half. A closed service whose Terms of Use couldn't be read; the docs, connectors, CLI and skills are MIT on GitHub (10 of 30). The privacy notice couldn't be read, so no retention or subprocessor statement was checked; the prohibited-countries list is public and dated (5 of 30). The changelog gives retirement dates for SBE schemas and FIX fields months ahead (16 of 20). No subprocessor or data-location statement read (0 of 20). 10 + 5 + 16 + 0 = 31.

Bitget 65

The editorial half. A closed hosted service with clear terms naming BTG Technology Holdings Limited; the toolkit is MIT (15 of 30). The privacy notice names the controller and EEA representative, gives 7-year and up to 10-year retention for compliance and litigation, and names recipients by category only (18 of 30). Deprecations and parameter changes carry effective dates (delta mode deprecated 27 August, symbol and category required from 30 September, snapshot changes with demo and live dates) but no written policy (15 of 20). Recipients by category, transfers under Seychelles law with no locations or provider names (5 of 20). 53.

Binance API 86

The docs are Markdown in a public repository with a Postman collection and a Swagger spec, but the spec was last pushed in October 2024 (20 of 25). llms.txt and llms-full.txt on developers.binance.com (10). Each endpoint states its weight, parameters and notes on behaviour, with less on when not to use one (15 of 20). Enums for order types, time in force and symbol filters, required columns in the parameter tables (12 of 15). Request and response examples throughout and an error code list with messages (14 of 15). A dated changelog since 2018 with retirements announced months ahead, such as the 2 September 2026 field removal notified on 2 December 2025 (15). 20 + 10 + 15 + 12 + 14 + 15 = 86.

Bitget 74

The agent SDK ships openapi.yaml with 109 typed UTA v3 operations from which the tools are generated, a machine-readable contract from the vendor's own organisation though not on the docs site (20 of 25). llms.txt in the SDK and MCP repositories; the docs site has none (6 of 10). Intent tools with a discover tool that explains each verb, action and its risk level, and the server's initialize instructions state surface, modules and read-only posture (15 of 20). Typed inputs with enums and required fields from the OpenAPI source (12 of 15). Examples in the quick start and READMEs, a REST error code page in the legacy docs that we did not read in full (9 of 15). Changelog by day with preview notices and effective dates (12 of 15). 74.

Binance API 72

API keys with HMAC, RSA or Ed25519 signatures, permissions for reading, trading, futures and withdrawals, an IP restriction, revocation in API Management, and OAuth with four scopes on the MCP server; no key expiry found (28 of 30). Read-only keys, sub-accounts, withdrawals only with an IP restriction, and the MCP server's isolated Agentic sub-account with no withdrawal scope and confirmation before writes (18 of 20). The API returns no untrusted content (10). Keys are listed in API Management and used weight is returned per call, but no per-call log for the operator was found (6 of 15). security.txt with a contact and no expiry, a Bugcrowd programme named in the proof-of-solvency repository, no certification read (10 of 20). 28 + 18 + 10 + 6 + 10 = 72.

Bitget 62

API keys with read or read-and-write permission, a passphrase, HMAC-SHA256 or RSA signing, IP binding recommended, 50 keys per UID, revocation on the management page; no OAuth and no separate withdrawal scope in the docs read (22 of 30). --read-only strips write tools at start, --paper-trading routes to demo, and high-risk writes need confirm: true (18 of 20). Tools return the exchange's own data (10). Request and response hooks are forwarded as MCP log notifications; no per-call audit log on Bitget's side was found (6 of 15). security@bitget.com in the toolkit README, no security.txt, Mandiant and SlowMist reports on the September breach, a proof-of-reserves repository, no bounty page read (6 of 20). 62.

Binance API 76

limit on depth, trades and klines, a symbols filter on exchangeInfo and tickers, and SBE encoding, though fields cannot be selected (16 of 25). fromId, startTime, endTime and limit on history endpoints (16 of 20). Error codes with messages an agent can branch on, such as the rate limit and timestamp errors (17 of 20). newClientOrderId on orders, a cancel-replace endpoint and the 5xx unknown-status rule, but no idempotency key on other writes (12 of 20). Connectors in nine languages, a CLI with testnet and demo profiles, and a timestamped HMAC or Ed25519 signature on every private call (15). 16 + 16 + 17 + 12 + 15 = 76.

Bitget 83

Read for the API with the MCP server as the agent route. 14 compact tools by default, module filters, a full surface on request and progressive discovery (25). Cursor pagination on CFD order history since 15 October 2026 and limit parameters on lists (15 of 20). Uniform ok or error result shape from the SDK with typed error classes and compact JSON in the text channel (13 of 20). clientOid on orders, dryRun: true on every write, confirm: true gating cancelAll and withdraw, annotations derived from risk level including readOnlyHint, destructiveHint and idempotentHint (18 of 20). Few required fields, official SDKs in five languages plus the TypeScript agent SDK and a CLI (12 of 15). 83.

Binance API 45

Read with the hosted lines on the spot REST API. No status page was found on binance.com or in the API docs (0), so no incident record (5). Rate limits are published as per-endpoint weights with numbers from exchangeInfo, 6,000 request weight a minute, 50 orders per 10 seconds, 160,000 a day and 61,000 raw requests per 5 minutes, and FIX limits per session (15). 429 and 418 carry Retry-After, a 5xx is documented as unknown status to be queried, and orders take a client order id (15). No SLA (0). Generally available (10). 0 + 5 + 15 + 15 + 0 + 10 = 45.

Bitget 40

Graded with the hosted lines on the UTA v3 API at api.bitget.com. No status page found (status.bitget.com does not resolve, the docs link none), so 0 for the page and 5 for no readable history; the September 2026 breach is in the deduction, not here. Rate limits are published as 6,000 per IP per minute and per-endpoint UID limits by VIP level (15). An x-mbx-used-remain-limit header is documented and the agent SDK backs off on 429, orders take a clientOid of up to 64 characters, but the breach error code and a Retry-After rule were not read (10 of 15). No SLA (0). UTA v3 is the production API (10). 40.

Binance API 35

No machine payment protocol (0). A 0.1 per cent standard spot fee is stated in the fee FAQ; the maker and taker table and futures fees load by script and weren't read (15 of 20). Public market data needs no key and the testnet is free with a GitHub login (20). A person signs up, passes Verified Plus verification, deposits and mints a key (0). 0 + 15 + 20 + 0 = 35.

Bitget 40

No machine payment protocol (0). Base spot and futures rates are stated in a help article without login, the tier table draws by script (20). Market data needs no key, demo trading costs nothing and no card is asked for at sign-up (20). A person registers, verifies identity and mints the key in a browser (0). 40.