Binance API vs Crypto.com Exchange API

Binance API 81

Read as a closed service. The spot changelog's newest entry is 30 October 2026, the MCP docs are dated 30 October and binance-cli v2.2.0 shipped on 20 October (30). Changelog entries on 2 September, 18 September, 27 October and 30 October (20). A public changelog, connectors pushed in October and a Skills Hub merging pull requests weekly; issue replies not read (10 of 15). Official connectors in nine languages current as of October 2026; the MCP server is not in the official registry (15). Connector CI not read; the CLI publishes release installers (6 of 10). 30 + 20 + 10 + 15 + 6 = 81.

Crypto.com Exchange API 29

Read as a closed service with an open CLI. The last change we could date is cdcx-cli v1.2.6 on 18 June 2026, 138 days before the check, with no commit since; the API changelog is unread (10). No three dated releases in the last 90 days (0). Five of six open items on cdcx-cli, all by collaborators or Dependabot since May, have no comment; the Exchange has a support chat and contact@crypto.com (8 of 25). Not in the official MCP registry and no official SDK beyond the CLI (5 of 15). CI tests on three operating systems with clippy and fmt; the npm wrapper's postinstall downloads the binary and two Dependabot bumps are open (6 of 10). 10 + 0 + 8 + 5 + 6 = 29.

Binance API 86

The docs are Markdown in a public repository with a Postman collection and a Swagger spec, but the spec was last pushed in October 2024 (20 of 25). llms.txt and llms-full.txt on developers.binance.com (10). Each endpoint states its weight, parameters and notes on behaviour, with less on when not to use one (15 of 20). Enums for order types, time in force and symbol filters, required columns in the parameter tables (12 of 15). Request and response examples throughout and an error code list with messages (14 of 15). A dated changelog since 2018 with retirements announced months ahead, such as the 2 September 2026 field removal notified on 2 December 2025 (15). 20 + 10 + 15 + 12 + 14 + 15 = 86.

Crypto.com Exchange API 42

An OpenAPI spec exists, since cdcx-cli generates its 95 commands and tools from it at run time, but its host (exchange-developer.crypto.com) answered 403 to robots.txt and the spec was not read; the vendor's own tooling is evidence it exists, not of its quality (15 of 25). No llms.txt on crypto.com or the Exchange pages (0). For descriptions, cdcx's tool descriptions come from the spec, which we couldn't read; the Exchange skill documents 52 endpoints in prose (8 of 20). cdcx's README says the tools carry typed parameters and enum validation, a vendor claim not checked against the spec (8 of 15). For examples, the skills and cdcx README carry worked commands, but the API's error codes and response examples sit on the unread host (6 of 15). Versioned path (v1); the API changelog and announcements page could not be read (5 of 15). 15 + 0 + 8 + 8 + 6 + 5 = 42.

Binance API 76

limit on depth, trades and klines, a symbols filter on exchangeInfo and tickers, and SBE encoding, though fields cannot be selected (16 of 25). fromId, startTime, endTime and limit on history endpoints (16 of 20). Error codes with messages an agent can branch on, such as the rate limit and timestamp errors (17 of 20). newClientOrderId on orders, a cancel-replace endpoint and the 5xx unknown-status rule, but no idempotency key on other writes (12 of 20). Connectors in nine languages, a CLI with testnet and demo profiles, and a timestamped HMAC or Ed25519 signature on every private call (15). 16 + 16 + 17 + 12 + 15 = 76.

Crypto.com Exchange API 50

Graded on the REST API as an agent calls it, with the MCP server noted. cdcx serves up to 95 tools, more than 30, but the default serves the market group alone and groups are enabled one by one, which is a read-only subset switch (5 + 10 = 15). Pagination and output controls for the API are on the unread docs host; cdcx adds -o json|table|ndjson (8 of 20). cdcx returns structured JSON errors and the safety gate names what is missing; the API's own error table is unread (8 of 20). cdcx's tiers (mutate needs acknowledged: true, dangerous needs --allow-dangerous), --dry-run and paper trading give safe rehearsal, though no MCP annotations or API idempotency keys were seen (12 of 20). No official SDK beyond the CLI; defaults in cdcx are sensible (7 of 15). 15 + 8 + 8 + 12 + 7 = 50.

Binance API 72

API keys with HMAC, RSA or Ed25519 signatures, permissions for reading, trading, futures and withdrawals, an IP restriction, revocation in API Management, and OAuth with four scopes on the MCP server; no key expiry found (28 of 30). Read-only keys, sub-accounts, withdrawals only with an IP restriction, and the MCP server's isolated Agentic sub-account with no withdrawal scope and confirmation before writes (18 of 20). The API returns no untrusted content (10). Keys are listed in API Management and used weight is returned per call, but no per-call log for the operator was found (6 of 15). security.txt with a contact and no expiry, a Bugcrowd programme named in the proof-of-solvency repository, no certification read (10 of 20). 28 + 18 + 10 + 6 + 10 = 72.

Crypto.com Exchange API 54

HMAC-SHA256 API keys made with 2FA; IP whitelisting and pre-approved withdrawal addresses per the official skill, and revocation from the Exchange settings. The permission list (read, trade, withdraw) is on the unread docs host, so scopes are recorded from the skills (20 of 30). On least privilege, the App skill's key has no withdrawal permission, the Exchange skill requires user confirmation before a production trade, and cdcx refuses withdrawals and cancel-all without --allow-dangerous; nothing on the server side limits order size (14 of 20). The tools return exchange data, not third-party text, but no guidance on untrusted content was found (6 of 15). An account audit trail is not documented where we could read (4 of 15). No security.txt on crypto.com; cdcx has a SECURITY.md with private reporting and a three-day acknowledgement, and the organisation keeps HackerOne policy guidelines; certifications were not read (10 of 20). 20 + 14 + 6 + 4 + 10 = 54.

Binance API 43

The editorial half. A closed service whose Terms of Use couldn't be read; the docs, connectors, CLI and skills are MIT on GitHub (10 of 30). The privacy notice couldn't be read, so no retention or subprocessor statement was checked; the prohibited-countries list is public and dated (5 of 30). The changelog gives retirement dates for SBE schemas and FIX fields months ahead (16 of 20). No subprocessor or data-location statement read (0 of 20). 10 + 5 + 16 + 0 = 31.

Crypto.com Exchange API 55

The editorial half. A closed service whose terms and trading rules loaded empty for our reader; cdcx and the skills are MIT or Apache-2.0 (10 of 30). The Exchange privacy notice of 12 March 2025 names Foris DAX Limited, gives retention examples (6 years for correspondence, 5 years for EEA AML records) and provider categories, with no DPA or subprocessor list (16 of 30). No deprecation policy or notice period was found (0). Transfers outside the Cayman Islands and the EEA are stated with no countries named (6 of 20). 10 + 16 + 0 + 6 = 32.

Binance API 45

Read with the hosted lines on the spot REST API. No status page was found on binance.com or in the API docs (0), so no incident record (5). Rate limits are published as per-endpoint weights with numbers from exchangeInfo, 6,000 request weight a minute, 50 orders per 10 seconds, 160,000 a day and 61,000 raw requests per 5 minutes, and FIX limits per session (15). 429 and 418 carry Retry-After, a 5xx is documented as unknown status to be queried, and orders take a client order id (15). No SLA (0). Generally available (10). 0 + 5 + 15 + 15 + 0 + 10 = 45.

Crypto.com Exchange API 50

Read with the hosted lines on the Exchange API at api.crypto.com. status.crypto.com is a Statuspage site with component history (20). Its feed for 18 August to 3 November 2026 has 25 entries; the Exchange is named in two, an 11-minute database upgrade on 18 August and a one-hour balance display issue on 6 October, while the longer disruptions (Android login on 1 and 5 October, card 3DS on 23 September, Main App predictions on 3 November) are App incidents. There is no Exchange API component, so the record may be incomplete. Minor only (20). Rate limits are documented on exchange-docs.crypto.com, which answered 403 to robots.txt and was not read (0, unchecked). 429 handling and client order ids are on the same host (0, unchecked). No SLA found (0). Generally available (10). 20 + 20 + 0 + 0 + 0 + 10 = 50.