Binance API vs Deribit

Binance API 81

Read as a closed service. The spot changelog's newest entry is 30 October 2026, the MCP docs are dated 30 October and binance-cli v2.2.0 shipped on 20 October (30). Changelog entries on 2 September, 18 September, 27 October and 30 October (20). A public changelog, connectors pushed in October and a Skills Hub merging pull requests weekly; issue replies not read (10 of 15). Official connectors in nine languages current as of October 2026; the MCP server is not in the official registry (15). Connector CI not read; the CLI publishes release installers (6 of 10). 30 + 20 + 10 + 15 + 6 = 81.

Deribit 65

Read as a closed service. The JSON-RPC changelog's latest production entry is 13 October 2026 and an entry dated 5 November 2026 describes the next release; Deribit's posts of 14 October and 2 November 2026 change fees (30). Entries of 18 August, 15 September and 13 October 2026, three in 90 days (20). A public changelog and a support site; whether support answers wasn't tested and the support site refused our reader (10 of 15). No official SDK and no MCP registry entry (0). The OpenAPI and AsyncAPI files are maintained with the docs (5 of 10). Total 65.

Binance API 72

API keys with HMAC, RSA or Ed25519 signatures, permissions for reading, trading, futures and withdrawals, an IP restriction, revocation in API Management, and OAuth with four scopes on the MCP server; no key expiry found (28 of 30). Read-only keys, sub-accounts, withdrawals only with an IP restriction, and the MCP server's isolated Agentic sub-account with no withdrawal scope and confirmation before writes (18 of 20). The API returns no untrusted content (10). Keys are listed in API Management and used weight is returned per call, but no per-call log for the operator was found (6 of 15). security.txt with a contact and no expiry, a Bugcrowd programme named in the proof-of-solvency repository, no certification read (10 of 20). 28 + 18 + 10 + 6 + 10 = 72.

Deribit 62

Keys carry five scopes at read, read_write or none, ip:ADDR and expires limits, can be disabled, reset and removed by API, and self-generated Ed25519 or RSA keys keep the private half off Deribit. The HTTP client_credentials example passes client_secret in the query string, a documented option, so 10 off (20 of 30). trade:read and wallet:none give read-only and no-withdrawal keys and the 5 August 2025 release stopped account:read keys reading other keys' secrets; no per-order confirmation and the address allow-list article was unreadable (16 of 20). The API returns no untrusted content (10). private/list_api_keys, the transaction log and order history let an operator see what a key did, but no per-key call log was found (8 of 15). A HackerOne bug bounty per the support article title and HackerOne's customer story, neither page read first-hand (insights.deribit.com/bug-bounty answered 403), a VARA licence, and no security.txt on www.deribit.com (8 of 20). Total 62.

Binance API 35

No machine payment protocol (0). A 0.1 per cent standard spot fee is stated in the fee FAQ; the maker and taker table and futures fees load by script and weren't read (15 of 20). Public market data needs no key and the testnet is free with a GitHub login (20). A person signs up, passes Verified Plus verification, deposits and mints a key (0). 0 + 15 + 20 + 0 = 35.

Deribit 25

No machine payment protocol (0). The fee schedule is on support.deribit.com, which answered 403; Deribit's own posts give VIP4 to VIP7 taker fees and the 0 bps linear options maker fee, so partial prices are public but the lowest tier is unchecked (5 of 20). Public market data needs no key and the test environment is free, with no card anywhere (20). A person signs up in a browser with identity checks before any key exists (0). Total 25.