# Bitfinex API vs Coinbase MCP server (Coinbase for Agents) (slim)

> Coinbase scores 59.6 (C) to Bitfinex's 58.4 (C) for exchange market data. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/bitfinex-vs-coinbase-mcp.md (~6,250 tokens) · this version ~3,630 tokens · JSON https://www.anchorterminal.com/compare/bitfinex-vs-coinbase-mcp.json · canonical https://www.anchorterminal.com/compare/bitfinex-vs-coinbase-mcp
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-04
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Coinbase MCP server (Coinbase for Agents) scores 59.6 (C) on agent readiness against Bitfinex API's 58.4 (C), and leads in 5 of 7 scored categories. Bitfinex API leads on reliability. Both do exchange market data.

- Bitfinex API: C 58.4, rank #675 of 1349 · https://www.anchorterminal.com/tools/bitfinex.min.md
- Coinbase MCP server (Coinbase for Agents): C 59.6, rank #618 of 1349 · https://www.anchorterminal.com/tools/coinbase-mcp.min.md
- Bitfinex API, good for An agent trading spot, margin or derivatives, or lending on the funding market, with scoped keys, official clients and paper trading. Ahead on Reliability, 85 against 55.
- Coinbase MCP server (Coinbase for Agents), good for An agent acting in a person's own Coinbase account, trading spot crypto, US futures and eligible US stocks and paying for market research by x402. Ahead on Schema & documentation, 65 against 48; Agent ergonomics, 66 against 61; Security & auth, 70 against 62; Maintenance & community, 53 against 41; Transparency & trust, 62 against 49. Also A hosted endpoint, with nothing to install; Runs on your own machine.

| Category | Bitfinex API | Coinbase MCP server (Coinbase for Agents) |
| --- | --- | --- |
| Reliability (16%) | 85 | 55 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 48 | 65 |
| Agent ergonomics (13%) | 61 | 66 |
| Security & auth (14%) | 62 | 70 |
| Payments & pricing (10%) | 40 | 40 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 41 | 53 |
| Transparency & trust (7%) | 49 | 62 |

| Fact (where they differ) | Bitfinex API | Coinbase MCP server (Coinbase for Agents) |
| --- | --- | --- |
| Kind | HTTP API | MCP server |
| Vendor | iFinex Inc. | Coinbase, Inc. |
| Hosted endpoint | no (local only) | `https://agents.coinbase.com/mcp` |
| Transports |  | Streamable HTTP, stdio |
| Auth | API key | OAuth |
| Pricing | Pay per use | Free |
| x402 | no | payer tooling only |
| Licence | Proprietary hosted API under Bitfinex's API Terms of Service, which our reader couldn't load. The official client libraries (Node, Python, Go, Ruby) are MIT or Apache-2.0 | Proprietary hosted service under Coinbase's account terms, which we couldn't read. The companion CLI, @coinbase/coinbase-cli, is MIT-licensed on npm with no public repository |
| Tools exposed | none | 29 |
| Last release | 2026-07-18 | 2026-09-30 |
| Privacy policy last updated | couldn't be read | 2026-05-27 |
| Popularity | 480 stars | 509 npm/wk |
| Agent reviews | none | 2.5/5 (4) |

Why the edge:
- Reliability, Bitfinex API +30: Bitfinex API 85 (Read with the hosted lines on the v2 API at api.bitfinex.com. bitfinex.statuspage.io is a Statuspage site with history back to May 2021 (20). Its feed has no entry between 25 March 2026 and 3 November 2026, so the last 90 days are clean on the record; the feed logs platform-wide outages only (a 14-hour maintenance in March 2026, a 3-hour outage in August 2025), so smaller incidents may go unrecorded. Judgement call (30). Rate limits with numbers, 10 to 90 a minute per IP and the WebSocket connection limits (15). `ERR_RATE_LIMIT` and the 60-second block are documented, with no Retry-After; orders take a `cid` but no idempotency key or retry guidance was found (10 of 15). No SLA found (0). Generally available (10). 20 + 30 + 15 + 10 + 0 + 10 = 85.); Coinbase MCP server (Coinbase for Agents) 55 (Graded with the hosted lines, on the remote server at agents.coinbase.com. status.coinbase.com is a Statuspage site with Advanced Trade, API, US Derivatives and Developer Platform components and 90 days of history, but no component for the agents MCP server, so it shows the trading back end and not the server agents call. Judgement call (10 of 20). Its history page read on 24 October covers 1 August to 24 October 2026, and its history feed, read on 4 November, 16 October to 4 November. Together they cover the window from 6 August. They show minor incidents for derivatives positions and portfolio transfers (21 October, some customers), a 64-minute BRL conversion fault for some users on 26 October and a two-minute website slowdown on 14 October, with none for Advanced Trade order entry (20). The setup guide says it specifies no numeric request quota for the remote server and that Advanced Trade limits are not the MCP limit (0). It says to honour Retry-After on 429 or back off with jitter, orders take a `client_order_id` that returns the existing order on retry, and x402 payments take an `idempotency_key` (15). No SLA found (0). Nothing labels the remote server beta or preview (10). 10+20+0+15+0+10 = 55.)
- Schema & documentation, Coinbase MCP server (Coinbase for Agents) +17: Bitfinex API 48 (No OpenAPI or AsyncAPI file was found on docs.bitfinex.com, in llms.txt or in the client repositories (0). llms.txt and a .md twin of every docs page (10). Each reference page states the endpoint's purpose and fields, and the introduction says when to use api-pub against api, but nothing says when not to use an endpoint (14 of 20). Responses are positional arrays described in field tables, inputs are typed in prose with some enumerations (wallet names, order types) and required fields marked; the withdrawal CODE field is work in progress (7 of 15). Signed-request recipes in five languages, but authenticated errors are documented as 400 with an empty object and there is no error reference (9 of 15). Version v2 in the path and a dated changelog, whose last entry is October 2024 and whose v1 deprecation has no date (8 of 15). 0 + 10 + 14 + 7 + 9 + 8 = 48.); Coinbase MCP server (Coinbase for Agents) 65 (No public tool manifest. The docs tell clients to use the names their own connection's `tools/list` returns, so the JSON Schema of the 29 tools is served only to a signed-in connection and wasn't read. The docs say the tool schemas carry field descriptions and enums, and the companion CLI's bundled command spec types every parameter. Judgement call (10 of 25). llms.txt, a Markdown twin of every docs page and a self-contained setup guide written for agents (10). The docs give one line per tool, and the guide has a routing matrix saying which tools to use or avoid for spot, equities and futures, but the tool descriptions as served weren't read (12 of 20). Enums and constraints are described for sessions, order types and sizes, not verified on the server (8 of 15). Order and x402 examples, and two error tables with cause and fix for 401, 403 `Missing required scopes`, `PERMISSION_DENIED`, `MISSING_FIELDS`, `INVALID_VALUE`, `INVALID_FORMAT` and x402 failures (13 of 15). Dated Coinbase for Agents entries in the CDP changelog and a versioned guide (0.2.3), but no server version is published and the October changes have no changelog entry (12 of 15).)
- Transparency & trust, Coinbase MCP server (Coinbase for Agents) +13: Bitfinex API 49 (The editorial half. A closed service whose Exchange Terms and API Terms of Service loaded only navigation, so the licence terms are unknown; the clients are MIT and Apache-2.0 (8 of 30). The privacy statement loaded only navigation, so retention and data handling are unchecked (0 of 30). The docs say v1 will be deprecated "at some point in the future" with no date, and the Python client's 4.0.0 removed endpoints with a release note (5 of 20). Subprocessors and data locations are in the unread privacy statement (0). 8 + 0 + 5 + 0 = 13.); Coinbase MCP server (Coinbase for Agents) 62 (The editorial half. A closed hosted service. The docs carry a disclaimer that the person is responsible for every trade an agent makes, but name no terms for agent access, and the Coinbase User Agreement answered a bot check and wasn't read. The CLI is MIT on npm (10 of 30). Per the coinbase-cdp-agentkit check of 1 October 2026, the privacy policy (updated 27 May 2026) names Coinbase, Inc., lists processing countries and ties retention to need without numbers; nothing specific to MCP calls or the feedback tool's screening was found (12 of 30). No deprecation policy or notice period for the server or its tools (0). Processing countries are stated and providers named by category per the same check, with no full subprocessor list (10 of 20).)
- Maintenance & community, Coinbase MCP server (Coinbase for Agents) +12: Bitfinex API 41 (Read as a closed service with open clients. The last dated change we could read is bitfinex-api-node 9.1.0 on 18 July 2026, 108 days before the check; the docs changelog stops in October 2024 (10). Not three dated releases in the last 90 days (0). The bitfinexcom organisation pushes often (bfx-report on 3 November 2026) and the clients have issue trackers, but support articles answered 403 and no reply times were read (10 of 25). Official clients current in four languages, Node 9.1.0 of July 2026 and Python 4.0.0 of October 2025; not in the MCP registry (15). The Node client has a dependency history of security fixes (its last GitHub release notes name two) and no CI was read (6 of 10). 10 + 0 + 10 + 15 + 6 = 41.); Coinbase MCP server (Coinbase for Agents) 53 (Read as a closed hosted service. The last dated change to the server in the CDP changelog is US stocks on 21 August 2026; the docs added three x402 tools in October (the overview of 2 October still calls them coming soon), and the sitemap dates the MCP page and the setup guide (still version 0.2.3) to 2 November 2026, with no changelog entry. A page stamp records no dated change, and the October x402 tools carry no date of their own, so the 21 August entry, 75 days before this check, sets the line (20). Changelog entries for futures (17 August) and stocks (21 August) both name the MCP server, and the CLI built from the same agent spec shipped six versions from 14 August to 30 September (20). A public changelog, a CDP Discord for integration help and a one-way feedback tool limited to six notes a day, none tested (10 of 25). Not in the official MCP registry; a search for coinbase on 4 November found only third-party servers (codespar, junct-bot, mrfentmen, pipeworx-io) (0). The CLI has no runtime dependencies but runs a postinstall script and has no public repository or CI (3 of 10). 20+20+10+0+3 = 53.)
- Security & auth, Coinbase MCP server (Coinbase for Agents) +8: Bitfinex API 62 (Revocable keys with per-scope read and write flags, a permissions endpoint, 2FA and email confirmation at creation, strictly increasing nonces, and IP binding to 20 addresses per the support article's search text (the article answered 403); no key expiry (24 of 30). `withdraw` and `ui_withdraw` are separate scopes and read-only keys are possible, but the support text says keys from email-and-password accounts start with every permission enabled and no confirmation step is documented for API withdrawals (14 of 20). The API returns exchange data, not third-party text (10). Login history and an account changelog (audit) endpoint are documented (10 of 15). No security.txt, no readable disclosure policy and no certification page readable (4 of 20). 24 + 14 + 10 + 10 + 4 = 62.); Coinbase MCP server (Coinbase for Agents) 70 (Coinbase OAuth with authorisation code and PKCE S256, `resource` on every request, DCR and CIMD limited to allowlisted clients, ten `mcp:*` scopes, a consent screen where the person picks portfolios, and revocation under Account > Security > Connections (30). A read-only grant and a funded separate portfolio limit what an agent can touch, and transfers move funds only between the person's portfolios. No per-order size limit or server-side confirmation is documented; the June blog's trade-size limits are still "soon", and the setup guide tells agents to request all scopes needed for the intended capabilities, not to stop at read-only because setup checks with a portfolio list, while honouring an explicit read-only request (12 of 20). x402 fetch returns third-party data from a curated catalogue only, and the 13 October changelog removes Bazaar resources whose metadata carries prompt-injection risk; no guidance on treating returned data as untrusted was found beyond citing only values the source returns (8 of 15). Orders, transfers and payments appear in the Coinbase account and connections are listed in account settings, but no per-call log for MCP was found (8 of 15). HackerOne bug bounty named in coinbase.com's security.txt, which expired on 1 June 2024; no security.txt on agents.coinbase.com; certifications not read because coinbase.com answered a bot check (12 of 20).)
- Agent ergonomics, Coinbase MCP server (Coinbase for Agents) +5: Bitfinex API 61 (Graded on the REST API. Limits on trades, candles and book depth, and `pub:list` config endpoints keep responses small, but positional arrays make every field a lookup (14 of 25). `start`, `end`, `limit` and `sort` on history endpoints and per-symbol variants (16 of 20). `ERR_RATE_LIMIT` is actionable; authenticated 400s return `{}` and withdrawal status strings may change, so an agent cannot branch on causes (8 of 20). A client id on orders, order multi-op and cancel-multiple, but no idempotency key and no retry contract (8 of 20). Few required parameters and official clients in Node, Python, Go and Ruby (15). 14 + 16 + 8 + 8 + 15 = 61.); Coinbase MCP server (Coinbase for Agents) 66 (Graded on the remote server. 29 tools per the docs, with no toolsets or read-only subset documented (15). `products_list` filters by symbol and product type and candles take a granularity, but the docs warn the product list runs to hundreds of entries and `--jq` and `--paginate` belong to the CLI, not the server (12 of 20). The error tables name causes and fixes, including the default-portfolio fallback behind `PERMISSION_DENIED`, and x402 errors say whether to retry with the same key (15 of 20). Client order IDs and x402 idempotency keys make retries safe. The CLI's bundled spec marks writes `destructiveHint` and reads `readOnlyHint`; whether the remote server sends these annotations couldn't be checked (14 of 20). Few required fields, but an order that omits the portfolio falls back to the default one, and the only official clients are the remote server and a Node.js CLI (10 of 15).)