Bitfinex API vs Gemini Exchange API

Bitfinex API 41

Read as a closed service with open clients. The last dated change we could read is bitfinex-api-node 9.1.0 on 18 July 2026, 108 days before the check; the docs changelog stops in October 2024 (10). Not three dated releases in the last 90 days (0). The bitfinexcom organisation pushes often (bfx-report on 3 November 2026) and the clients have issue trackers, but support articles answered 403 and no reply times were read (10 of 25). Official clients current in four languages, Node 9.1.0 of July 2026 and Python 4.0.0 of October 2025; not in the MCP registry (15). The Node client has a dependency history of security fixes (its last GitHub release notes name two) and no CI was read (6 of 10). 10 + 0 + 10 + 15 + 6 = 41.

Gemini Exchange API 88

Read as a closed hosted service with an open repository. The revision history's latest entry is 28 October 2026 and the repository was pushed on 5 October (30). Thirteen dated entries between 2 September and 28 October 2026 (20). The nine open items on the repository are all pull requests with replies, Dependabot included, and the docs name trading@gemini.com for developer support; no public issue tracker was tested (15 of 25). Not in the official MCP registry, but current official SDKs, TypeScript 0.1.1 of 23 September and Go 0.1.0 of 29 August 2026 (15). CI workflows validate and publish both SDKs and the MCP server has tests; dependencies are current (8 of 10). 30 + 20 + 15 + 15 + 8 = 88.

Bitfinex API 48

No OpenAPI or AsyncAPI file was found on docs.bitfinex.com, in llms.txt or in the client repositories (0). llms.txt and a .md twin of every docs page (10). Each reference page states the endpoint's purpose and fields, and the introduction says when to use api-pub against api, but nothing says when not to use an endpoint (14 of 20). Responses are positional arrays described in field tables, inputs are typed in prose with some enumerations (wallet names, order types) and required fields marked; the withdrawal CODE field is work in progress (7 of 15). Signed-request recipes in five languages, but authenticated errors are documented as 400 with an empty object and there is no error reference (9 of 15). Version v2 in the path and a dated changelog, whose last entry is October 2024 and whose v1 deprecation has no date (8 of 15). 0 + 10 + 14 + 7 + 9 + 8 = 48.

Gemini Exchange API 88

OpenAPI 3 for REST (specs/openapi/rest.yaml), AsyncAPI for WebSocket, a prediction-markets OpenAPI file and a specs/index.json catalogue; the MCP server's tools take zod schemas published as JSON Schema (25). llms.txt, llms-full.txt, agents.md, an agent card and an agent skills index (10). Endpoint pages state purpose, the Build an agent guide says what to establish before acting and when to stop, and MCP tool descriptions tell the model when to confirm; the docs don't say when not to use an endpoint (15 of 20). Typed inputs with enums for order types, options and sessions, required fields marked, decimals as strings since 7 July 2026 (12 of 15). Examples throughout, samples in three languages, and an error-codes page with 53 named reasons and their HTTP statuses (14 of 15). A revision history dated from 2015 to 28 October 2026 and versioned paths (v1, v2), but the upcoming-changes page reads "TBD" (12 of 15). 25 + 10 + 15 + 12 + 14 + 12 = 88.

Bitfinex API 49

The editorial half. A closed service whose Exchange Terms and API Terms of Service loaded only navigation, so the licence terms are unknown; the clients are MIT and Apache-2.0 (8 of 30). The privacy statement loaded only navigation, so retention and data handling are unchecked (0 of 30). The docs say v1 will be deprecated "at some point in the future" with no date, and the Python client's 4.0.0 removed endpoints with a release note (5 of 20). Subprocessors and data locations are in the unread privacy statement (0). 8 + 0 + 5 + 0 = 13.

Gemini Exchange API 75

The editorial half. A closed service under a user agreement that names its entities by state, with the MCP server and SDKs open under Apache-2.0 (18 of 30). The privacy policy of 11 May 2026 names entities and processing countries, ties retention to need without numbers and names provider categories only, with no DPA or subprocessor list found (16 of 30). The revision history records removals and type changes with dates, but the upcoming-changes page is "TBD" and no notice period is stated (8 of 20). Processing countries are named (US, Ireland, UK, Malta, Singapore, Australia) and providers by category, with no named subprocessors (12 of 20). 18 + 16 + 8 + 12 = 54.

Bitfinex API 61

Graded on the REST API. Limits on trades, candles and book depth, and pub:list config endpoints keep responses small, but positional arrays make every field a lookup (14 of 25). start, end, limit and sort on history endpoints and per-symbol variants (16 of 20). ERR_RATE_LIMIT is actionable; authenticated 400s return {} and withdrawal status strings may change, so an agent cannot branch on causes (8 of 20). A client id on orders, order multi-op and cancel-multiple, but no idempotency key and no retry contract (8 of 20). Few required parameters and official clients in Node, Python, Go and Ruby (15). 14 + 16 + 8 + 8 + 15 = 61.

Gemini Exchange API 79

Graded on the REST API, with the MCP server noted. Order book depth, trade and candle counts can be limited and symbols filtered; the MCP server lists 87 tools with no toolset or read-only subset switch, so a session that loads it pays for all of them (18 of 25). Timestamps, limit_trades, since and per-symbol filters on history, pagination on prediction-market lists (16 of 20). Errors carry a reason and message an agent can branch on, such as InsufficientFunds, MarketNotOpen and MissingRole, though some messages only say to retry later (16 of 20). client_order_id is echoed back but not checked for duplicates, cancel-all-session-orders and the heartbeat limit damage; the MCP server publishes readOnlyHint and destructiveHint on every tool and gates destructive ones on confirm: true (14 of 20). Few required parameters, sensible defaults, and official TypeScript and Go SDKs (15). 18 + 16 + 16 + 14 + 15 = 79.

Bitfinex API 62

Revocable keys with per-scope read and write flags, a permissions endpoint, 2FA and email confirmation at creation, strictly increasing nonces, and IP binding to 20 addresses per the support article's search text (the article answered 403); no key expiry (24 of 30). withdraw and ui_withdraw are separate scopes and read-only keys are possible, but the support text says keys from email-and-password accounts start with every permission enabled and no confirmation step is documented for API withdrawals (14 of 20). The API returns exchange data, not third-party text (10). Login history and an account changelog (audit) endpoint are documented (10 of 15). No security.txt, no readable disclosure policy and no certification page readable (4 of 20). 24 + 14 + 10 + 10 + 4 = 62.

Gemini Exchange API 78

Revocable API keys with one role each (Trader, Fund Manager, Auditor, Administrator), HMAC-SHA384 signing with a nonce, and OAuth 2.0 with scopes, PKCE S256, single-use refresh tokens and RFC 7009 revocation; no IP allow-list documented and no key expiry (28 of 30). Auditor is read-only, a Trader key cannot withdraw, approved withdrawal addresses are a Fund Manager action, and the MCP server refuses funds-moving tools without confirm: true (18 of 20). The MCP server wraps every response in untrusted-output markers, strips control and bidi characters and redacts memos, labels and agreement text; the REST docs say nothing on the subject (13 of 15). Order and transfer history are readable, but no per-key audit log or API access log was found (5 of 15). security.txt with a PGP contact and a bug bounty paying $150 to $20,000, scoped to the sandbox hosts; no certification was read and no public advisory process was found (14 of 20). 28 + 18 + 13 + 5 + 14 = 78.

Bitfinex API 85

Read with the hosted lines on the v2 API at api.bitfinex.com. bitfinex.statuspage.io is a Statuspage site with history back to May 2021 (20). Its feed has no entry between 25 March 2026 and 3 November 2026, so the last 90 days are clean on the record; the feed logs platform-wide outages only (a 14-hour maintenance in March 2026, a 3-hour outage in August 2025), so smaller incidents may go unrecorded. Judgement call (30). Rate limits with numbers, 10 to 90 a minute per IP and the WebSocket connection limits (15). ERR_RATE_LIMIT and the 60-second block are documented, with no Retry-After; orders take a cid but no idempotency key or retry guidance was found (10 of 15). No SLA found (0). Generally available (10). 20 + 30 + 15 + 10 + 0 + 10 = 85.

Gemini Exchange API 73

Read with the hosted lines on the REST API at api.gemini.com. status.gemini.com is a Statuspage site with component history (20). Its Atom feed for 10 September to 3 November 2026 holds 25 entries, mostly scheduled trading and FIX upgrades of 15 to 60 minutes with possible order timeouts, single-network deposit delays, and incorrect perpetual index prices for about 3.5 hours on 15 and 16 October; a 3-hour scheduled eOTC window was planned and outside the core API. Minor only (20). Rate limits with numbers, 120 a minute public and 600 private plus per-endpoint limits (15). 429 is documented but with no Retry-After or backoff guidance, and client order ids are recommended without duplicate rejection, so retries are not safe by contract; the heartbeat cancel is a safety net rather than idempotency (8 of 15). No SLA found (0). Generally available (10). 20 + 20 + 15 + 8 + 0 + 10 = 73.