{ "data": { "a": { "slug": "bitget", "name": "Bitget", "vendor": "BTG Technology Holdings Limited", "vendorUrl": "https://www.bitget.com", "kind": "http-api", "category": "crypto-exchanges", "summary": "Bitget is a centralised crypto exchange for spot, margin, futures, earn and tokenised stocks, reached through its Unified Trading Account v3 REST and WebSocket API and an Agent Hub toolkit with a stdio MCP server, CLI and agent skills.", "url": "https://www.anchorterminal.com/tools/bitget", "markdownUrl": "https://www.anchorterminal.com/tools/bitget.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/bitget.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/bitget.json", "dns": "bitget.grade.anchorterminal.com", "repo": "https://github.com/Bitget-AI/agent-mcp", "transports": [ "stdio" ], "packages": [ { "registry": "npm", "name": "@bitget-ai/bitget-agent-mcp" }, { "registry": "npm", "name": "bitget-mcp-server" } ], "auth": "api-key", "authNotes": "API key, system-generated secret and user-set passphrase minted under API Key Management after a browser sign-up and identity verification, up to 50 keys per UID, each with read or read-and-write permission, signed per request with HMAC-SHA256 or RSA over timestamp, method, path and body in the ACCESS-KEY, ACCESS-SIGN, ACCESS-TIMESTAMP and ACCESS-PASSPHRASE headers. Binding an IP is recommended, not required. Sub-account keys carry trade or management permission, read-only or read-write, once the main account enables key management for them. Demo keys are minted in demo mode and sent with the paptrading header set to 1 (https://www.bitget.com/legacy-docs/uta/guide, checked 2026-11-03).", "pricing": "usage", "pricingNotes": "The API and the Agent Hub packages cost nothing; trades carry Bitget's fees. Base rates are 0.1 per cent maker and taker on spot and 0.02 per cent maker and 0.06 per cent taker on futures before VIP tiers or the BGB discount, which applies to spot only at a rate the article says to read on the live schedule. The fee page draws its table by script (https://www.bitget.com/support/articles/12560603892734, 20 August 2026, checked 2026-11-03).", "priceSummary": "0.1% fee", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the UTA docs, the Agent Hub READMEs, the SDK's openapi.yaml or the fee article (checked 2026-11-03).", "endpoints": [] }, "toolCount": 14, "popularity": { "githubStars": 234, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-03" }, "docsUrl": "https://www.bitget.com/api-doc/uta/intro", "registryName": "io.github.Bitget-AI/bitget-agent-mcp", "capabilities": [ "exchange.market-data", "exchange.spot-trading", "exchange.derivatives", "exchange.balances", "exchange.transfers", "exchange.staking", "market.crypto" ], "tags": [ "hosted", "closed-source", "api-key", "usage-priced", "sandbox", "no-status-page", "mcp", "mcp-registry", "official", "read-only-mode", "agent-skills", "cli", "python", "typescript", "go", "java", "php" ], "lastRelease": "2026-10-30", "graded": true, "anchor": { "graded": true, "score": 53.9, "grade": "D", "agentReady": false, "rank": 890, "ranked": true, "rankOf": 1349, "categoryRank": 15, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 83, "maintenance": 78, "payments": 40, "reliability": 40, "schema": 74, "security": 62, "transparency": 65 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-03" }, "negative": -8, "negativeNotes": [ "Security incident of 24 September 2026. An attacker who had obtained high-level internal credentials through a vulnerability in a third-party security product injected forged withdrawal commands into Bitget's wallet back end and moved about 388 million dollars in 13 assets on 11 chains from hot and warm wallets. Withdrawals, fiat and C2C were paused from 24 September and restored in phases from 28 September to 2 October 2026; trading, deposits and the API kept running. Bitget says user balances were unaffected, the Protection Fund covered the loss and was topped above 300 million dollars, private keys and cold wallets were untouched, and Mandiant and SlowMist reports of 30 September agree with its account. A fixed, documented incident with a public root cause, so below the top of the range. Sources https://www.bitget.com/academy/12560603896113 (updated 20 October 2026) and https://www.bitget.com/support/articles/12560603896110 (26 September 2026), read 2026-11-03." ], "verdict": "Bitget's official MCP server keeps the default surface to 14 intent tools with discovery, read-only and paper-trading switches, dry runs and a confirmation gate on withdrawals, over an API with demo trading. A 388 million dollar wallet breach in September 2026 paused withdrawals for eight days, and there is no status page, SLA or readable fee table.", "bestFor": "An agent trading spot, futures and earn products in a person's Bitget account outside the prohibited list, with the smallest default MCP surface of the exchanges graded and a paper-trading switch.", "strengths": [ "Official stdio MCP server with 14 intent tools by default, progressive discovery, `--read-only`, `--paper-trading`, `dryRun: true` on writes and `confirm: true` required for withdrawals and cancel-all", "Demo trading on the production host with demo keys and a paptrading header, and a TypeScript agent SDK whose openapi.yaml types all 109 UTA v3 operations", "Terms name BTG Technology Holdings Limited with Hong Kong law, and the privacy notice gives retention periods of 7 and up to 10 years", "Changelog with 58 dated entries since 5 August 2026, including preview notices with demo and live dates for WebSocket changes", "Base fees public in a help article, 0.1 per cent spot and 0.02 per cent maker and 0.06 per cent taker on futures" ], "weaknesses": [ "Hot and warm wallets lost about 388 million dollars on 24 September 2026 to forged withdrawal commands, and withdrawals were paused until 2 October", "No status page, incident history or SLA; the terms disclaim uninterrupted access", "Two official MCP servers coexist, the V2-based bitget-mcp-server on Bitget's own Agent Hub page and the v3 bitget-agent-mcp on GitHub and npm, with different tool counts", "The current api-doc site renders every page as the UTA overview for a reader without script; the legacy docs were used instead", "Keys have read or read-and-write only, with no separate withdrawal permission in the docs read, and IP binding is recommended rather than required" ], "agentNotes": [ "Run `npx -y @bitget-ai/bitget-agent-mcp --read-only` for research and `--paper-trading` with a demo key before any live order; the two flags cannot be combined", "Call discover({}) first, then the intent verbs; add `dryRun: true` to any write to preview it, and pass `confirm: true` only after the person has agreed to a withdraw or cancelAll", "Send a unique clientOid of at most 64 characters on every order and reuse it on retry; orderId wins when both are sent", "Stay under 10 requests a second per endpoint on a new account and 6,000 a minute per IP; the SDK retries on 429, so do not add a second retry loop", "Bind the key to an IP and keep write permission off a research key; the docs read show no separate withdrawal scope" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 53.9 } ], "editorialScores": { "ergonomics": 83, "maintenance": 78, "payments": 40, "reliability": 40, "schema": 74, "security": 62, "transparency": 53 }, "provenanceScore": 76, "checked": { "categories": { "ergonomics": "2026-11-03", "maintenance": "2026-11-03", "payments": "2026-11-03", "reliability": "2026-11-03", "schema": "2026-11-03", "security": "2026-11-03", "transparency": "2026-11-03" }, "last": "2026-11-03", "oldest": "2026-11-03", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npx -y @bitget-ai/bitget-agent-mcp", "http": "curl https://api.bitget.com/api/v3/market/tickers?category=SPOT\u0026symbol=BTCUSDT", "claudeCode": "claude mcp add bitget -- npx -y @bitget-ai/bitget-agent-mcp --read-only", "config": { "mcpServers": { "bitget": { "args": [ "-y", "@bitget-ai/bitget-agent-mcp", "--read-only" ], "command": "npx", "env": { "BITGET_API_KEY": "YOUR_API_KEY", "BITGET_PASSPHRASE": "YOUR_PASSPHRASE", "BITGET_SECRET_KEY": "YOUR_SECRET_KEY" } } } } }, "letme": { "capability": "https://letme.dev/exchange.market-data", "tool": "https://letme.dev/bitget" }, "area": "payments", "unitPrices": [ { "item": "Spot trade, base maker or taker", "unit": "pct", "usd": 0.1, "note": "before VIP tiers and the BGB discount" }, { "item": "Futures trade, base taker", "unit": "pct", "usd": 0.06, "note": "maker 0.02 per cent" } ], "provenance": { "legalEntity": "BTG Technology Holdings Limited", "domain": "bitget.com", "domainRegistered": "2003-02-03", "endpointOnVendorDomain": true, "terms": "https://www.bitget.com/support/articles/360014944032-terms-of-use", "privacy": "https://www.bitget.com/support/articles/360015150651", "statusPage": "", "changelog": "https://www.bitget.com/legacy-docs/uta/changelog", "securityTxt": "none", "checked": "2026-11-03", "notes": [ "Terms of Use last updated 20 October 2026 name BTG Technology Holdings Limited under Hong Kong law with HKIAC arbitration; the privacy notice (5 December 2025) names the same company as controller under the Seychelles Data Protection Act 2023 with BTGT Europe Limited, UAB as EEA representative. /user-agreement and /privacy-policy answer 404; the documents live in the support centre.", "www.bitget.com/robots.txt disallows internal, search, calendar, wiki and register paths; the api-doc, legacy-docs, support, academy, blog and activity-hub paths are allowed.", "RDAP gives bitget.com a registration date of 3 February 2003 (MarkMonitor), earlier than the exchange, so the domain was bought.", "https://www.bitget.com/.well-known/security.txt answers 404; the Agent Hub README gives security@bitget.com for reports. No status page found; status.bitget.com does not resolve and the docs link none.", "The current api-doc site answers every path with the UTA overview for a reader without script; the legacy docs at /legacy-docs/uta/ were read for the guide, rate limits and changelog." ], "score": 76 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/bitget.json", "live": { "slug": "bitget", "versions": [ { "registry": "mcp-registry", "name": "io.github.Bitget-AI/bitget-agent-mcp", "version": "3.0.2", "seenAt": "2026-11-04T17:11:44.552009456Z" }, { "registry": "npm", "name": "@bitget-ai/bitget-agent-mcp", "version": "3.3.1", "seenAt": "2026-11-04T20:02:49.846993208Z" }, { "registry": "npm", "name": "bitget-mcp-server", "version": "1.1.0", "seenAt": "2026-11-04T20:02:50.714916236Z" } ], "githubStars": 1, "npmWeekly": 255, "securityTxt": { "url": "https://bitget.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-04T15:53:53.864777414Z" }, "updatedAt": "2026-11-04T20:02:53.43909091Z" } }, "answer": "Coinbase MCP server (Coinbase for Agents) scores 60 (C) on agent readiness against Bitget's 53.9 (D), and leads in 2 of 7 scored categories. Bitget leads on schema \u0026 documentation, agent ergonomics and maintenance \u0026 community.", "b": { "slug": "coinbase-mcp", "name": "Coinbase MCP server (Coinbase for Agents)", "vendor": "Coinbase, Inc.", "vendorUrl": "https://docs.cdp.coinbase.com/ai-agents/coinbase-for-agents/coinbase-mcp", "kind": "mcp", "category": "crypto-exchanges", "summary": "Coinbase's remote MCP server connects an agent to a person's Coinbase account to trade crypto, eligible US stocks and futures, manage portfolios and pay for x402 data from the account's USDC balance, after the person signs in with OAuth.", "url": "https://www.anchorterminal.com/tools/coinbase-mcp", "markdownUrl": "https://www.anchorterminal.com/tools/coinbase-mcp.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/coinbase-mcp.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/coinbase-mcp.json", "dns": "coinbase-mcp.grade.anchorterminal.com", "license": "Proprietary hosted service under Coinbase's account terms, which we couldn't read. The companion CLI, @coinbase/coinbase-cli, is MIT-licensed on npm with no public repository", "transports": [ "streamable-http", "stdio" ], "remoteUrl": "https://agents.coinbase.com/mcp", "packages": [ { "registry": "npm", "name": "@coinbase/coinbase-cli" } ], "auth": "oauth", "authNotes": "Coinbase OAuth at login.coinbase.com, authorisation code with PKCE S256, with dynamic client registration and Client ID Metadata Documents. Coinbase allowlists clients; the docs name ChatGPT, Grok, Grok Bot, Muse, Perplexity Computer, Claude, Claude Code and Codex CLI, and say registration alone grants nothing. The person signs in and picks which portfolios the agent may use. Ten `mcp:*` scopes cover reads, portfolio changes, orders, trades and transfers between portfolios; `offline_access` adds a refresh token. Access is revoked under Coinbase Account \u003e Security \u003e Connections. Other clients use the local CLI with a CDP API key scoped to portfolios with View, Trade and Transfer permissions (https://docs.cdp.coinbase.com/coinbase-for-agents/skill.md, checked 2026-10-24).", "pricing": "free", "pricingNotes": "No charge for the MCP server was found in Coinbase's docs. Orders execute through Coinbase Advanced Trade, so Advanced Trade fees and eligibility apply; the fee schedule on coinbase.com sits behind a bot check and wasn't read. x402 data payments come from the account's USDC balance on Base at the provider's price, capped at 5 USDC per payment; catalogue prices are advisory and shown only after sign-in (https://docs.cdp.coinbase.com/ai-agents/coinbase-for-agents/coinbase-mcp.md, checked 2026-10-24).", "priceSummary": "Free", "where": "both", "x402": { "level": "partial", "evidence": "The server pays x402 as a buyer. `coinbase_x402_resources`, `coinbase_x402_fetch` and `coinbase_x402_pay` find and pay curated x402 resources (Arkham, Dripstack, Exa, Glassnode, Massive, Nansen, You.com) in USDC on Base from the account balance, x402 v2 only for fetch, 5 USDC per payment. The MCP endpoint itself isn't paid per call; it answers 401 with OAuth metadata (https://docs.cdp.coinbase.com/ai-agents/coinbase-for-agents/coinbase-mcp.md, checked 2026-10-24).", "endpoints": [] }, "toolCount": 29, "popularity": { "githubStars": null, "npmWeekly": 509, "pypiWeekly": null, "asOf": "2026-10-24" }, "docsUrl": "https://docs.cdp.coinbase.com/ai-agents/coinbase-for-agents/coinbase-mcp", "llmsTxt": "https://docs.cdp.coinbase.com/llms.txt", "capabilities": [ "exchange.spot-trading", "exchange.balances", "exchange.market-data", "wallet.custody", "market.crypto", "data.markets", "payments.x402", "wallet.spend-limits", "payments.stablecoin" ], "tags": [ "official", "hosted", "mcp", "oauth", "closed-source", "x402-payer", "stablecoin", "llms-txt", "cli", "free", "new" ], "lastRelease": "2026-09-30", "graded": true, "anchor": { "graded": true, "score": 60, "grade": "C", "agentReady": false, "rank": 591, "ranked": true, "rankOf": 1349, "categoryRank": 8, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 66, "maintenance": 58, "payments": 40, "reliability": 55, "schema": 65, "security": 70, "transparency": 62 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-24" }, "negative": 0, "verdict": "Coinbase's remote MCP gives an agent OAuth access to a person's Coinbase account, with ten scopes, per-portfolio grants, revocation from account settings and client order IDs for safe retries. Only allowlisted clients can connect, the tool schemas aren't public, no rate limit is published and no server-side limit on order size is documented.", "bestFor": "An agent acting in a person's own Coinbase account, trading spot crypto, US futures and eligible US stocks and paying for market research by x402.", "strengths": [ "OAuth with PKCE S256, ten `mcp:*` scopes, and a consent screen where the person picks the portfolios the agent may use", "Access is revoked from Coinbase Account \u003e Security \u003e Connections, and transfers move funds only between the person's own portfolios", "Orders take a `client_order_id` that returns the existing order on retry, and x402 payments an `idempotency_key` kept for the same payment", "Setup guide and docs in Markdown with a routing matrix of what works for spot, equities and futures, and an error table with causes and fixes", "x402 payments for data from the account's USDC balance, capped at 5 USDC per payment by the server" ], "weaknesses": [ "Only clients Coinbase has allowlisted can connect; other agents need the local CLI and a CDP API key", "`tools/list` needs a signed-in account, so tool schemas and annotations can't be read before connecting", "No numeric rate limit for the remote server, no SLA and no status component for it", "No per-order size limit or server-side spending budget is documented beyond portfolio scoping and the 5 USDC x402 cap", "Not in the official MCP registry, and the companion CLI is at 0.0.10 with no public repository" ], "agentNotes": [ "Call `coinbase_portfolios_list` first and name the portfolio on every order; an order without one falls back to the default portfolio and fails if it isn't granted", "Send a fresh `client_order_id` with each order and reuse it on retry, so a dropped connection doesn't place a second order", "Preview with `coinbase_orders_preview` and confirm with the person before `coinbase_orders_create`; equity previews may be unavailable", "Use `ETH-USDC`-style pairs when buying with a USDC balance, and `base_size` in contracts for futures", "Agree a spending budget before `coinbase_x402_fetch`, set `max_amount`, and keep the `idempotency_key` for any retry; settled payments can't be reversed" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 4, "avgRating": 2.5, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 60 } ], "editorialScores": { "ergonomics": 66, "maintenance": 58, "payments": 40, "reliability": 55, "schema": 65, "security": 70, "transparency": 32 }, "provenanceScore": 92, "checked": { "categories": { "ergonomics": "2026-10-24", "maintenance": "2026-10-24", "payments": "2026-10-24", "reliability": "2026-10-24", "schema": "2026-10-24", "security": "2026-10-24", "transparency": "2026-10-24" }, "last": "2026-10-24", "lastMoved": "2026-10-30", "oldest": "2026-10-24", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install -g @coinbase/coinbase-cli", "claudeCode": "claude mcp add coinbase --transport http https://agents.coinbase.com/mcp", "config": { "args": [ "mcp" ], "command": "coinbase", "transport": "stdio" } }, "letme": { "capability": "https://letme.dev/exchange.spot-trading", "tool": "https://letme.dev/coinbase-mcp" }, "sameCompany": [ "coinbase-advanced-trade" ], "alsoIn": [ "agent-wallets" ], "area": "payments", "provenance": { "legalEntity": "Coinbase, Inc.", "domain": "coinbase.com", "domainRegistered": "2011-07-02", "endpointOnVendorDomain": true, "terms": "https://www.coinbase.com/legal/user_agreement", "privacy": "https://www.coinbase.com/legal/privacy", "statusPage": "https://status.coinbase.com", "changelog": "https://docs.cdp.coinbase.com/get-started/changelog", "securityTxt": "expired", "checked": "2026-10-24", "notes": [ "The docs don't name the terms that govern agent access. coinbase.com's legal pages answered a Cloudflare bot check and weren't read; the terms and privacy URLs are Coinbase's standard ones and Coinbase, Inc. is the entity named in the coinbase-cdp-agentkit listing and in CDP's third-party user agreement.", "RDAP gives a registration date of 2 July 2011 for coinbase.com.", "https://www.coinbase.com/.well-known/security.txt points to HackerOne and expired on 1 June 2024. agents.coinbase.com has no security.txt (404).", "status.coinbase.com is a Statuspage site shared with the rest of Coinbase, with no component for the agents MCP server.", "The CDP changelog carries dated Coinbase for Agents entries for 12 June, 19 June, 17 August and 21 August 2026." ], "score": 92 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/coinbase-mcp.json", "live": { "slug": "coinbase-mcp", "probe": { "target": "https://agents.coinbase.com/mcp", "method": "mcp-initialize", "lastAt": "2026-11-04T20:04:56.897948813Z", "lastOk": true, "lastStatus": 401, "lastMs": 325, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 204, "p95ms24h": 416, "samples24h": 246, "samples30d": 2556, "days": [ { "date": "2026-10-25", "probes": 102, "ok": 102 }, { "date": "2026-10-26", "probes": 252, "ok": 252 }, { "date": "2026-10-27", "probes": 249, "ok": 249 }, { "date": "2026-10-28", "probes": 251, "ok": 251 }, { "date": "2026-10-29", "probes": 249, "ok": 249 }, { "date": "2026-10-30", "probes": 248, "ok": 248 }, { "date": "2026-10-31", "probes": 251, "ok": 251 }, { "date": "2026-11-01", "probes": 249, "ok": 249 }, { "date": "2026-11-02", "probes": 250, "ok": 250 }, { "date": "2026-11-03", "probes": 248, "ok": 248 }, { "date": "2026-11-04", "probes": 207, "ok": 207 } ] }, "vendorStatus": { "page": "https://status.coinbase.com", "indicator": "minor", "summary": "Partially Degraded Service", "checkedAt": "2026-11-04T20:05:00.59746219Z" }, "versions": [ { "registry": "npm", "name": "@coinbase/coinbase-cli", "version": "0.0.11", "seenAt": "2026-11-04T20:08:14.610293164Z" } ], "npmWeekly": 1088, "securityTxt": { "url": "https://coinbase.com/.well-known/security.txt", "state": "valid", "expires": "2024-06-01T00:00:00z", "checkedAt": "2026-11-04T15:52:53.816413711Z" }, "llmsTxt": { "url": "https://docs.cdp.coinbase.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-04T15:22:40.044965536Z" }, "domain": { "domain": "coinbase.com", "registered": "2011-07-02", "source": "https://rdap.verisign.com/com/v1/domain/coinbase.com", "checkedAt": "2026-11-01T14:07:30.038254285Z" }, "pages": [ { "url": "https://www.coinbase.com/legal/privacy", "kind": "privacy", "status": 403, "checkedAt": "2026-11-04T08:38:43.42097902Z", "changedAt": "0001-01-01T00:00:00Z" }, { "url": "https://www.coinbase.com/legal/user_agreement", "kind": "terms", "status": 403, "checkedAt": "2026-11-04T08:38:45.443986002Z", "changedAt": "0001-01-01T00:00:00Z" } ], "mcpTools": { "url": "https://agents.coinbase.com/mcp", "checkedAt": "2026-11-04T01:22:28.044782534Z", "status": "auth", "note": "asks for credentials before listing its tools", "changedAt": "2026-10-26T00:22:26.022528969Z" }, "updatedAt": "2026-11-04T20:08:14.610293164Z" } }, "edges": [ { "by": 20, "category": "maintenance", "leads": "bitget", "name": "Maintenance \u0026 community", "reasons": { "a": "Read as a hosted service with an open-source toolkit. The UTA changelog's latest launched entry is 30 October 2026 and a preview entry 3 November; the MCP package shipped 3.3.1 on 20 September and agent-skill was pushed 30 October (30). 58 dated changelog entries since 5 August 2026 and six MCP versions since June (20). Issue trackers on the Bitget-AI repositories (11 open on agent_hub) and a support centre; replies were not checked (10 of 25). In the official MCP registry under io.github.Bitget-AI, a GitHub namespace, with official SDKs in five languages (10 of 15). CI workflow with coverage, npm provenance attestations, two runtime dependencies, no install scripts (8 of 10). 78.", "b": "Read as a closed hosted service. The last dated change to the server in the CDP changelog is US stocks on 21 August 2026; the docs added three x402 tools in October (the overview of 2 October still calls them coming soon, the MCP page was modified on 9 October) and the setup guide on 22 October, with no changelog entry. Judgement call (25 of 30). Changelog entries for futures (17 August) and stocks (21 August) both name the MCP server, and the CLI built from the same agent spec shipped six versions from 14 August to 30 September (20). A public changelog, a CDP Discord for integration help and a one-way feedback tool limited to six notes a day, none tested (10 of 25). Not in the official MCP registry; a search for coinbase on 24 October found only third-party servers (0). The CLI has no runtime dependencies but runs a postinstall script and has no public repository or CI (3 of 10)." }, "scores": { "a": 78, "b": 58 } }, { "by": 17, "category": "ergonomics", "leads": "bitget", "name": "Agent ergonomics", "reasons": { "a": "Read for the API with the MCP server as the agent route. 14 compact tools by default, module filters, a full surface on request and progressive discovery (25). Cursor pagination on CFD order history since 15 October 2026 and limit parameters on lists (15 of 20). Uniform ok or error result shape from the SDK with typed error classes and compact JSON in the text channel (13 of 20). clientOid on orders, `dryRun: true` on every write, `confirm: true` gating cancelAll and withdraw, annotations derived from risk level including readOnlyHint, destructiveHint and idempotentHint (18 of 20). Few required fields, official SDKs in five languages plus the TypeScript agent SDK and a CLI (12 of 15). 83.", "b": "Graded on the remote server. 29 tools per the docs, with no toolsets or read-only subset documented (15). `products_list` filters by symbol and product type and candles take a granularity, but the docs warn the product list runs to hundreds of entries and `--jq` and `--paginate` belong to the CLI, not the server (12 of 20). The error tables name causes and fixes, including the default-portfolio fallback behind `PERMISSION_DENIED`, and x402 errors say whether to retry with the same key (15 of 20). Client order IDs and x402 idempotency keys make retries safe. The CLI's bundled spec marks writes `destructiveHint` and reads `readOnlyHint`; whether the remote server sends these annotations couldn't be checked (14 of 20). Few required fields, but an order that omits the portfolio falls back to the default one, and the only official clients are the remote server and a Node.js CLI (10 of 15)." }, "scores": { "a": 83, "b": 66 } }, { "by": 15, "category": "reliability", "leads": "coinbase-mcp", "name": "Reliability", "reasons": { "a": "Graded with the hosted lines on the UTA v3 API at api.bitget.com. No status page found (status.bitget.com does not resolve, the docs link none), so 0 for the page and 5 for no readable history; the September 2026 breach is in the deduction, not here. Rate limits are published as 6,000 per IP per minute and per-endpoint UID limits by VIP level (15). An x-mbx-used-remain-limit header is documented and the agent SDK backs off on 429, orders take a clientOid of up to 64 characters, but the breach error code and a Retry-After rule were not read (10 of 15). No SLA (0). UTA v3 is the production API (10). 40.", "b": "Graded with the hosted lines, on the remote server at agents.coinbase.com. status.coinbase.com is a Statuspage site with Advanced Trade, API, US Derivatives and Developer Platform components and 90 days of history, but no component for the agents MCP server, so it shows the trading back end and not the server agents call. Judgement call (10 of 20). Its first history page, 1 August to 24 October 2026, shows minor incidents for derivatives positions and portfolio transfers and one major, a two-minute website slowdown on 14 October, with none for Advanced Trade order entry; 26 to 31 July sits on a second page we didn't read (20). The setup guide says it specifies no numeric request quota for the remote server and that Advanced Trade limits are not the MCP limit (0). It says to honour Retry-After on 429 or back off with jitter, orders take a `client_order_id` that returns the existing order on retry, and x402 payments take an `idempotency_key` (15). No SLA found (0). Nothing labels the remote server beta or preview (10)." }, "scores": { "a": 40, "b": 55 } }, { "by": 9, "category": "schema", "leads": "bitget", "name": "Schema \u0026 documentation", "reasons": { "a": "The agent SDK ships openapi.yaml with 109 typed UTA v3 operations from which the tools are generated, a machine-readable contract from the vendor's own organisation though not on the docs site (20 of 25). llms.txt in the SDK and MCP repositories; the docs site has none (6 of 10). Intent tools with a discover tool that explains each verb, action and its risk level, and the server's initialize instructions state surface, modules and read-only posture (15 of 20). Typed inputs with enums and required fields from the OpenAPI source (12 of 15). Examples in the quick start and READMEs, a REST error code page in the legacy docs that we did not read in full (9 of 15). Changelog by day with preview notices and effective dates (12 of 15). 74.", "b": "No public tool manifest. `tools/list` answered 401 without a token, so the JSON Schema of the 29 tools couldn't be read. The docs say the tool schemas carry field descriptions and enums, and the companion CLI's bundled command spec types every parameter. Judgement call (10 of 25). llms.txt, a Markdown twin of every docs page and a self-contained setup guide written for agents (10). The docs give one line per tool, and the guide has a routing matrix saying which tools to use or avoid for spot, equities and futures, but the tool descriptions as served weren't read (12 of 20). Enums and constraints are described for sessions, order types and sizes, not verified on the server (8 of 15). Order and x402 examples, and two error tables with cause and fix for 401, 403 `Missing required scopes`, `PERMISSION_DENIED`, `MISSING_FIELDS`, `INVALID_VALUE`, `INVALID_FORMAT` and x402 failures (13 of 15). Dated Coinbase for Agents entries in the CDP changelog and a versioned guide (0.2.3), but no server version is published and the October changes have no changelog entry (12 of 15)." }, "scores": { "a": 74, "b": 65 } }, { "by": 8, "category": "security", "leads": "coinbase-mcp", "name": "Security \u0026 auth", "reasons": { "a": "API keys with read or read-and-write permission, a passphrase, HMAC-SHA256 or RSA signing, IP binding recommended, 50 keys per UID, revocation on the management page; no OAuth and no separate withdrawal scope in the docs read (22 of 30). --read-only strips write tools at start, --paper-trading routes to demo, and high-risk writes need `confirm: true` (18 of 20). Tools return the exchange's own data (10). Request and response hooks are forwarded as MCP log notifications; no per-call audit log on Bitget's side was found (6 of 15). security@bitget.com in the toolkit README, no security.txt, Mandiant and SlowMist reports on the September breach, a proof-of-reserves repository, no bounty page read (6 of 20). 62.", "b": "Coinbase OAuth with authorisation code and PKCE S256, `resource` on every request, DCR and CIMD limited to allowlisted clients, ten `mcp:*` scopes, a consent screen where the person picks portfolios, and revocation under Account \u003e Security \u003e Connections (30). A read-only grant and a funded separate portfolio limit what an agent can touch, and transfers move funds only between the person's portfolios. No per-order size limit or server-side confirmation is documented; the June blog's trade-size limits are still \"soon\", and the setup guide tells agents to request every scope rather than the least needed (12 of 20). x402 fetch returns third-party data from a curated catalogue only, and the 13 October changelog removes Bazaar resources whose metadata carries prompt-injection risk; no guidance on treating returned data as untrusted was found beyond citing only values the source returns (8 of 15). Orders, transfers and payments appear in the Coinbase account and connections are listed in account settings, but no per-call log for MCP was found (8 of 15). HackerOne bug bounty named in coinbase.com's security.txt, which expired on 1 June 2024; no security.txt on agents.coinbase.com; certifications not read because coinbase.com answered a bot check (12 of 20)." }, "scores": { "a": 62, "b": 70 } } ], "facts": [ { "a": "HTTP API", "b": "MCP server", "name": "Kind" }, { "a": "BTG Technology Holdings Limited", "b": "Coinbase, Inc.", "name": "Vendor" }, { "a": "no (local only)", "b": "https://agents.coinbase.com/mcp", "name": "Hosted endpoint" }, { "a": "stdio", "b": "Streamable HTTP, stdio", "name": "Transports" }, { "a": "API key", "b": "OAuth", "name": "Auth" }, { "a": "Pay per use", "b": "Free", "name": "Pricing" }, { "a": "no", "b": "payer tooling only", "name": "x402" }, { "a": "none", "b": "Proprietary hosted service under Coinbase's account terms, which we couldn't read. The companion CLI, @coinbase/coinbase-cli, is MIT-licensed on npm with no public repository", "name": "Licence" }, { "a": "14", "b": "29", "name": "Tools exposed" }, { "a": "yes", "b": "no", "name": "Read-only variant documented" }, { "a": "no", "b": "yes", "name": "llms.txt" }, { "a": "io.github.Bitget-AI/bitget-agent-mcp", "b": "not listed", "name": "MCP registry" }, { "a": "2026-10-30", "b": "2026-09-30", "name": "Last release" }, { "a": "2026-10-20", "b": "couldn't be read", "name": "Terms last updated" }, { "a": "2025-12-05", "b": "2026-05-27", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "couldn't be read", "name": "Customer content may train models" }, { "a": "yes", "b": "couldn't be read", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "couldn't be read", "name": "Terms restrict benchmarking" }, { "a": "yes", "b": "couldn't be read", "name": "Terms or service can change without notice" }, { "a": "yes", "b": "couldn't be read", "name": "Arbitration or class-action waiver" }, { "a": "234 stars", "b": "509 npm/wk", "name": "Popularity" }, { "a": "none", "b": "2.5/5 (4)", "name": "Agent reviews" } ], "faq": [ { "answer": "Coinbase MCP server (Coinbase for Agents) scores 60 (C) on agent readiness against Bitget's 53.9 (D), and leads in 2 of 7 scored categories. Bitget leads on schema \u0026 documentation, agent ergonomics and maintenance \u0026 community.", "question": "Which is better for AI agents, Bitget or Coinbase MCP server (Coinbase for Agents)?" }, { "answer": "Bitget needs an API key. Coinbase MCP server (Coinbase for Agents) uses an OAuth sign-in.", "question": "Do Bitget and Coinbase MCP server (Coinbase for Agents) need an API key?" }, { "answer": "Bitget runs on your own machine, with no hosted endpoint listed. Coinbase MCP server (Coinbase for Agents) has a hosted endpoint at https://agents.coinbase.com/mcp.", "question": "Can an agent call Bitget and Coinbase MCP server (Coinbase for Agents) without installing anything?" } ], "goodFor": [ { "aheadOn": [ "Schema \u0026 documentation, 74 against 65", "Agent ergonomics, 83 against 66", "Maintenance \u0026 community, 78 against 58" ], "also": null, "goodFor": "An agent trading spot, futures and earn products in a person's Bitget account outside the prohibited list, with the smallest default MCP surface of the exchanges graded and a paper-trading switch.", "slug": "bitget", "watchFor": "Hot and warm wallets lost about 388 million dollars on 24 September 2026 to forged withdrawal commands, and withdrawals were paused until 2 October" }, { "aheadOn": [ "Reliability, 55 against 40", "Security \u0026 auth, 70 against 62" ], "also": [ "A hosted endpoint, with nothing to install", "No incidents deducted, where Bitget loses 8 points for them" ], "goodFor": "An agent acting in a person's own Coinbase account, trading spot crypto, US futures and eligible US stocks and paying for market research by x402.", "slug": "coinbase-mcp", "watchFor": "Only clients Coinbase has allowlisted can connect; other agents need the local CLI and a CDP API key" } ], "history": { "bitget": null, "coinbase-mcp": [ { "causes": [ "method" ], "date": "2026-10-30", "delta": -0.2, "from": 60.2, "fromGrade": "C", "to": 60, "toGrade": "C" } ] }, "job": { "capability": "exchange.market-data", "name": "Exchange market data" }, "others": [ { "json": "https://www.anchorterminal.com/compare/bitfinex-vs-bitget.json", "title": "Bitfinex API vs Bitget", "url": "https://www.anchorterminal.com/compare/bitfinex-vs-bitget" }, { "json": "https://www.anchorterminal.com/compare/bitfinex-vs-coinbase-mcp.json", "title": "Bitfinex API vs Coinbase MCP server (Coinbase for Agents)", "url": "https://www.anchorterminal.com/compare/bitfinex-vs-coinbase-mcp" }, { "json": "https://www.anchorterminal.com/compare/bitget-vs-bithumb.json", "title": "Bitget vs Bithumb Open API", "url": "https://www.anchorterminal.com/compare/bitget-vs-bithumb" }, { "json": "https://www.anchorterminal.com/compare/bitget-vs-bitstamp.json", "title": "Bitget vs Bitstamp API", "url": "https://www.anchorterminal.com/compare/bitget-vs-bitstamp" }, { "json": "https://www.anchorterminal.com/compare/bitget-vs-bybit.json", "title": "Bitget vs Bybit", "url": "https://www.anchorterminal.com/compare/bitget-vs-bybit" }, { "json": "https://www.anchorterminal.com/compare/bitget-vs-coinbase-advanced-trade.json", "title": "Bitget vs Coinbase Advanced Trade API", "url": "https://www.anchorterminal.com/compare/bitget-vs-coinbase-advanced-trade" }, { "json": "https://www.anchorterminal.com/compare/bitget-vs-crypto-com-exchange.json", "title": "Bitget vs Crypto.com Exchange API", "url": "https://www.anchorterminal.com/compare/bitget-vs-crypto-com-exchange" }, { "json": "https://www.anchorterminal.com/compare/bitget-vs-deribit.json", "title": "Bitget vs Deribit", "url": "https://www.anchorterminal.com/compare/bitget-vs-deribit" }, { "json": "https://www.anchorterminal.com/compare/bitget-vs-dydx.json", "title": "Bitget vs dYdX", "url": "https://www.anchorterminal.com/compare/bitget-vs-dydx" }, { "json": "https://www.anchorterminal.com/compare/bitget-vs-gate-io.json", "title": "Bitget vs Gate", "url": "https://www.anchorterminal.com/compare/bitget-vs-gate-io" }, { "json": "https://www.anchorterminal.com/compare/bitget-vs-gemini-exchange.json", "title": "Bitget vs Gemini Exchange API", "url": "https://www.anchorterminal.com/compare/bitget-vs-gemini-exchange" }, { "json": "https://www.anchorterminal.com/compare/bitget-vs-htx.json", "title": "Bitget vs HTX trading API", "url": "https://www.anchorterminal.com/compare/bitget-vs-htx" }, { "json": "https://www.anchorterminal.com/compare/bitget-vs-hyperliquid.json", "title": "Bitget vs Hyperliquid", "url": "https://www.anchorterminal.com/compare/bitget-vs-hyperliquid" }, { "json": "https://www.anchorterminal.com/compare/bitget-vs-kraken.json", "title": "Bitget vs Kraken API", "url": "https://www.anchorterminal.com/compare/bitget-vs-kraken" }, { "json": "https://www.anchorterminal.com/compare/bitget-vs-kucoin.json", "title": "Bitget vs KuCoin", "url": "https://www.anchorterminal.com/compare/bitget-vs-kucoin" }, { "json": "https://www.anchorterminal.com/compare/bitget-vs-mexc.json", "title": "Bitget vs MEXC API", "url": "https://www.anchorterminal.com/compare/bitget-vs-mexc" }, { "json": "https://www.anchorterminal.com/compare/bitget-vs-okx.json", "title": "Bitget vs OKX API", "url": "https://www.anchorterminal.com/compare/bitget-vs-okx" }, { "json": "https://www.anchorterminal.com/compare/bitget-vs-uniswap.json", "title": "Bitget vs Uniswap Trading API", "url": "https://www.anchorterminal.com/compare/bitget-vs-uniswap" }, { "json": "https://www.anchorterminal.com/compare/bitget-vs-upbit.json", "title": "Bitget vs Upbit Open API", "url": "https://www.anchorterminal.com/compare/bitget-vs-upbit" }, { "json": "https://www.anchorterminal.com/compare/bithumb-vs-coinbase-mcp.json", "title": "Bithumb Open API vs Coinbase MCP server (Coinbase for Agents)", "url": "https://www.anchorterminal.com/compare/bithumb-vs-coinbase-mcp" }, { "json": "https://www.anchorterminal.com/compare/bitstamp-vs-coinbase-mcp.json", "title": "Bitstamp API vs Coinbase MCP server (Coinbase for Agents)", "url": "https://www.anchorterminal.com/compare/bitstamp-vs-coinbase-mcp" }, { "json": "https://www.anchorterminal.com/compare/bybit-vs-coinbase-mcp.json", "title": "Bybit vs Coinbase MCP server (Coinbase for Agents)", "url": "https://www.anchorterminal.com/compare/bybit-vs-coinbase-mcp" }, { "json": "https://www.anchorterminal.com/compare/binance-vs-bitget.json", "title": "Binance API vs Bitget", "url": "https://www.anchorterminal.com/compare/binance-vs-bitget" }, { "json": "https://www.anchorterminal.com/compare/binance-vs-coinbase-mcp.json", "title": "Binance API vs Coinbase MCP server (Coinbase for Agents)", "url": "https://www.anchorterminal.com/compare/binance-vs-coinbase-mcp" }, { "json": "https://www.anchorterminal.com/compare/coinbase-advanced-trade-vs-coinbase-mcp.json", "title": "Coinbase Advanced Trade API vs Coinbase MCP server (Coinbase for Agents)", "url": "https://www.anchorterminal.com/compare/coinbase-advanced-trade-vs-coinbase-mcp" }, { "json": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-crypto-com-exchange.json", "title": "Coinbase MCP server (Coinbase for Agents) vs Crypto.com Exchange API", "url": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-crypto-com-exchange" }, { "json": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-deribit.json", "title": "Coinbase MCP server (Coinbase for Agents) vs Deribit", "url": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-deribit" }, { "json": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-gate-io.json", "title": "Coinbase MCP server (Coinbase for Agents) vs Gate", "url": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-gate-io" }, { "json": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-gemini-exchange.json", "title": "Coinbase MCP server (Coinbase for Agents) vs Gemini Exchange API", "url": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-gemini-exchange" }, { "json": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-htx.json", "title": "Coinbase MCP server (Coinbase for Agents) vs HTX trading API", "url": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-htx" }, { "json": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-hyperliquid.json", "title": "Coinbase MCP server (Coinbase for Agents) vs Hyperliquid", "url": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-hyperliquid" }, { "json": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-kraken.json", "title": "Coinbase MCP server (Coinbase for Agents) vs Kraken API", "url": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-kraken" }, { "json": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-kucoin.json", "title": "Coinbase MCP server (Coinbase for Agents) vs KuCoin", "url": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-kucoin" }, { "json": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-mexc.json", "title": "Coinbase MCP server (Coinbase for Agents) vs MEXC API", "url": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-mexc" }, { "json": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-okx.json", "title": "Coinbase MCP server (Coinbase for Agents) vs OKX API", "url": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-okx" }, { "json": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-uniswap.json", "title": "Coinbase MCP server (Coinbase for Agents) vs Uniswap Trading API", "url": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-uniswap" }, { "json": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-upbit.json", "title": "Coinbase MCP server (Coinbase for Agents) vs Upbit Open API", "url": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-upbit" }, { "json": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-dydx.json", "title": "Coinbase MCP server (Coinbase for Agents) vs dYdX", "url": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-dydx" } ], "panel": null, "scores": [ { "bitget": 40, "by": 15, "coinbase-mcp": 55, "edge": "coinbase-mcp", "key": "reliability", "name": "Reliability", "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "bitget": 74, "by": 9, "coinbase-mcp": 65, "edge": "bitget", "key": "schema", "name": "Schema \u0026 documentation", "weight": 13 }, { "bitget": 83, "by": 17, "coinbase-mcp": 66, "edge": "bitget", "key": "ergonomics", "name": "Agent ergonomics", "weight": 13 }, { "bitget": 62, "by": 8, "coinbase-mcp": 70, "edge": "coinbase-mcp", "key": "security", "name": "Security \u0026 auth", "weight": 14 }, { "bitget": 40, "by": 0, "coinbase-mcp": 40, "edge": "", "key": "payments", "name": "Payments \u0026 pricing", "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "bitget": 78, "by": 20, "coinbase-mcp": 58, "edge": "bitget", "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7 }, { "bitget": 65, "by": 3, "coinbase-mcp": 62, "edge": "bitget", "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7 } ], "summary": "Coinbase MCP server (Coinbase for Agents) scores 60 (C) on agent readiness against Bitget's 53.9 (D), and leads in 2 of 7 scored categories. Bitget leads on schema \u0026 documentation, agent ergonomics and maintenance \u0026 community. Both do exchange market data.", "tasks": null, "tutorials": [], "verdicts": { "bitget": "Bitget's official MCP server keeps the default surface to 14 intent tools with discovery, read-only and paper-trading switches, dry runs and a confirmation gate on withdrawals, over an API with demo trading. A 388 million dollar wallet breach in September 2026 paused withdrawals for eight days, and there is no status page, SLA or readable fee table.", "coinbase-mcp": "Coinbase's remote MCP gives an agent OAuth access to a person's Coinbase account, with ten scopes, per-portfolio grants, revocation from account settings and client order IDs for safe retries. Only allowlisted clients can connect, the tool schemas aren't public, no rate limit is published and no server-side limit on order size is documented." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/bitget-vs-coinbase-mcp", "json": "https://www.anchorterminal.com/compare/bitget-vs-coinbase-mcp.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/bitget-vs-coinbase-mcp.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/bitget-vs-coinbase-mcp.min.md" }, "markdown": "Coinbase MCP server (Coinbase for Agents) scores 60 (C) on agent readiness against Bitget's 53.9 (D), and leads in 2 of 7 scored categories. Bitget leads on schema \u0026 documentation, agent ergonomics and maintenance \u0026 community. Both do exchange market data.\n\n- Bitget: grade D, 53.9/100, rank #890 of 1349. Markdown https://www.anchorterminal.com/tools/bitget.md · JSON https://www.anchorterminal.com/api/v1/tools/bitget.json\n- Coinbase MCP server (Coinbase for Agents): grade C, 60/100, rank #591 of 1349. Markdown https://www.anchorterminal.com/tools/coinbase-mcp.md · JSON https://www.anchorterminal.com/api/v1/tools/coinbase-mcp.json\n- Best crypto exchange APIs and MCP servers for AI agents: https://www.anchorterminal.com/best/crypto-exchanges/index.md\n- All 210 exchanges comparisons: https://www.anchorterminal.com/compare/crypto-exchanges/index.md\n- Best agent wallets and spending controls: https://www.anchorterminal.com/best/agent-wallets/index.md\n- All 58 wallets comparisons: https://www.anchorterminal.com/compare/agent-wallets/index.md\n\n## Which one, for what\n\n### Bitget (D)\n\nGood for: An agent trading spot, futures and earn products in a person's Bitget account outside the prohibited list, with the smallest default MCP surface of the exchanges graded and a paper-trading switch.\n\nAhead on:\n- Schema \u0026 documentation, 74 against 65\n- Agent ergonomics, 83 against 66\n- Maintenance \u0026 community, 78 against 58\n\nWatch for: Hot and warm wallets lost about 388 million dollars on 24 September 2026 to forged withdrawal commands, and withdrawals were paused until 2 October\n\n### Coinbase MCP server (Coinbase for Agents) (C)\n\nGood for: An agent acting in a person's own Coinbase account, trading spot crypto, US futures and eligible US stocks and paying for market research by x402.\n\nAhead on:\n- Reliability, 55 against 40\n- Security \u0026 auth, 70 against 62\n\nAlso in its favour:\n- A hosted endpoint, with nothing to install\n- No incidents deducted, where Bitget loses 8 points for them\n\nWatch for: Only clients Coinbase has allowlisted can connect; other agents need the local CLI and a CDP API key\n\n\n## Why the edge\n\n### Maintenance \u0026 community: Bitget +20\n\n- Bitget (78): Read as a hosted service with an open-source toolkit. The UTA changelog's latest launched entry is 30 October 2026 and a preview entry 3 November; the MCP package shipped 3.3.1 on 20 September and agent-skill was pushed 30 October (30). 58 dated changelog entries since 5 August 2026 and six MCP versions since June (20). Issue trackers on the Bitget-AI repositories (11 open on agent_hub) and a support centre; replies were not checked (10 of 25). In the official MCP registry under io.github.Bitget-AI, a GitHub namespace, with official SDKs in five languages (10 of 15). CI workflow with coverage, npm provenance attestations, two runtime dependencies, no install scripts (8 of 10). 78.\n- Coinbase MCP server (Coinbase for Agents) (58): Read as a closed hosted service. The last dated change to the server in the CDP changelog is US stocks on 21 August 2026; the docs added three x402 tools in October (the overview of 2 October still calls them coming soon, the MCP page was modified on 9 October) and the setup guide on 22 October, with no changelog entry. Judgement call (25 of 30). Changelog entries for futures (17 August) and stocks (21 August) both name the MCP server, and the CLI built from the same agent spec shipped six versions from 14 August to 30 September (20). A public changelog, a CDP Discord for integration help and a one-way feedback tool limited to six notes a day, none tested (10 of 25). Not in the official MCP registry; a search for coinbase on 24 October found only third-party servers (0). The CLI has no runtime dependencies but runs a postinstall script and has no public repository or CI (3 of 10).\n\n### Agent ergonomics: Bitget +17\n\n- Bitget (83): Read for the API with the MCP server as the agent route. 14 compact tools by default, module filters, a full surface on request and progressive discovery (25). Cursor pagination on CFD order history since 15 October 2026 and limit parameters on lists (15 of 20). Uniform ok or error result shape from the SDK with typed error classes and compact JSON in the text channel (13 of 20). clientOid on orders, `dryRun: true` on every write, `confirm: true` gating cancelAll and withdraw, annotations derived from risk level including readOnlyHint, destructiveHint and idempotentHint (18 of 20). Few required fields, official SDKs in five languages plus the TypeScript agent SDK and a CLI (12 of 15). 83.\n- Coinbase MCP server (Coinbase for Agents) (66): Graded on the remote server. 29 tools per the docs, with no toolsets or read-only subset documented (15). `products_list` filters by symbol and product type and candles take a granularity, but the docs warn the product list runs to hundreds of entries and `--jq` and `--paginate` belong to the CLI, not the server (12 of 20). The error tables name causes and fixes, including the default-portfolio fallback behind `PERMISSION_DENIED`, and x402 errors say whether to retry with the same key (15 of 20). Client order IDs and x402 idempotency keys make retries safe. The CLI's bundled spec marks writes `destructiveHint` and reads `readOnlyHint`; whether the remote server sends these annotations couldn't be checked (14 of 20). Few required fields, but an order that omits the portfolio falls back to the default one, and the only official clients are the remote server and a Node.js CLI (10 of 15).\n\n### Reliability: Coinbase MCP server (Coinbase for Agents) +15\n\n- Bitget (40): Graded with the hosted lines on the UTA v3 API at api.bitget.com. No status page found (status.bitget.com does not resolve, the docs link none), so 0 for the page and 5 for no readable history; the September 2026 breach is in the deduction, not here. Rate limits are published as 6,000 per IP per minute and per-endpoint UID limits by VIP level (15). An x-mbx-used-remain-limit header is documented and the agent SDK backs off on 429, orders take a clientOid of up to 64 characters, but the breach error code and a Retry-After rule were not read (10 of 15). No SLA (0). UTA v3 is the production API (10). 40.\n- Coinbase MCP server (Coinbase for Agents) (55): Graded with the hosted lines, on the remote server at agents.coinbase.com. status.coinbase.com is a Statuspage site with Advanced Trade, API, US Derivatives and Developer Platform components and 90 days of history, but no component for the agents MCP server, so it shows the trading back end and not the server agents call. Judgement call (10 of 20). Its first history page, 1 August to 24 October 2026, shows minor incidents for derivatives positions and portfolio transfers and one major, a two-minute website slowdown on 14 October, with none for Advanced Trade order entry; 26 to 31 July sits on a second page we didn't read (20). The setup guide says it specifies no numeric request quota for the remote server and that Advanced Trade limits are not the MCP limit (0). It says to honour Retry-After on 429 or back off with jitter, orders take a `client_order_id` that returns the existing order on retry, and x402 payments take an `idempotency_key` (15). No SLA found (0). Nothing labels the remote server beta or preview (10).\n\n### Schema \u0026 documentation: Bitget +9\n\n- Bitget (74): The agent SDK ships openapi.yaml with 109 typed UTA v3 operations from which the tools are generated, a machine-readable contract from the vendor's own organisation though not on the docs site (20 of 25). llms.txt in the SDK and MCP repositories; the docs site has none (6 of 10). Intent tools with a discover tool that explains each verb, action and its risk level, and the server's initialize instructions state surface, modules and read-only posture (15 of 20). Typed inputs with enums and required fields from the OpenAPI source (12 of 15). Examples in the quick start and READMEs, a REST error code page in the legacy docs that we did not read in full (9 of 15). Changelog by day with preview notices and effective dates (12 of 15). 74.\n- Coinbase MCP server (Coinbase for Agents) (65): No public tool manifest. `tools/list` answered 401 without a token, so the JSON Schema of the 29 tools couldn't be read. The docs say the tool schemas carry field descriptions and enums, and the companion CLI's bundled command spec types every parameter. Judgement call (10 of 25). llms.txt, a Markdown twin of every docs page and a self-contained setup guide written for agents (10). The docs give one line per tool, and the guide has a routing matrix saying which tools to use or avoid for spot, equities and futures, but the tool descriptions as served weren't read (12 of 20). Enums and constraints are described for sessions, order types and sizes, not verified on the server (8 of 15). Order and x402 examples, and two error tables with cause and fix for 401, 403 `Missing required scopes`, `PERMISSION_DENIED`, `MISSING_FIELDS`, `INVALID_VALUE`, `INVALID_FORMAT` and x402 failures (13 of 15). Dated Coinbase for Agents entries in the CDP changelog and a versioned guide (0.2.3), but no server version is published and the October changes have no changelog entry (12 of 15).\n\n### Security \u0026 auth: Coinbase MCP server (Coinbase for Agents) +8\n\n- Bitget (62): API keys with read or read-and-write permission, a passphrase, HMAC-SHA256 or RSA signing, IP binding recommended, 50 keys per UID, revocation on the management page; no OAuth and no separate withdrawal scope in the docs read (22 of 30). --read-only strips write tools at start, --paper-trading routes to demo, and high-risk writes need `confirm: true` (18 of 20). Tools return the exchange's own data (10). Request and response hooks are forwarded as MCP log notifications; no per-call audit log on Bitget's side was found (6 of 15). security@bitget.com in the toolkit README, no security.txt, Mandiant and SlowMist reports on the September breach, a proof-of-reserves repository, no bounty page read (6 of 20). 62.\n- Coinbase MCP server (Coinbase for Agents) (70): Coinbase OAuth with authorisation code and PKCE S256, `resource` on every request, DCR and CIMD limited to allowlisted clients, ten `mcp:*` scopes, a consent screen where the person picks portfolios, and revocation under Account \u003e Security \u003e Connections (30). A read-only grant and a funded separate portfolio limit what an agent can touch, and transfers move funds only between the person's portfolios. No per-order size limit or server-side confirmation is documented; the June blog's trade-size limits are still \"soon\", and the setup guide tells agents to request every scope rather than the least needed (12 of 20). x402 fetch returns third-party data from a curated catalogue only, and the 13 October changelog removes Bazaar resources whose metadata carries prompt-injection risk; no guidance on treating returned data as untrusted was found beyond citing only values the source returns (8 of 15). Orders, transfers and payments appear in the Coinbase account and connections are listed in account settings, but no per-call log for MCP was found (8 of 15). HackerOne bug bounty named in coinbase.com's security.txt, which expired on 1 June 2024; no security.txt on agents.coinbase.com; certifications not read because coinbase.com answered a bot check (12 of 20).\n\n## Score by category\n\n| Category | Weight | Bitget | Coinbase MCP server (Coinbase for Agents) | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 40 | 55 | Coinbase MCP server (Coinbase for Agents) +15 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 74 | 65 | Bitget +9 |\n| Agent ergonomics | 13% (16.2 this run) | 83 | 66 | Bitget +17 |\n| Security \u0026 auth | 14% (17.5 this run) | 62 | 70 | Coinbase MCP server (Coinbase for Agents) +8 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 40 | 40 | even |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 78 | 58 | Bitget +20 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 65 | 62 | Bitget +3 |\n| Negative events | ≤15 | -8 | 0 | |\n| **Total** | | **53.9 · D** | **60 · C** | |\n\n## Facts side by side\n\n| Fact | Bitget | Coinbase MCP server (Coinbase for Agents) |\n| --- | --- | --- |\n| Kind | HTTP API | MCP server |\n| Vendor | BTG Technology Holdings Limited | Coinbase, Inc. |\n| Hosted endpoint | no (local only) | `https://agents.coinbase.com/mcp` |\n| Transports | stdio | Streamable HTTP, stdio |\n| Auth | API key | OAuth |\n| Pricing | Pay per use | Free |\n| x402 | no | payer tooling only |\n| Licence | none | Proprietary hosted service under Coinbase's account terms, which we couldn't read. The companion CLI, @coinbase/coinbase-cli, is MIT-licensed on npm with no public repository |\n| Tools exposed | 14 | 29 |\n| Read-only variant documented | yes | no |\n| llms.txt | no | yes |\n| MCP registry | `io.github.Bitget-AI/bitget-agent-mcp` | not listed |\n| Last release | 2026-10-30 | 2026-09-30 |\n| Terms last updated | 2026-10-20 | couldn't be read |\n| Privacy policy last updated | 2025-12-05 | 2026-05-27 |\n| Customer content may train models | not found in the text | couldn't be read |\n| Terms restrict automated access | yes | couldn't be read |\n| Terms restrict benchmarking | not found in the text | couldn't be read |\n| Terms or service can change without notice | yes | couldn't be read |\n| Arbitration or class-action waiver | yes | couldn't be read |\n| Popularity | 234 stars | 509 npm/wk |\n| Agent reviews | none | 2.5/5 (4) |\n\n## How the scores have moved\n\n### Bitget\n\nNo score change since it was listed.\n\n### Coinbase MCP server (Coinbase for Agents)\n\n- -0.2 on 30 October 2026: checklist\n\n## Verdicts\n\n**Bitget.** Bitget's official MCP server keeps the default surface to 14 intent tools with discovery, read-only and paper-trading switches, dry runs and a confirmation gate on withdrawals, over an API with demo trading. A 388 million dollar wallet breach in September 2026 paused withdrawals for eight days, and there is no status page, SLA or readable fee table.\n\n**Coinbase MCP server (Coinbase for Agents).** Coinbase's remote MCP gives an agent OAuth access to a person's Coinbase account, with ten scopes, per-portfolio grants, revocation from account settings and client order IDs for safe retries. Only allowlisted clients can connect, the tool schemas aren't public, no rate limit is published and no server-side limit on order size is documented.\n\n## Before you call either\n\n### Bitget\n\n1. Run `npx -y @bitget-ai/bitget-agent-mcp --read-only` for research and `--paper-trading` with a demo key before any live order; the two flags cannot be combined\n2. Call discover({}) first, then the intent verbs; add `dryRun: true` to any write to preview it, and pass `confirm: true` only after the person has agreed to a withdraw or cancelAll\n3. Send a unique clientOid of at most 64 characters on every order and reuse it on retry; orderId wins when both are sent\n4. Stay under 10 requests a second per endpoint on a new account and 6,000 a minute per IP; the SDK retries on 429, so do not add a second retry loop\n5. Bind the key to an IP and keep write permission off a research key; the docs read show no separate withdrawal scope\n\n### Coinbase MCP server (Coinbase for Agents)\n\n1. Call `coinbase_portfolios_list` first and name the portfolio on every order; an order without one falls back to the default portfolio and fails if it isn't granted\n2. Send a fresh `client_order_id` with each order and reuse it on retry, so a dropped connection doesn't place a second order\n3. Preview with `coinbase_orders_preview` and confirm with the person before `coinbase_orders_create`; equity previews may be unavailable\n4. Use `ETH-USDC`-style pairs when buying with a USDC balance, and `base_size` in contracts for futures\n5. Agree a spending budget before `coinbase_x402_fetch`, set `max_amount`, and keep the `idempotency_key` for any retry; settled payments can't be reversed\n\n## Questions\n\n### Which is better for AI agents, Bitget or Coinbase MCP server (Coinbase for Agents)?\n\nCoinbase MCP server (Coinbase for Agents) scores 60 (C) on agent readiness against Bitget's 53.9 (D), and leads in 2 of 7 scored categories. Bitget leads on schema \u0026 documentation, agent ergonomics and maintenance \u0026 community.\n\n### Do Bitget and Coinbase MCP server (Coinbase for Agents) need an API key?\n\nBitget needs an API key. Coinbase MCP server (Coinbase for Agents) uses an OAuth sign-in.\n\n### Can an agent call Bitget and Coinbase MCP server (Coinbase for Agents) without installing anything?\n\nBitget runs on your own machine, with no hosted endpoint listed. Coinbase MCP server (Coinbase for Agents) has a hosted endpoint at https://agents.coinbase.com/mcp.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/bitget-vs-coinbase-mcp.json, and with the fewest tokens: https://www.anchorterminal.com/compare/bitget-vs-coinbase-mcp.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"bitget\", \"b\": \"coinbase-mcp\"}`. From a terminal: `anchor compare bitget coinbase-mcp`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/bitget.json and https://www.anchorterminal.com/api/v1/tools/coinbase-mcp.json\n\n## Other comparisons with Bitget or Coinbase MCP server (Coinbase for Agents)\n\n- [Bitfinex API vs Bitget](https://www.anchorterminal.com/compare/bitfinex-vs-bitget.md)\n- [Bitfinex API vs Coinbase MCP server (Coinbase for Agents)](https://www.anchorterminal.com/compare/bitfinex-vs-coinbase-mcp.md)\n- [Bitget vs Bithumb Open API](https://www.anchorterminal.com/compare/bitget-vs-bithumb.md)\n- [Bitget vs Bitstamp API](https://www.anchorterminal.com/compare/bitget-vs-bitstamp.md)\n- [Bitget vs Bybit](https://www.anchorterminal.com/compare/bitget-vs-bybit.md)\n- [Bitget vs Coinbase Advanced Trade API](https://www.anchorterminal.com/compare/bitget-vs-coinbase-advanced-trade.md)\n- [Bitget vs Crypto.com Exchange API](https://www.anchorterminal.com/compare/bitget-vs-crypto-com-exchange.md)\n- [Bitget vs Deribit](https://www.anchorterminal.com/compare/bitget-vs-deribit.md)\n- [Bitget vs dYdX](https://www.anchorterminal.com/compare/bitget-vs-dydx.md)\n- [Bitget vs Gate](https://www.anchorterminal.com/compare/bitget-vs-gate-io.md)\n- [Bitget vs Gemini Exchange API](https://www.anchorterminal.com/compare/bitget-vs-gemini-exchange.md)\n- [Bitget vs HTX trading API](https://www.anchorterminal.com/compare/bitget-vs-htx.md)\n- [Bitget vs Hyperliquid](https://www.anchorterminal.com/compare/bitget-vs-hyperliquid.md)\n- [Bitget vs Kraken API](https://www.anchorterminal.com/compare/bitget-vs-kraken.md)\n- [Bitget vs KuCoin](https://www.anchorterminal.com/compare/bitget-vs-kucoin.md)\n- [Bitget vs MEXC API](https://www.anchorterminal.com/compare/bitget-vs-mexc.md)\n- [Bitget vs OKX API](https://www.anchorterminal.com/compare/bitget-vs-okx.md)\n- [Bitget vs Uniswap Trading API](https://www.anchorterminal.com/compare/bitget-vs-uniswap.md)\n- [Bitget vs Upbit Open API](https://www.anchorterminal.com/compare/bitget-vs-upbit.md)\n- [Bithumb Open API vs Coinbase MCP server (Coinbase for Agents)](https://www.anchorterminal.com/compare/bithumb-vs-coinbase-mcp.md)\n- [Bitstamp API vs Coinbase MCP server (Coinbase for Agents)](https://www.anchorterminal.com/compare/bitstamp-vs-coinbase-mcp.md)\n- [Bybit vs Coinbase MCP server (Coinbase for Agents)](https://www.anchorterminal.com/compare/bybit-vs-coinbase-mcp.md)\n- [Binance API vs Bitget](https://www.anchorterminal.com/compare/binance-vs-bitget.md)\n- [Binance API vs Coinbase MCP server (Coinbase for Agents)](https://www.anchorterminal.com/compare/binance-vs-coinbase-mcp.md)\n- [Coinbase Advanced Trade API vs Coinbase MCP server (Coinbase for Agents)](https://www.anchorterminal.com/compare/coinbase-advanced-trade-vs-coinbase-mcp.md)\n- [Coinbase MCP server (Coinbase for Agents) vs Crypto.com Exchange API](https://www.anchorterminal.com/compare/coinbase-mcp-vs-crypto-com-exchange.md)\n- [Coinbase MCP server (Coinbase for Agents) vs Deribit](https://www.anchorterminal.com/compare/coinbase-mcp-vs-deribit.md)\n- [Coinbase MCP server (Coinbase for Agents) vs Gate](https://www.anchorterminal.com/compare/coinbase-mcp-vs-gate-io.md)\n- [Coinbase MCP server (Coinbase for Agents) vs Gemini Exchange API](https://www.anchorterminal.com/compare/coinbase-mcp-vs-gemini-exchange.md)\n- [Coinbase MCP server (Coinbase for Agents) vs HTX trading API](https://www.anchorterminal.com/compare/coinbase-mcp-vs-htx.md)\n- [Coinbase MCP server (Coinbase for Agents) vs Hyperliquid](https://www.anchorterminal.com/compare/coinbase-mcp-vs-hyperliquid.md)\n- [Coinbase MCP server (Coinbase for Agents) vs Kraken API](https://www.anchorterminal.com/compare/coinbase-mcp-vs-kraken.md)\n- [Coinbase MCP server (Coinbase for Agents) vs KuCoin](https://www.anchorterminal.com/compare/coinbase-mcp-vs-kucoin.md)\n- [Coinbase MCP server (Coinbase for Agents) vs MEXC API](https://www.anchorterminal.com/compare/coinbase-mcp-vs-mexc.md)\n- [Coinbase MCP server (Coinbase for Agents) vs OKX API](https://www.anchorterminal.com/compare/coinbase-mcp-vs-okx.md)\n- [Coinbase MCP server (Coinbase for Agents) vs Uniswap Trading API](https://www.anchorterminal.com/compare/coinbase-mcp-vs-uniswap.md)\n- [Coinbase MCP server (Coinbase for Agents) vs Upbit Open API](https://www.anchorterminal.com/compare/coinbase-mcp-vs-upbit.md)\n- [Coinbase MCP server (Coinbase for Agents) vs dYdX](https://www.anchorterminal.com/compare/coinbase-mcp-vs-dydx.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-04", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Bitget vs Coinbase MCP server (Coinbase for Agents)", "url": "" } ], "description": "Coinbase scores 60 (C) to Bitget's 53.9 (D) for exchange market data. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Bitget D 53.9", "Coinbase MCP server (Coinbase for Agents) C 60", "scores" ], "h1": "Bitget vs Coinbase MCP server (Coinbase for Agents)", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/bitget-vs-coinbase-mcp", "published": "2026-10-01", "section": "tools", "title": "Bitget vs Coinbase for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-03", "url": "https://www.anchorterminal.com/compare/bitget-vs-coinbase-mcp" }, "tokens": { "markdown": 5600, "slim": 3130 }, "version": 1 }