Bitget vs Gemini Exchange API

Bitget 40

Graded with the hosted lines on the UTA v3 API at api.bitget.com. No status page found (status.bitget.com does not resolve, the docs link none), so 0 for the page and 5 for no readable history; the September 2026 breach is in the deduction, not here. Rate limits are published as 6,000 per IP per minute and per-endpoint UID limits by VIP level (15). An x-mbx-used-remain-limit header is documented and the agent SDK backs off on 429, orders take a clientOid of up to 64 characters, but the breach error code and a Retry-After rule were not read (10 of 15). No SLA (0). UTA v3 is the production API (10). 40.

Gemini Exchange API 73

Read with the hosted lines on the REST API at api.gemini.com. status.gemini.com is a Statuspage site with component history (20). Its Atom feed for 10 September to 3 November 2026 holds 25 entries, mostly scheduled trading and FIX upgrades of 15 to 60 minutes with possible order timeouts, single-network deposit delays, and incorrect perpetual index prices for about 3.5 hours on 15 and 16 October; a 3-hour scheduled eOTC window was planned and outside the core API. Minor only (20). Rate limits with numbers, 120 a minute public and 600 private plus per-endpoint limits (15). 429 is documented but with no Retry-After or backoff guidance, and client order ids are recommended without duplicate rejection, so retries are not safe by contract; the heartbeat cancel is a safety net rather than idempotency (8 of 15). No SLA found (0). Generally available (10). 20 + 20 + 15 + 8 + 0 + 10 = 73.

Bitget 62

API keys with read or read-and-write permission, a passphrase, HMAC-SHA256 or RSA signing, IP binding recommended, 50 keys per UID, revocation on the management page; no OAuth and no separate withdrawal scope in the docs read (22 of 30). --read-only strips write tools at start, --paper-trading routes to demo, and high-risk writes need confirm: true (18 of 20). Tools return the exchange's own data (10). Request and response hooks are forwarded as MCP log notifications; no per-call audit log on Bitget's side was found (6 of 15). security@bitget.com in the toolkit README, no security.txt, Mandiant and SlowMist reports on the September breach, a proof-of-reserves repository, no bounty page read (6 of 20). 62.

Gemini Exchange API 78

Revocable API keys with one role each (Trader, Fund Manager, Auditor, Administrator), HMAC-SHA384 signing with a nonce, and OAuth 2.0 with scopes, PKCE S256, single-use refresh tokens and RFC 7009 revocation; no IP allow-list documented and no key expiry (28 of 30). Auditor is read-only, a Trader key cannot withdraw, approved withdrawal addresses are a Fund Manager action, and the MCP server refuses funds-moving tools without confirm: true (18 of 20). The MCP server wraps every response in untrusted-output markers, strips control and bidi characters and redacts memos, labels and agreement text; the REST docs say nothing on the subject (13 of 15). Order and transfer history are readable, but no per-key audit log or API access log was found (5 of 15). security.txt with a PGP contact and a bug bounty paying $150 to $20,000, scoped to the sandbox hosts; no certification was read and no public advisory process was found (14 of 20). 28 + 18 + 13 + 5 + 14 = 78.

Bitget 74

The agent SDK ships openapi.yaml with 109 typed UTA v3 operations from which the tools are generated, a machine-readable contract from the vendor's own organisation though not on the docs site (20 of 25). llms.txt in the SDK and MCP repositories; the docs site has none (6 of 10). Intent tools with a discover tool that explains each verb, action and its risk level, and the server's initialize instructions state surface, modules and read-only posture (15 of 20). Typed inputs with enums and required fields from the OpenAPI source (12 of 15). Examples in the quick start and READMEs, a REST error code page in the legacy docs that we did not read in full (9 of 15). Changelog by day with preview notices and effective dates (12 of 15). 74.

Gemini Exchange API 88

OpenAPI 3 for REST (specs/openapi/rest.yaml), AsyncAPI for WebSocket, a prediction-markets OpenAPI file and a specs/index.json catalogue; the MCP server's tools take zod schemas published as JSON Schema (25). llms.txt, llms-full.txt, agents.md, an agent card and an agent skills index (10). Endpoint pages state purpose, the Build an agent guide says what to establish before acting and when to stop, and MCP tool descriptions tell the model when to confirm; the docs don't say when not to use an endpoint (15 of 20). Typed inputs with enums for order types, options and sessions, required fields marked, decimals as strings since 7 July 2026 (12 of 15). Examples throughout, samples in three languages, and an error-codes page with 53 named reasons and their HTTP statuses (14 of 15). A revision history dated from 2015 to 28 October 2026 and versioned paths (v1, v2), but the upcoming-changes page reads "TBD" (12 of 15). 25 + 10 + 15 + 12 + 14 + 12 = 88.

Bitget 78

Read as a hosted service with an open-source toolkit. The UTA changelog's latest launched entry is 30 October 2026 and a preview entry 3 November; the MCP package shipped 3.3.1 on 20 September and agent-skill was pushed 30 October (30). 58 dated changelog entries since 5 August 2026 and six MCP versions since June (20). Issue trackers on the Bitget-AI repositories (11 open on agent_hub) and a support centre; replies were not checked (10 of 25). In the official MCP registry under io.github.Bitget-AI, a GitHub namespace, with official SDKs in five languages (10 of 15). CI workflow with coverage, npm provenance attestations, two runtime dependencies, no install scripts (8 of 10). 78.

Gemini Exchange API 88

Read as a closed hosted service with an open repository. The revision history's latest entry is 28 October 2026 and the repository was pushed on 5 October (30). Thirteen dated entries between 2 September and 28 October 2026 (20). The nine open items on the repository are all pull requests with replies, Dependabot included, and the docs name trading@gemini.com for developer support; no public issue tracker was tested (15 of 25). Not in the official MCP registry, but current official SDKs, TypeScript 0.1.1 of 23 September and Go 0.1.0 of 29 August 2026 (15). CI workflows validate and publish both SDKs and the MCP server has tests; dependencies are current (8 of 10). 30 + 20 + 15 + 15 + 8 = 88.

Bitget 65

The editorial half. A closed hosted service with clear terms naming BTG Technology Holdings Limited; the toolkit is MIT (15 of 30). The privacy notice names the controller and EEA representative, gives 7-year and up to 10-year retention for compliance and litigation, and names recipients by category only (18 of 30). Deprecations and parameter changes carry effective dates (delta mode deprecated 27 August, symbol and category required from 30 September, snapshot changes with demo and live dates) but no written policy (15 of 20). Recipients by category, transfers under Seychelles law with no locations or provider names (5 of 20). 53.

Gemini Exchange API 75

The editorial half. A closed service under a user agreement that names its entities by state, with the MCP server and SDKs open under Apache-2.0 (18 of 30). The privacy policy of 11 May 2026 names entities and processing countries, ties retention to need without numbers and names provider categories only, with no DPA or subprocessor list found (16 of 30). The revision history records removals and type changes with dates, but the upcoming-changes page is "TBD" and no notice period is stated (8 of 20). Processing countries are named (US, Ireland, UK, Malta, Singapore, Australia) and providers by category, with no named subprocessors (12 of 20). 18 + 16 + 8 + 12 = 54.