Bitget vs KuCoin

Bitget 83

Read for the API with the MCP server as the agent route. 14 compact tools by default, module filters, a full surface on request and progressive discovery (25). Cursor pagination on CFD order history since 15 October 2026 and limit parameters on lists (15 of 20). Uniform ok or error result shape from the SDK with typed error classes and compact JSON in the text channel (13 of 20). clientOid on orders, dryRun: true on every write, confirm: true gating cancelAll and withdraw, annotations derived from risk level including readOnlyHint, destructiveHint and idempotentHint (18 of 20). Few required fields, official SDKs in five languages plus the TypeScript agent SDK and a CLI (12 of 15). 83.

KuCoin 62

Read for the API alone, since there is no MCP server. Responses take limit and cursor parameters on list endpoints and the order book depth is a parameter (14 of 25). Pagination and symbol filters on orders, fills and ledgers (15 of 20). Codes and messages per response, with the V2 scheme claimed to be clearer; the rate-limit page's own examples contradict its table, which costs an agent a turn (12 of 20). clientOid on orders makes retries safe; no MCP annotations to read (10 of 20). Three required fields on a spot order, official SDKs in five languages (11 of 15). 62.

Bitget 74

The agent SDK ships openapi.yaml with 109 typed UTA v3 operations from which the tools are generated, a machine-readable contract from the vendor's own organisation though not on the docs site (20 of 25). llms.txt in the SDK and MCP repositories; the docs site has none (6 of 10). Intent tools with a discover tool that explains each verb, action and its risk level, and the server's initialize instructions state surface, modules and read-only posture (15 of 20). Typed inputs with enums and required fields from the OpenAPI source (12 of 15). Examples in the quick start and READMEs, a REST error code page in the legacy docs that we did not read in full (9 of 15). Changelog by day with preview notices and effective dates (12 of 15). 74.

KuCoin 60

No OpenAPI or other machine-readable contract was found; the docs link a Postman workspace and the universal SDK is generated from an internal spec (8 of 25). No llms.txt; the skills hub ships Markdown SKILL.md files with endpoint tables for seven product areas, read-only (6 of 10). One docs page per endpoint with a description, permission and weight, but no when-to-use guidance (12 of 20). Typed parameter tables with enums for type and side and required flags (11 of 15). Request and response examples per endpoint and a unified six-digit error code scheme introduced with V2 (10 of 15). Dated changelog with V1 to V2 versioning (13 of 15). 60.

Bitget 65

The editorial half. A closed hosted service with clear terms naming BTG Technology Holdings Limited; the toolkit is MIT (15 of 30). The privacy notice names the controller and EEA representative, gives 7-year and up to 10-year retention for compliance and litigation, and names recipients by category only (18 of 30). Deprecations and parameter changes carry effective dates (delta mode deprecated 27 August, symbol and category required from 30 September, snapshot changes with demo and live dates) but no written policy (15 of 20). Recipients by category, transfers under Seychelles law with no locations or provider names (5 of 20). 53.

KuCoin 54

The editorial half. A closed hosted service with terms that are clear on use, liability and law but name no company (12 of 30). The privacy policy gives retention periods by purpose and provider (2 years after closure, 14 months for Firebase, 3 years for Jumio, 5 years for Sumsub) and names 41 services, with no data centre locations (22 of 30). Endpoints are removed and fields deprecated in dated changelog entries with no notice period or policy (8 of 20). Third parties named by service, locations not stated beyond transfers around the globe (10 of 20). 52.

Bitget 62

API keys with read or read-and-write permission, a passphrase, HMAC-SHA256 or RSA signing, IP binding recommended, 50 keys per UID, revocation on the management page; no OAuth and no separate withdrawal scope in the docs read (22 of 30). --read-only strips write tools at start, --paper-trading routes to demo, and high-risk writes need confirm: true (18 of 20). Tools return the exchange's own data (10). Request and response hooks are forwarded as MCP log notifications; no per-call audit log on Bitget's side was found (6 of 15). security@bitget.com in the toolkit README, no security.txt, Mandiant and SlowMist reports on the September breach, a proof-of-reserves repository, no bounty page read (6 of 20). 62.

KuCoin 55

API key with a user-set passphrase, HMAC-SHA256 signing, nine permission groups, IP allow-lists required for Withdrawal and FlexTransfers, trading keys without an IP disabled after 30 days of inactivity, revocation on the management page; no OAuth and no expiry on General keys (24 of 30). A General-only key is a true read-only mode and withdrawals are a separate permission; no confirmation step for writes beyond the key scope (12 of 20). Tools return the exchange's own data (10). The API key info endpoint shows permissions and IP lists; no per-call audit log was found (5 of 15). No security.txt, no disclosure policy or bounty on a page we could read, a whistleblower notice on the legal page (4 of 20). 55.

Bitget 40

Graded with the hosted lines on the UTA v3 API at api.bitget.com. No status page found (status.bitget.com does not resolve, the docs link none), so 0 for the page and 5 for no readable history; the September 2026 breach is in the deduction, not here. Rate limits are published as 6,000 per IP per minute and per-endpoint UID limits by VIP level (15). An x-mbx-used-remain-limit header is documented and the agent SDK backs off on 429, orders take a clientOid of up to 64 characters, but the breach error code and a Retry-After rule were not read (10 of 15). No SLA (0). UTA v3 is the production API (10). 40.

KuCoin 45

Graded with the hosted lines on the API at api.kucoin.com. No status page found (status.kucoin.com does not resolve, the docs link none), so 0 for the page and 5 for no readable history. Rate limits are published per VIP level with per-endpoint weights and IP limits for public endpoints (15). Every response carries gw-ratelimit-limit, gw-ratelimit-remaining and gw-ratelimit-reset, 429000 is documented with a wait rule, and orders take a clientOid the docs recommend as a UUID (15). No SLA (0). The UTA V2 API is the production surface (10). 45.

Bitget 40

No machine payment protocol (0). Base spot and futures rates are stated in a help article without login, the tier table draws by script (20). Market data needs no key, demo trading costs nothing and no card is asked for at sign-up (20). A person registers, verifies identity and mints the key in a browser (0). 40.

KuCoin 35

No machine payment protocol (0). The spot base fee is stated in support articles without login, the futures base rate and the full tier table sit in images or behind script (15 of 20). Market data needs no key, no card is asked for at sign-up (20). A person registers, verifies identity and mints the key in a browser (0). 35.