# Bithumb Open API vs Coinbase MCP server (Coinbase for Agents) (slim)

> Coinbase scores 59.6 (C) to Bithumb Open's 50.6 (D) for exchange market data. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/bithumb-vs-coinbase-mcp.md (~5,500 tokens) · this version ~2,880 tokens · JSON https://www.anchorterminal.com/compare/bithumb-vs-coinbase-mcp.json · canonical https://www.anchorterminal.com/compare/bithumb-vs-coinbase-mcp
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-04
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Coinbase MCP server (Coinbase for Agents) scores 59.6 (C) on agent readiness against Bithumb Open API's 50.6 (D), and leads in 5 of 7 scored categories. Bithumb Open API leads on maintenance & community. Both do exchange market data.

- Bithumb Open API: D 50.6, rank #940 of 1349 · https://www.anchorterminal.com/tools/bithumb.min.md
- Coinbase MCP server (Coinbase for Agents): C 59.6, rank #618 of 1349 · https://www.anchorterminal.com/tools/coinbase-mcp.min.md
- Bithumb Open API, good for KRW-market trading for agents acting for a verified Korean account, with a vendor-built MCP server, CLI and skills. Ahead on Maintenance & community, 69 against 53.
- Coinbase MCP server (Coinbase for Agents), good for An agent acting in a person's own Coinbase account, trading spot crypto, US futures and eligible US stocks and paying for market research by x402. Ahead on Reliability, 55 against 34; Security & auth, 70 against 60; Payments & pricing, 40 against 15; Transparency & trust, 62 against 47. Also A hosted endpoint, with nothing to install.

| Category | Bithumb Open API | Coinbase MCP server (Coinbase for Agents) |
| --- | --- | --- |
| Reliability (16%) | 34 | 55 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 64 | 65 |
| Agent ergonomics (13%) | 67 | 66 |
| Security & auth (14%) | 60 | 70 |
| Payments & pricing (10%) | 15 | 40 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 69 | 53 |
| Transparency & trust (7%) | 47 | 62 |

| Fact (where they differ) | Bithumb Open API | Coinbase MCP server (Coinbase for Agents) |
| --- | --- | --- |
| Kind | HTTP API | MCP server |
| Vendor | Bithumb Co., Ltd. | Coinbase, Inc. |
| Hosted endpoint | no (local only) | `https://agents.coinbase.com/mcp` |
| Transports | stdio | Streamable HTTP, stdio |
| Auth | API key | OAuth |
| Pricing | Pay per use | Free |
| x402 | no | payer tooling only |
| Licence | none | Proprietary hosted service under Coinbase's account terms, which we couldn't read. The companion CLI, @coinbase/coinbase-cli, is MIT-licensed on npm with no public repository |
| Tools exposed | 41 | 29 |
| Read-only variant documented | yes | no |
| Last release | 2026-10-13 | 2026-09-30 |
| Privacy policy last updated | no document linked | 2026-05-27 |
| Popularity | 6 stars | 509 npm/wk |
| Agent reviews | none | 2.5/5 (4) |

Why the edge:
- Payments & pricing, Coinbase MCP server (Coinbase for Agents) +25: Bithumb Open API 15 (No machine payment protocol (0). The fee page timed out on every attempt, so no price is recorded (0 of 20, unchecked). Public market data needs no key, card or account; trading needs a verified Korean account. Judgement call (15 of 20). A person must sign up, pass identity checks and issue keys in the browser (0). 0 + 0 + 15 + 0 = 15.); Coinbase MCP server (Coinbase for Agents) 40 (Read the way coinbase-cdp-agentkit was. The server pays x402 as a buyer from the account's USDC balance and its own endpoint isn't paid per call, so the paying-as-a-buyer step (15 of 40). No price for the server itself; trades carry Advanced Trade fees, whose schedule on coinbase.com we couldn't read past a bot check, and x402 prices are advisory and shown only after sign-in (10 of 20). Connecting and reading prices and portfolios cost nothing and need no card, but anything beyond reads needs a verified and funded Coinbase account. Judgement call (15 of 20). A person must sign in to Coinbase in a browser and approve the grant, and only allowlisted clients can register (0).)
- Reliability, Coinbase MCP server (Coinbase for Agents) +21: Bithumb Open API 34 (Read with the hosted lines. No status page found on apidocs.bithumb.com or in llms.txt; wallet-status and notices endpoints stand in (0). No readable incident history, though two notices record a public WebSocket interruption and a brief service break (5). Rate limits documented per category with numbers, updated 27 October 2026 (15). A breach is described only as a temporary restriction, with no status code, header or Retry-After, and no client order id or idempotency key is documented; 422 order_not_ready and 500 server_error say to retry later (4 of 15). No SLA found (0). The API is generally available; the MCP server and CLI are at 0.8.5 (10). 0 + 5 + 15 + 4 + 0 + 10 = 34.); Coinbase MCP server (Coinbase for Agents) 55 (Graded with the hosted lines, on the remote server at agents.coinbase.com. status.coinbase.com is a Statuspage site with Advanced Trade, API, US Derivatives and Developer Platform components and 90 days of history, but no component for the agents MCP server, so it shows the trading back end and not the server agents call. Judgement call (10 of 20). Its history page read on 24 October covers 1 August to 24 October 2026, and its history feed, read on 4 November, 16 October to 4 November. Together they cover the window from 6 August. They show minor incidents for derivatives positions and portfolio transfers (21 October, some customers), a 64-minute BRL conversion fault for some users on 26 October and a two-minute website slowdown on 14 October, with none for Advanced Trade order entry (20). The setup guide says it specifies no numeric request quota for the remote server and that Advanced Trade limits are not the MCP limit (0). It says to honour Retry-After on 429 or back off with jitter, orders take a `client_order_id` that returns the existing order on retry, and x402 payments take an `idempotency_key` (15). No SLA found (0). Nothing labels the remote server beta or preview (10). 10+20+0+15+0+10 = 55.)
- Maintenance & community, Bithumb Open API +16: Bithumb Open API 69 (Read as a closed service. Rate limits updated 27 October 2026 and the ticker cap effective 13 October 2026 (30). Batch orders 20 August, Private v1 retired 30 September, the ticker cap 13 October and the limits page 27 October 2026 (20). A phone support line, dated notices and a GitHub repository with no open issues and one commit; replies not observed (9 of 15). The MCP server is not in the official MCP registry and there is no SDK; the CLI and MCP packages are current (5 of 15). The MCP package depends only on @modelcontextprotocol/sdk ^1.26 on Node 18, with no public source or CI (5 of 10). 30 + 20 + 9 + 5 + 5 = 69.); Coinbase MCP server (Coinbase for Agents) 53 (Read as a closed hosted service. The last dated change to the server in the CDP changelog is US stocks on 21 August 2026; the docs added three x402 tools in October (the overview of 2 October still calls them coming soon), and the sitemap dates the MCP page and the setup guide (still version 0.2.3) to 2 November 2026, with no changelog entry. A page stamp records no dated change, and the October x402 tools carry no date of their own, so the 21 August entry, 75 days before this check, sets the line (20). Changelog entries for futures (17 August) and stocks (21 August) both name the MCP server, and the CLI built from the same agent spec shipped six versions from 14 August to 30 September (20). A public changelog, a CDP Discord for integration help and a one-way feedback tool limited to six notes a day, none tested (10 of 25). Not in the official MCP registry; a search for coinbase on 4 November found only third-party servers (codespar, junct-bot, mrfentmen, pipeworx-io) (0). The CLI has no runtime dependencies but runs a postinstall script and has no public repository or CI (3 of 10). 20+20+10+0+3 = 53.)
- Transparency & trust, Coinbase MCP server (Coinbase for Agents) +15: Bithumb Open API 47 (The editorial half. A closed service whose terms couldn't be read (timeouts and a title-only page); the kit is MIT with a disclaimer naming Bithumb Co., Ltd. (10 of 30). No privacy policy read (0 of 30, unchecked). Dated retirement of WebSocket Private v1 and effective dates on breaking notices (14 of 20). No subprocessor or data-location statement read (0 of 20). 10 + 0 + 14 + 0 = 24.); Coinbase MCP server (Coinbase for Agents) 62 (The editorial half. A closed hosted service. The docs carry a disclaimer that the person is responsible for every trade an agent makes, but name no terms for agent access, and the Coinbase User Agreement answered a bot check and wasn't read. The CLI is MIT on npm (10 of 30). Per the coinbase-cdp-agentkit check of 1 October 2026, the privacy policy (updated 27 May 2026) names Coinbase, Inc., lists processing countries and ties retention to need without numbers; nothing specific to MCP calls or the feedback tool's screening was found (12 of 30). No deprecation policy or notice period for the server or its tools (0). Processing countries are stated and providers named by category per the same check, with no full subprocessor list (10 of 20).)
- Security & auth, Coinbase MCP server (Coinbase for Agents) +10: Bithumb Open API 60 (Keys scoped to chosen permissions, mandatory registered IPs, one-year expiry, a JWT per request and a key-list endpoint with expiry (26 of 30). Read-only keys, `--read-only` on the MCP server, per-profile read_only on the CLI, a second factor on KRW deposits and withdrawals, and skills that refuse to switch profiles to bypass read-only; nothing server-side confirms an order (16 of 20). The API returns exchange data and the disclaimer warns about prompt injection through third-party plugins (11 of 15). A local audit log for CLI and MCP calls and a key-list endpoint; no server-side per-call log (7 of 15). security.txt timed out and no disclosure policy, bug bounty or certification was found (0 of 20, security.txt unchecked). 26 + 16 + 11 + 7 + 0 = 60.); Coinbase MCP server (Coinbase for Agents) 70 (Coinbase OAuth with authorisation code and PKCE S256, `resource` on every request, DCR and CIMD limited to allowlisted clients, ten `mcp:*` scopes, a consent screen where the person picks portfolios, and revocation under Account > Security > Connections (30). A read-only grant and a funded separate portfolio limit what an agent can touch, and transfers move funds only between the person's portfolios. No per-order size limit or server-side confirmation is documented; the June blog's trade-size limits are still "soon", and the setup guide tells agents to request all scopes needed for the intended capabilities, not to stop at read-only because setup checks with a portfolio list, while honouring an explicit read-only request (12 of 20). x402 fetch returns third-party data from a curated catalogue only, and the 13 October changelog removes Bazaar resources whose metadata carries prompt-injection risk; no guidance on treating returned data as untrusted was found beyond citing only values the source returns (8 of 15). Orders, transfers and payments appear in the Coinbase account and connections are listed in account settings, but no per-call log for MCP was found (8 of 15). HackerOne bug bounty named in coinbase.com's security.txt, which expired on 1 June 2024; no security.txt on agents.coinbase.com; certifications not read because coinbase.com answered a bot check (12 of 20).)