Bithumb Open API vs MEXC API

Bithumb Open API 15

No machine payment protocol (0). The fee page timed out on every attempt, so no price is recorded (0 of 20, unchecked). Public market data needs no key, card or account; trading needs a verified Korean account. Judgement call (15 of 20). A person must sign up, pass identity checks and issue keys in the browser (0). 0 + 0 + 15 + 0 = 15.

MEXC API 31

No machine payment protocol (0). Fees published without login on MEXC's own fee guide (20 October 2026) and a 2024 announcement, with a separate API futures schedule; the fee page itself is drawn by script (16 of 20). Public market data needs no key or card; trading needs a verified and funded account. Judgement call (15 of 20). A person must sign up in a browser, and futures need identity verification (0). 0 + 16 + 15 + 0 = 31.

Bithumb Open API 47

The editorial half. A closed service whose terms couldn't be read (timeouts and a title-only page); the kit is MIT with a disclaimer naming Bithumb Co., Ltd. (10 of 30). No privacy policy read (0 of 30, unchecked). Dated retirement of WebSocket Private v1 and effective dates on breaking notices (14 of 20). No subprocessor or data-location statement read (0 of 20). 10 + 0 + 14 + 0 = 24.

MEXC API 58

The editorial half. A closed service with a dated user agreement naming MEXC (Comoros) Ltd; the CLI is UNLICENSED on npm (15 of 30). The privacy policy names no entity, states no retention periods and relies on standard contractual clauses for transfers (10 of 30). The changelog flags endpoints as "will be discontinued soon" without dates and the futures log records removals (8 of 20). Third parties are named by category only, with no subprocessor list or data locations (5 of 20). 15 + 10 + 8 + 5 = 38.

Bithumb Open API 34

Read with the hosted lines. No status page found on apidocs.bithumb.com or in llms.txt; wallet-status and notices endpoints stand in (0). No readable incident history, though two notices record a public WebSocket interruption and a brief service break (5). Rate limits documented per category with numbers, updated 27 October 2026 (15). A breach is described only as a temporary restriction, with no status code, header or Retry-After, and no client order id or idempotency key is documented; 422 order_not_ready and 500 server_error say to retry later (4 of 15). No SLA found (0). The API is generally available; the MCP server and CLI are at 0.8.5 (10). 0 + 5 + 15 + 4 + 0 + 10 = 34.

MEXC API 43

Read with the hosted lines. No status page found; status.mexc.com does not resolve and llms.txt points to a maintenance-updates feed (0). No readable incident history (5). Rate limits documented with numbers, 300 weight per 10 seconds per IP, 500 per UID, 12 order requests a second per UID, 100 WebSocket messages a second (15). 429 and 418 carry Retry-After with ban lengths stated, a 5xx is to be treated as unknown rather than failed, an order-test endpoint exists, and newClientOrderId is optional with no idempotency promise (13 of 15). No SLA found (0). Spot and futures are generally available, futures order placement having reopened on 31 March 2026 after being closed since July 2022 (10). 0 + 5 + 15 + 13 + 0 + 10 = 43.

Bithumb Open API 69

Read as a closed service. Rate limits updated 27 October 2026 and the ticker cap effective 13 October 2026 (30). Batch orders 20 August, Private v1 retired 30 September, the ticker cap 13 October and the limits page 27 October 2026 (20). A phone support line, dated notices and a GitHub repository with no open issues and one commit; replies not observed (9 of 15). The MCP server is not in the official MCP registry and there is no SDK; the CLI and MCP packages are current (5 of 15). The MCP package depends only on @modelcontextprotocol/sdk ^1.26 on Node 18, with no public source or CI (5 of 10). 30 + 20 + 9 + 5 + 5 = 69.

MEXC API 75

Read as a closed service. Last dated change 23 October 2026 in both the spot and futures logs (30). Spot entries on 14 August, 24 August, 11 September and 23 October 2026, futures on 1 September, 11 September, 19 October and 23 October (20). An API support Telegram group, a ticket form and dated changelogs; GitHub issues not read (10 of 15). The official SDK repository was last pushed in February 2024 while the CLI is current (10 of 15). The CLI ships platform binaries with no dependencies and no public repository or CI; the SDK is stale (5 of 10). 30 + 20 + 10 + 10 + 5 = 75.

Bithumb Open API 60

Keys scoped to chosen permissions, mandatory registered IPs, one-year expiry, a JWT per request and a key-list endpoint with expiry (26 of 30). Read-only keys, --read-only on the MCP server, per-profile read_only on the CLI, a second factor on KRW deposits and withdrawals, and skills that refuse to switch profiles to bypass read-only; nothing server-side confirms an order (16 of 20). The API returns exchange data and the disclaimer warns about prompt injection through third-party plugins (11 of 15). A local audit log for CLI and MCP calls and a key-list endpoint; no server-side per-call log (7 of 15). security.txt timed out and no disclosure policy, bug bounty or certification was found (0 of 20, security.txt unchecked). 26 + 16 + 11 + 7 + 0 = 60.

MEXC API 65

Granular permissions (account read, trade, withdraw, transfer), per-pair restriction, up to 10 linked IPs, 90-day expiry without an IP, renewal and revocation in the account, 30 keys per account (26 of 30). A read-only MCP mode that hides write tools, a confirmation step before orders and transfers in the CLI and MCP, and --yes that agents are told not to add; nothing server-side confirms an API order (17 of 20). The API returns exchange data, and the CLI security page warns that agents may be led by web pages or files into unwanted actions (12 of 15). CLI confirmations are logged and reported to MEXC with no operator access described; an apiKeyInfo endpoint shows key settings (6 of 15). No security.txt, disclosure policy or bug bounty found; a proof-of-reserves page exists (4 of 20). 26 + 17 + 12 + 6 + 4 = 65.