{ "data": { "a": { "slug": "bybit", "name": "Bybit", "vendor": "Bybit", "vendorUrl": "https://www.bybit.com", "kind": "http-api", "category": "crypto-exchanges", "summary": "Bybit is a centralised crypto exchange for spot, perpetual and futures contracts, options and earn products, reached through its V5 REST and WebSocket API, a FIX order-entry gateway and an official stdio MCP server published from its GitHub organisation.", "url": "https://www.anchorterminal.com/tools/bybit", "markdownUrl": "https://www.anchorterminal.com/tools/bybit.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/bybit.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/bybit.json", "dns": "bybit.grade.anchorterminal.com", "repo": "https://github.com/bybit-exchange/trading-mcp", "transports": [ "stdio" ], "packages": [ { "registry": "npm", "name": "bybit-official-trading-server" }, { "registry": "pypi", "name": "pybit" } ], "auth": "api-key", "authNotes": "API key minted on the API management page after a browser sign-up and identity verification, signed per request with HMAC-SHA256 (system-generated secret) or RSA-SHA256 (self-generated key pair) in the X-BAPI-API-KEY, X-BAPI-TIMESTAMP, X-BAPI-SIGN and X-BAPI-RECV-WINDOW headers. Permissions are granted per group (ContractTrade, Spot, Wallet with a separate Withdraw value, Options, Derivatives, Exchange, Earn, Affiliate, BlockTrade) with a readOnly flag, and keys can be bound to IP addresses. A key with no IP binding expires 90 days after creation and can be extended on the management page with email and 2FA codes. Keys for testnet come from testnet.bybit.com and keys for demo trading from the production account in demo mode (https://bybit-exchange.github.io/docs/v5/user/apikey-info and https://bybit-exchange.github.io/docs/faq, checked 2026-11-03).", "pricing": "usage", "pricingNotes": "The API and the MCP server cost nothing; trades carry Bybit's fees. At VIP 0 the spot fee is 0.1 per cent maker and taker, perpetual and futures contracts 0.02 per cent maker and 0.055 per cent taker, options 0.02 per cent maker and 0.03 per cent taker, with lower tiers by 30-day volume or asset balance and a note that rates vary by region. Fiat pairs, the Adventure Zone, xStocks and pre-market perpetuals have their own tables (https://www.bybit.com/en/help-center/article/Trading-Fee-Structure, last updated 2 September 2026, read 2026-11-03).", "priceSummary": "0.1% fee", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the V5 docs, the MCP server's README or source, or the fee schedule (checked 2026-11-03). Trading fees are taken from the account balance.", "endpoints": [] }, "toolCount": 398, "popularity": { "githubStars": 43, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-03" }, "docsUrl": "https://bybit-exchange.github.io/docs/v5/intro", "capabilities": [ "exchange.market-data", "exchange.spot-trading", "exchange.derivatives", "exchange.balances", "exchange.transfers", "exchange.staking", "market.crypto" ], "tags": [ "hosted", "closed-source", "api-key", "usage-priced", "sandbox", "no-status-page", "mcp", "official", "python", "typescript", "go", "java", "dotnet" ], "lastRelease": "2026-10-30", "graded": true, "anchor": { "graded": true, "score": 57.3, "grade": "C", "agentReady": false, "rank": 745, "ranked": true, "rankOf": 1349, "categoryRank": 11, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 66, "maintenance": 66, "payments": 40, "reliability": 45, "schema": 73, "security": 60, "transparency": 51 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-03" }, "negative": 0, "verdict": "Bybit publishes per-endpoint rate limits, a demo environment, scoped keys with a read-only flag and IP binding, and an official stdio MCP server whose 398 tools carry read-only and destructive annotations. There is no status page, no OpenAPI file, no SLA, the MCP server has no toolsets, and the global terms and privacy pages are drawn by script.", "bestFor": "An agent trading spot, perpetuals, futures and options in a person's Bybit account outside the excluded jurisdictions, with a demo environment to rehearse on.", "strengths": [ "Official MCP server from Bybit's GitHub organisation with 398 generated tools, each annotated readOnlyHint, destructiveHint and openWorldHint, and market data tools that need no key", "Rate limits published per endpoint and per UID with limit, remaining and reset headers on every response, and a documented 403 ban rule for the IP limit", "API keys scoped by product group with a read-only flag, a separate Withdraw permission, IP binding and a 90-day expiry for unbound keys", "Demo trading at api-demo.bybit.com with self-served demo funds, plus a testnet with its own keys", "VIP 0 fees published without login, 0.1 per cent spot and 0.02 per cent maker and 0.055 per cent taker on contracts" ], "weaknesses": [ "No status page, incident history or SLA was found; the terms say the API is not guaranteed to be available", "No OpenAPI or llms.txt for the V5 API, and the MCP server exposes all 398 tools with no toolset, module or read-only switch", "Not in the official MCP registry; the hosted `bybit` entry there is a third party's server, not Bybit's", "The global terms, privacy policy and about pages on bybit.com render by script and were not read; the terms read are the UAE-regulated entity's PDF", "Changelog entries change response shapes and remove fields without a notice period, such as the Asset Overview restructure of 18 August 2026" ], "agentNotes": [ "Create a key with only the permission groups the task needs, set readOnly for research keys, leave Withdraw off and bind an IP, or the key expires after 90 days", "Send a unique orderLinkId on every order and reuse it when amending or cancelling, since create-order is asynchronous and confirmed over WebSocket", "Read X-Bapi-Limit-Status before bursts and wait until X-Bapi-Limit-Reset-Timestamp on retCode 10006; on HTTP 403 stop all sessions for at least 10 minutes", "Test on api-demo.bybit.com with a demo key from the production account, not on testnet demo mode, which the docs call meaningless", "Run the MCP server with BYBIT_TESTNET=true first, and only in a client that shows a per-call approval, because the server has no read-only mode of its own" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 57.3 } ], "editorialScores": { "ergonomics": 66, "maintenance": 66, "payments": 40, "reliability": 45, "schema": 73, "security": 60, "transparency": 27 }, "provenanceScore": 75, "checked": { "categories": { "ergonomics": "2026-11-03", "maintenance": "2026-11-03", "payments": "2026-11-03", "reliability": "2026-11-03", "schema": "2026-11-03", "security": "2026-11-03", "transparency": "2026-11-03" }, "last": "2026-11-03", "oldest": "2026-11-03", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install -g bybit-official-trading-server", "http": "curl https://api.bybit.com/v5/market/tickers?category=spot\u0026symbol=BTCUSDT", "claudeCode": "claude mcp add bybit -- npx -y bybit-official-trading-server@latest", "config": { "mcpServers": { "bybit": { "args": [ "-y", "bybit-official-trading-server@latest" ], "command": "npx", "env": { "BYBIT_API_KEY": "YOUR_API_KEY", "BYBIT_API_SECRET": "YOUR_API_SECRET", "BYBIT_TESTNET": "true" } } } } }, "letme": { "capability": "https://letme.dev/exchange.market-data", "tool": "https://letme.dev/bybit" }, "area": "payments", "unitPrices": [ { "item": "Spot trade, VIP 0 maker or taker", "unit": "pct", "usd": 0.1, "note": "crypto-crypto pairs" }, { "item": "Perpetual or futures trade, VIP 0 taker", "unit": "pct", "usd": 0.055, "note": "maker 0.02 per cent" }, { "item": "Options trade, VIP 0 taker", "unit": "pct", "usd": 0.03, "note": "maker 0.02 per cent" } ], "provenance": { "legalEntity": "Bybit Virtual Asset Platform Operator L.L.C. S.P.C", "domain": "bybit.com", "domainRegistered": "1999-08-05", "endpointOnVendorDomain": true, "terms": "https://www.bybit.com/en/terms-service", "privacy": "https://www.bybit.com/en/privacy-policy", "statusPage": "", "changelog": "https://bybit-exchange.github.io/docs/changelog/v5", "securityTxt": "none", "checked": "2026-11-03", "notes": [ "www.bybit.com answers WebFetch with a timeout; its robots.txt (read with curl) allows the help centre, legal and static paths and disallows query-string URLs and x-api endpoints. The terms and privacy pages render by script, so the terms read are the PDF at /common-static/compliance/legal/BYBIT/b2e1c94c53ee5e12e165919de919337e.pdf (Bybit Virtual Asset Platform Operator L.L.C. S.P.C, last updated 23 January 2026, English and Welsh law, SIAC arbitration). The privacy policy was not read.", "RDAP gives bybit.com a registration date of 5 August 1999 (CSC Corporate Domains), earlier than the company, so the domain was bought.", "https://www.bybit.com/.well-known/security.txt answers 404. bybit-exchange.github.io has no robots.txt and no security.txt.", "No status page found; status.bybit.com does not resolve, the docs link none, and a search found only third-party monitors.", "The V5 changelog is dated by day; the MCP server's versions are on npm. The P2P service terms on bybit.com name Bybit Technology Limited as the company." ], "score": 75 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/bybit.json", "live": { "slug": "bybit", "versions": [ { "registry": "github", "name": "bybit-exchange/trading-mcp", "version": "2.1.26", "released": "2026-10-30", "seenAt": "2026-11-04T20:04:41.294958912Z" }, { "registry": "npm", "name": "bybit-official-trading-server", "version": "2.1.26", "seenAt": "2026-11-04T20:04:40.287082189Z" }, { "registry": "pypi", "name": "pybit", "version": "5.17.0", "released": "2026-07-14", "seenAt": "2026-11-04T20:04:41.10004853Z" } ], "githubStars": 43, "npmWeekly": 1294, "pypiWeekly": 97932, "securityTxt": { "url": "https://bybit.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-04T15:54:01.70982249Z" }, "updatedAt": "2026-11-04T20:04:41.294958912Z" } }, "answer": "Bybit scores 57.3 (C) on agent readiness against Crypto.com Exchange API's 46.8 (D), and leads in 4 of 7 scored categories. Crypto.com Exchange API leads on reliability.", "b": { "slug": "crypto-com-exchange", "name": "Crypto.com Exchange API", "vendor": "Foris DAX Limited (Crypto.com)", "vendorUrl": "https://crypto.com/exchange", "kind": "http-api", "category": "crypto-exchanges", "summary": "Crypto.com Exchange's trading API for spot, perpetuals, margin, staking and trading bots, through REST, WebSocket and FIX with HMAC-signed API keys. Crypto.com's cdcx-cli adds an MCP server, agent skills and local paper trading.", "url": "https://www.anchorterminal.com/tools/crypto-com-exchange", "markdownUrl": "https://www.anchorterminal.com/tools/crypto-com-exchange.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/crypto-com-exchange.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/crypto-com-exchange.json", "dns": "crypto-com-exchange.grade.anchorterminal.com", "repo": "https://github.com/crypto-com/cdcx-cli", "license": "Proprietary hosted API under the Exchange terms and conditions, which our reader couldn't load. cdcx-cli, the official CLI and MCP server, is MIT or Apache-2.0", "transports": [ "stdio" ], "packages": [ { "registry": "npm", "name": "@cryptocom/cdcx-cli" } ], "auth": "api-key", "authNotes": "API key and secret created in the Exchange under Settings \u003e API Keys after a browser signup, with HMAC-SHA256 request signing. The official agent skill says IP whitelisting is recommended for production and withdrawal addresses must be pre-approved, and the App skill uses a key with no withdrawal permission; the Exchange docs' own permission list (read, trade, withdraw) sits on exchange-docs.crypto.com, which refused our reader. cdcx reads CDCX_API_KEY and CDCX_API_SECRET or a 0600 config file and has no key flag by design (https://github.com/crypto-com/crypto-agent-trading, https://github.com/crypto-com/cdcx-cli/blob/main/SECURITY.md, checked 2026-11-03).", "pricing": "usage", "pricingNotes": "The API itself costs nothing. Spot fees by 30-day volume, Level 1 (under $10,000) 0.25% maker and 0.50% taker, down to 0.08% and 0.18% at $500,000 or more, with a 3% discount for a CRO balance and 0% maker or rebates at higher CRO levels; rates reset daily at 04:00 UTC. A 0.5% liquidation fee. Derivatives fees are not on the fees page. A UAT environment (uat-api.3ona.co) and cdcx's local paper trading need no money (https://crypto.com/exchange-pro/en-US/document/fees-limits, checked 2026-11-03).", "priceSummary": "0.25% fee", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 on the Exchange pages, in cdcx-cli or the agent skills (checked 2026-11-03). Crypto.com's GitHub has an x402 facilitator client for its Developer Platform, which is a different product.", "endpoints": [] }, "toolCount": 95, "popularity": { "githubStars": 27, "npmWeekly": 59, "pypiWeekly": null, "asOf": "2026-11-03" }, "docsUrl": "https://exchange-docs.crypto.com/exchange/v1/rest-ws/index.html", "capabilities": [ "exchange.market-data", "exchange.spot-trading", "exchange.derivatives", "exchange.balances", "exchange.transfers", "exchange.staking", "market.crypto" ], "tags": [ "official", "hosted", "api-key", "mcp", "cli", "agent-skills", "sandbox", "status-page", "rust", "usage-priced" ], "lastRelease": "2026-06-18", "graded": true, "anchor": { "graded": true, "score": 46.8, "grade": "D", "agentReady": false, "rank": 1100, "ranked": true, "rankOf": 1349, "categoryRank": 20, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 50, "maintenance": 29, "payments": 40, "reliability": 50, "schema": 42, "security": 54, "transparency": 55 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "low", "date": "2026-11-03" }, "negative": 0, "verdict": "Crypto.com is one of two exchanges here with an official MCP server, cdcx-cli, whose 95 generated tools are grouped by service and gated by safety tier. The API docs, OpenAPI file, terms and trading rules refused or hid from our reader, so rate limits, key permissions and the automated-trading clauses are unchecked, and cdcx has no release since June 2026.", "bestFor": "An agent trading spot or perpetuals on Crypto.com through a local MCP server with safety tiers, for a person outside the App's restricted list.", "strengths": [ "Official cdcx-cli MCP server with 95 typed tools generated from the Exchange's OpenAPI spec, enabled by service group so a session can load `market` alone", "Safety tiers in the source, where order writes need `acknowledged: true` and cancel-all, withdrawals and bot termination need `--allow-dangerous` on the server", "A UAT environment with the same API paths and a local paper-trading engine that needs no credentials", "Spot fee tiers published without login, from 0.25% maker and 0.50% taker", "Official agent skills for the Exchange and the App that require user confirmation before a production trade" ], "weaknesses": [ "exchange-docs.crypto.com and the OpenAPI host answered 403 to robots.txt, so rate limits, key permissions, errors and the changelog could not be read", "The Exchange terms, trading rules and announcements pages load empty without a browser, so clauses on bots, API use and restricted countries are unchecked", "cdcx-cli's last tag is v1.2.6 of 18 June 2026 with no commit since, five of six open items unanswered, and the npm wrapper at 1.2.3 runs a postinstall download", "Not in the official MCP registry and no official SDK beyond the CLI", "No security.txt on crypto.com, and no SLA or Exchange-API component found on the status page" ], "agentNotes": [ "Enable only the service groups the task needs with `cdcx mcp config --enable trade,account` (the default serves `market` alone), and leave `--allow-dangerous` off unless the person asks for withdrawals or cancel-all", "Rehearse on `--env uat` or `cdcx paper` first; production keys trade real funds, and the skill requires explicit user confirmation before each live order", "Put the key in CDCX_API_KEY and CDCX_API_SECRET or `~/.config/cdcx/config.toml` at 0600; there is no key flag, and the key should have no withdrawal permission and an IP allow-list", "Pass `acknowledged: true` on mutate tools and `--dry-run` while testing; read the tool's generated schema before calling, since the docs host is unreadable to agents without a browser", "Check the person's country against Crypto.com's geo-restriction article and the Exchange terms before trading; New York and about 70 countries are excluded from the App, and the Exchange list was unreadable" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "low", "grade": "D", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 46.8 } ], "editorialScores": { "ergonomics": 50, "maintenance": 29, "payments": 40, "reliability": 50, "schema": 42, "security": 54, "transparency": 32 }, "provenanceScore": 77, "checked": { "categories": { "ergonomics": "2026-11-03", "maintenance": "2026-11-03", "payments": "2026-11-03", "reliability": "2026-11-03", "schema": "2026-11-03", "security": "2026-11-03", "transparency": "2026-11-03" }, "last": "2026-11-03", "oldest": "2026-11-03", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "curl -sSfL https://raw.githubusercontent.com/crypto-com/cdcx-cli/main/install.sh | sh", "http": "curl https://api.crypto.com/exchange/v1/public/get-tickers", "config": { "mcpServers": { "cdcx": { "args": [ "-y", "@cryptocom/cdcx-cli@latest", "mcp" ], "command": "npx", "env": { "CDCX_API_KEY": "your_api_key", "CDCX_API_SECRET": "your_api_secret" } } } } }, "letme": { "capability": "https://letme.dev/exchange.market-data", "tool": "https://letme.dev/crypto-com-exchange" }, "area": "payments", "unitPrices": [ { "item": "Spot maker fee, Level 1 (under $10,000 of 30-day volume)", "unit": "pct", "usd": 0.25, "note": "0.2425% with a CRO balance" }, { "item": "Spot taker fee, Level 1", "unit": "pct", "usd": 0.5, "note": "falls to 0.18% at $500,000 or more of 30-day volume" } ], "provenance": { "legalEntity": "Foris DAX Limited", "domain": "crypto.com", "domainRegistered": "1993-05-06", "endpointOnVendorDomain": true, "terms": "https://crypto.com/exchange-pro/en-US/document/tnc", "privacy": "https://crypto.com/uk/privacy/exchange", "statusPage": "https://status.crypto.com", "changelog": "", "securityTxt": "none", "checked": "2026-11-03", "notes": [ "Foris DAX Limited is named in the Exchange privacy notice (last updated 12 March 2025) as a Cayman Islands exempted company. The terms and conditions page loaded empty, so the entity in the terms is unconfirmed.", "RDAP gives crypto.com a registration date of 6 May 1993.", "https://crypto.com/.well-known/security.txt returns 404. cdcx-cli has a SECURITY.md with private vulnerability reporting through GitHub, and the crypto-com organisation has an h1-policy-guidelines repository.", "crypto.com/robots.txt allows the pages read; exchange-docs.crypto.com, exchange-developer.crypto.com and static2.crypto.com answered 403 to robots.txt and nothing on them was fetched. help.crypto.com allows with Crawl-delay 1.", "No API changelog could be read; the Exchange announcements page loaded empty." ], "score": 77 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/crypto-com-exchange.json", "live": { "slug": "crypto-com-exchange", "vendorStatus": { "page": "https://status.crypto.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-04T20:05:02.608262953Z" }, "securityTxt": { "url": "https://crypto.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-04T15:54:09.539387255Z" }, "updatedAt": "2026-11-04T20:05:02.608262953Z" } }, "edges": [ { "by": 37, "category": "maintenance", "leads": "bybit", "name": "Maintenance \u0026 community", "reasons": { "a": "Read as a hosted service with an open-source MCP server. The MCP package shipped 2.1.26 on 30 October 2026 and the V5 changelog's latest entry is 29 October (30). 31 npm versions since 16 April 2026, 11 of them in the last 90 days, and 24 changelog entries in the same window (20). The trading-mcp repository has 4 open issues and 18 forks; whether issues get answers was not checked, and the API has no public forum we could read (10 of 25). Not in the official MCP registry (0). The package has four dependencies, no install scripts, a publish workflow and no test workflow (6 of 10). 66.", "b": "Read as a closed service with an open CLI. The last change we could date is cdcx-cli v1.2.6 on 18 June 2026, 138 days before the check, with no commit since; the API changelog is unread (10). No three dated releases in the last 90 days (0). Five of six open items on cdcx-cli, all by collaborators or Dependabot since May, have no comment; the Exchange has a support chat and contact@crypto.com (8 of 25). Not in the official MCP registry and no official SDK beyond the CLI (5 of 15). CI tests on three operating systems with clippy and fmt; the npm wrapper's postinstall downloads the binary and two Dependabot bumps are open (6 of 10). 10 + 0 + 8 + 5 + 6 = 29." }, "scores": { "a": 66, "b": 29 } }, { "by": 31, "category": "schema", "leads": "bybit", "name": "Schema \u0026 documentation", "reasons": { "a": "No OpenAPI or other machine-readable contract for the REST API; the MCP server's 398 tools have zod schemas turned into JSON Schema, so the contract exists for the MCP surface only (12 of 25). No llms.txt; the docs are a public Docusaurus repository (bybit-exchange/docs) whose MDX source an agent can read (5 of 10). The MCP tool descriptions state purpose, rules and an agent hint per tool, and the API reference gives one page per endpoint (15 of 20). Parameters are typed with enums such as category and orderType and required flags (12 of 15). Request and response examples on each endpoint page and an error code page of about 750 codes with text (14 of 15). A dated changelog with 24 entries in the last 90 days, versioned V3 to V5 (15). 73.", "b": "An OpenAPI spec exists, since cdcx-cli generates its 95 commands and tools from it at run time, but its host (exchange-developer.crypto.com) answered 403 to robots.txt and the spec was not read; the vendor's own tooling is evidence it exists, not of its quality (15 of 25). No llms.txt on crypto.com or the Exchange pages (0). For descriptions, cdcx's tool descriptions come from the spec, which we couldn't read; the Exchange skill documents 52 endpoints in prose (8 of 20). cdcx's README says the tools carry typed parameters and enum validation, a vendor claim not checked against the spec (8 of 15). For examples, the skills and cdcx README carry worked commands, but the API's error codes and response examples sit on the unread host (6 of 15). Versioned path (v1); the API changelog and announcements page could not be read (5 of 15). 15 + 0 + 8 + 8 + 6 + 5 = 42." }, "scores": { "a": 73, "b": 42 } }, { "by": 16, "category": "ergonomics", "leads": "bybit", "name": "Agent ergonomics", "reasons": { "a": "Read for the API with the MCP server beside it. The MCP server has 398 tools in one list with no toolset, module or read-only switch (5 of 25, nothing added back). V5 reads take limit and cursor and category filters (15 of 20). retCode and retMsg on every response with a code list an agent can branch on, though create-order answers before the order is final and the docs say to confirm over WebSocket (14 of 20). orderLinkId makes order retries safe and every MCP tool carries readOnlyHint and destructiveHint (17 of 20). Five required fields on an order, official SDKs in Python, Go, Java and .NET (15). 66.", "b": "Graded on the REST API as an agent calls it, with the MCP server noted. cdcx serves up to 95 tools, more than 30, but the default serves the `market` group alone and groups are enabled one by one, which is a read-only subset switch (5 + 10 = 15). Pagination and output controls for the API are on the unread docs host; cdcx adds `-o json|table|ndjson` (8 of 20). cdcx returns structured JSON errors and the safety gate names what is missing; the API's own error table is unread (8 of 20). cdcx's tiers (mutate needs `acknowledged: true`, dangerous needs `--allow-dangerous`), `--dry-run` and paper trading give safe rehearsal, though no MCP annotations or API idempotency keys were seen (12 of 20). No official SDK beyond the CLI; defaults in cdcx are sensible (7 of 15). 15 + 8 + 8 + 12 + 7 = 50." }, "scores": { "a": 66, "b": 50 } }, { "by": 6, "category": "security", "leads": "bybit", "name": "Security \u0026 auth", "reasons": { "a": "API keys scoped by product group with a readOnly flag, a separate Withdraw value, IP binding, a 90-day expiry for unbound keys, HMAC or RSA signing, and revocation on the management page; no OAuth (24 of 30). A read-only key and a withdrawal-free key are first-class, but the MCP server has no read-only mode and relies on the client's approval prompt for writes (14 of 20). Tools return the exchange's own data, not third-party text (10). The API key info endpoint shows permissions, IPs and expiry, and an IP change log exists for institutional accounts, but no per-call audit log was found (7 of 15). No security.txt on bybit.com or the docs host, no disclosure policy or bug bounty found on a page we could read, proof-of-reserves articles in the help centre (5 of 20). 60.", "b": "HMAC-SHA256 API keys made with 2FA; IP whitelisting and pre-approved withdrawal addresses per the official skill, and revocation from the Exchange settings. The permission list (read, trade, withdraw) is on the unread docs host, so scopes are recorded from the skills (20 of 30). On least privilege, the App skill's key has no withdrawal permission, the Exchange skill requires user confirmation before a production trade, and cdcx refuses withdrawals and cancel-all without `--allow-dangerous`; nothing on the server side limits order size (14 of 20). The tools return exchange data, not third-party text, but no guidance on untrusted content was found (6 of 15). An account audit trail is not documented where we could read (4 of 15). No security.txt on crypto.com; cdcx has a SECURITY.md with private reporting and a three-day acknowledgement, and the organisation keeps HackerOne policy guidelines; certifications were not read (10 of 20). 20 + 14 + 6 + 4 + 10 = 54." }, "scores": { "a": 60, "b": 54 } }, { "by": 5, "category": "reliability", "leads": "crypto-com-exchange", "name": "Reliability", "reasons": { "a": "Graded with the hosted lines on the V5 API at api.bybit.com. No status page found (status.bybit.com does not resolve, the docs link none), so 0 for the page and 5 for no readable history. Rate limits are published per endpoint and per UID with numbers, plus a 600 per 5 second IP limit (15). Every response carries X-Bapi-Limit, X-Bapi-Limit-Status and X-Bapi-Limit-Reset-Timestamp, retCode 10006 and HTTP 403 are documented with a wait rule, and orders take a unique orderLinkId that amend and cancel accept (15). No SLA (0). V5 is the current production API, not a beta (10). 45.", "b": "Read with the hosted lines on the Exchange API at api.crypto.com. status.crypto.com is a Statuspage site with component history (20). Its feed for 18 August to 3 November 2026 has 25 entries; the Exchange is named in two, an 11-minute database upgrade on 18 August and a one-hour balance display issue on 6 October, while the longer disruptions (Android login on 1 and 5 October, card 3DS on 23 September, Main App predictions on 3 November) are App incidents. There is no Exchange API component, so the record may be incomplete. Minor only (20). Rate limits are documented on exchange-docs.crypto.com, which answered 403 to robots.txt and was not read (0, unchecked). 429 handling and client order ids are on the same host (0, unchecked). No SLA found (0). Generally available (10). 20 + 20 + 0 + 0 + 0 + 10 = 50." }, "scores": { "a": 45, "b": 50 } } ], "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "Bybit", "b": "Foris DAX Limited (Crypto.com)", "name": "Vendor" }, { "a": "no (local only)", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "stdio", "b": "stdio", "name": "Transports" }, { "a": "API key", "b": "API key", "name": "Auth" }, { "a": "Pay per use", "b": "Pay per use", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "none", "b": "Proprietary hosted API under the Exchange terms and conditions, which our reader couldn't load. cdcx-cli, the official CLI and MCP server, is MIT or Apache-2.0", "name": "Licence" }, { "a": "398", "b": "95", "name": "Tools exposed" }, { "a": "yes", "b": "no", "name": "Read-only variant documented" }, { "a": "no", "b": "no", "name": "llms.txt" }, { "a": "2026-10-30", "b": "2026-06-18", "name": "Last release" }, { "a": "couldn't be read", "b": "couldn't be read", "name": "Terms last updated" }, { "a": "couldn't be read", "b": "2025-03-12", "name": "Privacy policy last updated" }, { "a": "couldn't be read", "b": "couldn't be read", "name": "Customer content may train models" }, { "a": "couldn't be read", "b": "couldn't be read", "name": "Terms restrict automated access" }, { "a": "couldn't be read", "b": "couldn't be read", "name": "Terms restrict benchmarking" }, { "a": "couldn't be read", "b": "couldn't be read", "name": "Terms or service can change without notice" }, { "a": "couldn't be read", "b": "couldn't be read", "name": "Arbitration or class-action waiver" }, { "a": "43 stars", "b": "27 stars, 59 npm/wk", "name": "Popularity" } ], "faq": [ { "answer": "Bybit scores 57.3 (C) on agent readiness against Crypto.com Exchange API's 46.8 (D), and leads in 4 of 7 scored categories. Crypto.com Exchange API leads on reliability.", "question": "Which is better for AI agents, Bybit or Crypto.com Exchange API?" }, { "answer": "Both need an API key.", "question": "Do Bybit and Crypto.com Exchange API need an API key?" }, { "answer": "Bybit runs on your own machine, with no hosted endpoint listed. Crypto.com Exchange API runs on your own machine, with no hosted endpoint listed.", "question": "Can an agent call Bybit and Crypto.com Exchange API without installing anything?" } ], "goodFor": [ { "aheadOn": [ "Schema \u0026 documentation, 73 against 42", "Agent ergonomics, 66 against 50", "Security \u0026 auth, 60 against 54", "Maintenance \u0026 community, 66 against 29" ], "also": null, "goodFor": "An agent trading spot, perpetuals, futures and options in a person's Bybit account outside the excluded jurisdictions, with a demo environment to rehearse on.", "slug": "bybit", "watchFor": "No status page, incident history or SLA was found; the terms say the API is not guaranteed to be available" }, { "aheadOn": [ "Reliability, 50 against 45" ], "also": null, "goodFor": "An agent trading spot or perpetuals on Crypto.com through a local MCP server with safety tiers, for a person outside the App's restricted list.", "slug": "crypto-com-exchange", "watchFor": "exchange-docs.crypto.com and the OpenAPI host answered 403 to robots.txt, so rate limits, key permissions, errors and the changelog could not be read" } ], "history": null, "job": { "capability": "exchange.market-data", "name": "Exchange market data" }, "others": [ { "json": "https://www.anchorterminal.com/compare/bitfinex-vs-bybit.json", "title": "Bitfinex API vs Bybit", "url": "https://www.anchorterminal.com/compare/bitfinex-vs-bybit" }, { "json": "https://www.anchorterminal.com/compare/bitfinex-vs-crypto-com-exchange.json", "title": "Bitfinex API vs Crypto.com Exchange API", "url": "https://www.anchorterminal.com/compare/bitfinex-vs-crypto-com-exchange" }, { "json": "https://www.anchorterminal.com/compare/bitget-vs-bybit.json", "title": "Bitget vs Bybit", "url": "https://www.anchorterminal.com/compare/bitget-vs-bybit" }, { "json": "https://www.anchorterminal.com/compare/bitget-vs-crypto-com-exchange.json", "title": "Bitget vs Crypto.com Exchange API", "url": "https://www.anchorterminal.com/compare/bitget-vs-crypto-com-exchange" }, { "json": "https://www.anchorterminal.com/compare/bithumb-vs-bybit.json", "title": "Bithumb Open API vs Bybit", "url": "https://www.anchorterminal.com/compare/bithumb-vs-bybit" }, { "json": "https://www.anchorterminal.com/compare/bithumb-vs-crypto-com-exchange.json", "title": "Bithumb Open API vs Crypto.com Exchange API", "url": "https://www.anchorterminal.com/compare/bithumb-vs-crypto-com-exchange" }, { "json": "https://www.anchorterminal.com/compare/bitstamp-vs-bybit.json", "title": "Bitstamp API vs Bybit", "url": "https://www.anchorterminal.com/compare/bitstamp-vs-bybit" }, { "json": "https://www.anchorterminal.com/compare/bitstamp-vs-crypto-com-exchange.json", "title": "Bitstamp API vs Crypto.com Exchange API", "url": "https://www.anchorterminal.com/compare/bitstamp-vs-crypto-com-exchange" }, { "json": "https://www.anchorterminal.com/compare/bybit-vs-coinbase-advanced-trade.json", "title": "Bybit vs Coinbase Advanced Trade API", "url": "https://www.anchorterminal.com/compare/bybit-vs-coinbase-advanced-trade" }, { "json": "https://www.anchorterminal.com/compare/bybit-vs-coinbase-mcp.json", "title": "Bybit vs Coinbase MCP server (Coinbase for Agents)", "url": "https://www.anchorterminal.com/compare/bybit-vs-coinbase-mcp" }, { "json": "https://www.anchorterminal.com/compare/bybit-vs-deribit.json", "title": "Bybit vs Deribit", "url": "https://www.anchorterminal.com/compare/bybit-vs-deribit" }, { "json": "https://www.anchorterminal.com/compare/bybit-vs-dydx.json", "title": "Bybit vs dYdX", "url": "https://www.anchorterminal.com/compare/bybit-vs-dydx" }, { "json": "https://www.anchorterminal.com/compare/bybit-vs-gate-io.json", "title": "Bybit vs Gate", "url": "https://www.anchorterminal.com/compare/bybit-vs-gate-io" }, { "json": "https://www.anchorterminal.com/compare/bybit-vs-gemini-exchange.json", "title": "Bybit vs Gemini Exchange API", "url": "https://www.anchorterminal.com/compare/bybit-vs-gemini-exchange" }, { "json": "https://www.anchorterminal.com/compare/bybit-vs-htx.json", "title": "Bybit vs HTX trading API", "url": "https://www.anchorterminal.com/compare/bybit-vs-htx" }, { "json": "https://www.anchorterminal.com/compare/bybit-vs-hyperliquid.json", "title": "Bybit vs Hyperliquid", "url": "https://www.anchorterminal.com/compare/bybit-vs-hyperliquid" }, { "json": "https://www.anchorterminal.com/compare/bybit-vs-kraken.json", "title": "Bybit vs Kraken API", "url": "https://www.anchorterminal.com/compare/bybit-vs-kraken" }, { "json": "https://www.anchorterminal.com/compare/bybit-vs-kucoin.json", "title": "Bybit vs KuCoin", "url": "https://www.anchorterminal.com/compare/bybit-vs-kucoin" }, { "json": "https://www.anchorterminal.com/compare/bybit-vs-mexc.json", "title": "Bybit vs MEXC API", "url": "https://www.anchorterminal.com/compare/bybit-vs-mexc" }, { "json": "https://www.anchorterminal.com/compare/bybit-vs-okx.json", "title": "Bybit vs OKX API", "url": "https://www.anchorterminal.com/compare/bybit-vs-okx" }, { "json": "https://www.anchorterminal.com/compare/bybit-vs-uniswap.json", "title": "Bybit vs Uniswap Trading API", "url": "https://www.anchorterminal.com/compare/bybit-vs-uniswap" }, { "json": "https://www.anchorterminal.com/compare/bybit-vs-upbit.json", "title": "Bybit vs Upbit Open API", "url": "https://www.anchorterminal.com/compare/bybit-vs-upbit" }, { "json": "https://www.anchorterminal.com/compare/crypto-com-exchange-vs-deribit.json", "title": "Crypto.com Exchange API vs Deribit", "url": "https://www.anchorterminal.com/compare/crypto-com-exchange-vs-deribit" }, { "json": "https://www.anchorterminal.com/compare/crypto-com-exchange-vs-dydx.json", "title": "Crypto.com Exchange API vs dYdX", "url": "https://www.anchorterminal.com/compare/crypto-com-exchange-vs-dydx" }, { "json": "https://www.anchorterminal.com/compare/crypto-com-exchange-vs-gate-io.json", "title": "Crypto.com Exchange API vs Gate", "url": "https://www.anchorterminal.com/compare/crypto-com-exchange-vs-gate-io" }, { "json": "https://www.anchorterminal.com/compare/crypto-com-exchange-vs-gemini-exchange.json", "title": "Crypto.com Exchange API vs Gemini Exchange API", "url": "https://www.anchorterminal.com/compare/crypto-com-exchange-vs-gemini-exchange" }, { "json": "https://www.anchorterminal.com/compare/crypto-com-exchange-vs-htx.json", "title": "Crypto.com Exchange API vs HTX trading API", "url": "https://www.anchorterminal.com/compare/crypto-com-exchange-vs-htx" }, { "json": "https://www.anchorterminal.com/compare/crypto-com-exchange-vs-hyperliquid.json", "title": "Crypto.com Exchange API vs Hyperliquid", "url": "https://www.anchorterminal.com/compare/crypto-com-exchange-vs-hyperliquid" }, { "json": "https://www.anchorterminal.com/compare/crypto-com-exchange-vs-kraken.json", "title": "Crypto.com Exchange API vs Kraken API", "url": "https://www.anchorterminal.com/compare/crypto-com-exchange-vs-kraken" }, { "json": "https://www.anchorterminal.com/compare/crypto-com-exchange-vs-kucoin.json", "title": "Crypto.com Exchange API vs KuCoin", "url": "https://www.anchorterminal.com/compare/crypto-com-exchange-vs-kucoin" }, { "json": "https://www.anchorterminal.com/compare/crypto-com-exchange-vs-mexc.json", "title": "Crypto.com Exchange API vs MEXC API", "url": "https://www.anchorterminal.com/compare/crypto-com-exchange-vs-mexc" }, { "json": "https://www.anchorterminal.com/compare/crypto-com-exchange-vs-okx.json", "title": "Crypto.com Exchange API vs OKX API", "url": "https://www.anchorterminal.com/compare/crypto-com-exchange-vs-okx" }, { "json": "https://www.anchorterminal.com/compare/crypto-com-exchange-vs-uniswap.json", "title": "Crypto.com Exchange API vs Uniswap Trading API", "url": "https://www.anchorterminal.com/compare/crypto-com-exchange-vs-uniswap" }, { "json": "https://www.anchorterminal.com/compare/crypto-com-exchange-vs-upbit.json", "title": "Crypto.com Exchange API vs Upbit Open API", "url": "https://www.anchorterminal.com/compare/crypto-com-exchange-vs-upbit" }, { "json": "https://www.anchorterminal.com/compare/binance-vs-bybit.json", "title": "Binance API vs Bybit", "url": "https://www.anchorterminal.com/compare/binance-vs-bybit" }, { "json": "https://www.anchorterminal.com/compare/binance-vs-crypto-com-exchange.json", "title": "Binance API vs Crypto.com Exchange API", "url": "https://www.anchorterminal.com/compare/binance-vs-crypto-com-exchange" }, { "json": "https://www.anchorterminal.com/compare/coinbase-advanced-trade-vs-crypto-com-exchange.json", "title": "Coinbase Advanced Trade API vs Crypto.com Exchange API", "url": "https://www.anchorterminal.com/compare/coinbase-advanced-trade-vs-crypto-com-exchange" }, { "json": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-crypto-com-exchange.json", "title": "Coinbase MCP server (Coinbase for Agents) vs Crypto.com Exchange API", "url": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-crypto-com-exchange" } ], "panel": null, "scores": [ { "by": 5, "bybit": 45, "crypto-com-exchange": 50, "edge": "crypto-com-exchange", "key": "reliability", "name": "Reliability", "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 31, "bybit": 73, "crypto-com-exchange": 42, "edge": "bybit", "key": "schema", "name": "Schema \u0026 documentation", "weight": 13 }, { "by": 16, "bybit": 66, "crypto-com-exchange": 50, "edge": "bybit", "key": "ergonomics", "name": "Agent ergonomics", "weight": 13 }, { "by": 6, "bybit": 60, "crypto-com-exchange": 54, "edge": "bybit", "key": "security", "name": "Security \u0026 auth", "weight": 14 }, { "by": 0, "bybit": 40, "crypto-com-exchange": 40, "edge": "", "key": "payments", "name": "Payments \u0026 pricing", "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 37, "bybit": 66, "crypto-com-exchange": 29, "edge": "bybit", "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7 }, { "by": 4, "bybit": 51, "crypto-com-exchange": 55, "edge": "crypto-com-exchange", "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7 } ], "summary": "Bybit scores 57.3 (C) on agent readiness against Crypto.com Exchange API's 46.8 (D), and leads in 4 of 7 scored categories. Crypto.com Exchange API leads on reliability. Both do exchange market data.", "tasks": null, "tutorials": [], "verdicts": { "bybit": "Bybit publishes per-endpoint rate limits, a demo environment, scoped keys with a read-only flag and IP binding, and an official stdio MCP server whose 398 tools carry read-only and destructive annotations. There is no status page, no OpenAPI file, no SLA, the MCP server has no toolsets, and the global terms and privacy pages are drawn by script.", "crypto-com-exchange": "Crypto.com is one of two exchanges here with an official MCP server, cdcx-cli, whose 95 generated tools are grouped by service and gated by safety tier. The API docs, OpenAPI file, terms and trading rules refused or hid from our reader, so rate limits, key permissions and the automated-trading clauses are unchecked, and cdcx has no release since June 2026." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/bybit-vs-crypto-com-exchange", "json": "https://www.anchorterminal.com/compare/bybit-vs-crypto-com-exchange.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/bybit-vs-crypto-com-exchange.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/bybit-vs-crypto-com-exchange.min.md" }, "markdown": "Bybit scores 57.3 (C) on agent readiness against Crypto.com Exchange API's 46.8 (D), and leads in 4 of 7 scored categories. Crypto.com Exchange API leads on reliability. Both do exchange market data.\n\n- Bybit: grade C, 57.3/100, rank #745 of 1349. Markdown https://www.anchorterminal.com/tools/bybit.md · JSON https://www.anchorterminal.com/api/v1/tools/bybit.json\n- Crypto.com Exchange API: grade D, 46.8/100, rank #1100 of 1349. Markdown https://www.anchorterminal.com/tools/crypto-com-exchange.md · JSON https://www.anchorterminal.com/api/v1/tools/crypto-com-exchange.json\n- Best crypto exchange APIs and MCP servers for AI agents: https://www.anchorterminal.com/best/crypto-exchanges/index.md\n- All 210 exchanges comparisons: https://www.anchorterminal.com/compare/crypto-exchanges/index.md\n\n## Which one, for what\n\n### Bybit (C)\n\nGood for: An agent trading spot, perpetuals, futures and options in a person's Bybit account outside the excluded jurisdictions, with a demo environment to rehearse on.\n\nAhead on:\n- Schema \u0026 documentation, 73 against 42\n- Agent ergonomics, 66 against 50\n- Security \u0026 auth, 60 against 54\n- Maintenance \u0026 community, 66 against 29\n\nWatch for: No status page, incident history or SLA was found; the terms say the API is not guaranteed to be available\n\n### Crypto.com Exchange API (D)\n\nGood for: An agent trading spot or perpetuals on Crypto.com through a local MCP server with safety tiers, for a person outside the App's restricted list.\n\nAhead on:\n- Reliability, 50 against 45\n\nWatch for: exchange-docs.crypto.com and the OpenAPI host answered 403 to robots.txt, so rate limits, key permissions, errors and the changelog could not be read\n\n\n## Why the edge\n\n### Maintenance \u0026 community: Bybit +37\n\n- Bybit (66): Read as a hosted service with an open-source MCP server. The MCP package shipped 2.1.26 on 30 October 2026 and the V5 changelog's latest entry is 29 October (30). 31 npm versions since 16 April 2026, 11 of them in the last 90 days, and 24 changelog entries in the same window (20). The trading-mcp repository has 4 open issues and 18 forks; whether issues get answers was not checked, and the API has no public forum we could read (10 of 25). Not in the official MCP registry (0). The package has four dependencies, no install scripts, a publish workflow and no test workflow (6 of 10). 66.\n- Crypto.com Exchange API (29): Read as a closed service with an open CLI. The last change we could date is cdcx-cli v1.2.6 on 18 June 2026, 138 days before the check, with no commit since; the API changelog is unread (10). No three dated releases in the last 90 days (0). Five of six open items on cdcx-cli, all by collaborators or Dependabot since May, have no comment; the Exchange has a support chat and contact@crypto.com (8 of 25). Not in the official MCP registry and no official SDK beyond the CLI (5 of 15). CI tests on three operating systems with clippy and fmt; the npm wrapper's postinstall downloads the binary and two Dependabot bumps are open (6 of 10). 10 + 0 + 8 + 5 + 6 = 29.\n\n### Schema \u0026 documentation: Bybit +31\n\n- Bybit (73): No OpenAPI or other machine-readable contract for the REST API; the MCP server's 398 tools have zod schemas turned into JSON Schema, so the contract exists for the MCP surface only (12 of 25). No llms.txt; the docs are a public Docusaurus repository (bybit-exchange/docs) whose MDX source an agent can read (5 of 10). The MCP tool descriptions state purpose, rules and an agent hint per tool, and the API reference gives one page per endpoint (15 of 20). Parameters are typed with enums such as category and orderType and required flags (12 of 15). Request and response examples on each endpoint page and an error code page of about 750 codes with text (14 of 15). A dated changelog with 24 entries in the last 90 days, versioned V3 to V5 (15). 73.\n- Crypto.com Exchange API (42): An OpenAPI spec exists, since cdcx-cli generates its 95 commands and tools from it at run time, but its host (exchange-developer.crypto.com) answered 403 to robots.txt and the spec was not read; the vendor's own tooling is evidence it exists, not of its quality (15 of 25). No llms.txt on crypto.com or the Exchange pages (0). For descriptions, cdcx's tool descriptions come from the spec, which we couldn't read; the Exchange skill documents 52 endpoints in prose (8 of 20). cdcx's README says the tools carry typed parameters and enum validation, a vendor claim not checked against the spec (8 of 15). For examples, the skills and cdcx README carry worked commands, but the API's error codes and response examples sit on the unread host (6 of 15). Versioned path (v1); the API changelog and announcements page could not be read (5 of 15). 15 + 0 + 8 + 8 + 6 + 5 = 42.\n\n### Agent ergonomics: Bybit +16\n\n- Bybit (66): Read for the API with the MCP server beside it. The MCP server has 398 tools in one list with no toolset, module or read-only switch (5 of 25, nothing added back). V5 reads take limit and cursor and category filters (15 of 20). retCode and retMsg on every response with a code list an agent can branch on, though create-order answers before the order is final and the docs say to confirm over WebSocket (14 of 20). orderLinkId makes order retries safe and every MCP tool carries readOnlyHint and destructiveHint (17 of 20). Five required fields on an order, official SDKs in Python, Go, Java and .NET (15). 66.\n- Crypto.com Exchange API (50): Graded on the REST API as an agent calls it, with the MCP server noted. cdcx serves up to 95 tools, more than 30, but the default serves the `market` group alone and groups are enabled one by one, which is a read-only subset switch (5 + 10 = 15). Pagination and output controls for the API are on the unread docs host; cdcx adds `-o json|table|ndjson` (8 of 20). cdcx returns structured JSON errors and the safety gate names what is missing; the API's own error table is unread (8 of 20). cdcx's tiers (mutate needs `acknowledged: true`, dangerous needs `--allow-dangerous`), `--dry-run` and paper trading give safe rehearsal, though no MCP annotations or API idempotency keys were seen (12 of 20). No official SDK beyond the CLI; defaults in cdcx are sensible (7 of 15). 15 + 8 + 8 + 12 + 7 = 50.\n\n### Security \u0026 auth: Bybit +6\n\n- Bybit (60): API keys scoped by product group with a readOnly flag, a separate Withdraw value, IP binding, a 90-day expiry for unbound keys, HMAC or RSA signing, and revocation on the management page; no OAuth (24 of 30). A read-only key and a withdrawal-free key are first-class, but the MCP server has no read-only mode and relies on the client's approval prompt for writes (14 of 20). Tools return the exchange's own data, not third-party text (10). The API key info endpoint shows permissions, IPs and expiry, and an IP change log exists for institutional accounts, but no per-call audit log was found (7 of 15). No security.txt on bybit.com or the docs host, no disclosure policy or bug bounty found on a page we could read, proof-of-reserves articles in the help centre (5 of 20). 60.\n- Crypto.com Exchange API (54): HMAC-SHA256 API keys made with 2FA; IP whitelisting and pre-approved withdrawal addresses per the official skill, and revocation from the Exchange settings. The permission list (read, trade, withdraw) is on the unread docs host, so scopes are recorded from the skills (20 of 30). On least privilege, the App skill's key has no withdrawal permission, the Exchange skill requires user confirmation before a production trade, and cdcx refuses withdrawals and cancel-all without `--allow-dangerous`; nothing on the server side limits order size (14 of 20). The tools return exchange data, not third-party text, but no guidance on untrusted content was found (6 of 15). An account audit trail is not documented where we could read (4 of 15). No security.txt on crypto.com; cdcx has a SECURITY.md with private reporting and a three-day acknowledgement, and the organisation keeps HackerOne policy guidelines; certifications were not read (10 of 20). 20 + 14 + 6 + 4 + 10 = 54.\n\n### Reliability: Crypto.com Exchange API +5\n\n- Bybit (45): Graded with the hosted lines on the V5 API at api.bybit.com. No status page found (status.bybit.com does not resolve, the docs link none), so 0 for the page and 5 for no readable history. Rate limits are published per endpoint and per UID with numbers, plus a 600 per 5 second IP limit (15). Every response carries X-Bapi-Limit, X-Bapi-Limit-Status and X-Bapi-Limit-Reset-Timestamp, retCode 10006 and HTTP 403 are documented with a wait rule, and orders take a unique orderLinkId that amend and cancel accept (15). No SLA (0). V5 is the current production API, not a beta (10). 45.\n- Crypto.com Exchange API (50): Read with the hosted lines on the Exchange API at api.crypto.com. status.crypto.com is a Statuspage site with component history (20). Its feed for 18 August to 3 November 2026 has 25 entries; the Exchange is named in two, an 11-minute database upgrade on 18 August and a one-hour balance display issue on 6 October, while the longer disruptions (Android login on 1 and 5 October, card 3DS on 23 September, Main App predictions on 3 November) are App incidents. There is no Exchange API component, so the record may be incomplete. Minor only (20). Rate limits are documented on exchange-docs.crypto.com, which answered 403 to robots.txt and was not read (0, unchecked). 429 handling and client order ids are on the same host (0, unchecked). No SLA found (0). Generally available (10). 20 + 20 + 0 + 0 + 0 + 10 = 50.\n\n## Score by category\n\n| Category | Weight | Bybit | Crypto.com Exchange API | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 45 | 50 | Crypto.com Exchange API +5 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 73 | 42 | Bybit +31 |\n| Agent ergonomics | 13% (16.2 this run) | 66 | 50 | Bybit +16 |\n| Security \u0026 auth | 14% (17.5 this run) | 60 | 54 | Bybit +6 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 40 | 40 | even |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 66 | 29 | Bybit +37 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 51 | 55 | Crypto.com Exchange API +4 |\n| Negative events | ≤15 | 0 | 0 | |\n| **Total** | | **57.3 · C** | **46.8 · D** | |\n\n## Facts side by side\n\n| Fact | Bybit | Crypto.com Exchange API |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Bybit | Foris DAX Limited (Crypto.com) |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports | stdio | stdio |\n| Auth | API key | API key |\n| Pricing | Pay per use | Pay per use |\n| x402 | no | no |\n| Licence | none | Proprietary hosted API under the Exchange terms and conditions, which our reader couldn't load. cdcx-cli, the official CLI and MCP server, is MIT or Apache-2.0 |\n| Tools exposed | 398 | 95 |\n| Read-only variant documented | yes | no |\n| llms.txt | no | no |\n| Last release | 2026-10-30 | 2026-06-18 |\n| Terms last updated | couldn't be read | couldn't be read |\n| Privacy policy last updated | couldn't be read | 2025-03-12 |\n| Customer content may train models | couldn't be read | couldn't be read |\n| Terms restrict automated access | couldn't be read | couldn't be read |\n| Terms restrict benchmarking | couldn't be read | couldn't be read |\n| Terms or service can change without notice | couldn't be read | couldn't be read |\n| Arbitration or class-action waiver | couldn't be read | couldn't be read |\n| Popularity | 43 stars | 27 stars, 59 npm/wk |\n\n## Verdicts\n\n**Bybit.** Bybit publishes per-endpoint rate limits, a demo environment, scoped keys with a read-only flag and IP binding, and an official stdio MCP server whose 398 tools carry read-only and destructive annotations. There is no status page, no OpenAPI file, no SLA, the MCP server has no toolsets, and the global terms and privacy pages are drawn by script.\n\n**Crypto.com Exchange API.** Crypto.com is one of two exchanges here with an official MCP server, cdcx-cli, whose 95 generated tools are grouped by service and gated by safety tier. The API docs, OpenAPI file, terms and trading rules refused or hid from our reader, so rate limits, key permissions and the automated-trading clauses are unchecked, and cdcx has no release since June 2026.\n\n## Before you call either\n\n### Bybit\n\n1. Create a key with only the permission groups the task needs, set readOnly for research keys, leave Withdraw off and bind an IP, or the key expires after 90 days\n2. Send a unique orderLinkId on every order and reuse it when amending or cancelling, since create-order is asynchronous and confirmed over WebSocket\n3. Read X-Bapi-Limit-Status before bursts and wait until X-Bapi-Limit-Reset-Timestamp on retCode 10006; on HTTP 403 stop all sessions for at least 10 minutes\n4. Test on api-demo.bybit.com with a demo key from the production account, not on testnet demo mode, which the docs call meaningless\n5. Run the MCP server with BYBIT_TESTNET=true first, and only in a client that shows a per-call approval, because the server has no read-only mode of its own\n\n### Crypto.com Exchange API\n\n1. Enable only the service groups the task needs with `cdcx mcp config --enable trade,account` (the default serves `market` alone), and leave `--allow-dangerous` off unless the person asks for withdrawals or cancel-all\n2. Rehearse on `--env uat` or `cdcx paper` first; production keys trade real funds, and the skill requires explicit user confirmation before each live order\n3. Put the key in CDCX_API_KEY and CDCX_API_SECRET or `~/.config/cdcx/config.toml` at 0600; there is no key flag, and the key should have no withdrawal permission and an IP allow-list\n4. Pass `acknowledged: true` on mutate tools and `--dry-run` while testing; read the tool's generated schema before calling, since the docs host is unreadable to agents without a browser\n5. Check the person's country against Crypto.com's geo-restriction article and the Exchange terms before trading; New York and about 70 countries are excluded from the App, and the Exchange list was unreadable\n\n## Questions\n\n### Which is better for AI agents, Bybit or Crypto.com Exchange API?\n\nBybit scores 57.3 (C) on agent readiness against Crypto.com Exchange API's 46.8 (D), and leads in 4 of 7 scored categories. Crypto.com Exchange API leads on reliability.\n\n### Do Bybit and Crypto.com Exchange API need an API key?\n\nBoth need an API key.\n\n### Can an agent call Bybit and Crypto.com Exchange API without installing anything?\n\nBybit runs on your own machine, with no hosted endpoint listed. Crypto.com Exchange API runs on your own machine, with no hosted endpoint listed.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/bybit-vs-crypto-com-exchange.json, and with the fewest tokens: https://www.anchorterminal.com/compare/bybit-vs-crypto-com-exchange.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"bybit\", \"b\": \"crypto-com-exchange\"}`. From a terminal: `anchor compare bybit crypto-com-exchange`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/bybit.json and https://www.anchorterminal.com/api/v1/tools/crypto-com-exchange.json\n\n## Other comparisons with Bybit or Crypto.com Exchange API\n\n- [Bitfinex API vs Bybit](https://www.anchorterminal.com/compare/bitfinex-vs-bybit.md)\n- [Bitfinex API vs Crypto.com Exchange API](https://www.anchorterminal.com/compare/bitfinex-vs-crypto-com-exchange.md)\n- [Bitget vs Bybit](https://www.anchorterminal.com/compare/bitget-vs-bybit.md)\n- [Bitget vs Crypto.com Exchange API](https://www.anchorterminal.com/compare/bitget-vs-crypto-com-exchange.md)\n- [Bithumb Open API vs Bybit](https://www.anchorterminal.com/compare/bithumb-vs-bybit.md)\n- [Bithumb Open API vs Crypto.com Exchange API](https://www.anchorterminal.com/compare/bithumb-vs-crypto-com-exchange.md)\n- [Bitstamp API vs Bybit](https://www.anchorterminal.com/compare/bitstamp-vs-bybit.md)\n- [Bitstamp API vs Crypto.com Exchange API](https://www.anchorterminal.com/compare/bitstamp-vs-crypto-com-exchange.md)\n- [Bybit vs Coinbase Advanced Trade API](https://www.anchorterminal.com/compare/bybit-vs-coinbase-advanced-trade.md)\n- [Bybit vs Coinbase MCP server (Coinbase for Agents)](https://www.anchorterminal.com/compare/bybit-vs-coinbase-mcp.md)\n- [Bybit vs Deribit](https://www.anchorterminal.com/compare/bybit-vs-deribit.md)\n- [Bybit vs dYdX](https://www.anchorterminal.com/compare/bybit-vs-dydx.md)\n- [Bybit vs Gate](https://www.anchorterminal.com/compare/bybit-vs-gate-io.md)\n- [Bybit vs Gemini Exchange API](https://www.anchorterminal.com/compare/bybit-vs-gemini-exchange.md)\n- [Bybit vs HTX trading API](https://www.anchorterminal.com/compare/bybit-vs-htx.md)\n- [Bybit vs Hyperliquid](https://www.anchorterminal.com/compare/bybit-vs-hyperliquid.md)\n- [Bybit vs Kraken API](https://www.anchorterminal.com/compare/bybit-vs-kraken.md)\n- [Bybit vs KuCoin](https://www.anchorterminal.com/compare/bybit-vs-kucoin.md)\n- [Bybit vs MEXC API](https://www.anchorterminal.com/compare/bybit-vs-mexc.md)\n- [Bybit vs OKX API](https://www.anchorterminal.com/compare/bybit-vs-okx.md)\n- [Bybit vs Uniswap Trading API](https://www.anchorterminal.com/compare/bybit-vs-uniswap.md)\n- [Bybit vs Upbit Open API](https://www.anchorterminal.com/compare/bybit-vs-upbit.md)\n- [Crypto.com Exchange API vs Deribit](https://www.anchorterminal.com/compare/crypto-com-exchange-vs-deribit.md)\n- [Crypto.com Exchange API vs dYdX](https://www.anchorterminal.com/compare/crypto-com-exchange-vs-dydx.md)\n- [Crypto.com Exchange API vs Gate](https://www.anchorterminal.com/compare/crypto-com-exchange-vs-gate-io.md)\n- [Crypto.com Exchange API vs Gemini Exchange API](https://www.anchorterminal.com/compare/crypto-com-exchange-vs-gemini-exchange.md)\n- [Crypto.com Exchange API vs HTX trading API](https://www.anchorterminal.com/compare/crypto-com-exchange-vs-htx.md)\n- [Crypto.com Exchange API vs Hyperliquid](https://www.anchorterminal.com/compare/crypto-com-exchange-vs-hyperliquid.md)\n- [Crypto.com Exchange API vs Kraken API](https://www.anchorterminal.com/compare/crypto-com-exchange-vs-kraken.md)\n- [Crypto.com Exchange API vs KuCoin](https://www.anchorterminal.com/compare/crypto-com-exchange-vs-kucoin.md)\n- [Crypto.com Exchange API vs MEXC API](https://www.anchorterminal.com/compare/crypto-com-exchange-vs-mexc.md)\n- [Crypto.com Exchange API vs OKX API](https://www.anchorterminal.com/compare/crypto-com-exchange-vs-okx.md)\n- [Crypto.com Exchange API vs Uniswap Trading API](https://www.anchorterminal.com/compare/crypto-com-exchange-vs-uniswap.md)\n- [Crypto.com Exchange API vs Upbit Open API](https://www.anchorterminal.com/compare/crypto-com-exchange-vs-upbit.md)\n- [Binance API vs Bybit](https://www.anchorterminal.com/compare/binance-vs-bybit.md)\n- [Binance API vs Crypto.com Exchange API](https://www.anchorterminal.com/compare/binance-vs-crypto-com-exchange.md)\n- [Coinbase Advanced Trade API vs Crypto.com Exchange API](https://www.anchorterminal.com/compare/coinbase-advanced-trade-vs-crypto-com-exchange.md)\n- [Coinbase MCP server (Coinbase for Agents) vs Crypto.com Exchange API](https://www.anchorterminal.com/compare/coinbase-mcp-vs-crypto-com-exchange.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-04", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Bybit vs Crypto.com Exchange API", "url": "" } ], "description": "Bybit scores 57.3 (C) to Crypto.com Exchange's 46.8 (D) for exchange market data. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Bybit C 57.3", "Crypto.com Exchange API D 46.8", "scores" ], "h1": "Bybit vs Crypto.com Exchange API", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/bybit-vs-crypto-com-exchange", "published": "2026-10-01", "section": "tools", "title": "Bybit vs Crypto.com Exchange for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-03", "url": "https://www.anchorterminal.com/compare/bybit-vs-crypto-com-exchange" }, "tokens": { "markdown": 5000, "slim": 2530 }, "version": 1 }