Bybit vs Kraken API

Bybit 45

Graded with the hosted lines on the V5 API at api.bybit.com. No status page found (status.bybit.com does not resolve, the docs link none), so 0 for the page and 5 for no readable history. Rate limits are published per endpoint and per UID with numbers, plus a 600 per 5 second IP limit (15). Every response carries X-Bapi-Limit, X-Bapi-Limit-Status and X-Bapi-Limit-Reset-Timestamp, retCode 10006 and HTTP 403 are documented with a wait rule, and orders take a unique orderLinkId that amend and cancel accept (15). No SLA (0). V5 is the current production API, not a beta (10). 45.

Kraken API 67

Read with the hosted lines on the spot API. status.kraken.com is a Statuspage site with REST, WebSocket and FIX components (20). The incidents feed read covers 4 September to 3 November 2026. On 30 October spot and derivatives clients could not connect or submit orders across web, mobile, REST, WebSocket and FIX for 59 minutes 39 seconds, rated minor by Kraken; on 28 October some FIX clients were rejected on reconnection for 1 hour 59 minutes while other interfaces worked; the futures engine was degraded for 3 minutes on 13 October. A whole-exchange order outage 21 seconds short of an hour is read as one major (10 of 30). Numeric limits per key by tier and per pair for the matching engine (15). EAPI:Rate limit exceeded and EService:Throttled with a retry timestamp, a client order id and a validate flag on orders, but no Retry-After header (12 of 15). No SLA (0). Generally available (10). 20 + 10 + 15 + 12 + 0 + 10 = 67.

Bybit 60

API keys scoped by product group with a readOnly flag, a separate Withdraw value, IP binding, a 90-day expiry for unbound keys, HMAC or RSA signing, and revocation on the management page; no OAuth (24 of 30). A read-only key and a withdrawal-free key are first-class, but the MCP server has no read-only mode and relies on the client's approval prompt for writes (14 of 20). Tools return the exchange's own data, not third-party text (10). The API key info endpoint shows permissions, IPs and expiry, and an IP change log exists for institutional accounts, but no per-call audit log was found (7 of 15). No security.txt on bybit.com or the docs host, no disclosure policy or bug bounty found on a page we could read, proof-of-reserves articles in the help centre (5 of 20). 60.

Kraken API 80

Keys with nine named permissions, optional expiry, IP restriction and nonce window, plus an OAuth sign-in from the CLI (authorisation code with PKCE, public client) that mints a no-withdrawal key expiring within 90 days or a read-only key (30). Read-only and no-withdrawal keys, position limits and pair allowlists in account settings, and MCP approval prompts for 33 dangerous tools (18 of 20). The API returns no untrusted content; the CLI docs warn that the feedback tool uploads a local file without approval (10). Keys and their permissions are listed in settings and ledgers record activity, but no per-call log for the operator was found (6 of 15). A valid security.txt, a bug bounty policy page, SECURITY.md and a secure SDLC workflow in the CLI; certifications not read (16 of 20). 30 + 18 + 10 + 6 + 16 = 80.

Bybit 66

Read as a hosted service with an open-source MCP server. The MCP package shipped 2.1.26 on 30 October 2026 and the V5 changelog's latest entry is 29 October (30). 31 npm versions since 16 April 2026, 11 of them in the last 90 days, and 24 changelog entries in the same window (20). The trading-mcp repository has 4 open issues and 18 forks; whether issues get answers was not checked, and the API has no public forum we could read (10 of 25). Not in the official MCP registry (0). The package has four dependencies, no install scripts, a publish workflow and no test workflow (6 of 10). 66.

Kraken API 81

Read as a closed service with an open-source client. Changelog entry of 27 October 2026 and kraken-cli v0.5.1 on 29 October (30). Fourteen changelog entries since 19 August 2026 and CLI tags on 6 and 7 August and 28 and 29 October (20). A public changelog, api@kraken.com, a status page and a CLI repository merging pull requests at the end of October; issue replies not read (11 of 15). An official Rust SDK pushed in October 2026 and a Go module from January; the MCP server is not in the official registry (12 of 15). The CLI has release and secure SDLC workflows, deny.toml and a pinned toolchain; the SDK's CI not read (8 of 10). 30 + 20 + 11 + 12 + 8 = 81.

Bybit 51

The editorial half. A closed hosted service. The terms read are the UAE entity's PDF served from bybit.com, clear on API use and availability, but the global terms page renders by script and was not read; the MCP server is MIT (12 of 30). The privacy policy was not read, so data handling is unscored (5 of 30). The changelog dates removals and response changes but gives no notice period or deprecation policy (10 of 20). No subprocessor list or data location statement was read (0 of 20). 27.

Kraken API 65

The editorial half. A closed service with clear terms naming regional Payward entities under California law; the CLI is MIT (15 of 30). The privacy notice was not read (5 of 30). The changelog dates deprecations and the terms carry a last-updated date (16 of 20). No subprocessor or data-location statement read (0 of 20). 15 + 5 + 16 + 0 = 36.

Bybit 66

Read for the API with the MCP server beside it. The MCP server has 398 tools in one list with no toolset, module or read-only switch (5 of 25, nothing added back). V5 reads take limit and cursor and category filters (15 of 20). retCode and retMsg on every response with a code list an agent can branch on, though create-order answers before the order is final and the docs say to confirm over WebSocket (14 of 20). orderLinkId makes order retries safe and every MCP tool carries readOnlyHint and destructiveHint (17 of 20). Five required fields on an order, official SDKs in Python, Go, Java and .NET (15). 66.

Kraken API 79

The MCP server loads services with -s, defaults to no live trading, and its 152 tool definitions average about 520 characters; the REST API takes count, limit and pair filters but has no field selection (18 of 25). Cursor pagination on ledgers and trades since 30 September and 6 October 2026, with ofs deprecated (17 of 20). Prefixed error strings such as EOrder:Rate limit exceeded and EAPI:Invalid nonce, and the CLI's error catalogue says which to retry (17 of 20). cl_ord_id and validate on orders, destructive_hint and elicitation on dangerous MCP tools, no idempotency key on REST (16 of 20). An official Rust SDK at 5 stars, a Go module and example clients, HMAC-SHA512 signing with a strict nonce (11 of 15). 18 + 17 + 17 + 16 + 11 = 79.

Bybit 73

No OpenAPI or other machine-readable contract for the REST API; the MCP server's 398 tools have zod schemas turned into JSON Schema, so the contract exists for the MCP surface only (12 of 25). No llms.txt; the docs are a public Docusaurus repository (bybit-exchange/docs) whose MDX source an agent can read (5 of 10). The MCP tool descriptions state purpose, rules and an agent hint per tool, and the API reference gives one page per endpoint (15 of 20). Parameters are typed with enums such as category and orderType and required flags (12 of 15). Request and response examples on each endpoint page and an error code page of about 750 codes with text (14 of 15). A dated changelog with 24 entries in the last 90 days, versioned V3 to V5 (15). 73.

Kraken API 80

No OpenAPI file was found for the REST API in the docs read; the CLI's agents/tool-catalog.json gives JSON Schema inputs for all 188 commands and the 152 MCP tools (15 of 25). The docs serve Markdown twins such as quickstart.md and the CLI ships llms.txt, AGENTS.md and CONTEXT.md (10). Endpoint pages and guides on order lifecycle, errors and rate limits say what each call does, with less on when not to use one (15 of 20). Enums for order types, time in force and flags, and enums and required fields in the tool catalogue (12 of 15). Python, Node.js and cURL examples, an errors guide and the CLI's error-catalog.json with retry guidance (13 of 15). A changelog of 120 dated entries with deprecations dated (15). 15 + 10 + 15 + 12 + 13 + 15 = 80.