Bybit vs MEXC API

Bybit 73

No OpenAPI or other machine-readable contract for the REST API; the MCP server's 398 tools have zod schemas turned into JSON Schema, so the contract exists for the MCP surface only (12 of 25). No llms.txt; the docs are a public Docusaurus repository (bybit-exchange/docs) whose MDX source an agent can read (5 of 10). The MCP tool descriptions state purpose, rules and an agent hint per tool, and the API reference gives one page per endpoint (15 of 20). Parameters are typed with enums such as category and orderType and required flags (12 of 15). Request and response examples on each endpoint page and an error code page of about 750 codes with text (14 of 15). A dated changelog with 24 entries in the last 90 days, versioned V3 to V5 (15). 73.

MEXC API 64

No OpenAPI found; a Postman collection and the CLI's 25 capability reference files are the nearest machine-readable contract (5 of 25). llms.txt on mexc.com, written for assistants and pointing at the API docs and legal pages (7 of 10). Per-endpoint pages with purpose, parameters and permissions, without when-not-to-use guidance (13 of 20). Typed parameters with enums for order types, statuses and intervals (11 of 15). Examples on each endpoint and a separate error-code page with numeric codes and messages (13 of 15). Versioned API (v3) with a dated changelog of 72 entries to 23 October 2026 (15). 5 + 7 + 13 + 11 + 13 + 15 = 64.

Bybit 40

No machine payment protocol (0). The fee schedule is public without login, with VIP 0 maker and taker rates per product and the tier criteria (20). Reading market data needs no key and the demo environment costs nothing, no card is asked for at sign-up (20). A person must register, pass identity verification and mint the key in a browser (0). 40.

MEXC API 31

No machine payment protocol (0). Fees published without login on MEXC's own fee guide (20 October 2026) and a 2024 announcement, with a separate API futures schedule; the fee page itself is drawn by script (16 of 20). Public market data needs no key or card; trading needs a verified and funded account. Judgement call (15 of 20). A person must sign up in a browser, and futures need identity verification (0). 0 + 16 + 15 + 0 = 31.

Bybit 66

Read as a hosted service with an open-source MCP server. The MCP package shipped 2.1.26 on 30 October 2026 and the V5 changelog's latest entry is 29 October (30). 31 npm versions since 16 April 2026, 11 of them in the last 90 days, and 24 changelog entries in the same window (20). The trading-mcp repository has 4 open issues and 18 forks; whether issues get answers was not checked, and the API has no public forum we could read (10 of 25). Not in the official MCP registry (0). The package has four dependencies, no install scripts, a publish workflow and no test workflow (6 of 10). 66.

MEXC API 75

Read as a closed service. Last dated change 23 October 2026 in both the spot and futures logs (30). Spot entries on 14 August, 24 August, 11 September and 23 October 2026, futures on 1 September, 11 September, 19 October and 23 October (20). An API support Telegram group, a ticket form and dated changelogs; GitHub issues not read (10 of 15). The official SDK repository was last pushed in February 2024 while the CLI is current (10 of 15). The CLI ships platform binaries with no dependencies and no public repository or CI; the SDK is stale (5 of 10). 30 + 20 + 10 + 10 + 5 = 75.

Bybit 51

The editorial half. A closed hosted service. The terms read are the UAE entity's PDF served from bybit.com, clear on API use and availability, but the global terms page renders by script and was not read; the MCP server is MIT (12 of 30). The privacy policy was not read, so data handling is unscored (5 of 30). The changelog dates removals and response changes but gives no notice period or deprecation policy (10 of 20). No subprocessor list or data location statement was read (0 of 20). 27.

MEXC API 58

The editorial half. A closed service with a dated user agreement naming MEXC (Comoros) Ltd; the CLI is UNLICENSED on npm (15 of 30). The privacy policy names no entity, states no retention periods and relies on standard contractual clauses for transfers (10 of 30). The changelog flags endpoints as "will be discontinued soon" without dates and the futures log records removals (8 of 20). Third parties are named by category only, with no subprocessor list or data locations (5 of 20). 15 + 10 + 8 + 5 = 38.

Bybit 60

API keys scoped by product group with a readOnly flag, a separate Withdraw value, IP binding, a 90-day expiry for unbound keys, HMAC or RSA signing, and revocation on the management page; no OAuth (24 of 30). A read-only key and a withdrawal-free key are first-class, but the MCP server has no read-only mode and relies on the client's approval prompt for writes (14 of 20). Tools return the exchange's own data, not third-party text (10). The API key info endpoint shows permissions, IPs and expiry, and an IP change log exists for institutional accounts, but no per-call audit log was found (7 of 15). No security.txt on bybit.com or the docs host, no disclosure policy or bug bounty found on a page we could read, proof-of-reserves articles in the help centre (5 of 20). 60.

MEXC API 65

Granular permissions (account read, trade, withdraw, transfer), per-pair restriction, up to 10 linked IPs, 90-day expiry without an IP, renewal and revocation in the account, 30 keys per account (26 of 30). A read-only MCP mode that hides write tools, a confirmation step before orders and transfers in the CLI and MCP, and --yes that agents are told not to add; nothing server-side confirms an API order (17 of 20). The API returns exchange data, and the CLI security page warns that agents may be led by web pages or files into unwanted actions (12 of 15). CLI confirmations are logged and reported to MEXC with no operator access described; an apiKeyInfo endpoint shows key settings (6 of 15). No security.txt, disclosure policy or bug bounty found; a proof-of-reserves page exists (4 of 20). 26 + 17 + 12 + 6 + 4 = 65.