Coinbase MCP server (Coinbase for Agents) vs Upbit Open API

Coinbase MCP server (Coinbase for Agents) 40

Read the way coinbase-cdp-agentkit was. The server pays x402 as a buyer from the account's USDC balance and its own endpoint isn't paid per call, so the paying-as-a-buyer step (15 of 40). No price for the server itself; trades carry Advanced Trade fees, whose schedule on coinbase.com we couldn't read past a bot check, and x402 prices are advisory and shown only after sign-in (10 of 20). Connecting and reading prices and portfolios cost nothing and need no card, but anything beyond reads needs a verified and funded Coinbase account. Judgement call (15 of 20). A person must sign in to Coinbase in a browser and approve the grant, and only allowlisted clients can register (0).

Upbit Open API 15

No machine payment protocol (0). The fee schedule is on upbit.com, which disallows every crawler path, so no price is recorded (0 of 20, unchecked). Public quotation endpoints need no key, card or account; trading needs a verified Korean account. Judgement call (15 of 20). A person must sign up, pass identity checks and issue keys on the PC web site (0). 0 + 0 + 15 + 0 = 15.

Coinbase MCP server (Coinbase for Agents) 58

Read as a closed hosted service. The last dated change to the server in the CDP changelog is US stocks on 21 August 2026; the docs added three x402 tools in October (the overview of 2 October still calls them coming soon, the MCP page was modified on 9 October) and the setup guide on 22 October, with no changelog entry. Judgement call (25 of 30). Changelog entries for futures (17 August) and stocks (21 August) both name the MCP server, and the CLI built from the same agent spec shipped six versions from 14 August to 30 September (20). A public changelog, a CDP Discord for integration help and a one-way feedback tool limited to six notes a day, none tested (10 of 25). Not in the official MCP registry; a search for coinbase on 24 October found only third-party servers (0). The CLI has no runtime dependencies but runs a postinstall script and has no public repository or CI (3 of 10).

Upbit Open API 83

Read as a closed service. SDK v1.1.0 on 20 October 2026 (30). The CLI 1.0.0 on 1 September, the rate-limit update of 7 October, the SDK on 20 October and the path-format notice for 16 November 2026 (20). open-api@upbit.com answers in turn on weekdays per the support notice, notices carry dates, and the six upbit-official repositories show no open issues (12 of 15). Current official SDKs in Python, TypeScript and Go (15). Apache-2.0 repositories pushed in October 2026; CI not checked (6 of 10). 30 + 20 + 12 + 15 + 6 = 83.

Coinbase MCP server (Coinbase for Agents) 55

Graded with the hosted lines, on the remote server at agents.coinbase.com. status.coinbase.com is a Statuspage site with Advanced Trade, API, US Derivatives and Developer Platform components and 90 days of history, but no component for the agents MCP server, so it shows the trading back end and not the server agents call. Judgement call (10 of 20). Its first history page, 1 August to 24 October 2026, shows minor incidents for derivatives positions and portfolio transfers and one major, a two-minute website slowdown on 14 October, with none for Advanced Trade order entry; 26 to 31 July sits on a second page we didn't read (20). The setup guide says it specifies no numeric request quota for the remote server and that Advanced Trade limits are not the MCP limit (0). It says to honour Retry-After on 429 or back off with jitter, orders take a client_order_id that returns the existing order on retry, and x402 payments take an idempotency_key (15). No SLA found (0). Nothing labels the remote server beta or preview (10).

Upbit Open API 42

Read with the hosted lines. No status page found on docs.upbit.com or in llms.txt; a wallet-status endpoint and an announcements stream stand in (0). No readable incident history (5). Rate limits documented with numbers per group, per IP and per pocket, updated 7 October 2026 (15). 429 then 418 with a stated block length and a Remaining-Req header, an order-test endpoint and a self-match-prevention default; an order identifier for safe retries was not checked (12 of 15). No SLA found (0). Generally available (10). 0 + 5 + 15 + 12 + 0 + 10 = 42.

Coinbase MCP server (Coinbase for Agents) 70

Coinbase OAuth with authorisation code and PKCE S256, resource on every request, DCR and CIMD limited to allowlisted clients, ten mcp:* scopes, a consent screen where the person picks portfolios, and revocation under Account > Security > Connections (30). A read-only grant and a funded separate portfolio limit what an agent can touch, and transfers move funds only between the person's portfolios. No per-order size limit or server-side confirmation is documented; the June blog's trade-size limits are still "soon", and the setup guide tells agents to request every scope rather than the least needed (12 of 20). x402 fetch returns third-party data from a curated catalogue only, and the 13 October changelog removes Bazaar resources whose metadata carries prompt-injection risk; no guidance on treating returned data as untrusted was found beyond citing only values the source returns (8 of 15). Orders, transfers and payments appear in the Coinbase account and connections are listed in account settings, but no per-call log for MCP was found (8 of 15). HackerOne bug bounty named in coinbase.com's security.txt, which expired on 1 June 2024; no security.txt on agents.coinbase.com; certifications not read because coinbase.com answered a bot check (12 of 20).

Upbit Open API 59

Keys limited to chosen functions, a mandatory public IPv4 allow-list, a JWT per request with a fresh nonce, keys listed with expiry through the API, and a withdrawal safe-lock on by default (27 of 30). Read-only keys, the default withdrawal lock lifted only in the app, and skills that require a typed CONFIRM before writes (17 of 20). The API returns exchange data and announcements, no third-party content (10 of 15). An API key list endpoint; no per-call log for the operator (5 of 15). No disclosure policy, bug bounty or certification found; security.txt on upbit.com could not be fetched under its robots.txt (0 of 20). 27 + 17 + 10 + 5 + 0 = 59.

Coinbase MCP server (Coinbase for Agents) 62

The editorial half. A closed hosted service. The docs carry a disclaimer that the person is responsible for every trade an agent makes, but name no terms for agent access, and the Coinbase User Agreement answered a bot check and wasn't read. The CLI is MIT on npm (10 of 30). Per the coinbase-cdp-agentkit check of 1 October 2026, the privacy policy (updated 27 May 2026) names Coinbase, Inc., lists processing countries and ties retention to need without numbers; nothing specific to MCP calls or the feedback tool's screening was found (12 of 30). No deprecation policy or notice period for the server or its tools (0). Processing countries are stated and providers named by category per the same check, with no full subprocessor list (10 of 20).

Upbit Open API 54

The editorial half. A closed service whose user and Open API terms could not be fetched under upbit.com's robots.txt, and whose SDK licence page calls the SDK material not open source while the repositories carry Apache-2.0 (8 of 30). The developer centre's privacy policy names Dunamu Inc., gives retention periods and names Zendesk in Japan; the main privacy policy was not read (14 of 30). Notices with effective dates, including the path-format change and the deprecated Remaining-Req min field (12 of 20). Zendesk and Google Analytics named with a location for the developer centre only (8 of 20). 8 + 14 + 12 + 8 = 42.