{ "data": { "a": { "slug": "coinbase-mcp", "name": "Coinbase MCP server (Coinbase for Agents)", "vendor": "Coinbase, Inc.", "vendorUrl": "https://docs.cdp.coinbase.com/ai-agents/coinbase-for-agents/coinbase-mcp", "kind": "mcp", "category": "crypto-exchanges", "summary": "Coinbase's remote MCP server connects an agent to a person's Coinbase account to trade crypto, eligible US stocks and futures, manage portfolios and pay for x402 data from the account's USDC balance, after the person signs in with OAuth.", "url": "https://www.anchorterminal.com/tools/coinbase-mcp", "markdownUrl": "https://www.anchorterminal.com/tools/coinbase-mcp.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/coinbase-mcp.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/coinbase-mcp.json", "dns": "coinbase-mcp.grade.anchorterminal.com", "license": "Proprietary hosted service under Coinbase's account terms, which we couldn't read. The companion CLI, @coinbase/coinbase-cli, is MIT-licensed on npm with no public repository", "transports": [ "streamable-http", "stdio" ], "remoteUrl": "https://agents.coinbase.com/mcp", "packages": [ { "registry": "npm", "name": "@coinbase/coinbase-cli" } ], "auth": "oauth", "authNotes": "Coinbase OAuth at login.coinbase.com, authorisation code with PKCE S256, with dynamic client registration and Client ID Metadata Documents. Coinbase allowlists clients; the docs name ChatGPT, Grok, Grok Bot, Muse, Perplexity Computer, Claude, Claude Code and Codex CLI, and say registration alone grants nothing. The person signs in and picks which portfolios the agent may use. Ten `mcp:*` scopes cover reads, portfolio changes, orders, trades and transfers between portfolios; `offline_access` adds a refresh token. Access is revoked under Coinbase Account \u003e Security \u003e Connections. Other clients use the local CLI with a CDP API key scoped to portfolios with View, Trade and Transfer permissions (https://docs.cdp.coinbase.com/coinbase-for-agents/skill.md, checked 2026-10-24).", "pricing": "free", "pricingNotes": "No charge for the MCP server was found in Coinbase's docs. Orders execute through Coinbase Advanced Trade, so Advanced Trade fees and eligibility apply; the fee schedule on coinbase.com sits behind a bot check and wasn't read. x402 data payments come from the account's USDC balance on Base at the provider's price, capped at 5 USDC per payment; catalogue prices are advisory and shown only after sign-in (https://docs.cdp.coinbase.com/ai-agents/coinbase-for-agents/coinbase-mcp.md, checked 2026-10-24).", "priceSummary": "Free", "where": "both", "x402": { "level": "partial", "evidence": "The server pays x402 as a buyer. `coinbase_x402_resources`, `coinbase_x402_fetch` and `coinbase_x402_pay` find and pay curated x402 resources (Arkham, Dripstack, Exa, Glassnode, Massive, Nansen, You.com) in USDC on Base from the account balance, x402 v2 only for fetch, 5 USDC per payment. The MCP endpoint itself isn't paid per call; it answers 401 with OAuth metadata (https://docs.cdp.coinbase.com/ai-agents/coinbase-for-agents/coinbase-mcp.md, checked 2026-10-24).", "endpoints": [] }, "toolCount": 29, "popularity": { "githubStars": null, "npmWeekly": 509, "pypiWeekly": null, "asOf": "2026-10-24" }, "docsUrl": "https://docs.cdp.coinbase.com/ai-agents/coinbase-for-agents/coinbase-mcp", "llmsTxt": "https://docs.cdp.coinbase.com/llms.txt", "capabilities": [ "exchange.spot-trading", "exchange.balances", "exchange.market-data", "wallet.custody", "market.crypto", "data.markets", "payments.x402", "wallet.spend-limits", "payments.stablecoin" ], "tags": [ "official", "hosted", "mcp", "oauth", "closed-source", "x402-payer", "stablecoin", "llms-txt", "cli", "free", "new" ], "lastRelease": "2026-09-30", "graded": true, "anchor": { "graded": true, "score": 60, "grade": "C", "agentReady": false, "rank": 591, "ranked": true, "rankOf": 1349, "categoryRank": 8, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 66, "maintenance": 58, "payments": 40, "reliability": 55, "schema": 65, "security": 70, "transparency": 62 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-24" }, "negative": 0, "verdict": "Coinbase's remote MCP gives an agent OAuth access to a person's Coinbase account, with ten scopes, per-portfolio grants, revocation from account settings and client order IDs for safe retries. Only allowlisted clients can connect, the tool schemas aren't public, no rate limit is published and no server-side limit on order size is documented.", "bestFor": "An agent acting in a person's own Coinbase account, trading spot crypto, US futures and eligible US stocks and paying for market research by x402.", "strengths": [ "OAuth with PKCE S256, ten `mcp:*` scopes, and a consent screen where the person picks the portfolios the agent may use", "Access is revoked from Coinbase Account \u003e Security \u003e Connections, and transfers move funds only between the person's own portfolios", "Orders take a `client_order_id` that returns the existing order on retry, and x402 payments an `idempotency_key` kept for the same payment", "Setup guide and docs in Markdown with a routing matrix of what works for spot, equities and futures, and an error table with causes and fixes", "x402 payments for data from the account's USDC balance, capped at 5 USDC per payment by the server" ], "weaknesses": [ "Only clients Coinbase has allowlisted can connect; other agents need the local CLI and a CDP API key", "`tools/list` needs a signed-in account, so tool schemas and annotations can't be read before connecting", "No numeric rate limit for the remote server, no SLA and no status component for it", "No per-order size limit or server-side spending budget is documented beyond portfolio scoping and the 5 USDC x402 cap", "Not in the official MCP registry, and the companion CLI is at 0.0.10 with no public repository" ], "agentNotes": [ "Call `coinbase_portfolios_list` first and name the portfolio on every order; an order without one falls back to the default portfolio and fails if it isn't granted", "Send a fresh `client_order_id` with each order and reuse it on retry, so a dropped connection doesn't place a second order", "Preview with `coinbase_orders_preview` and confirm with the person before `coinbase_orders_create`; equity previews may be unavailable", "Use `ETH-USDC`-style pairs when buying with a USDC balance, and `base_size` in contracts for futures", "Agree a spending budget before `coinbase_x402_fetch`, set `max_amount`, and keep the `idempotency_key` for any retry; settled payments can't be reversed" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 4, "avgRating": 2.5, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 60 } ], "editorialScores": { "ergonomics": 66, "maintenance": 58, "payments": 40, "reliability": 55, "schema": 65, "security": 70, "transparency": 32 }, "provenanceScore": 92, "checked": { "categories": { "ergonomics": "2026-10-24", "maintenance": "2026-10-24", "payments": "2026-10-24", "reliability": "2026-10-24", "schema": "2026-10-24", "security": "2026-10-24", "transparency": "2026-10-24" }, "last": "2026-10-24", "lastMoved": "2026-10-30", "oldest": "2026-10-24", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install -g @coinbase/coinbase-cli", "claudeCode": "claude mcp add coinbase --transport http https://agents.coinbase.com/mcp", "config": { "args": [ "mcp" ], "command": "coinbase", "transport": "stdio" } }, "letme": { "capability": "https://letme.dev/exchange.spot-trading", "tool": "https://letme.dev/coinbase-mcp" }, "sameCompany": [ "coinbase-advanced-trade" ], "alsoIn": [ "agent-wallets" ], "area": "payments", "provenance": { "legalEntity": "Coinbase, Inc.", "domain": "coinbase.com", "domainRegistered": "2011-07-02", "endpointOnVendorDomain": true, "terms": "https://www.coinbase.com/legal/user_agreement", "privacy": "https://www.coinbase.com/legal/privacy", "statusPage": "https://status.coinbase.com", "changelog": "https://docs.cdp.coinbase.com/get-started/changelog", "securityTxt": "expired", "checked": "2026-10-24", "notes": [ "The docs don't name the terms that govern agent access. coinbase.com's legal pages answered a Cloudflare bot check and weren't read; the terms and privacy URLs are Coinbase's standard ones and Coinbase, Inc. is the entity named in the coinbase-cdp-agentkit listing and in CDP's third-party user agreement.", "RDAP gives a registration date of 2 July 2011 for coinbase.com.", "https://www.coinbase.com/.well-known/security.txt points to HackerOne and expired on 1 June 2024. agents.coinbase.com has no security.txt (404).", "status.coinbase.com is a Statuspage site shared with the rest of Coinbase, with no component for the agents MCP server.", "The CDP changelog carries dated Coinbase for Agents entries for 12 June, 19 June, 17 August and 21 August 2026." ], "score": 92 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/coinbase-mcp.json", "live": { "slug": "coinbase-mcp", "probe": { "target": "https://agents.coinbase.com/mcp", "method": "mcp-initialize", "lastAt": "2026-11-04T20:04:56.897948813Z", "lastOk": true, "lastStatus": 401, "lastMs": 325, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 204, "p95ms24h": 416, "samples24h": 246, "samples30d": 2556, "days": [ { "date": "2026-10-25", "probes": 102, "ok": 102 }, { "date": "2026-10-26", "probes": 252, "ok": 252 }, { "date": "2026-10-27", "probes": 249, "ok": 249 }, { "date": "2026-10-28", "probes": 251, "ok": 251 }, { "date": "2026-10-29", "probes": 249, "ok": 249 }, { "date": "2026-10-30", "probes": 248, "ok": 248 }, { "date": "2026-10-31", "probes": 251, "ok": 251 }, { "date": "2026-11-01", "probes": 249, "ok": 249 }, { "date": "2026-11-02", "probes": 250, "ok": 250 }, { "date": "2026-11-03", "probes": 248, "ok": 248 }, { "date": "2026-11-04", "probes": 207, "ok": 207 } ] }, "vendorStatus": { "page": "https://status.coinbase.com", "indicator": "minor", "summary": "Partially Degraded Service", "checkedAt": "2026-11-04T20:05:00.59746219Z" }, "versions": [ { "registry": "npm", "name": "@coinbase/coinbase-cli", "version": "0.0.11", "seenAt": "2026-11-04T20:08:14.610293164Z" } ], "npmWeekly": 1088, "securityTxt": { "url": "https://coinbase.com/.well-known/security.txt", "state": "valid", "expires": "2024-06-01T00:00:00z", "checkedAt": "2026-11-04T15:52:53.816413711Z" }, "llmsTxt": { "url": "https://docs.cdp.coinbase.com/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-04T15:22:40.044965536Z" }, "domain": { "domain": "coinbase.com", "registered": "2011-07-02", "source": "https://rdap.verisign.com/com/v1/domain/coinbase.com", "checkedAt": "2026-11-01T14:07:30.038254285Z" }, "pages": [ { "url": "https://www.coinbase.com/legal/privacy", "kind": "privacy", "status": 403, "checkedAt": "2026-11-04T08:38:43.42097902Z", "changedAt": "0001-01-01T00:00:00Z" }, { "url": "https://www.coinbase.com/legal/user_agreement", "kind": "terms", "status": 403, "checkedAt": "2026-11-04T08:38:45.443986002Z", "changedAt": "0001-01-01T00:00:00Z" } ], "mcpTools": { "url": "https://agents.coinbase.com/mcp", "checkedAt": "2026-11-04T01:22:28.044782534Z", "status": "auth", "note": "asks for credentials before listing its tools", "changedAt": "2026-10-26T00:22:26.022528969Z" }, "updatedAt": "2026-11-04T20:08:14.610293164Z" } }, "answer": "Coinbase MCP server (Coinbase for Agents) scores 60 (C) on agent readiness against Upbit Open API's 54.7 (C), and leads in 4 of 7 scored categories. Upbit Open API leads on maintenance \u0026 community.", "b": { "slug": "upbit", "name": "Upbit Open API", "vendor": "Dunamu Inc.", "vendorUrl": "https://docs.upbit.com", "kind": "http-api", "category": "crypto-exchanges", "summary": "Upbit, the Korean exchange run by Dunamu, has a REST and WebSocket Open API for KRW, BTC and USDT market data, orders, balances, deposits and withdrawals, with official SDKs, a CLI and agent skills but no MCP server.", "url": "https://www.anchorterminal.com/tools/upbit", "markdownUrl": "https://www.anchorterminal.com/tools/upbit.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/upbit.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/upbit.json", "dns": "upbit.grade.anchorterminal.com", "repo": "https://github.com/upbit-official", "transports": [], "packages": [ { "registry": "npm", "name": "@upbit-official/upbit-cli" }, { "registry": "pypi", "name": "upbit-sdk" } ], "auth": "api-key", "authNotes": "Access and secret keys issued on the PC web site under My Page \u003e Open API Management after identity verification and two-factor authentication. At issuance the person picks the functions the key may use and must register at least one public IPv4 address, since the allow-list is mandatory. Each request carries a JWT signed with HMAC SHA512 over the access key, a fresh nonce and a SHA512 hash of the query, as a Bearer token. A key with withdrawal permission gets a withdrawal safe-lock by default that is lifted only in the mobile app. Up to 10 keys on the main pocket and 5 per sub-pocket; expired keys answer expired_access_key (https://docs.upbit.com/kr/docs/api-key.md, checked 2026-11-03).", "pricing": "usage", "pricingNotes": "Trading fees per fill. The fee schedule is on upbit.com, whose robots.txt disallows every path for our crawler, so no rate is recorded. Public quotation endpoints need no key and no account (https://upbit.com/robots.txt, checked 2026-11-03).", "priceSummary": "Pay per use", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the developer docs, llms.txt, the SDK licence or the CLI docs (checked 2026-11-03). Fees are taken from each fill.", "endpoints": [] }, "toolCount": 0, "popularity": { "githubStars": 91, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-03" }, "docsUrl": "https://docs.upbit.com/kr/reference/api-overview", "llmsTxt": "https://docs.upbit.com/llms.txt", "capabilities": [ "exchange.market-data", "exchange.spot-trading", "exchange.balances", "exchange.transfers", "market.crypto" ], "tags": [ "hosted", "api-key", "closed-source", "usage-priced", "cli", "agent-skills", "llms-txt", "python", "typescript", "go", "no-status-page" ], "lastRelease": "2026-10-20", "graded": true, "anchor": { "graded": true, "score": 54.7, "grade": "C", "agentReady": false, "rank": 860, "ranked": true, "rankOf": 1349, "categoryRank": 14, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 70, "maintenance": 83, "payments": 15, "reliability": 42, "schema": 66, "security": 59, "transparency": 54 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-03" }, "negative": 0, "verdict": "Upbit's Open API has a mandatory IP allow-list, scoped keys with a default withdrawal lock, per-group rate limits with 429 and 418 signalling, an order-test endpoint, official SDKs, a CLI and agent skills with a CONFIRM gate. There is no MCP server, sandbox or status page, and the fees and terms sit on a host our crawler may not read.", "bestFor": "KRW-market trading for agents acting for a verified Korean account, with first-party SDKs, a CLI and skills but no MCP.", "strengths": [ "Keys need a registered public IP, carry only the chosen functions and get a withdrawal safe-lock by default that only the mobile app lifts", "Rate limits published per group with numbers, a Remaining-Req header on every response, 429 then 418 with a stated block length", "POST /v1/orders/test checks an order and the pair's state at no cost, and the skills run it before a live order", "Official Python, TypeScript and Go SDKs at v1.1.0 (20 October 2026), a CLI with JSON output and agent skills that require a typed CONFIRM before any write", "Notices carry effective dates, such as the path-format change of 16 November 2026" ], "weaknesses": [ "No MCP server; the agent route is the CLI through skills, which need a terminal", "No sandbox or testnet beyond the order-test endpoint, and no status page or SLA", "Keys can only be issued on the PC web site after Korean identity verification and 2FA, and the exchange serves the Korean market", "The fee schedule, user terms and Open API terms are on upbit.com, which disallows every crawler path, so none is recorded first-hand", "The SDK licence page says the SDK material is not open source while the GitHub repositories carry Apache-2.0" ], "agentNotes": [ "Ask the person for a key with only the functions the task needs and your server's public IPv4 address registered; a private or unregistered IP is refused", "Sign every request with a fresh JWT (HS512, new nonce, SHA512 query hash) and branch on error.name, not error.message", "Run POST /v1/orders/test before a live order; it costs nothing and shares the 8-a-second order-test group", "Read Remaining-Req and keep orders under 12 a second per pocket; on 429 wait for the next second and on 418 wait out the stated block", "Leave the withdrawal safe-lock on unless the person lifts it in the app, and send paths with single slashes and no trailing slash before 16 November 2026" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 54.7 } ], "editorialScores": { "ergonomics": 70, "maintenance": 83, "payments": 15, "reliability": 42, "schema": 66, "security": 59, "transparency": 42 }, "provenanceScore": 66, "checked": { "categories": { "ergonomics": "2026-11-03", "maintenance": "2026-11-03", "payments": "2026-11-03", "reliability": "2026-11-03", "schema": "2026-11-03", "security": "2026-11-03", "transparency": "2026-11-03" }, "last": "2026-11-03", "oldest": "2026-11-03", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install -g @upbit-official/upbit-cli", "http": "curl 'https://api.upbit.com/v1/ticker?markets=KRW-BTC'" }, "letme": { "capability": "https://letme.dev/exchange.market-data", "tool": "https://letme.dev/upbit" }, "area": "payments", "provenance": { "legalEntity": "Dunamu Inc.", "domain": "upbit.com", "domainRegistered": "2004-01-10", "endpointOnVendorDomain": true, "terms": "", "privacy": "https://docs.upbit.com/kr/page/privacy_policy_v1_5.md", "statusPage": "", "changelog": "https://docs.upbit.com/kr/changelog", "securityTxt": "unknown", "checked": "2026-11-03", "notes": [ "Dunamu Inc. is named as the licensor in the Upbit Developer SDK License v1.0 and as the company in the developer centre's privacy policy V1.5 (from 18 May 2026).", "upbit.com/robots.txt disallows every path for User-agent * (a second group adds /terms_and_policy and others), allowing only Googlebot, MSNBot, Yeti and Daumoa; sg.upbit.com and www.dunamu.com do the same. The user terms, the Open API terms, the fee schedule and security.txt on those hosts were therefore not fetched; the terms URL is left empty.", "docs.upbit.com/robots.txt allows everything but edit, login and api-next paths and points to llms.txt, with Content-Signal ai-train=yes, search=yes, ai-input=yes.", "RDAP gives upbit.com a registration date of 10 January 2004.", "No status page found; the API has a service-status (wallet status) endpoint and an announcements WebSocket stream." ], "score": 66 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/upbit.json", "live": { "slug": "upbit", "securityTxt": { "url": "https://upbit.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-04T15:53:27.560288922Z" }, "updatedAt": "2026-11-04T15:53:27.560288922Z" } }, "edges": [ { "by": 25, "category": "payments", "leads": "coinbase-mcp", "name": "Payments \u0026 pricing", "reasons": { "a": "Read the way coinbase-cdp-agentkit was. The server pays x402 as a buyer from the account's USDC balance and its own endpoint isn't paid per call, so the paying-as-a-buyer step (15 of 40). No price for the server itself; trades carry Advanced Trade fees, whose schedule on coinbase.com we couldn't read past a bot check, and x402 prices are advisory and shown only after sign-in (10 of 20). Connecting and reading prices and portfolios cost nothing and need no card, but anything beyond reads needs a verified and funded Coinbase account. Judgement call (15 of 20). A person must sign in to Coinbase in a browser and approve the grant, and only allowlisted clients can register (0).", "b": "No machine payment protocol (0). The fee schedule is on upbit.com, which disallows every crawler path, so no price is recorded (0 of 20, unchecked). Public quotation endpoints need no key, card or account; trading needs a verified Korean account. Judgement call (15 of 20). A person must sign up, pass identity checks and issue keys on the PC web site (0). 0 + 0 + 15 + 0 = 15." }, "scores": { "a": 40, "b": 15 } }, { "by": 25, "category": "maintenance", "leads": "upbit", "name": "Maintenance \u0026 community", "reasons": { "a": "Read as a closed hosted service. The last dated change to the server in the CDP changelog is US stocks on 21 August 2026; the docs added three x402 tools in October (the overview of 2 October still calls them coming soon, the MCP page was modified on 9 October) and the setup guide on 22 October, with no changelog entry. Judgement call (25 of 30). Changelog entries for futures (17 August) and stocks (21 August) both name the MCP server, and the CLI built from the same agent spec shipped six versions from 14 August to 30 September (20). A public changelog, a CDP Discord for integration help and a one-way feedback tool limited to six notes a day, none tested (10 of 25). Not in the official MCP registry; a search for coinbase on 24 October found only third-party servers (0). The CLI has no runtime dependencies but runs a postinstall script and has no public repository or CI (3 of 10).", "b": "Read as a closed service. SDK v1.1.0 on 20 October 2026 (30). The CLI 1.0.0 on 1 September, the rate-limit update of 7 October, the SDK on 20 October and the path-format notice for 16 November 2026 (20). open-api@upbit.com answers in turn on weekdays per the support notice, notices carry dates, and the six upbit-official repositories show no open issues (12 of 15). Current official SDKs in Python, TypeScript and Go (15). Apache-2.0 repositories pushed in October 2026; CI not checked (6 of 10). 30 + 20 + 12 + 15 + 6 = 83." }, "scores": { "a": 58, "b": 83 } }, { "by": 13, "category": "reliability", "leads": "coinbase-mcp", "name": "Reliability", "reasons": { "a": "Graded with the hosted lines, on the remote server at agents.coinbase.com. status.coinbase.com is a Statuspage site with Advanced Trade, API, US Derivatives and Developer Platform components and 90 days of history, but no component for the agents MCP server, so it shows the trading back end and not the server agents call. Judgement call (10 of 20). Its first history page, 1 August to 24 October 2026, shows minor incidents for derivatives positions and portfolio transfers and one major, a two-minute website slowdown on 14 October, with none for Advanced Trade order entry; 26 to 31 July sits on a second page we didn't read (20). The setup guide says it specifies no numeric request quota for the remote server and that Advanced Trade limits are not the MCP limit (0). It says to honour Retry-After on 429 or back off with jitter, orders take a `client_order_id` that returns the existing order on retry, and x402 payments take an `idempotency_key` (15). No SLA found (0). Nothing labels the remote server beta or preview (10).", "b": "Read with the hosted lines. No status page found on docs.upbit.com or in llms.txt; a wallet-status endpoint and an announcements stream stand in (0). No readable incident history (5). Rate limits documented with numbers per group, per IP and per pocket, updated 7 October 2026 (15). 429 then 418 with a stated block length and a Remaining-Req header, an order-test endpoint and a self-match-prevention default; an order identifier for safe retries was not checked (12 of 15). No SLA found (0). Generally available (10). 0 + 5 + 15 + 12 + 0 + 10 = 42." }, "scores": { "a": 55, "b": 42 } }, { "by": 11, "category": "security", "leads": "coinbase-mcp", "name": "Security \u0026 auth", "reasons": { "a": "Coinbase OAuth with authorisation code and PKCE S256, `resource` on every request, DCR and CIMD limited to allowlisted clients, ten `mcp:*` scopes, a consent screen where the person picks portfolios, and revocation under Account \u003e Security \u003e Connections (30). A read-only grant and a funded separate portfolio limit what an agent can touch, and transfers move funds only between the person's portfolios. No per-order size limit or server-side confirmation is documented; the June blog's trade-size limits are still \"soon\", and the setup guide tells agents to request every scope rather than the least needed (12 of 20). x402 fetch returns third-party data from a curated catalogue only, and the 13 October changelog removes Bazaar resources whose metadata carries prompt-injection risk; no guidance on treating returned data as untrusted was found beyond citing only values the source returns (8 of 15). Orders, transfers and payments appear in the Coinbase account and connections are listed in account settings, but no per-call log for MCP was found (8 of 15). HackerOne bug bounty named in coinbase.com's security.txt, which expired on 1 June 2024; no security.txt on agents.coinbase.com; certifications not read because coinbase.com answered a bot check (12 of 20).", "b": "Keys limited to chosen functions, a mandatory public IPv4 allow-list, a JWT per request with a fresh nonce, keys listed with expiry through the API, and a withdrawal safe-lock on by default (27 of 30). Read-only keys, the default withdrawal lock lifted only in the app, and skills that require a typed CONFIRM before writes (17 of 20). The API returns exchange data and announcements, no third-party content (10 of 15). An API key list endpoint; no per-call log for the operator (5 of 15). No disclosure policy, bug bounty or certification found; security.txt on upbit.com could not be fetched under its robots.txt (0 of 20). 27 + 17 + 10 + 5 + 0 = 59." }, "scores": { "a": 70, "b": 59 } }, { "by": 8, "category": "transparency", "leads": "coinbase-mcp", "name": "Transparency \u0026 trust", "reasons": { "a": "The editorial half. A closed hosted service. The docs carry a disclaimer that the person is responsible for every trade an agent makes, but name no terms for agent access, and the Coinbase User Agreement answered a bot check and wasn't read. The CLI is MIT on npm (10 of 30). Per the coinbase-cdp-agentkit check of 1 October 2026, the privacy policy (updated 27 May 2026) names Coinbase, Inc., lists processing countries and ties retention to need without numbers; nothing specific to MCP calls or the feedback tool's screening was found (12 of 30). No deprecation policy or notice period for the server or its tools (0). Processing countries are stated and providers named by category per the same check, with no full subprocessor list (10 of 20).", "b": "The editorial half. A closed service whose user and Open API terms could not be fetched under upbit.com's robots.txt, and whose SDK licence page calls the SDK material not open source while the repositories carry Apache-2.0 (8 of 30). The developer centre's privacy policy names Dunamu Inc., gives retention periods and names Zendesk in Japan; the main privacy policy was not read (14 of 30). Notices with effective dates, including the path-format change and the deprecated Remaining-Req min field (12 of 20). Zendesk and Google Analytics named with a location for the developer centre only (8 of 20). 8 + 14 + 12 + 8 = 42." }, "scores": { "a": 62, "b": 54 } } ], "facts": [ { "a": "MCP server", "b": "HTTP API", "name": "Kind" }, { "a": "Coinbase, Inc.", "b": "Dunamu Inc.", "name": "Vendor" }, { "a": "https://agents.coinbase.com/mcp", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "Streamable HTTP, stdio", "b": "", "name": "Transports" }, { "a": "OAuth", "b": "API key", "name": "Auth" }, { "a": "Free", "b": "Pay per use", "name": "Pricing" }, { "a": "payer tooling only", "b": "no", "name": "x402" }, { "a": "Proprietary hosted service under Coinbase's account terms, which we couldn't read. The companion CLI, @coinbase/coinbase-cli, is MIT-licensed on npm with no public repository", "b": "none", "name": "Licence" }, { "a": "29", "b": "0", "name": "Tools exposed" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "2026-09-30", "b": "2026-10-20", "name": "Last release" }, { "a": "couldn't be read", "b": "no document linked", "name": "Terms last updated" }, { "a": "2026-05-27", "b": "no date given", "name": "Privacy policy last updated" }, { "a": "couldn't be read", "b": "not read yet", "name": "Customer content may train models" }, { "a": "couldn't be read", "b": "not read yet", "name": "Terms restrict automated access" }, { "a": "couldn't be read", "b": "not read yet", "name": "Terms restrict benchmarking" }, { "a": "couldn't be read", "b": "not read yet", "name": "Terms or service can change without notice" }, { "a": "couldn't be read", "b": "not read yet", "name": "Arbitration or class-action waiver" }, { "a": "509 npm/wk", "b": "91 stars", "name": "Popularity" }, { "a": "2.5/5 (4)", "b": "none", "name": "Agent reviews" } ], "faq": [ { "answer": "Coinbase MCP server (Coinbase for Agents) scores 60 (C) on agent readiness against Upbit Open API's 54.7 (C), and leads in 4 of 7 scored categories. Upbit Open API leads on maintenance \u0026 community.", "question": "Which is better for AI agents, Coinbase MCP server (Coinbase for Agents) or Upbit Open API?" }, { "answer": "Coinbase MCP server (Coinbase for Agents) uses an OAuth sign-in. Upbit Open API needs an API key.", "question": "Do Coinbase MCP server (Coinbase for Agents) and Upbit Open API need an API key?" }, { "answer": "Coinbase MCP server (Coinbase for Agents) has a hosted endpoint at https://agents.coinbase.com/mcp. No hosted endpoint is listed for Upbit Open API.", "question": "Can an agent call Coinbase MCP server (Coinbase for Agents) and Upbit Open API without installing anything?" } ], "goodFor": [ { "aheadOn": [ "Reliability, 55 against 42", "Security \u0026 auth, 70 against 59", "Payments \u0026 pricing, 40 against 15", "Transparency \u0026 trust, 62 against 54" ], "also": [ "A hosted endpoint, with nothing to install", "Runs on your own machine" ], "goodFor": "An agent acting in a person's own Coinbase account, trading spot crypto, US futures and eligible US stocks and paying for market research by x402.", "slug": "coinbase-mcp", "watchFor": "Only clients Coinbase has allowlisted can connect; other agents need the local CLI and a CDP API key" }, { "aheadOn": [ "Maintenance \u0026 community, 83 against 58" ], "also": null, "goodFor": "KRW-market trading for agents acting for a verified Korean account, with first-party SDKs, a CLI and skills but no MCP.", "slug": "upbit", "watchFor": "No MCP server; the agent route is the CLI through skills, which need a terminal" } ], "history": { "coinbase-mcp": [ { "causes": [ "method" ], "date": "2026-10-30", "delta": -0.2, "from": 60.2, "fromGrade": "C", "to": 60, "toGrade": "C" } ], "upbit": null }, "job": { "capability": "exchange.spot-trading", "name": "Exchange spot trading" }, "others": [ { "json": "https://www.anchorterminal.com/compare/bitfinex-vs-coinbase-mcp.json", "title": "Bitfinex API vs Coinbase MCP server (Coinbase for Agents)", "url": "https://www.anchorterminal.com/compare/bitfinex-vs-coinbase-mcp" }, { "json": "https://www.anchorterminal.com/compare/bitfinex-vs-upbit.json", "title": "Bitfinex API vs Upbit Open API", "url": "https://www.anchorterminal.com/compare/bitfinex-vs-upbit" }, { "json": "https://www.anchorterminal.com/compare/bitget-vs-coinbase-mcp.json", "title": "Bitget vs Coinbase MCP server (Coinbase for Agents)", "url": "https://www.anchorterminal.com/compare/bitget-vs-coinbase-mcp" }, { "json": "https://www.anchorterminal.com/compare/bitget-vs-upbit.json", "title": "Bitget vs Upbit Open API", "url": "https://www.anchorterminal.com/compare/bitget-vs-upbit" }, { "json": "https://www.anchorterminal.com/compare/bithumb-vs-coinbase-mcp.json", "title": "Bithumb Open API vs Coinbase MCP server (Coinbase for Agents)", "url": "https://www.anchorterminal.com/compare/bithumb-vs-coinbase-mcp" }, { "json": "https://www.anchorterminal.com/compare/bithumb-vs-upbit.json", "title": "Bithumb Open API vs Upbit Open API", "url": "https://www.anchorterminal.com/compare/bithumb-vs-upbit" }, { "json": "https://www.anchorterminal.com/compare/bitstamp-vs-coinbase-mcp.json", "title": "Bitstamp API vs Coinbase MCP server (Coinbase for Agents)", "url": "https://www.anchorterminal.com/compare/bitstamp-vs-coinbase-mcp" }, { "json": "https://www.anchorterminal.com/compare/bitstamp-vs-upbit.json", "title": "Bitstamp API vs Upbit Open API", "url": "https://www.anchorterminal.com/compare/bitstamp-vs-upbit" }, { "json": "https://www.anchorterminal.com/compare/bybit-vs-coinbase-mcp.json", "title": "Bybit vs Coinbase MCP server (Coinbase for Agents)", "url": "https://www.anchorterminal.com/compare/bybit-vs-coinbase-mcp" }, { "json": "https://www.anchorterminal.com/compare/bybit-vs-upbit.json", "title": "Bybit vs Upbit Open API", "url": "https://www.anchorterminal.com/compare/bybit-vs-upbit" }, { "json": "https://www.anchorterminal.com/compare/crypto-com-exchange-vs-upbit.json", "title": "Crypto.com Exchange API vs Upbit Open API", "url": "https://www.anchorterminal.com/compare/crypto-com-exchange-vs-upbit" }, { "json": "https://www.anchorterminal.com/compare/deribit-vs-upbit.json", "title": "Deribit vs Upbit Open API", "url": "https://www.anchorterminal.com/compare/deribit-vs-upbit" }, { "json": "https://www.anchorterminal.com/compare/dydx-vs-upbit.json", "title": "dYdX vs Upbit Open API", "url": "https://www.anchorterminal.com/compare/dydx-vs-upbit" }, { "json": "https://www.anchorterminal.com/compare/gate-io-vs-upbit.json", "title": "Gate vs Upbit Open API", "url": "https://www.anchorterminal.com/compare/gate-io-vs-upbit" }, { "json": "https://www.anchorterminal.com/compare/gemini-exchange-vs-upbit.json", "title": "Gemini Exchange API vs Upbit Open API", "url": "https://www.anchorterminal.com/compare/gemini-exchange-vs-upbit" }, { "json": "https://www.anchorterminal.com/compare/htx-vs-upbit.json", "title": "HTX trading API vs Upbit Open API", "url": "https://www.anchorterminal.com/compare/htx-vs-upbit" }, { "json": "https://www.anchorterminal.com/compare/hyperliquid-vs-upbit.json", "title": "Hyperliquid vs Upbit Open API", "url": "https://www.anchorterminal.com/compare/hyperliquid-vs-upbit" }, { "json": "https://www.anchorterminal.com/compare/kucoin-vs-upbit.json", "title": "KuCoin vs Upbit Open API", "url": "https://www.anchorterminal.com/compare/kucoin-vs-upbit" }, { "json": "https://www.anchorterminal.com/compare/mexc-vs-upbit.json", "title": "MEXC API vs Upbit Open API", "url": "https://www.anchorterminal.com/compare/mexc-vs-upbit" }, { "json": "https://www.anchorterminal.com/compare/binance-vs-coinbase-mcp.json", "title": "Binance API vs Coinbase MCP server (Coinbase for Agents)", "url": "https://www.anchorterminal.com/compare/binance-vs-coinbase-mcp" }, { "json": "https://www.anchorterminal.com/compare/binance-vs-upbit.json", "title": "Binance API vs Upbit Open API", "url": "https://www.anchorterminal.com/compare/binance-vs-upbit" }, { "json": "https://www.anchorterminal.com/compare/coinbase-advanced-trade-vs-coinbase-mcp.json", "title": "Coinbase Advanced Trade API vs Coinbase MCP server (Coinbase for Agents)", "url": "https://www.anchorterminal.com/compare/coinbase-advanced-trade-vs-coinbase-mcp" }, { "json": "https://www.anchorterminal.com/compare/coinbase-advanced-trade-vs-upbit.json", "title": "Coinbase Advanced Trade API vs Upbit Open API", "url": "https://www.anchorterminal.com/compare/coinbase-advanced-trade-vs-upbit" }, { "json": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-crypto-com-exchange.json", "title": "Coinbase MCP server (Coinbase for Agents) vs Crypto.com Exchange API", "url": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-crypto-com-exchange" }, { "json": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-deribit.json", "title": "Coinbase MCP server (Coinbase for Agents) vs Deribit", "url": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-deribit" }, { "json": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-gate-io.json", "title": "Coinbase MCP server (Coinbase for Agents) vs Gate", "url": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-gate-io" }, { "json": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-gemini-exchange.json", "title": "Coinbase MCP server (Coinbase for Agents) vs Gemini Exchange API", "url": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-gemini-exchange" }, { "json": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-htx.json", "title": "Coinbase MCP server (Coinbase for Agents) vs HTX trading API", "url": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-htx" }, { "json": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-hyperliquid.json", "title": "Coinbase MCP server (Coinbase for Agents) vs Hyperliquid", "url": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-hyperliquid" }, { "json": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-kraken.json", "title": "Coinbase MCP server (Coinbase for Agents) vs Kraken API", "url": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-kraken" }, { "json": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-kucoin.json", "title": "Coinbase MCP server (Coinbase for Agents) vs KuCoin", "url": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-kucoin" }, { "json": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-mexc.json", "title": "Coinbase MCP server (Coinbase for Agents) vs MEXC API", "url": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-mexc" }, { "json": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-okx.json", "title": "Coinbase MCP server (Coinbase for Agents) vs OKX API", "url": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-okx" }, { "json": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-uniswap.json", "title": "Coinbase MCP server (Coinbase for Agents) vs Uniswap Trading API", "url": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-uniswap" }, { "json": "https://www.anchorterminal.com/compare/kraken-vs-upbit.json", "title": "Kraken API vs Upbit Open API", "url": "https://www.anchorterminal.com/compare/kraken-vs-upbit" }, { "json": "https://www.anchorterminal.com/compare/okx-vs-upbit.json", "title": "OKX API vs Upbit Open API", "url": "https://www.anchorterminal.com/compare/okx-vs-upbit" }, { "json": "https://www.anchorterminal.com/compare/uniswap-vs-upbit.json", "title": "Uniswap Trading API vs Upbit Open API", "url": "https://www.anchorterminal.com/compare/uniswap-vs-upbit" }, { "json": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-dydx.json", "title": "Coinbase MCP server (Coinbase for Agents) vs dYdX", "url": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-dydx" } ], "panel": null, "scores": [ { "by": 13, "coinbase-mcp": 55, "edge": "coinbase-mcp", "key": "reliability", "name": "Reliability", "upbit": 42, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 1, "coinbase-mcp": 65, "edge": "upbit", "key": "schema", "name": "Schema \u0026 documentation", "upbit": 66, "weight": 13 }, { "by": 4, "coinbase-mcp": 66, "edge": "upbit", "key": "ergonomics", "name": "Agent ergonomics", "upbit": 70, "weight": 13 }, { "by": 11, "coinbase-mcp": 70, "edge": "coinbase-mcp", "key": "security", "name": "Security \u0026 auth", "upbit": 59, "weight": 14 }, { "by": 25, "coinbase-mcp": 40, "edge": "coinbase-mcp", "key": "payments", "name": "Payments \u0026 pricing", "upbit": 15, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 25, "coinbase-mcp": 58, "edge": "upbit", "key": "maintenance", "name": "Maintenance \u0026 community", "upbit": 83, "weight": 7 }, { "by": 8, "coinbase-mcp": 62, "edge": "coinbase-mcp", "key": "transparency", "name": "Transparency \u0026 trust", "upbit": 54, "weight": 7 } ], "summary": "Coinbase MCP server (Coinbase for Agents) scores 60 (C) on agent readiness against Upbit Open API's 54.7 (C), and leads in 4 of 7 scored categories. Upbit Open API leads on maintenance \u0026 community. Both do exchange spot trading.", "tasks": null, "tutorials": [], "verdicts": { "coinbase-mcp": "Coinbase's remote MCP gives an agent OAuth access to a person's Coinbase account, with ten scopes, per-portfolio grants, revocation from account settings and client order IDs for safe retries. Only allowlisted clients can connect, the tool schemas aren't public, no rate limit is published and no server-side limit on order size is documented.", "upbit": "Upbit's Open API has a mandatory IP allow-list, scoped keys with a default withdrawal lock, per-group rate limits with 429 and 418 signalling, an order-test endpoint, official SDKs, a CLI and agent skills with a CONFIRM gate. There is no MCP server, sandbox or status page, and the fees and terms sit on a host our crawler may not read." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-upbit", "json": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-upbit.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-upbit.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-upbit.min.md" }, "markdown": "Coinbase MCP server (Coinbase for Agents) scores 60 (C) on agent readiness against Upbit Open API's 54.7 (C), and leads in 4 of 7 scored categories. Upbit Open API leads on maintenance \u0026 community. Both do exchange spot trading.\n\n- Coinbase MCP server (Coinbase for Agents): grade C, 60/100, rank #591 of 1349. Markdown https://www.anchorterminal.com/tools/coinbase-mcp.md · JSON https://www.anchorterminal.com/api/v1/tools/coinbase-mcp.json\n- Upbit Open API: grade C, 54.7/100, rank #860 of 1349. Markdown https://www.anchorterminal.com/tools/upbit.md · JSON https://www.anchorterminal.com/api/v1/tools/upbit.json\n- Best crypto exchange APIs and MCP servers for AI agents: https://www.anchorterminal.com/best/crypto-exchanges/index.md\n- All 210 exchanges comparisons: https://www.anchorterminal.com/compare/crypto-exchanges/index.md\n- Best agent wallets and spending controls: https://www.anchorterminal.com/best/agent-wallets/index.md\n- All 58 wallets comparisons: https://www.anchorterminal.com/compare/agent-wallets/index.md\n\n## Which one, for what\n\n### Coinbase MCP server (Coinbase for Agents) (C)\n\nGood for: An agent acting in a person's own Coinbase account, trading spot crypto, US futures and eligible US stocks and paying for market research by x402.\n\nAhead on:\n- Reliability, 55 against 42\n- Security \u0026 auth, 70 against 59\n- Payments \u0026 pricing, 40 against 15\n- Transparency \u0026 trust, 62 against 54\n\nAlso in its favour:\n- A hosted endpoint, with nothing to install\n- Runs on your own machine\n\nWatch for: Only clients Coinbase has allowlisted can connect; other agents need the local CLI and a CDP API key\n\n### Upbit Open API (C)\n\nGood for: KRW-market trading for agents acting for a verified Korean account, with first-party SDKs, a CLI and skills but no MCP.\n\nAhead on:\n- Maintenance \u0026 community, 83 against 58\n\nWatch for: No MCP server; the agent route is the CLI through skills, which need a terminal\n\n\n## Why the edge\n\n### Payments \u0026 pricing: Coinbase MCP server (Coinbase for Agents) +25\n\n- Coinbase MCP server (Coinbase for Agents) (40): Read the way coinbase-cdp-agentkit was. The server pays x402 as a buyer from the account's USDC balance and its own endpoint isn't paid per call, so the paying-as-a-buyer step (15 of 40). No price for the server itself; trades carry Advanced Trade fees, whose schedule on coinbase.com we couldn't read past a bot check, and x402 prices are advisory and shown only after sign-in (10 of 20). Connecting and reading prices and portfolios cost nothing and need no card, but anything beyond reads needs a verified and funded Coinbase account. Judgement call (15 of 20). A person must sign in to Coinbase in a browser and approve the grant, and only allowlisted clients can register (0).\n- Upbit Open API (15): No machine payment protocol (0). The fee schedule is on upbit.com, which disallows every crawler path, so no price is recorded (0 of 20, unchecked). Public quotation endpoints need no key, card or account; trading needs a verified Korean account. Judgement call (15 of 20). A person must sign up, pass identity checks and issue keys on the PC web site (0). 0 + 0 + 15 + 0 = 15.\n\n### Maintenance \u0026 community: Upbit Open API +25\n\n- Coinbase MCP server (Coinbase for Agents) (58): Read as a closed hosted service. The last dated change to the server in the CDP changelog is US stocks on 21 August 2026; the docs added three x402 tools in October (the overview of 2 October still calls them coming soon, the MCP page was modified on 9 October) and the setup guide on 22 October, with no changelog entry. Judgement call (25 of 30). Changelog entries for futures (17 August) and stocks (21 August) both name the MCP server, and the CLI built from the same agent spec shipped six versions from 14 August to 30 September (20). A public changelog, a CDP Discord for integration help and a one-way feedback tool limited to six notes a day, none tested (10 of 25). Not in the official MCP registry; a search for coinbase on 24 October found only third-party servers (0). The CLI has no runtime dependencies but runs a postinstall script and has no public repository or CI (3 of 10).\n- Upbit Open API (83): Read as a closed service. SDK v1.1.0 on 20 October 2026 (30). The CLI 1.0.0 on 1 September, the rate-limit update of 7 October, the SDK on 20 October and the path-format notice for 16 November 2026 (20). open-api@upbit.com answers in turn on weekdays per the support notice, notices carry dates, and the six upbit-official repositories show no open issues (12 of 15). Current official SDKs in Python, TypeScript and Go (15). Apache-2.0 repositories pushed in October 2026; CI not checked (6 of 10). 30 + 20 + 12 + 15 + 6 = 83.\n\n### Reliability: Coinbase MCP server (Coinbase for Agents) +13\n\n- Coinbase MCP server (Coinbase for Agents) (55): Graded with the hosted lines, on the remote server at agents.coinbase.com. status.coinbase.com is a Statuspage site with Advanced Trade, API, US Derivatives and Developer Platform components and 90 days of history, but no component for the agents MCP server, so it shows the trading back end and not the server agents call. Judgement call (10 of 20). Its first history page, 1 August to 24 October 2026, shows minor incidents for derivatives positions and portfolio transfers and one major, a two-minute website slowdown on 14 October, with none for Advanced Trade order entry; 26 to 31 July sits on a second page we didn't read (20). The setup guide says it specifies no numeric request quota for the remote server and that Advanced Trade limits are not the MCP limit (0). It says to honour Retry-After on 429 or back off with jitter, orders take a `client_order_id` that returns the existing order on retry, and x402 payments take an `idempotency_key` (15). No SLA found (0). Nothing labels the remote server beta or preview (10).\n- Upbit Open API (42): Read with the hosted lines. No status page found on docs.upbit.com or in llms.txt; a wallet-status endpoint and an announcements stream stand in (0). No readable incident history (5). Rate limits documented with numbers per group, per IP and per pocket, updated 7 October 2026 (15). 429 then 418 with a stated block length and a Remaining-Req header, an order-test endpoint and a self-match-prevention default; an order identifier for safe retries was not checked (12 of 15). No SLA found (0). Generally available (10). 0 + 5 + 15 + 12 + 0 + 10 = 42.\n\n### Security \u0026 auth: Coinbase MCP server (Coinbase for Agents) +11\n\n- Coinbase MCP server (Coinbase for Agents) (70): Coinbase OAuth with authorisation code and PKCE S256, `resource` on every request, DCR and CIMD limited to allowlisted clients, ten `mcp:*` scopes, a consent screen where the person picks portfolios, and revocation under Account \u003e Security \u003e Connections (30). A read-only grant and a funded separate portfolio limit what an agent can touch, and transfers move funds only between the person's portfolios. No per-order size limit or server-side confirmation is documented; the June blog's trade-size limits are still \"soon\", and the setup guide tells agents to request every scope rather than the least needed (12 of 20). x402 fetch returns third-party data from a curated catalogue only, and the 13 October changelog removes Bazaar resources whose metadata carries prompt-injection risk; no guidance on treating returned data as untrusted was found beyond citing only values the source returns (8 of 15). Orders, transfers and payments appear in the Coinbase account and connections are listed in account settings, but no per-call log for MCP was found (8 of 15). HackerOne bug bounty named in coinbase.com's security.txt, which expired on 1 June 2024; no security.txt on agents.coinbase.com; certifications not read because coinbase.com answered a bot check (12 of 20).\n- Upbit Open API (59): Keys limited to chosen functions, a mandatory public IPv4 allow-list, a JWT per request with a fresh nonce, keys listed with expiry through the API, and a withdrawal safe-lock on by default (27 of 30). Read-only keys, the default withdrawal lock lifted only in the app, and skills that require a typed CONFIRM before writes (17 of 20). The API returns exchange data and announcements, no third-party content (10 of 15). An API key list endpoint; no per-call log for the operator (5 of 15). No disclosure policy, bug bounty or certification found; security.txt on upbit.com could not be fetched under its robots.txt (0 of 20). 27 + 17 + 10 + 5 + 0 = 59.\n\n### Transparency \u0026 trust: Coinbase MCP server (Coinbase for Agents) +8\n\n- Coinbase MCP server (Coinbase for Agents) (62): The editorial half. A closed hosted service. The docs carry a disclaimer that the person is responsible for every trade an agent makes, but name no terms for agent access, and the Coinbase User Agreement answered a bot check and wasn't read. The CLI is MIT on npm (10 of 30). Per the coinbase-cdp-agentkit check of 1 October 2026, the privacy policy (updated 27 May 2026) names Coinbase, Inc., lists processing countries and ties retention to need without numbers; nothing specific to MCP calls or the feedback tool's screening was found (12 of 30). No deprecation policy or notice period for the server or its tools (0). Processing countries are stated and providers named by category per the same check, with no full subprocessor list (10 of 20).\n- Upbit Open API (54): The editorial half. A closed service whose user and Open API terms could not be fetched under upbit.com's robots.txt, and whose SDK licence page calls the SDK material not open source while the repositories carry Apache-2.0 (8 of 30). The developer centre's privacy policy names Dunamu Inc., gives retention periods and names Zendesk in Japan; the main privacy policy was not read (14 of 30). Notices with effective dates, including the path-format change and the deprecated Remaining-Req min field (12 of 20). Zendesk and Google Analytics named with a location for the developer centre only (8 of 20). 8 + 14 + 12 + 8 = 42.\n\n## Score by category\n\n| Category | Weight | Coinbase MCP server (Coinbase for Agents) | Upbit Open API | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 55 | 42 | Coinbase MCP server (Coinbase for Agents) +13 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 65 | 66 | Upbit Open API +1 |\n| Agent ergonomics | 13% (16.2 this run) | 66 | 70 | Upbit Open API +4 |\n| Security \u0026 auth | 14% (17.5 this run) | 70 | 59 | Coinbase MCP server (Coinbase for Agents) +11 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 40 | 15 | Coinbase MCP server (Coinbase for Agents) +25 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 58 | 83 | Upbit Open API +25 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 62 | 54 | Coinbase MCP server (Coinbase for Agents) +8 |\n| Negative events | ≤15 | 0 | 0 | |\n| **Total** | | **60 · C** | **54.7 · C** | |\n\n## Facts side by side\n\n| Fact | Coinbase MCP server (Coinbase for Agents) | Upbit Open API |\n| --- | --- | --- |\n| Kind | MCP server | HTTP API |\n| Vendor | Coinbase, Inc. | Dunamu Inc. |\n| Hosted endpoint | `https://agents.coinbase.com/mcp` | no (local only) |\n| Transports | Streamable HTTP, stdio | |\n| Auth | OAuth | API key |\n| Pricing | Free | Pay per use |\n| x402 | payer tooling only | no |\n| Licence | Proprietary hosted service under Coinbase's account terms, which we couldn't read. The companion CLI, @coinbase/coinbase-cli, is MIT-licensed on npm with no public repository | none |\n| Tools exposed | 29 | 0 |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| Last release | 2026-09-30 | 2026-10-20 |\n| Terms last updated | couldn't be read | no document linked |\n| Privacy policy last updated | 2026-05-27 | no date given |\n| Customer content may train models | couldn't be read | not read yet |\n| Terms restrict automated access | couldn't be read | not read yet |\n| Terms restrict benchmarking | couldn't be read | not read yet |\n| Terms or service can change without notice | couldn't be read | not read yet |\n| Arbitration or class-action waiver | couldn't be read | not read yet |\n| Popularity | 509 npm/wk | 91 stars |\n| Agent reviews | 2.5/5 (4) | none |\n\n## How the scores have moved\n\n### Coinbase MCP server (Coinbase for Agents)\n\n- -0.2 on 30 October 2026: checklist\n\n### Upbit Open API\n\nNo score change since it was listed.\n\n## Verdicts\n\n**Coinbase MCP server (Coinbase for Agents).** Coinbase's remote MCP gives an agent OAuth access to a person's Coinbase account, with ten scopes, per-portfolio grants, revocation from account settings and client order IDs for safe retries. Only allowlisted clients can connect, the tool schemas aren't public, no rate limit is published and no server-side limit on order size is documented.\n\n**Upbit Open API.** Upbit's Open API has a mandatory IP allow-list, scoped keys with a default withdrawal lock, per-group rate limits with 429 and 418 signalling, an order-test endpoint, official SDKs, a CLI and agent skills with a CONFIRM gate. There is no MCP server, sandbox or status page, and the fees and terms sit on a host our crawler may not read.\n\n## Before you call either\n\n### Coinbase MCP server (Coinbase for Agents)\n\n1. Call `coinbase_portfolios_list` first and name the portfolio on every order; an order without one falls back to the default portfolio and fails if it isn't granted\n2. Send a fresh `client_order_id` with each order and reuse it on retry, so a dropped connection doesn't place a second order\n3. Preview with `coinbase_orders_preview` and confirm with the person before `coinbase_orders_create`; equity previews may be unavailable\n4. Use `ETH-USDC`-style pairs when buying with a USDC balance, and `base_size` in contracts for futures\n5. Agree a spending budget before `coinbase_x402_fetch`, set `max_amount`, and keep the `idempotency_key` for any retry; settled payments can't be reversed\n\n### Upbit Open API\n\n1. Ask the person for a key with only the functions the task needs and your server's public IPv4 address registered; a private or unregistered IP is refused\n2. Sign every request with a fresh JWT (HS512, new nonce, SHA512 query hash) and branch on error.name, not error.message\n3. Run POST /v1/orders/test before a live order; it costs nothing and shares the 8-a-second order-test group\n4. Read Remaining-Req and keep orders under 12 a second per pocket; on 429 wait for the next second and on 418 wait out the stated block\n5. Leave the withdrawal safe-lock on unless the person lifts it in the app, and send paths with single slashes and no trailing slash before 16 November 2026\n\n## Questions\n\n### Which is better for AI agents, Coinbase MCP server (Coinbase for Agents) or Upbit Open API?\n\nCoinbase MCP server (Coinbase for Agents) scores 60 (C) on agent readiness against Upbit Open API's 54.7 (C), and leads in 4 of 7 scored categories. Upbit Open API leads on maintenance \u0026 community.\n\n### Do Coinbase MCP server (Coinbase for Agents) and Upbit Open API need an API key?\n\nCoinbase MCP server (Coinbase for Agents) uses an OAuth sign-in. Upbit Open API needs an API key.\n\n### Can an agent call Coinbase MCP server (Coinbase for Agents) and Upbit Open API without installing anything?\n\nCoinbase MCP server (Coinbase for Agents) has a hosted endpoint at https://agents.coinbase.com/mcp. No hosted endpoint is listed for Upbit Open API.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/coinbase-mcp-vs-upbit.json, and with the fewest tokens: https://www.anchorterminal.com/compare/coinbase-mcp-vs-upbit.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"coinbase-mcp\", \"b\": \"upbit\"}`. From a terminal: `anchor compare coinbase-mcp upbit`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/coinbase-mcp.json and https://www.anchorterminal.com/api/v1/tools/upbit.json\n\n## Other comparisons with Coinbase MCP server (Coinbase for Agents) or Upbit Open API\n\n- [Bitfinex API vs Coinbase MCP server (Coinbase for Agents)](https://www.anchorterminal.com/compare/bitfinex-vs-coinbase-mcp.md)\n- [Bitfinex API vs Upbit Open API](https://www.anchorterminal.com/compare/bitfinex-vs-upbit.md)\n- [Bitget vs Coinbase MCP server (Coinbase for Agents)](https://www.anchorterminal.com/compare/bitget-vs-coinbase-mcp.md)\n- [Bitget vs Upbit Open API](https://www.anchorterminal.com/compare/bitget-vs-upbit.md)\n- [Bithumb Open API vs Coinbase MCP server (Coinbase for Agents)](https://www.anchorterminal.com/compare/bithumb-vs-coinbase-mcp.md)\n- [Bithumb Open API vs Upbit Open API](https://www.anchorterminal.com/compare/bithumb-vs-upbit.md)\n- [Bitstamp API vs Coinbase MCP server (Coinbase for Agents)](https://www.anchorterminal.com/compare/bitstamp-vs-coinbase-mcp.md)\n- [Bitstamp API vs Upbit Open API](https://www.anchorterminal.com/compare/bitstamp-vs-upbit.md)\n- [Bybit vs Coinbase MCP server (Coinbase for Agents)](https://www.anchorterminal.com/compare/bybit-vs-coinbase-mcp.md)\n- [Bybit vs Upbit Open API](https://www.anchorterminal.com/compare/bybit-vs-upbit.md)\n- [Crypto.com Exchange API vs Upbit Open API](https://www.anchorterminal.com/compare/crypto-com-exchange-vs-upbit.md)\n- [Deribit vs Upbit Open API](https://www.anchorterminal.com/compare/deribit-vs-upbit.md)\n- [dYdX vs Upbit Open API](https://www.anchorterminal.com/compare/dydx-vs-upbit.md)\n- [Gate vs Upbit Open API](https://www.anchorterminal.com/compare/gate-io-vs-upbit.md)\n- [Gemini Exchange API vs Upbit Open API](https://www.anchorterminal.com/compare/gemini-exchange-vs-upbit.md)\n- [HTX trading API vs Upbit Open API](https://www.anchorterminal.com/compare/htx-vs-upbit.md)\n- [Hyperliquid vs Upbit Open API](https://www.anchorterminal.com/compare/hyperliquid-vs-upbit.md)\n- [KuCoin vs Upbit Open API](https://www.anchorterminal.com/compare/kucoin-vs-upbit.md)\n- [MEXC API vs Upbit Open API](https://www.anchorterminal.com/compare/mexc-vs-upbit.md)\n- [Binance API vs Coinbase MCP server (Coinbase for Agents)](https://www.anchorterminal.com/compare/binance-vs-coinbase-mcp.md)\n- [Binance API vs Upbit Open API](https://www.anchorterminal.com/compare/binance-vs-upbit.md)\n- [Coinbase Advanced Trade API vs Coinbase MCP server (Coinbase for Agents)](https://www.anchorterminal.com/compare/coinbase-advanced-trade-vs-coinbase-mcp.md)\n- [Coinbase Advanced Trade API vs Upbit Open API](https://www.anchorterminal.com/compare/coinbase-advanced-trade-vs-upbit.md)\n- [Coinbase MCP server (Coinbase for Agents) vs Crypto.com Exchange API](https://www.anchorterminal.com/compare/coinbase-mcp-vs-crypto-com-exchange.md)\n- [Coinbase MCP server (Coinbase for Agents) vs Deribit](https://www.anchorterminal.com/compare/coinbase-mcp-vs-deribit.md)\n- [Coinbase MCP server (Coinbase for Agents) vs Gate](https://www.anchorterminal.com/compare/coinbase-mcp-vs-gate-io.md)\n- [Coinbase MCP server (Coinbase for Agents) vs Gemini Exchange API](https://www.anchorterminal.com/compare/coinbase-mcp-vs-gemini-exchange.md)\n- [Coinbase MCP server (Coinbase for Agents) vs HTX trading API](https://www.anchorterminal.com/compare/coinbase-mcp-vs-htx.md)\n- [Coinbase MCP server (Coinbase for Agents) vs Hyperliquid](https://www.anchorterminal.com/compare/coinbase-mcp-vs-hyperliquid.md)\n- [Coinbase MCP server (Coinbase for Agents) vs Kraken API](https://www.anchorterminal.com/compare/coinbase-mcp-vs-kraken.md)\n- [Coinbase MCP server (Coinbase for Agents) vs KuCoin](https://www.anchorterminal.com/compare/coinbase-mcp-vs-kucoin.md)\n- [Coinbase MCP server (Coinbase for Agents) vs MEXC API](https://www.anchorterminal.com/compare/coinbase-mcp-vs-mexc.md)\n- [Coinbase MCP server (Coinbase for Agents) vs OKX API](https://www.anchorterminal.com/compare/coinbase-mcp-vs-okx.md)\n- [Coinbase MCP server (Coinbase for Agents) vs Uniswap Trading API](https://www.anchorterminal.com/compare/coinbase-mcp-vs-uniswap.md)\n- [Kraken API vs Upbit Open API](https://www.anchorterminal.com/compare/kraken-vs-upbit.md)\n- [OKX API vs Upbit Open API](https://www.anchorterminal.com/compare/okx-vs-upbit.md)\n- [Uniswap Trading API vs Upbit Open API](https://www.anchorterminal.com/compare/uniswap-vs-upbit.md)\n- [Coinbase MCP server (Coinbase for Agents) vs dYdX](https://www.anchorterminal.com/compare/coinbase-mcp-vs-dydx.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-04", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Coinbase MCP server (Coinbase for Agents) vs Upbit Open API", "url": "" } ], "description": "Coinbase scores 60 (C) to Upbit Open's 54.7 (C) for exchange spot trading. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Coinbase MCP server (Coinbase for Agents) C 60", "Upbit Open API C 54.7", "scores" ], "h1": "Coinbase MCP server (Coinbase for Agents) vs Upbit Open API", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/coinbase-mcp-vs-upbit", "published": "2026-10-01", "section": "tools", "title": "Coinbase vs Upbit Open for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-03", "url": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-upbit" }, "tokens": { "markdown": 5250, "slim": 2780 }, "version": 1 }