# Crypto.com Exchange API vs Deribit (slim)

> Deribit scores 59 (C) to Crypto.com Exchange's 46.8 (D) for exchange market data. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/crypto-com-exchange-vs-deribit.md (~5,450 tokens) · this version ~3,080 tokens · JSON https://www.anchorterminal.com/compare/crypto-com-exchange-vs-deribit.json · canonical https://www.anchorterminal.com/compare/crypto-com-exchange-vs-deribit
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-03
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Deribit scores 59 (C) on agent readiness against Crypto.com Exchange API's 46.8 (D), and leads in 4 of 7 scored categories. Crypto.com Exchange API leads on reliability, payments & pricing and transparency & trust. Both do exchange market data.

- Crypto.com Exchange API: D 46.8, rank #1100 of 1349 · https://www.anchorterminal.com/tools/crypto-com-exchange.min.md
- Deribit: C 59, rank #650 of 1349 · https://www.anchorterminal.com/tools/deribit.min.md
- Crypto.com Exchange API, good for An agent trading spot or perpetuals on Crypto.com through a local MCP server with safety tiers, for a person outside the App's restricted list. Ahead on Reliability, 50 against 45; Payments & pricing, 40 against 25; Transparency & trust, 55 against 46. Also Runs on your own machine.
- Deribit, good for An agent trading crypto options, dated futures and perpetuals for an institutional or retail Deribit account, and anyone migrated from Coinbase International Exchange. Ahead on Schema & documentation, 88 against 42; Agent ergonomics, 74 against 50; Security & auth, 62 against 54; Maintenance & community, 65 against 29.

| Category | Crypto.com Exchange API | Deribit |
| --- | --- | --- |
| Reliability (16%) | 50 | 45 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 42 | 88 |
| Agent ergonomics (13%) | 50 | 74 |
| Security & auth (14%) | 54 | 62 |
| Payments & pricing (10%) | 40 | 25 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 29 | 65 |
| Transparency & trust (7%) | 55 | 46 |

| Fact (where they differ) | Crypto.com Exchange API | Deribit |
| --- | --- | --- |
| Vendor | Foris DAX Limited (Crypto.com) | Deribit FZE |
| Transports | stdio |  |
| Licence | Proprietary hosted API under the Exchange terms and conditions, which our reader couldn't load. cdcx-cli, the official CLI and MCP server, is MIT or Apache-2.0 | Proprietary hosted exchange. The API is documented under the Deribit docs with an OpenAPI 3.0 file; no official client library is published |
| Tools exposed | 95 | 0 |
| llms.txt | no | yes |
| Last release | 2026-06-18 | 2026-10-13 |
| Terms last updated | couldn't be read | 2026-08-13 |
| Privacy policy last updated | 2025-03-12 | no document linked |
| Customer content may train models | couldn't be read | not found in the text |
| Terms restrict automated access | couldn't be read | yes |
| Terms restrict benchmarking | couldn't be read | not found in the text |
| Terms or service can change without notice | couldn't be read | not found in the text |
| Arbitration or class-action waiver | couldn't be read | not found in the text |
| Popularity | 27 stars, 59 npm/wk | none |

Why the edge:
- Schema & documentation, Deribit +46: Crypto.com Exchange API 42 (An OpenAPI spec exists, since cdcx-cli generates its 95 commands and tools from it at run time, but its host (exchange-developer.crypto.com) answered 403 to robots.txt and the spec was not read; the vendor's own tooling is evidence it exists, not of its quality (15 of 25). No llms.txt on crypto.com or the Exchange pages (0). For descriptions, cdcx's tool descriptions come from the spec, which we couldn't read; the Exchange skill documents 52 endpoints in prose (8 of 20). cdcx's README says the tools carry typed parameters and enum validation, a vendor claim not checked against the spec (8 of 15). For examples, the skills and cdcx README carry worked commands, but the API's error codes and response examples sit on the unread host (6 of 15). Versioned path (v1); the API changelog and announcements page could not be read (5 of 15). 15 + 0 + 8 + 8 + 6 + 5 = 42.); Deribit 88 (OpenAPI 3.0.0 for the whole JSON-RPC surface (Deribit API 2.1.1, about 1.4 million characters) plus AsyncAPI files for the WebSocket side (25). llms.txt with production and upcoming indexes, and a Markdown twin of every page (10). Each operation has a description such as "Places a buy order for an instrument." with parameter notes, and the articles say when to use WebSocket subscriptions over polling, but the reference seldom says when not to use a method (13 of 20). Parameters are typed with enums (order `type` has eight values, `time_in_force` four) and required flags, with `amount` or `contracts` as a documented either-or (13 of 15). Every reference page carries an example request and response, and the errors page lists about 159 codes with retry guidance, though most operations document only a 200 response and the smaller error tables disagree with the full one on two codes (12 of 15). A versioned path (/api/v2), a production and an upcoming docs branch, and a dated changelog of 64 entries since 21 January 2020 (15). Total 88.)
- Maintenance & community, Deribit +36: Crypto.com Exchange API 29 (Read as a closed service with an open CLI. The last change we could date is cdcx-cli v1.2.6 on 18 June 2026, 138 days before the check, with no commit since; the API changelog is unread (10). No three dated releases in the last 90 days (0). Five of six open items on cdcx-cli, all by collaborators or Dependabot since May, have no comment; the Exchange has a support chat and contact@crypto.com (8 of 25). Not in the official MCP registry and no official SDK beyond the CLI (5 of 15). CI tests on three operating systems with clippy and fmt; the npm wrapper's postinstall downloads the binary and two Dependabot bumps are open (6 of 10). 10 + 0 + 8 + 5 + 6 = 29.); Deribit 65 (Read as a closed service. The JSON-RPC changelog's latest production entry is 13 October 2026 and an entry dated 5 November 2026 describes the next release; Deribit's posts of 14 October and 2 November 2026 change fees (30). Entries of 18 August, 15 September and 13 October 2026, three in 90 days (20). A public changelog and a support site; whether support answers wasn't tested and the support site refused our reader (10 of 15). No official SDK and no MCP registry entry (0). The OpenAPI and AsyncAPI files are maintained with the docs (5 of 10). Total 65.)
- Agent ergonomics, Deribit +24: Crypto.com Exchange API 50 (Graded on the REST API as an agent calls it, with the MCP server noted. cdcx serves up to 95 tools, more than 30, but the default serves the `market` group alone and groups are enabled one by one, which is a read-only subset switch (5 + 10 = 15). Pagination and output controls for the API are on the unread docs host; cdcx adds `-o json|table|ndjson` (8 of 20). cdcx returns structured JSON errors and the safety gate names what is missing; the API's own error table is unread (8 of 20). cdcx's tiers (mutate needs `acknowledged: true`, dangerous needs `--allow-dangerous`), `--dry-run` and paper trading give safe rehearsal, though no MCP annotations or API idempotency keys were seen (12 of 20). No official SDK beyond the CLI; defaults in cdcx are sensible (7 of 15). 15 + 8 + 8 + 12 + 7 = 50.); Deribit 74 (An API, read for response sizing. `public/get_order_book` takes `depth`, `get_instruments` filters by currency and kind, and history methods take `count` and `offset`, though `get_instruments` returns every instrument for a currency and costs 10,000 credits (18 of 25). Count and offset pagination, time ranges on trade and transaction logs, and WebSocket channels with interval and depth options (16 of 20). Numeric error codes with short names, a `wait` value on some errors, and sample code that branches on them (18 of 20). A `nonce` on orders since May 2026 returns the existing order on retry, a `label` lets an agent find its own orders, and 10040 marks the calls safe to retry; no MCP annotations apply (16 of 20). Few required parameters and sensible defaults (limit and good_til_cancelled), but no official SDK in any language, so every caller signs and frames JSON-RPC itself (6 of 15). Total 74.)
- Payments & pricing, Crypto.com Exchange API +15: Crypto.com Exchange API 40 (No machine payment protocol (0). Spot fee tiers published without login, 0.25% maker and 0.50% taker at Level 1 (20). The API is free, public market data needs no key, UAT and paper trading need no money (20). A person must sign up in a browser with identity checks and mint the key (0). 0 + 20 + 20 + 0 = 40.); Deribit 25 (No machine payment protocol (0). The fee schedule is on support.deribit.com, which answered 403; Deribit's own posts give VIP4 to VIP7 taker fees and the 0 bps linear options maker fee, so partial prices are public but the lowest tier is unchecked (5 of 20). Public market data needs no key and the test environment is free, with no card anywhere (20). A person signs up in a browser with identity checks before any key exists (0). Total 25.)
- Transparency & trust, Crypto.com Exchange API +9: Crypto.com Exchange API 55 (The editorial half. A closed service whose terms and trading rules loaded empty for our reader; cdcx and the skills are MIT or Apache-2.0 (10 of 30). The Exchange privacy notice of 12 March 2025 names Foris DAX Limited, gives retention examples (6 years for correspondence, 5 years for EEA AML records) and provider categories, with no DPA or subprocessor list (16 of 30). No deprecation policy or notice period was found (0). Transfers outside the Cayman Islands and the EEA are stated with no countries named (6 of 20). 10 + 16 + 0 + 6 = 32.); Deribit 46 (The editorial half. A closed service whose terms (Deribit FZE membership terms and DRB Panama Inc. terms) sit on a support site that answered 403, with the entity confirmed on VARA's register (12 of 30). The privacy policy was not read, and nothing in the docs states retention (0 of 30). The changelog marks deprecations and the upcoming docs branch previews the next release, but removals such as `public/get_index` on 25 November 2025 carry no notice period (10 of 20). No subprocessor or data-location statement found (0 of 20). Total 22.)
- Security & auth, Deribit +8: Crypto.com Exchange API 54 (HMAC-SHA256 API keys made with 2FA; IP whitelisting and pre-approved withdrawal addresses per the official skill, and revocation from the Exchange settings. The permission list (read, trade, withdraw) is on the unread docs host, so scopes are recorded from the skills (20 of 30). On least privilege, the App skill's key has no withdrawal permission, the Exchange skill requires user confirmation before a production trade, and cdcx refuses withdrawals and cancel-all without `--allow-dangerous`; nothing on the server side limits order size (14 of 20). The tools return exchange data, not third-party text, but no guidance on untrusted content was found (6 of 15). An account audit trail is not documented where we could read (4 of 15). No security.txt on crypto.com; cdcx has a SECURITY.md with private reporting and a three-day acknowledgement, and the organisation keeps HackerOne policy guidelines; certifications were not read (10 of 20). 20 + 14 + 6 + 4 + 10 = 54.); Deribit 62 (Keys carry five scopes at read, read_write or none, `ip:ADDR` and `expires` limits, can be disabled, reset and removed by API, and self-generated Ed25519 or RSA keys keep the private half off Deribit. The HTTP `client_credentials` example passes `client_secret` in the query string, a documented option, so 10 off (20 of 30). `trade:read` and `wallet:none` give read-only and no-withdrawal keys and the 5 August 2025 release stopped `account:read` keys reading other keys' secrets; no per-order confirmation and the address allow-list article was unreadable (16 of 20). The API returns no untrusted content (10). `private/list_api_keys`, the transaction log and order history let an operator see what a key did, but no per-key call log was found (8 of 15). A HackerOne bug bounty per the support article title and HackerOne's customer story, neither page read first-hand (insights.deribit.com/bug-bounty answered 403), a VARA licence, and no security.txt on www.deribit.com (8 of 20). Total 62.)