Crypto.com Exchange API vs Gate

Crypto.com Exchange API 29

Read as a closed service with an open CLI. The last change we could date is cdcx-cli v1.2.6 on 18 June 2026, 138 days before the check, with no commit since; the API changelog is unread (10). No three dated releases in the last 90 days (0). Five of six open items on cdcx-cli, all by collaborators or Dependabot since May, have no comment; the Exchange has a support chat and contact@crypto.com (8 of 25). Not in the official MCP registry and no official SDK beyond the CLI (5 of 15). CI tests on three operating systems with clippy and fmt; the npm wrapper's postinstall downloads the binary and two Dependabot bumps are open (6 of 10). 10 + 0 + 8 + 5 + 6 = 29.

Gate 77

Read as a hosted service with open-source MCP packages. The API changelog's latest entry is 2 November 2026 and gate-skills was pushed 3 November (30). 40 dated changelog entries since 5 August 2026 (20). developer@gate.com, a help centre and issue trackers on gate-mcp and gate-skills, replies not checked (12 of 25). In the official MCP registry under io.github.gateio-dev, a GitHub namespace rather than gate.com, and official SDKs current (10 of 15). The local package has a publish workflow and no test workflow in CI, and its last tag is 16 April 2026 (5 of 10). 77.

Crypto.com Exchange API 42

An OpenAPI spec exists, since cdcx-cli generates its 95 commands and tools from it at run time, but its host (exchange-developer.crypto.com) answered 403 to robots.txt and the spec was not read; the vendor's own tooling is evidence it exists, not of its quality (15 of 25). No llms.txt on crypto.com or the Exchange pages (0). For descriptions, cdcx's tool descriptions come from the spec, which we couldn't read; the Exchange skill documents 52 endpoints in prose (8 of 20). cdcx's README says the tools carry typed parameters and enum validation, a vendor claim not checked against the spec (8 of 15). For examples, the skills and cdcx README carry worked commands, but the API's error codes and response examples sit on the unread host (6 of 15). Versioned path (v1); the API changelog and announcements page could not be read (5 of 15). 15 + 0 + 8 + 8 + 6 + 5 = 42.

Gate 70

No public OpenAPI file was found, though the SDKs are generated and the MCP tools carry typed parameters per the tool reference; the hosted tools' JSON Schema could not be read without a session (12 of 25). The whole REST and WebSocket documentation is downloadable as Markdown and the agent guide is a plain page (10). The tool reference gives one line and the main parameters per tool, the API reference a description per endpoint, no when-not-to-use guidance (12 of 20). Required flags, enums for side, type and time_in_force (11 of 15). Examples per endpoint and a labelled error body with a fixed label list the docs tell you to branch on instead of messages (13 of 15). A versioned changelog, v4.106.177 on 2 November 2026 (12 of 15, since entries are terse). 70.

Crypto.com Exchange API 50

Graded on the REST API as an agent calls it, with the MCP server noted. cdcx serves up to 95 tools, more than 30, but the default serves the market group alone and groups are enabled one by one, which is a read-only subset switch (5 + 10 = 15). Pagination and output controls for the API are on the unread docs host; cdcx adds -o json|table|ndjson (8 of 20). cdcx returns structured JSON errors and the safety gate names what is missing; the API's own error table is unread (8 of 20). cdcx's tiers (mutate needs acknowledged: true, dangerous needs --allow-dangerous), --dry-run and paper trading give safe rehearsal, though no MCP annotations or API idempotency keys were seen (12 of 20). No official SDK beyond the CLI; defaults in cdcx are sensible (7 of 15). 15 + 8 + 8 + 12 + 7 = 50.

Gate 66

Read for the API with the hosted MCP beside it. The MCP is split by endpoint (58 public tools on /mcp, 400 or more on /mcp/exchange, smaller info and news servers) and the local package filters by module and read-only flag, which stands in for toolsets (5 of 25 for the trading server, 10 added back). Pagination by page and limit, from and to timestamps, status filters (15 of 20). Error labels such as INVALID_SIGNATURE, REQUEST_EXPIRED, IP_FORBIDDEN and READ_ONLY name the recovery (15 of 20). The text order identifier makes retries safe; the local server's source sets no readOnlyHint or destructiveHint and the hosted annotations are unread (8 of 20). Three required fields on a spot order, SDKs in seven languages and a CLI (13 of 15). 66.

Crypto.com Exchange API 50

Read with the hosted lines on the Exchange API at api.crypto.com. status.crypto.com is a Statuspage site with component history (20). Its feed for 18 August to 3 November 2026 has 25 entries; the Exchange is named in two, an 11-minute database upgrade on 18 August and a one-hour balance display issue on 6 October, while the longer disruptions (Android login on 1 and 5 October, card 3DS on 23 September, Main App predictions on 3 November) are App incidents. There is no Exchange API component, so the record may be incomplete. Minor only (20). Rate limits are documented on exchange-docs.crypto.com, which answered 403 to robots.txt and was not read (0, unchecked). 429 handling and client order ids are on the same host (0, unchecked). No SLA found (0). Generally available (10). 20 + 20 + 0 + 0 + 0 + 10 = 50.

Gate 42

Graded with the hosted lines on the API v4 at api.gateio.ws with the hosted MCP beside it. No status page found (status.gate.com does not resolve, the docs link none), so 0 for the page and 5 for no readable history. Rate limits are published per endpoint group with numbers and fill-ratio rules (15). Every response carries X-Gate-RateLimit-Limit, X-Gate-RateLimit-Requests-Remain and X-Gate-RateLimit-Reset-Timestamp, 429 answers with the label TOO_FAST, and spot orders take a user text identifier, but no retry or idempotency guidance is written down (12 of 15). No SLA (0). API v4 and the MCP endpoints are production surfaces (10). 42.

Crypto.com Exchange API 54

HMAC-SHA256 API keys made with 2FA; IP whitelisting and pre-approved withdrawal addresses per the official skill, and revocation from the Exchange settings. The permission list (read, trade, withdraw) is on the unread docs host, so scopes are recorded from the skills (20 of 30). On least privilege, the App skill's key has no withdrawal permission, the Exchange skill requires user confirmation before a production trade, and cdcx refuses withdrawals and cancel-all without --allow-dangerous; nothing on the server side limits order size (14 of 20). The tools return exchange data, not third-party text, but no guidance on untrusted content was found (6 of 15). An account audit trail is not documented where we could read (4 of 15). No security.txt on crypto.com; cdcx has a SECURITY.md with private reporting and a three-day acknowledgement, and the organisation keeps HackerOne policy guidelines; certifications were not read (10 of 20). 20 + 14 + 6 + 4 + 10 = 54.

Gate 60

Gate OAuth 2 for the hosted trading MCP with eight scopes per the protected-resource metadata and revocation on the API management page, and API keys with disabled, read-only or read-write per product group, a separate withdrawal group and an IP allow-list of 20 addresses (30). A read-only key and a GATE_READONLY switch exist, and the guide says fund-moving actions need the person's confirmation in the client, with no server-side cap documented (15 of 20). The news and info servers return third-party content with no guidance on treating it as untrusted (5 of 15). Key changes and OAuth grants are visible on the API management page; no per-call log found (5 of 15). No security.txt, no disclosure policy or bounty on a page we read, a proof-of-reserves repository (5 of 20). 60.

Crypto.com Exchange API 55

The editorial half. A closed service whose terms and trading rules loaded empty for our reader; cdcx and the skills are MIT or Apache-2.0 (10 of 30). The Exchange privacy notice of 12 March 2025 names Foris DAX Limited, gives retention examples (6 years for correspondence, 5 years for EEA AML records) and provider categories, with no DPA or subprocessor list (16 of 30). No deprecation policy or notice period was found (0). Transfers outside the Cayman Islands and the EEA are stated with no countries named (6 of 20). 10 + 16 + 0 + 6 = 32.

Gate 49

The editorial half. A closed hosted service with a clear user agreement that names no company; the MCP packages are MIT (12 of 30). The privacy policy names a DPO address and categories of recipients, with no retention numbers and no named subprocessors (12 of 30). The changelog records breaking changes such as the amend endpoint path move of 16 October 2026 with no notice period or policy (8 of 20). Transfers outside the user's jurisdiction are disclosed with no locations or provider names (5 of 20). 37.