{ "data": { "a": { "slug": "crypto-com-exchange", "name": "Crypto.com Exchange API", "vendor": "Foris DAX Limited (Crypto.com)", "vendorUrl": "https://crypto.com/exchange", "kind": "http-api", "category": "crypto-exchanges", "summary": "Crypto.com Exchange's trading API for spot, perpetuals, margin, staking and trading bots, through REST, WebSocket and FIX with HMAC-signed API keys. Crypto.com's cdcx-cli adds an MCP server, agent skills and local paper trading.", "url": "https://www.anchorterminal.com/tools/crypto-com-exchange", "markdownUrl": "https://www.anchorterminal.com/tools/crypto-com-exchange.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/crypto-com-exchange.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/crypto-com-exchange.json", "dns": "crypto-com-exchange.grade.anchorterminal.com", "repo": "https://github.com/crypto-com/cdcx-cli", "license": "Proprietary hosted API under the Exchange terms and conditions, which our reader couldn't load. cdcx-cli, the official CLI and MCP server, is MIT or Apache-2.0", "transports": [ "stdio" ], "packages": [ { "registry": "npm", "name": "@cryptocom/cdcx-cli" } ], "auth": "api-key", "authNotes": "API key and secret created in the Exchange under Settings \u003e API Keys after a browser signup, with HMAC-SHA256 request signing. The official agent skill says IP whitelisting is recommended for production and withdrawal addresses must be pre-approved, and the App skill uses a key with no withdrawal permission; the Exchange docs' own permission list (read, trade, withdraw) sits on exchange-docs.crypto.com, which refused our reader. cdcx reads CDCX_API_KEY and CDCX_API_SECRET or a 0600 config file and has no key flag by design (https://github.com/crypto-com/crypto-agent-trading, https://github.com/crypto-com/cdcx-cli/blob/main/SECURITY.md, checked 2026-11-03).", "pricing": "usage", "pricingNotes": "The API itself costs nothing. Spot fees by 30-day volume, Level 1 (under $10,000) 0.25% maker and 0.50% taker, down to 0.08% and 0.18% at $500,000 or more, with a 3% discount for a CRO balance and 0% maker or rebates at higher CRO levels; rates reset daily at 04:00 UTC. A 0.5% liquidation fee. Derivatives fees are not on the fees page. A UAT environment (uat-api.3ona.co) and cdcx's local paper trading need no money (https://crypto.com/exchange-pro/en-US/document/fees-limits, checked 2026-11-03).", "priceSummary": "0.25% fee", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 on the Exchange pages, in cdcx-cli or the agent skills (checked 2026-11-03). Crypto.com's GitHub has an x402 facilitator client for its Developer Platform, which is a different product.", "endpoints": [] }, "toolCount": 95, "popularity": { "githubStars": 27, "npmWeekly": 59, "pypiWeekly": null, "asOf": "2026-11-03" }, "docsUrl": "https://exchange-docs.crypto.com/exchange/v1/rest-ws/index.html", "capabilities": [ "exchange.market-data", "exchange.spot-trading", "exchange.derivatives", "exchange.balances", "exchange.transfers", "exchange.staking", "market.crypto" ], "tags": [ "official", "hosted", "api-key", "mcp", "cli", "agent-skills", "sandbox", "status-page", "rust", "usage-priced" ], "lastRelease": "2026-06-18", "graded": true, "anchor": { "graded": true, "score": 46.8, "grade": "D", "agentReady": false, "rank": 1078, "ranked": true, "rankOf": 1349, "categoryRank": 20, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 50, "maintenance": 29, "payments": 40, "reliability": 50, "schema": 42, "security": 54, "transparency": 55 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "low", "date": "2026-11-03" }, "negative": 0, "verdict": "Crypto.com is one of two exchanges here with an official MCP server, cdcx-cli, whose 95 generated tools are grouped by service and gated by safety tier. The API docs, OpenAPI file, terms and trading rules refused or hid from our reader, so rate limits, key permissions and the automated-trading clauses are unchecked, and cdcx has no release since June 2026.", "bestFor": "An agent trading spot or perpetuals on Crypto.com through a local MCP server with safety tiers, for a person outside the App's restricted list.", "strengths": [ "Official cdcx-cli MCP server with 95 typed tools generated from the Exchange's OpenAPI spec, enabled by service group so a session can load `market` alone", "Safety tiers in the source, where order writes need `acknowledged: true` and cancel-all, withdrawals and bot termination need `--allow-dangerous` on the server", "A UAT environment with the same API paths and a local paper-trading engine that needs no credentials", "Spot fee tiers published without login, from 0.25% maker and 0.50% taker", "Official agent skills for the Exchange and the App that require user confirmation before a production trade" ], "weaknesses": [ "exchange-docs.crypto.com and the OpenAPI host answered 403 to robots.txt, so rate limits, key permissions, errors and the changelog could not be read", "The Exchange terms, trading rules and announcements pages load empty without a browser, so clauses on bots, API use and restricted countries are unchecked", "cdcx-cli's last tag is v1.2.6 of 18 June 2026 with no commit since, five of six open items unanswered, and the npm wrapper at 1.2.3 runs a postinstall download", "Not in the official MCP registry and no official SDK beyond the CLI", "No security.txt on crypto.com, and no SLA or Exchange-API component found on the status page" ], "agentNotes": [ "Enable only the service groups the task needs with `cdcx mcp config --enable trade,account` (the default serves `market` alone), and leave `--allow-dangerous` off unless the person asks for withdrawals or cancel-all", "Rehearse on `--env uat` or `cdcx paper` first; production keys trade real funds, and the skill requires explicit user confirmation before each live order", "Put the key in CDCX_API_KEY and CDCX_API_SECRET or `~/.config/cdcx/config.toml` at 0600; there is no key flag, and the key should have no withdrawal permission and an IP allow-list", "Pass `acknowledged: true` on mutate tools and `--dry-run` while testing; read the tool's generated schema before calling, since the docs host is unreadable to agents without a browser", "Check the person's country against Crypto.com's geo-restriction article and the Exchange terms before trading; New York and about 70 countries are excluded from the App, and the Exchange list was unreadable" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "low", "grade": "D", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 46.8 } ], "editorialScores": { "ergonomics": 50, "maintenance": 29, "payments": 40, "reliability": 50, "schema": 42, "security": 54, "transparency": 32 }, "provenanceScore": 77, "checked": { "categories": { "ergonomics": "2026-11-03", "maintenance": "2026-11-03", "payments": "2026-11-03", "reliability": "2026-11-03", "schema": "2026-11-03", "security": "2026-11-03", "transparency": "2026-11-03" }, "last": "2026-11-03", "oldest": "2026-11-03", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "curl -sSfL https://raw.githubusercontent.com/crypto-com/cdcx-cli/main/install.sh | sh", "http": "curl https://api.crypto.com/exchange/v1/public/get-tickers", "config": { "mcpServers": { "cdcx": { "args": [ "-y", "@cryptocom/cdcx-cli@latest", "mcp" ], "command": "npx", "env": { "CDCX_API_KEY": "your_api_key", "CDCX_API_SECRET": "your_api_secret" } } } } }, "letme": { "capability": "https://letme.dev/exchange.market-data", "tool": "https://letme.dev/crypto-com-exchange" }, "area": "payments", "unitPrices": [ { "item": "Spot maker fee, Level 1 (under $10,000 of 30-day volume)", "unit": "pct", "usd": 0.25, "note": "0.2425% with a CRO balance" }, { "item": "Spot taker fee, Level 1", "unit": "pct", "usd": 0.5, "note": "falls to 0.18% at $500,000 or more of 30-day volume" } ], "provenance": { "legalEntity": "Foris DAX Limited", "domain": "crypto.com", "domainRegistered": "1993-05-06", "endpointOnVendorDomain": true, "terms": "https://crypto.com/exchange-pro/en-US/document/tnc", "privacy": "https://crypto.com/uk/privacy/exchange", "statusPage": "https://status.crypto.com", "changelog": "", "securityTxt": "none", "checked": "2026-11-03", "notes": [ "Foris DAX Limited is named in the Exchange privacy notice (last updated 12 March 2025) as a Cayman Islands exempted company. The terms and conditions page loaded empty, so the entity in the terms is unconfirmed.", "RDAP gives crypto.com a registration date of 6 May 1993.", "https://crypto.com/.well-known/security.txt returns 404. cdcx-cli has a SECURITY.md with private vulnerability reporting through GitHub, and the crypto-com organisation has an h1-policy-guidelines repository.", "crypto.com/robots.txt allows the pages read; exchange-docs.crypto.com, exchange-developer.crypto.com and static2.crypto.com answered 403 to robots.txt and nothing on them was fetched. help.crypto.com allows with Crawl-delay 1.", "No API changelog could be read; the Exchange announcements page loaded empty." ], "score": 77 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/crypto-com-exchange.json", "live": { "slug": "crypto-com-exchange", "vendorStatus": { "page": "https://status.crypto.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-04T21:25:39.694772729Z" }, "versions": [ { "registry": "github", "name": "crypto-com/cdcx-cli", "version": "v1.2.6", "released": "2026-06-18", "seenAt": "2026-11-04T20:09:55.434074077Z" }, { "registry": "npm", "name": "@cryptocom/cdcx-cli", "version": "1.2.3", "seenAt": "2026-11-04T20:09:54.573709836Z" } ], "githubStars": 27, "npmWeekly": 51, "securityTxt": { "url": "https://crypto.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-04T15:54:09.539387255Z" }, "updatedAt": "2026-11-04T21:25:39.694772729Z" } }, "answer": "Upbit Open API scores 54.7 (C) on agent readiness against Crypto.com Exchange API's 46.8 (D), and leads in 4 of 7 scored categories. Crypto.com Exchange API leads on reliability and payments \u0026 pricing.", "b": { "slug": "upbit", "name": "Upbit Open API", "vendor": "Dunamu Inc.", "vendorUrl": "https://docs.upbit.com", "kind": "http-api", "category": "crypto-exchanges", "summary": "Upbit, the Korean exchange run by Dunamu, has a REST and WebSocket Open API for KRW, BTC and USDT market data, orders, balances, deposits and withdrawals, with official SDKs, a CLI and agent skills but no MCP server.", "url": "https://www.anchorterminal.com/tools/upbit", "markdownUrl": "https://www.anchorterminal.com/tools/upbit.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/upbit.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/upbit.json", "dns": "upbit.grade.anchorterminal.com", "repo": "https://github.com/upbit-official", "transports": [], "packages": [ { "registry": "npm", "name": "@upbit-official/upbit-cli" }, { "registry": "pypi", "name": "upbit-sdk" } ], "auth": "api-key", "authNotes": "Access and secret keys issued on the PC web site under My Page \u003e Open API Management after identity verification and two-factor authentication. At issuance the person picks the functions the key may use and must register at least one public IPv4 address, since the allow-list is mandatory. Each request carries a JWT signed with HMAC SHA512 over the access key, a fresh nonce and a SHA512 hash of the query, as a Bearer token. A key with withdrawal permission gets a withdrawal safe-lock by default that is lifted only in the mobile app. Up to 10 keys on the main pocket and 5 per sub-pocket; expired keys answer expired_access_key (https://docs.upbit.com/kr/docs/api-key.md, checked 2026-11-03).", "pricing": "usage", "pricingNotes": "Trading fees per fill. The fee schedule is on upbit.com, whose robots.txt disallows every path for our crawler, so no rate is recorded. Public quotation endpoints need no key and no account (https://upbit.com/robots.txt, checked 2026-11-03).", "priceSummary": "Pay per use", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the developer docs, llms.txt, the SDK licence or the CLI docs (checked 2026-11-03). Fees are taken from each fill.", "endpoints": [] }, "toolCount": 0, "popularity": { "githubStars": 91, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-03" }, "docsUrl": "https://docs.upbit.com/kr/reference/api-overview", "llmsTxt": "https://docs.upbit.com/llms.txt", "capabilities": [ "exchange.market-data", "exchange.spot-trading", "exchange.balances", "exchange.transfers", "market.crypto" ], "tags": [ "hosted", "api-key", "closed-source", "usage-priced", "cli", "agent-skills", "llms-txt", "python", "typescript", "go", "no-status-page" ], "lastRelease": "2026-10-20", "graded": true, "anchor": { "graded": true, "score": 54.7, "grade": "C", "agentReady": false, "rank": 802, "ranked": true, "rankOf": 1349, "categoryRank": 14, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 70, "maintenance": 83, "payments": 15, "reliability": 42, "schema": 66, "security": 59, "transparency": 54 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-03" }, "negative": 0, "verdict": "Upbit's Open API has a mandatory IP allow-list, scoped keys with a default withdrawal lock, per-group rate limits with 429 and 418 signalling, an order-test endpoint, official SDKs, a CLI and agent skills with a CONFIRM gate. There is no MCP server, sandbox or status page, and the fees and terms sit on a host our crawler may not read.", "bestFor": "KRW-market trading for agents acting for a verified Korean account, with first-party SDKs, a CLI and skills but no MCP.", "strengths": [ "Keys need a registered public IP, carry only the chosen functions and get a withdrawal safe-lock by default that only the mobile app lifts", "Rate limits published per group with numbers, a Remaining-Req header on every response, 429 then 418 with a stated block length", "POST /v1/orders/test checks an order and the pair's state at no cost, and the skills run it before a live order", "Official Python, TypeScript and Go SDKs at v1.1.0 (20 October 2026), a CLI with JSON output and agent skills that require a typed CONFIRM before any write", "Notices carry effective dates, such as the path-format change of 16 November 2026" ], "weaknesses": [ "No MCP server; the agent route is the CLI through skills, which need a terminal", "No sandbox or testnet beyond the order-test endpoint, and no status page or SLA", "Keys can only be issued on the PC web site after Korean identity verification and 2FA, and the exchange serves the Korean market", "The fee schedule, user terms and Open API terms are on upbit.com, which disallows every crawler path, so none is recorded first-hand", "The SDK licence page says the SDK material is not open source while the GitHub repositories carry Apache-2.0" ], "agentNotes": [ "Ask the person for a key with only the functions the task needs and your server's public IPv4 address registered; a private or unregistered IP is refused", "Sign every request with a fresh JWT (HS512, new nonce, SHA512 query hash) and branch on error.name, not error.message", "Run POST /v1/orders/test before a live order; it costs nothing and shares the 8-a-second order-test group", "Read Remaining-Req and keep orders under 12 a second per pocket; on 429 wait for the next second and on 418 wait out the stated block", "Leave the withdrawal safe-lock on unless the person lifts it in the app, and send paths with single slashes and no trailing slash before 16 November 2026" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 54.7 } ], "editorialScores": { "ergonomics": 70, "maintenance": 83, "payments": 15, "reliability": 42, "schema": 66, "security": 59, "transparency": 42 }, "provenanceScore": 66, "checked": { "categories": { "ergonomics": "2026-11-03", "maintenance": "2026-11-03", "payments": "2026-11-03", "reliability": "2026-11-03", "schema": "2026-11-03", "security": "2026-11-03", "transparency": "2026-11-03" }, "last": "2026-11-03", "oldest": "2026-11-03", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install -g @upbit-official/upbit-cli", "http": "curl 'https://api.upbit.com/v1/ticker?markets=KRW-BTC'" }, "letme": { "capability": "https://letme.dev/exchange.market-data", "tool": "https://letme.dev/upbit" }, "area": "payments", "provenance": { "legalEntity": "Dunamu Inc.", "domain": "upbit.com", "domainRegistered": "2004-01-10", "endpointOnVendorDomain": true, "terms": "", "privacy": "https://docs.upbit.com/kr/page/privacy_policy_v1_5.md", "statusPage": "", "changelog": "https://docs.upbit.com/kr/changelog", "securityTxt": "unknown", "checked": "2026-11-03", "notes": [ "Dunamu Inc. is named as the licensor in the Upbit Developer SDK License v1.0 and as the company in the developer centre's privacy policy V1.5 (from 18 May 2026).", "upbit.com/robots.txt disallows every path for User-agent * (a second group adds /terms_and_policy and others), allowing only Googlebot, MSNBot, Yeti and Daumoa; sg.upbit.com and www.dunamu.com do the same. The user terms, the Open API terms, the fee schedule and security.txt on those hosts were therefore not fetched; the terms URL is left empty.", "docs.upbit.com/robots.txt allows everything but edit, login and api-next paths and points to llms.txt, with Content-Signal ai-train=yes, search=yes, ai-input=yes.", "RDAP gives upbit.com a registration date of 10 January 2004.", "No status page found; the API has a service-status (wallet status) endpoint and an announcements WebSocket stream." ], "score": 66 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/upbit.json", "live": { "slug": "upbit", "versions": [ { "registry": "npm", "name": "@upbit-official/upbit-cli", "version": "1.0.0", "seenAt": "2026-11-04T21:03:15.347083898Z" }, { "registry": "pypi", "name": "upbit-sdk", "version": "1.1.0", "released": "2026-10-20", "seenAt": "2026-11-04T21:03:16.288654002Z" } ], "npmWeekly": 71, "pypiWeekly": 122, "securityTxt": { "url": "https://upbit.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-04T15:53:27.560288922Z" }, "updatedAt": "2026-11-04T21:03:16.288654002Z" } }, "edges": [ { "by": 54, "category": "maintenance", "leads": "upbit", "name": "Maintenance \u0026 community", "reasons": { "a": "Read as a closed service with an open CLI. The last change we could date is cdcx-cli v1.2.6 on 18 June 2026, 138 days before the check, with no commit since; the API changelog is unread (10). No three dated releases in the last 90 days (0). Five of six open items on cdcx-cli, all by collaborators or Dependabot since May, have no comment; the Exchange has a support chat and contact@crypto.com (8 of 25). Not in the official MCP registry and no official SDK beyond the CLI (5 of 15). CI tests on three operating systems with clippy and fmt; the npm wrapper's postinstall downloads the binary and two Dependabot bumps are open (6 of 10). 10 + 0 + 8 + 5 + 6 = 29.", "b": "Read as a closed service. SDK v1.1.0 on 20 October 2026 (30). The CLI 1.0.0 on 1 September, the rate-limit update of 7 October, the SDK on 20 October and the path-format notice for 16 November 2026 (20). open-api@upbit.com answers in turn on weekdays per the support notice, notices carry dates, and the six upbit-official repositories show no open issues (12 of 15). Current official SDKs in Python, TypeScript and Go (15). Apache-2.0 repositories pushed in October 2026; CI not checked (6 of 10). 30 + 20 + 12 + 15 + 6 = 83." }, "scores": { "a": 29, "b": 83 } }, { "by": 25, "category": "payments", "leads": "crypto-com-exchange", "name": "Payments \u0026 pricing", "reasons": { "a": "No machine payment protocol (0). Spot fee tiers published without login, 0.25% maker and 0.50% taker at Level 1 (20). The API is free, public market data needs no key, UAT and paper trading need no money (20). A person must sign up in a browser with identity checks and mint the key (0). 0 + 20 + 20 + 0 = 40.", "b": "No machine payment protocol (0). The fee schedule is on upbit.com, which disallows every crawler path, so no price is recorded (0 of 20, unchecked). Public quotation endpoints need no key, card or account; trading needs a verified Korean account. Judgement call (15 of 20). A person must sign up, pass identity checks and issue keys on the PC web site (0). 0 + 0 + 15 + 0 = 15." }, "scores": { "a": 40, "b": 15 } }, { "by": 24, "category": "schema", "leads": "upbit", "name": "Schema \u0026 documentation", "reasons": { "a": "An OpenAPI spec exists, since cdcx-cli generates its 95 commands and tools from it at run time, but its host (exchange-developer.crypto.com) answered 403 to robots.txt and the spec was not read; the vendor's own tooling is evidence it exists, not of its quality (15 of 25). No llms.txt on crypto.com or the Exchange pages (0). For descriptions, cdcx's tool descriptions come from the spec, which we couldn't read; the Exchange skill documents 52 endpoints in prose (8 of 20). cdcx's README says the tools carry typed parameters and enum validation, a vendor claim not checked against the spec (8 of 15). For examples, the skills and cdcx README carry worked commands, but the API's error codes and response examples sit on the unread host (6 of 15). Versioned path (v1); the API changelog and announcements page could not be read (5 of 15). 15 + 0 + 8 + 8 + 6 + 5 = 42.", "b": "No OpenAPI found; the reference is a readme.io site with a Markdown twin of every page (5 of 25). llms.txt on docs.upbit.com and a kr/llms.txt index (10). Each reference page states what the endpoint does, its group and its errors, with warnings such as market_offline after maintenance (14 of 20). Typed parameters with enums for order type, side and time in force and required flags (11 of 15). Recipes in Python, Java and Node.js and an error format of error.name and error.message with HTTP statuses (13 of 15). Feature versions in page histories (v1.6.1) and dated notices with effective dates, no single API version (13 of 15). 5 + 10 + 14 + 11 + 13 + 13 = 66." }, "scores": { "a": 42, "b": 66 } }, { "by": 20, "category": "ergonomics", "leads": "upbit", "name": "Agent ergonomics", "reasons": { "a": "Graded on the REST API as an agent calls it, with the MCP server noted. cdcx serves up to 95 tools, more than 30, but the default serves the `market` group alone and groups are enabled one by one, which is a read-only subset switch (5 + 10 = 15). Pagination and output controls for the API are on the unread docs host; cdcx adds `-o json|table|ndjson` (8 of 20). cdcx returns structured JSON errors and the safety gate names what is missing; the API's own error table is unread (8 of 20). cdcx's tiers (mutate needs `acknowledged: true`, dangerous needs `--allow-dangerous`), `--dry-run` and paper trading give safe rehearsal, though no MCP annotations or API idempotency keys were seen (12 of 20). No official SDK beyond the CLI; defaults in cdcx are sensible (7 of 15). 15 + 8 + 8 + 12 + 7 = 50.", "b": "Graded on the REST API with the CLI. Candle counts, list limits and the CLI's --max-items and --transform size responses (16 of 25). Paging and filters on orders and history (15 of 20). error.name codes to branch on, which the November 2026 notice tells clients to use, and 418 with its block length (15 of 20). An order-test endpoint and a CONFIRM gate in the skills; an order identifier for idempotent placement was not checked (11 of 20). Few required parameters, SDKs in three languages and a CLI, but keys need the PC web site and a registered IP (13 of 15). 16 + 15 + 15 + 11 + 13 = 70." }, "scores": { "a": 50, "b": 70 } }, { "by": 8, "category": "reliability", "leads": "crypto-com-exchange", "name": "Reliability", "reasons": { "a": "Read with the hosted lines on the Exchange API at api.crypto.com. status.crypto.com is a Statuspage site with component history (20). Its feed for 18 August to 3 November 2026 has 25 entries; the Exchange is named in two, an 11-minute database upgrade on 18 August and a one-hour balance display issue on 6 October, while the longer disruptions (Android login on 1 and 5 October, card 3DS on 23 September, Main App predictions on 3 November) are App incidents. There is no Exchange API component, so the record may be incomplete. Minor only (20). Rate limits are documented on exchange-docs.crypto.com, which answered 403 to robots.txt and was not read (0, unchecked). 429 handling and client order ids are on the same host (0, unchecked). No SLA found (0). Generally available (10). 20 + 20 + 0 + 0 + 0 + 10 = 50.", "b": "Read with the hosted lines. No status page found on docs.upbit.com or in llms.txt; a wallet-status endpoint and an announcements stream stand in (0). No readable incident history (5). Rate limits documented with numbers per group, per IP and per pocket, updated 7 October 2026 (15). 429 then 418 with a stated block length and a Remaining-Req header, an order-test endpoint and a self-match-prevention default; an order identifier for safe retries was not checked (12 of 15). No SLA found (0). Generally available (10). 0 + 5 + 15 + 12 + 0 + 10 = 42." }, "scores": { "a": 50, "b": 42 } }, { "by": 5, "category": "security", "leads": "upbit", "name": "Security \u0026 auth", "reasons": { "a": "HMAC-SHA256 API keys made with 2FA; IP whitelisting and pre-approved withdrawal addresses per the official skill, and revocation from the Exchange settings. The permission list (read, trade, withdraw) is on the unread docs host, so scopes are recorded from the skills (20 of 30). On least privilege, the App skill's key has no withdrawal permission, the Exchange skill requires user confirmation before a production trade, and cdcx refuses withdrawals and cancel-all without `--allow-dangerous`; nothing on the server side limits order size (14 of 20). The tools return exchange data, not third-party text, but no guidance on untrusted content was found (6 of 15). An account audit trail is not documented where we could read (4 of 15). No security.txt on crypto.com; cdcx has a SECURITY.md with private reporting and a three-day acknowledgement, and the organisation keeps HackerOne policy guidelines; certifications were not read (10 of 20). 20 + 14 + 6 + 4 + 10 = 54.", "b": "Keys limited to chosen functions, a mandatory public IPv4 allow-list, a JWT per request with a fresh nonce, keys listed with expiry through the API, and a withdrawal safe-lock on by default (27 of 30). Read-only keys, the default withdrawal lock lifted only in the app, and skills that require a typed CONFIRM before writes (17 of 20). The API returns exchange data and announcements, no third-party content (10 of 15). An API key list endpoint; no per-call log for the operator (5 of 15). No disclosure policy, bug bounty or certification found; security.txt on upbit.com could not be fetched under its robots.txt (0 of 20). 27 + 17 + 10 + 5 + 0 = 59." }, "scores": { "a": 54, "b": 59 } } ], "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "Foris DAX Limited (Crypto.com)", "b": "Dunamu Inc.", "name": "Vendor" }, { "a": "no (local only)", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "stdio", "b": "", "name": "Transports" }, { "a": "API key", "b": "API key", "name": "Auth" }, { "a": "Pay per use", "b": "Pay per use", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Proprietary hosted API under the Exchange terms and conditions, which our reader couldn't load. cdcx-cli, the official CLI and MCP server, is MIT or Apache-2.0", "b": "none", "name": "Licence" }, { "a": "95", "b": "0", "name": "Tools exposed" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "no", "b": "yes", "name": "llms.txt" }, { "a": "2026-06-18", "b": "2026-10-20", "name": "Last release" }, { "a": "couldn't be read", "b": "no document linked", "name": "Terms last updated" }, { "a": "2025-03-12", "b": "no date given", "name": "Privacy policy last updated" }, { "a": "couldn't be read", "b": "not read yet", "name": "Customer content may train models" }, { "a": "couldn't be read", "b": "not read yet", "name": "Terms restrict automated access" }, { "a": "couldn't be read", "b": "not read yet", "name": "Terms restrict benchmarking" }, { "a": "couldn't be read", "b": "not read yet", "name": "Terms or service can change without notice" }, { "a": "couldn't be read", "b": "not read yet", "name": "Arbitration or class-action waiver" }, { "a": "27 stars, 59 npm/wk", "b": "91 stars", "name": "Popularity" } ], "faq": [ { "answer": "Upbit Open API scores 54.7 (C) on agent readiness against Crypto.com Exchange API's 46.8 (D), and leads in 4 of 7 scored categories. Crypto.com Exchange API leads on reliability and payments \u0026 pricing.", "question": "Which is better for AI agents, Crypto.com Exchange API or Upbit Open API?" }, { "answer": "Both need an API key.", "question": "Do Crypto.com Exchange API and Upbit Open API need an API key?" }, { "answer": "Crypto.com Exchange API runs on your own machine, with no hosted endpoint listed. No hosted endpoint is listed for Upbit Open API.", "question": "Can an agent call Crypto.com Exchange API and Upbit Open API without installing anything?" } ], "goodFor": [ { "aheadOn": [ "Reliability, 50 against 42", "Payments \u0026 pricing, 40 against 15" ], "also": [ "Runs on your own machine" ], "goodFor": "An agent trading spot or perpetuals on Crypto.com through a local MCP server with safety tiers, for a person outside the App's restricted list.", "slug": "crypto-com-exchange", "watchFor": "exchange-docs.crypto.com and the OpenAPI host answered 403 to robots.txt, so rate limits, key permissions, errors and the changelog could not be read" }, { "aheadOn": [ "Schema \u0026 documentation, 66 against 42", "Agent ergonomics, 70 against 50", "Security \u0026 auth, 59 against 54", "Maintenance \u0026 community, 83 against 29" ], "also": null, "goodFor": "KRW-market trading for agents acting for a verified Korean account, with first-party SDKs, a CLI and skills but no MCP.", "slug": "upbit", "watchFor": "No MCP server; the agent route is the CLI through skills, which need a terminal" } ], "history": null, "job": { "capability": "exchange.market-data", "name": "Exchange market data" }, "others": [ { "json": "https://www.anchorterminal.com/compare/bitfinex-vs-crypto-com-exchange.json", "title": "Bitfinex API vs Crypto.com Exchange API", "url": "https://www.anchorterminal.com/compare/bitfinex-vs-crypto-com-exchange" }, { "json": "https://www.anchorterminal.com/compare/bitfinex-vs-upbit.json", "title": "Bitfinex API vs Upbit Open API", "url": "https://www.anchorterminal.com/compare/bitfinex-vs-upbit" }, { "json": "https://www.anchorterminal.com/compare/bitget-vs-crypto-com-exchange.json", "title": "Bitget vs Crypto.com Exchange API", "url": "https://www.anchorterminal.com/compare/bitget-vs-crypto-com-exchange" }, { "json": "https://www.anchorterminal.com/compare/bitget-vs-upbit.json", "title": "Bitget vs Upbit Open API", "url": "https://www.anchorterminal.com/compare/bitget-vs-upbit" }, { "json": "https://www.anchorterminal.com/compare/bithumb-vs-crypto-com-exchange.json", "title": "Bithumb Open API vs Crypto.com Exchange API", "url": "https://www.anchorterminal.com/compare/bithumb-vs-crypto-com-exchange" }, { "json": "https://www.anchorterminal.com/compare/bithumb-vs-upbit.json", "title": "Bithumb Open API vs Upbit Open API", "url": "https://www.anchorterminal.com/compare/bithumb-vs-upbit" }, { "json": "https://www.anchorterminal.com/compare/bitstamp-vs-crypto-com-exchange.json", "title": "Bitstamp API vs Crypto.com Exchange API", "url": "https://www.anchorterminal.com/compare/bitstamp-vs-crypto-com-exchange" }, { "json": "https://www.anchorterminal.com/compare/bitstamp-vs-upbit.json", "title": "Bitstamp API vs Upbit Open API", "url": "https://www.anchorterminal.com/compare/bitstamp-vs-upbit" }, { "json": "https://www.anchorterminal.com/compare/bybit-vs-crypto-com-exchange.json", "title": "Bybit vs Crypto.com Exchange API", "url": "https://www.anchorterminal.com/compare/bybit-vs-crypto-com-exchange" }, { "json": "https://www.anchorterminal.com/compare/bybit-vs-upbit.json", "title": "Bybit vs Upbit Open API", "url": "https://www.anchorterminal.com/compare/bybit-vs-upbit" }, { "json": "https://www.anchorterminal.com/compare/crypto-com-exchange-vs-deribit.json", "title": "Crypto.com Exchange API vs Deribit", "url": "https://www.anchorterminal.com/compare/crypto-com-exchange-vs-deribit" }, { "json": "https://www.anchorterminal.com/compare/crypto-com-exchange-vs-dydx.json", "title": "Crypto.com Exchange API vs dYdX", "url": "https://www.anchorterminal.com/compare/crypto-com-exchange-vs-dydx" }, { "json": "https://www.anchorterminal.com/compare/crypto-com-exchange-vs-gate-io.json", "title": "Crypto.com Exchange API vs Gate", "url": "https://www.anchorterminal.com/compare/crypto-com-exchange-vs-gate-io" }, { "json": "https://www.anchorterminal.com/compare/crypto-com-exchange-vs-gemini-exchange.json", "title": "Crypto.com Exchange API vs Gemini Exchange API", "url": "https://www.anchorterminal.com/compare/crypto-com-exchange-vs-gemini-exchange" }, { "json": "https://www.anchorterminal.com/compare/crypto-com-exchange-vs-htx.json", "title": "Crypto.com Exchange API vs HTX trading API", "url": "https://www.anchorterminal.com/compare/crypto-com-exchange-vs-htx" }, { "json": "https://www.anchorterminal.com/compare/crypto-com-exchange-vs-hyperliquid.json", "title": "Crypto.com Exchange API vs Hyperliquid", "url": "https://www.anchorterminal.com/compare/crypto-com-exchange-vs-hyperliquid" }, { "json": "https://www.anchorterminal.com/compare/crypto-com-exchange-vs-kraken.json", "title": "Crypto.com Exchange API vs Kraken API", "url": "https://www.anchorterminal.com/compare/crypto-com-exchange-vs-kraken" }, { "json": "https://www.anchorterminal.com/compare/crypto-com-exchange-vs-kucoin.json", "title": "Crypto.com Exchange API vs KuCoin", "url": "https://www.anchorterminal.com/compare/crypto-com-exchange-vs-kucoin" }, { "json": "https://www.anchorterminal.com/compare/crypto-com-exchange-vs-mexc.json", "title": "Crypto.com Exchange API vs MEXC API", "url": "https://www.anchorterminal.com/compare/crypto-com-exchange-vs-mexc" }, { "json": "https://www.anchorterminal.com/compare/crypto-com-exchange-vs-okx.json", "title": "Crypto.com Exchange API vs OKX API", "url": "https://www.anchorterminal.com/compare/crypto-com-exchange-vs-okx" }, { "json": "https://www.anchorterminal.com/compare/crypto-com-exchange-vs-uniswap.json", "title": "Crypto.com Exchange API vs Uniswap Trading API", "url": "https://www.anchorterminal.com/compare/crypto-com-exchange-vs-uniswap" }, { "json": "https://www.anchorterminal.com/compare/deribit-vs-upbit.json", "title": "Deribit vs Upbit Open API", "url": "https://www.anchorterminal.com/compare/deribit-vs-upbit" }, { "json": "https://www.anchorterminal.com/compare/dydx-vs-upbit.json", "title": "dYdX vs Upbit Open API", "url": "https://www.anchorterminal.com/compare/dydx-vs-upbit" }, { "json": "https://www.anchorterminal.com/compare/gate-io-vs-upbit.json", "title": "Gate vs Upbit Open API", "url": "https://www.anchorterminal.com/compare/gate-io-vs-upbit" }, { "json": "https://www.anchorterminal.com/compare/gemini-exchange-vs-upbit.json", "title": "Gemini Exchange API vs Upbit Open API", "url": "https://www.anchorterminal.com/compare/gemini-exchange-vs-upbit" }, { "json": "https://www.anchorterminal.com/compare/htx-vs-upbit.json", "title": "HTX trading API vs Upbit Open API", "url": "https://www.anchorterminal.com/compare/htx-vs-upbit" }, { "json": "https://www.anchorterminal.com/compare/hyperliquid-vs-upbit.json", "title": "Hyperliquid vs Upbit Open API", "url": "https://www.anchorterminal.com/compare/hyperliquid-vs-upbit" }, { "json": "https://www.anchorterminal.com/compare/kucoin-vs-upbit.json", "title": "KuCoin vs Upbit Open API", "url": "https://www.anchorterminal.com/compare/kucoin-vs-upbit" }, { "json": "https://www.anchorterminal.com/compare/mexc-vs-upbit.json", "title": "MEXC API vs Upbit Open API", "url": "https://www.anchorterminal.com/compare/mexc-vs-upbit" }, { "json": "https://www.anchorterminal.com/compare/binance-vs-crypto-com-exchange.json", "title": "Binance API vs Crypto.com Exchange API", "url": "https://www.anchorterminal.com/compare/binance-vs-crypto-com-exchange" }, { "json": "https://www.anchorterminal.com/compare/binance-vs-upbit.json", "title": "Binance API vs Upbit Open API", "url": "https://www.anchorterminal.com/compare/binance-vs-upbit" }, { "json": "https://www.anchorterminal.com/compare/coinbase-advanced-trade-vs-crypto-com-exchange.json", "title": "Coinbase Advanced Trade API vs Crypto.com Exchange API", "url": "https://www.anchorterminal.com/compare/coinbase-advanced-trade-vs-crypto-com-exchange" }, { "json": "https://www.anchorterminal.com/compare/coinbase-advanced-trade-vs-upbit.json", "title": "Coinbase Advanced Trade API vs Upbit Open API", "url": "https://www.anchorterminal.com/compare/coinbase-advanced-trade-vs-upbit" }, { "json": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-crypto-com-exchange.json", "title": "Coinbase MCP server (Coinbase for Agents) vs Crypto.com Exchange API", "url": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-crypto-com-exchange" }, { "json": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-upbit.json", "title": "Coinbase MCP server (Coinbase for Agents) vs Upbit Open API", "url": "https://www.anchorterminal.com/compare/coinbase-mcp-vs-upbit" }, { "json": "https://www.anchorterminal.com/compare/kraken-vs-upbit.json", "title": "Kraken API vs Upbit Open API", "url": "https://www.anchorterminal.com/compare/kraken-vs-upbit" }, { "json": "https://www.anchorterminal.com/compare/okx-vs-upbit.json", "title": "OKX API vs Upbit Open API", "url": "https://www.anchorterminal.com/compare/okx-vs-upbit" }, { "json": "https://www.anchorterminal.com/compare/uniswap-vs-upbit.json", "title": "Uniswap Trading API vs Upbit Open API", "url": "https://www.anchorterminal.com/compare/uniswap-vs-upbit" } ], "panel": null, "scores": [ { "by": 8, "crypto-com-exchange": 50, "edge": "crypto-com-exchange", "key": "reliability", "name": "Reliability", "upbit": 42, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 24, "crypto-com-exchange": 42, "edge": "upbit", "key": "schema", "name": "Schema \u0026 documentation", "upbit": 66, "weight": 13 }, { "by": 20, "crypto-com-exchange": 50, "edge": "upbit", "key": "ergonomics", "name": "Agent ergonomics", "upbit": 70, "weight": 13 }, { "by": 5, "crypto-com-exchange": 54, "edge": "upbit", "key": "security", "name": "Security \u0026 auth", "upbit": 59, "weight": 14 }, { "by": 25, "crypto-com-exchange": 40, "edge": "crypto-com-exchange", "key": "payments", "name": "Payments \u0026 pricing", "upbit": 15, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 54, "crypto-com-exchange": 29, "edge": "upbit", "key": "maintenance", "name": "Maintenance \u0026 community", "upbit": 83, "weight": 7 }, { "by": 1, "crypto-com-exchange": 55, "edge": "crypto-com-exchange", "key": "transparency", "name": "Transparency \u0026 trust", "upbit": 54, "weight": 7 } ], "summary": "Upbit Open API scores 54.7 (C) on agent readiness against Crypto.com Exchange API's 46.8 (D), and leads in 4 of 7 scored categories. Crypto.com Exchange API leads on reliability and payments \u0026 pricing. Both do exchange market data.", "tasks": null, "tutorials": [], "verdicts": { "crypto-com-exchange": "Crypto.com is one of two exchanges here with an official MCP server, cdcx-cli, whose 95 generated tools are grouped by service and gated by safety tier. The API docs, OpenAPI file, terms and trading rules refused or hid from our reader, so rate limits, key permissions and the automated-trading clauses are unchecked, and cdcx has no release since June 2026.", "upbit": "Upbit's Open API has a mandatory IP allow-list, scoped keys with a default withdrawal lock, per-group rate limits with 429 and 418 signalling, an order-test endpoint, official SDKs, a CLI and agent skills with a CONFIRM gate. There is no MCP server, sandbox or status page, and the fees and terms sit on a host our crawler may not read." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/crypto-com-exchange-vs-upbit", "json": "https://www.anchorterminal.com/compare/crypto-com-exchange-vs-upbit.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/crypto-com-exchange-vs-upbit.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/crypto-com-exchange-vs-upbit.min.md" }, "markdown": "Upbit Open API scores 54.7 (C) on agent readiness against Crypto.com Exchange API's 46.8 (D), and leads in 4 of 7 scored categories. Crypto.com Exchange API leads on reliability and payments \u0026 pricing. Both do exchange market data.\n\n- Crypto.com Exchange API: grade D, 46.8/100, rank #1078 of 1349. Markdown https://www.anchorterminal.com/tools/crypto-com-exchange.md · JSON https://www.anchorterminal.com/api/v1/tools/crypto-com-exchange.json\n- Upbit Open API: grade C, 54.7/100, rank #802 of 1349. Markdown https://www.anchorterminal.com/tools/upbit.md · JSON https://www.anchorterminal.com/api/v1/tools/upbit.json\n- Best crypto exchange APIs and MCP servers for AI agents: https://www.anchorterminal.com/best/crypto-exchanges/index.md\n- All 210 exchanges comparisons: https://www.anchorterminal.com/compare/crypto-exchanges/index.md\n\n## Which one, for what\n\n### Crypto.com Exchange API (D)\n\nGood for: An agent trading spot or perpetuals on Crypto.com through a local MCP server with safety tiers, for a person outside the App's restricted list.\n\nAhead on:\n- Reliability, 50 against 42\n- Payments \u0026 pricing, 40 against 15\n\nAlso in its favour:\n- Runs on your own machine\n\nWatch for: exchange-docs.crypto.com and the OpenAPI host answered 403 to robots.txt, so rate limits, key permissions, errors and the changelog could not be read\n\n### Upbit Open API (C)\n\nGood for: KRW-market trading for agents acting for a verified Korean account, with first-party SDKs, a CLI and skills but no MCP.\n\nAhead on:\n- Schema \u0026 documentation, 66 against 42\n- Agent ergonomics, 70 against 50\n- Security \u0026 auth, 59 against 54\n- Maintenance \u0026 community, 83 against 29\n\nWatch for: No MCP server; the agent route is the CLI through skills, which need a terminal\n\n\n## Why the edge\n\n### Maintenance \u0026 community: Upbit Open API +54\n\n- Crypto.com Exchange API (29): Read as a closed service with an open CLI. The last change we could date is cdcx-cli v1.2.6 on 18 June 2026, 138 days before the check, with no commit since; the API changelog is unread (10). No three dated releases in the last 90 days (0). Five of six open items on cdcx-cli, all by collaborators or Dependabot since May, have no comment; the Exchange has a support chat and contact@crypto.com (8 of 25). Not in the official MCP registry and no official SDK beyond the CLI (5 of 15). CI tests on three operating systems with clippy and fmt; the npm wrapper's postinstall downloads the binary and two Dependabot bumps are open (6 of 10). 10 + 0 + 8 + 5 + 6 = 29.\n- Upbit Open API (83): Read as a closed service. SDK v1.1.0 on 20 October 2026 (30). The CLI 1.0.0 on 1 September, the rate-limit update of 7 October, the SDK on 20 October and the path-format notice for 16 November 2026 (20). open-api@upbit.com answers in turn on weekdays per the support notice, notices carry dates, and the six upbit-official repositories show no open issues (12 of 15). Current official SDKs in Python, TypeScript and Go (15). Apache-2.0 repositories pushed in October 2026; CI not checked (6 of 10). 30 + 20 + 12 + 15 + 6 = 83.\n\n### Payments \u0026 pricing: Crypto.com Exchange API +25\n\n- Crypto.com Exchange API (40): No machine payment protocol (0). Spot fee tiers published without login, 0.25% maker and 0.50% taker at Level 1 (20). The API is free, public market data needs no key, UAT and paper trading need no money (20). A person must sign up in a browser with identity checks and mint the key (0). 0 + 20 + 20 + 0 = 40.\n- Upbit Open API (15): No machine payment protocol (0). The fee schedule is on upbit.com, which disallows every crawler path, so no price is recorded (0 of 20, unchecked). Public quotation endpoints need no key, card or account; trading needs a verified Korean account. Judgement call (15 of 20). A person must sign up, pass identity checks and issue keys on the PC web site (0). 0 + 0 + 15 + 0 = 15.\n\n### Schema \u0026 documentation: Upbit Open API +24\n\n- Crypto.com Exchange API (42): An OpenAPI spec exists, since cdcx-cli generates its 95 commands and tools from it at run time, but its host (exchange-developer.crypto.com) answered 403 to robots.txt and the spec was not read; the vendor's own tooling is evidence it exists, not of its quality (15 of 25). No llms.txt on crypto.com or the Exchange pages (0). For descriptions, cdcx's tool descriptions come from the spec, which we couldn't read; the Exchange skill documents 52 endpoints in prose (8 of 20). cdcx's README says the tools carry typed parameters and enum validation, a vendor claim not checked against the spec (8 of 15). For examples, the skills and cdcx README carry worked commands, but the API's error codes and response examples sit on the unread host (6 of 15). Versioned path (v1); the API changelog and announcements page could not be read (5 of 15). 15 + 0 + 8 + 8 + 6 + 5 = 42.\n- Upbit Open API (66): No OpenAPI found; the reference is a readme.io site with a Markdown twin of every page (5 of 25). llms.txt on docs.upbit.com and a kr/llms.txt index (10). Each reference page states what the endpoint does, its group and its errors, with warnings such as market_offline after maintenance (14 of 20). Typed parameters with enums for order type, side and time in force and required flags (11 of 15). Recipes in Python, Java and Node.js and an error format of error.name and error.message with HTTP statuses (13 of 15). Feature versions in page histories (v1.6.1) and dated notices with effective dates, no single API version (13 of 15). 5 + 10 + 14 + 11 + 13 + 13 = 66.\n\n### Agent ergonomics: Upbit Open API +20\n\n- Crypto.com Exchange API (50): Graded on the REST API as an agent calls it, with the MCP server noted. cdcx serves up to 95 tools, more than 30, but the default serves the `market` group alone and groups are enabled one by one, which is a read-only subset switch (5 + 10 = 15). Pagination and output controls for the API are on the unread docs host; cdcx adds `-o json|table|ndjson` (8 of 20). cdcx returns structured JSON errors and the safety gate names what is missing; the API's own error table is unread (8 of 20). cdcx's tiers (mutate needs `acknowledged: true`, dangerous needs `--allow-dangerous`), `--dry-run` and paper trading give safe rehearsal, though no MCP annotations or API idempotency keys were seen (12 of 20). No official SDK beyond the CLI; defaults in cdcx are sensible (7 of 15). 15 + 8 + 8 + 12 + 7 = 50.\n- Upbit Open API (70): Graded on the REST API with the CLI. Candle counts, list limits and the CLI's --max-items and --transform size responses (16 of 25). Paging and filters on orders and history (15 of 20). error.name codes to branch on, which the November 2026 notice tells clients to use, and 418 with its block length (15 of 20). An order-test endpoint and a CONFIRM gate in the skills; an order identifier for idempotent placement was not checked (11 of 20). Few required parameters, SDKs in three languages and a CLI, but keys need the PC web site and a registered IP (13 of 15). 16 + 15 + 15 + 11 + 13 = 70.\n\n### Reliability: Crypto.com Exchange API +8\n\n- Crypto.com Exchange API (50): Read with the hosted lines on the Exchange API at api.crypto.com. status.crypto.com is a Statuspage site with component history (20). Its feed for 18 August to 3 November 2026 has 25 entries; the Exchange is named in two, an 11-minute database upgrade on 18 August and a one-hour balance display issue on 6 October, while the longer disruptions (Android login on 1 and 5 October, card 3DS on 23 September, Main App predictions on 3 November) are App incidents. There is no Exchange API component, so the record may be incomplete. Minor only (20). Rate limits are documented on exchange-docs.crypto.com, which answered 403 to robots.txt and was not read (0, unchecked). 429 handling and client order ids are on the same host (0, unchecked). No SLA found (0). Generally available (10). 20 + 20 + 0 + 0 + 0 + 10 = 50.\n- Upbit Open API (42): Read with the hosted lines. No status page found on docs.upbit.com or in llms.txt; a wallet-status endpoint and an announcements stream stand in (0). No readable incident history (5). Rate limits documented with numbers per group, per IP and per pocket, updated 7 October 2026 (15). 429 then 418 with a stated block length and a Remaining-Req header, an order-test endpoint and a self-match-prevention default; an order identifier for safe retries was not checked (12 of 15). No SLA found (0). Generally available (10). 0 + 5 + 15 + 12 + 0 + 10 = 42.\n\n### Security \u0026 auth: Upbit Open API +5\n\n- Crypto.com Exchange API (54): HMAC-SHA256 API keys made with 2FA; IP whitelisting and pre-approved withdrawal addresses per the official skill, and revocation from the Exchange settings. The permission list (read, trade, withdraw) is on the unread docs host, so scopes are recorded from the skills (20 of 30). On least privilege, the App skill's key has no withdrawal permission, the Exchange skill requires user confirmation before a production trade, and cdcx refuses withdrawals and cancel-all without `--allow-dangerous`; nothing on the server side limits order size (14 of 20). The tools return exchange data, not third-party text, but no guidance on untrusted content was found (6 of 15). An account audit trail is not documented where we could read (4 of 15). No security.txt on crypto.com; cdcx has a SECURITY.md with private reporting and a three-day acknowledgement, and the organisation keeps HackerOne policy guidelines; certifications were not read (10 of 20). 20 + 14 + 6 + 4 + 10 = 54.\n- Upbit Open API (59): Keys limited to chosen functions, a mandatory public IPv4 allow-list, a JWT per request with a fresh nonce, keys listed with expiry through the API, and a withdrawal safe-lock on by default (27 of 30). Read-only keys, the default withdrawal lock lifted only in the app, and skills that require a typed CONFIRM before writes (17 of 20). The API returns exchange data and announcements, no third-party content (10 of 15). An API key list endpoint; no per-call log for the operator (5 of 15). No disclosure policy, bug bounty or certification found; security.txt on upbit.com could not be fetched under its robots.txt (0 of 20). 27 + 17 + 10 + 5 + 0 = 59.\n\n## Score by category\n\n| Category | Weight | Crypto.com Exchange API | Upbit Open API | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 50 | 42 | Crypto.com Exchange API +8 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 42 | 66 | Upbit Open API +24 |\n| Agent ergonomics | 13% (16.2 this run) | 50 | 70 | Upbit Open API +20 |\n| Security \u0026 auth | 14% (17.5 this run) | 54 | 59 | Upbit Open API +5 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 40 | 15 | Crypto.com Exchange API +25 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 29 | 83 | Upbit Open API +54 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 55 | 54 | Crypto.com Exchange API +1 |\n| Negative events | ≤15 | 0 | 0 | |\n| **Total** | | **46.8 · D** | **54.7 · C** | |\n\n## Facts side by side\n\n| Fact | Crypto.com Exchange API | Upbit Open API |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Foris DAX Limited (Crypto.com) | Dunamu Inc. |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports | stdio | |\n| Auth | API key | API key |\n| Pricing | Pay per use | Pay per use |\n| x402 | no | no |\n| Licence | Proprietary hosted API under the Exchange terms and conditions, which our reader couldn't load. cdcx-cli, the official CLI and MCP server, is MIT or Apache-2.0 | none |\n| Tools exposed | 95 | 0 |\n| Read-only variant documented | no | no |\n| llms.txt | no | yes |\n| Last release | 2026-06-18 | 2026-10-20 |\n| Terms last updated | couldn't be read | no document linked |\n| Privacy policy last updated | 2025-03-12 | no date given |\n| Customer content may train models | couldn't be read | not read yet |\n| Terms restrict automated access | couldn't be read | not read yet |\n| Terms restrict benchmarking | couldn't be read | not read yet |\n| Terms or service can change without notice | couldn't be read | not read yet |\n| Arbitration or class-action waiver | couldn't be read | not read yet |\n| Popularity | 27 stars, 59 npm/wk | 91 stars |\n\n## Verdicts\n\n**Crypto.com Exchange API.** Crypto.com is one of two exchanges here with an official MCP server, cdcx-cli, whose 95 generated tools are grouped by service and gated by safety tier. The API docs, OpenAPI file, terms and trading rules refused or hid from our reader, so rate limits, key permissions and the automated-trading clauses are unchecked, and cdcx has no release since June 2026.\n\n**Upbit Open API.** Upbit's Open API has a mandatory IP allow-list, scoped keys with a default withdrawal lock, per-group rate limits with 429 and 418 signalling, an order-test endpoint, official SDKs, a CLI and agent skills with a CONFIRM gate. There is no MCP server, sandbox or status page, and the fees and terms sit on a host our crawler may not read.\n\n## Before you call either\n\n### Crypto.com Exchange API\n\n1. Enable only the service groups the task needs with `cdcx mcp config --enable trade,account` (the default serves `market` alone), and leave `--allow-dangerous` off unless the person asks for withdrawals or cancel-all\n2. Rehearse on `--env uat` or `cdcx paper` first; production keys trade real funds, and the skill requires explicit user confirmation before each live order\n3. Put the key in CDCX_API_KEY and CDCX_API_SECRET or `~/.config/cdcx/config.toml` at 0600; there is no key flag, and the key should have no withdrawal permission and an IP allow-list\n4. Pass `acknowledged: true` on mutate tools and `--dry-run` while testing; read the tool's generated schema before calling, since the docs host is unreadable to agents without a browser\n5. Check the person's country against Crypto.com's geo-restriction article and the Exchange terms before trading; New York and about 70 countries are excluded from the App, and the Exchange list was unreadable\n\n### Upbit Open API\n\n1. Ask the person for a key with only the functions the task needs and your server's public IPv4 address registered; a private or unregistered IP is refused\n2. Sign every request with a fresh JWT (HS512, new nonce, SHA512 query hash) and branch on error.name, not error.message\n3. Run POST /v1/orders/test before a live order; it costs nothing and shares the 8-a-second order-test group\n4. Read Remaining-Req and keep orders under 12 a second per pocket; on 429 wait for the next second and on 418 wait out the stated block\n5. Leave the withdrawal safe-lock on unless the person lifts it in the app, and send paths with single slashes and no trailing slash before 16 November 2026\n\n## Questions\n\n### Which is better for AI agents, Crypto.com Exchange API or Upbit Open API?\n\nUpbit Open API scores 54.7 (C) on agent readiness against Crypto.com Exchange API's 46.8 (D), and leads in 4 of 7 scored categories. Crypto.com Exchange API leads on reliability and payments \u0026 pricing.\n\n### Do Crypto.com Exchange API and Upbit Open API need an API key?\n\nBoth need an API key.\n\n### Can an agent call Crypto.com Exchange API and Upbit Open API without installing anything?\n\nCrypto.com Exchange API runs on your own machine, with no hosted endpoint listed. No hosted endpoint is listed for Upbit Open API.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/crypto-com-exchange-vs-upbit.json, and with the fewest tokens: https://www.anchorterminal.com/compare/crypto-com-exchange-vs-upbit.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"crypto-com-exchange\", \"b\": \"upbit\"}`. From a terminal: `anchor compare crypto-com-exchange upbit`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/crypto-com-exchange.json and https://www.anchorterminal.com/api/v1/tools/upbit.json\n\n## Other comparisons with Crypto.com Exchange API or Upbit Open API\n\n- [Bitfinex API vs Crypto.com Exchange API](https://www.anchorterminal.com/compare/bitfinex-vs-crypto-com-exchange.md)\n- [Bitfinex API vs Upbit Open API](https://www.anchorterminal.com/compare/bitfinex-vs-upbit.md)\n- [Bitget vs Crypto.com Exchange API](https://www.anchorterminal.com/compare/bitget-vs-crypto-com-exchange.md)\n- [Bitget vs Upbit Open API](https://www.anchorterminal.com/compare/bitget-vs-upbit.md)\n- [Bithumb Open API vs Crypto.com Exchange API](https://www.anchorterminal.com/compare/bithumb-vs-crypto-com-exchange.md)\n- [Bithumb Open API vs Upbit Open API](https://www.anchorterminal.com/compare/bithumb-vs-upbit.md)\n- [Bitstamp API vs Crypto.com Exchange API](https://www.anchorterminal.com/compare/bitstamp-vs-crypto-com-exchange.md)\n- [Bitstamp API vs Upbit Open API](https://www.anchorterminal.com/compare/bitstamp-vs-upbit.md)\n- [Bybit vs Crypto.com Exchange API](https://www.anchorterminal.com/compare/bybit-vs-crypto-com-exchange.md)\n- [Bybit vs Upbit Open API](https://www.anchorterminal.com/compare/bybit-vs-upbit.md)\n- [Crypto.com Exchange API vs Deribit](https://www.anchorterminal.com/compare/crypto-com-exchange-vs-deribit.md)\n- [Crypto.com Exchange API vs dYdX](https://www.anchorterminal.com/compare/crypto-com-exchange-vs-dydx.md)\n- [Crypto.com Exchange API vs Gate](https://www.anchorterminal.com/compare/crypto-com-exchange-vs-gate-io.md)\n- [Crypto.com Exchange API vs Gemini Exchange API](https://www.anchorterminal.com/compare/crypto-com-exchange-vs-gemini-exchange.md)\n- [Crypto.com Exchange API vs HTX trading API](https://www.anchorterminal.com/compare/crypto-com-exchange-vs-htx.md)\n- [Crypto.com Exchange API vs Hyperliquid](https://www.anchorterminal.com/compare/crypto-com-exchange-vs-hyperliquid.md)\n- [Crypto.com Exchange API vs Kraken API](https://www.anchorterminal.com/compare/crypto-com-exchange-vs-kraken.md)\n- [Crypto.com Exchange API vs KuCoin](https://www.anchorterminal.com/compare/crypto-com-exchange-vs-kucoin.md)\n- [Crypto.com Exchange API vs MEXC API](https://www.anchorterminal.com/compare/crypto-com-exchange-vs-mexc.md)\n- [Crypto.com Exchange API vs OKX API](https://www.anchorterminal.com/compare/crypto-com-exchange-vs-okx.md)\n- [Crypto.com Exchange API vs Uniswap Trading API](https://www.anchorterminal.com/compare/crypto-com-exchange-vs-uniswap.md)\n- [Deribit vs Upbit Open API](https://www.anchorterminal.com/compare/deribit-vs-upbit.md)\n- [dYdX vs Upbit Open API](https://www.anchorterminal.com/compare/dydx-vs-upbit.md)\n- [Gate vs Upbit Open API](https://www.anchorterminal.com/compare/gate-io-vs-upbit.md)\n- [Gemini Exchange API vs Upbit Open API](https://www.anchorterminal.com/compare/gemini-exchange-vs-upbit.md)\n- [HTX trading API vs Upbit Open API](https://www.anchorterminal.com/compare/htx-vs-upbit.md)\n- [Hyperliquid vs Upbit Open API](https://www.anchorterminal.com/compare/hyperliquid-vs-upbit.md)\n- [KuCoin vs Upbit Open API](https://www.anchorterminal.com/compare/kucoin-vs-upbit.md)\n- [MEXC API vs Upbit Open API](https://www.anchorterminal.com/compare/mexc-vs-upbit.md)\n- [Binance API vs Crypto.com Exchange API](https://www.anchorterminal.com/compare/binance-vs-crypto-com-exchange.md)\n- [Binance API vs Upbit Open API](https://www.anchorterminal.com/compare/binance-vs-upbit.md)\n- [Coinbase Advanced Trade API vs Crypto.com Exchange API](https://www.anchorterminal.com/compare/coinbase-advanced-trade-vs-crypto-com-exchange.md)\n- [Coinbase Advanced Trade API vs Upbit Open API](https://www.anchorterminal.com/compare/coinbase-advanced-trade-vs-upbit.md)\n- [Coinbase MCP server (Coinbase for Agents) vs Crypto.com Exchange API](https://www.anchorterminal.com/compare/coinbase-mcp-vs-crypto-com-exchange.md)\n- [Coinbase MCP server (Coinbase for Agents) vs Upbit Open API](https://www.anchorterminal.com/compare/coinbase-mcp-vs-upbit.md)\n- [Kraken API vs Upbit Open API](https://www.anchorterminal.com/compare/kraken-vs-upbit.md)\n- [OKX API vs Upbit Open API](https://www.anchorterminal.com/compare/okx-vs-upbit.md)\n- [Uniswap Trading API vs Upbit Open API](https://www.anchorterminal.com/compare/uniswap-vs-upbit.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-04", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Crypto.com Exchange API vs Upbit Open API", "url": "" } ], "description": "Upbit Open scores 54.7 (C) to Crypto.com Exchange's 46.8 (D) for exchange market data. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Crypto.com Exchange API D 46.8", "Upbit Open API C 54.7", "scores" ], "h1": "Crypto.com Exchange API vs Upbit Open API", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/crypto-com-exchange-vs-upbit", "published": "2026-10-01", "section": "tools", "title": "Crypto.com Exchange vs Upbit Open for AI agents (2026)", "toc": null, "updated": "2026-11-04", "url": "https://www.anchorterminal.com/compare/crypto-com-exchange-vs-upbit" }, "tokens": { "markdown": 5200, "slim": 2830 }, "version": 1 }