# Deribit vs Kraken API (slim)

> Kraken scores 71 (BB) to Deribit's 59 (C) for exchange derivatives. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/deribit-vs-kraken.md (~5,000 tokens) · this version ~2,880 tokens · JSON https://www.anchorterminal.com/compare/deribit-vs-kraken.json · canonical https://www.anchorterminal.com/compare/deribit-vs-kraken
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-03
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Kraken API scores 71 (BB) on agent readiness against Deribit's 59 (C), and leads in 6 of 7 scored categories. Deribit leads on schema & documentation. Both do exchange derivatives.

- Deribit: C 59, rank #650 of 1349 · https://www.anchorterminal.com/tools/deribit.min.md
- Kraken API: BB 71, rank #159 of 1349 · https://www.anchorterminal.com/tools/kraken.min.md
- Deribit, good for An agent trading crypto options, dated futures and perpetuals for an institutional or retail Deribit account, and anyone migrated from Coinbase International Exchange. Ahead on Schema & documentation, 88 against 80.
- Kraken API, good for An agent that trades spot, xStocks, forex or futures on a person's Kraken account from a local machine, with paper trading to test first and an approval gate on live orders. Ahead on Reliability, 67 against 45; Agent ergonomics, 79 against 74; Security & auth, 80 against 62; Payments & pricing, 40 against 25; Maintenance & community, 81 against 65; Transparency & trust, 65 against 46. Also Agent-ready, a grade of BB or better; Runs on your own machine; Free to start without a card.

| Category | Deribit | Kraken API |
| --- | --- | --- |
| Reliability (16%) | 45 | 67 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 88 | 80 |
| Agent ergonomics (13%) | 74 | 79 |
| Security & auth (14%) | 62 | 80 |
| Payments & pricing (10%) | 25 | 40 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 65 | 81 |
| Transparency & trust (7%) | 46 | 65 |

| Fact (where they differ) | Deribit | Kraken API |
| --- | --- | --- |
| Vendor | Deribit FZE | Payward, Inc. |
| Transports |  | stdio |
| Auth | API key | OAuth or key |
| Licence | Proprietary hosted exchange. The API is documented under the Deribit docs with an OpenAPI 3.0 file; no official client library is published | Proprietary hosted service under Kraken's Global Terms of Service (30 October 2026). kraken-cli, which carries the kraken-mcp server, is MIT |
| Tools exposed | 0 | 152 |
| Read-only variant documented | no | yes |
| Last release | 2026-10-13 | 2026-10-29 |
| Terms last updated | 2026-08-13 | 2026-10-30 |
| Privacy policy last updated | no document linked | 2026-10-21 |
| Terms restrict benchmarking | not found in the text | yes |
| Terms or service can change without notice | not found in the text | yes |
| Arbitration or class-action waiver | not found in the text | yes |
| Popularity | none | 795 stars |

Why the edge:
- Reliability, Kraken API +22: Deribit 45 (Read with the hosted lines on the JSON-RPC API. status.deribit.com did not resolve for our reader on 3 November 2026 and Coinbase's status page showed no Deribit component, so no status page is scored, with the unchecked line below (0). No readable history (5). Rate limits are documented with numbers, 50,000 credits per sub-account refilled at 10,000 a second, and matching-engine tiers of 5 to 30 requests a second by 7-day volume (15). Error 10028 ends the session and the errors page says to back off exponentially; 10040 means retry; the 6 May 2026 release added a `nonce` for idempotent orders (15). No SLA found (0). The API is generally available; only Starbase is limited to selected clients (10). 0 + 5 + 15 + 15 + 0 + 10 = 45.); Kraken API 67 (Read with the hosted lines on the spot API. status.kraken.com is a Statuspage site with REST, WebSocket and FIX components (20). The incidents feed read covers 4 September to 3 November 2026. On 30 October spot and derivatives clients could not connect or submit orders across web, mobile, REST, WebSocket and FIX for 59 minutes 39 seconds, rated minor by Kraken; on 28 October some FIX clients were rejected on reconnection for 1 hour 59 minutes while other interfaces worked; the futures engine was degraded for 3 minutes on 13 October. A whole-exchange order outage 21 seconds short of an hour is read as one major (10 of 30). Numeric limits per key by tier and per pair for the matching engine (15). EAPI:Rate limit exceeded and EService:Throttled with a retry timestamp, a client order id and a validate flag on orders, but no Retry-After header (12 of 15). No SLA (0). Generally available (10). 20 + 10 + 15 + 12 + 0 + 10 = 67.)
- Transparency & trust, Kraken API +19: Deribit 46 (The editorial half. A closed service whose terms (Deribit FZE membership terms and DRB Panama Inc. terms) sit on a support site that answered 403, with the entity confirmed on VARA's register (12 of 30). The privacy policy was not read, and nothing in the docs states retention (0 of 30). The changelog marks deprecations and the upcoming docs branch previews the next release, but removals such as `public/get_index` on 25 November 2025 carry no notice period (10 of 20). No subprocessor or data-location statement found (0 of 20). Total 22.); Kraken API 65 (The editorial half. A closed service with clear terms naming regional Payward entities under California law; the CLI is MIT (15 of 30). The privacy notice was not read (5 of 30). The changelog dates deprecations and the terms carry a last-updated date (16 of 20). No subprocessor or data-location statement read (0 of 20). 15 + 5 + 16 + 0 = 36.)
- Security & auth, Kraken API +18: Deribit 62 (Keys carry five scopes at read, read_write or none, `ip:ADDR` and `expires` limits, can be disabled, reset and removed by API, and self-generated Ed25519 or RSA keys keep the private half off Deribit. The HTTP `client_credentials` example passes `client_secret` in the query string, a documented option, so 10 off (20 of 30). `trade:read` and `wallet:none` give read-only and no-withdrawal keys and the 5 August 2025 release stopped `account:read` keys reading other keys' secrets; no per-order confirmation and the address allow-list article was unreadable (16 of 20). The API returns no untrusted content (10). `private/list_api_keys`, the transaction log and order history let an operator see what a key did, but no per-key call log was found (8 of 15). A HackerOne bug bounty per the support article title and HackerOne's customer story, neither page read first-hand (insights.deribit.com/bug-bounty answered 403), a VARA licence, and no security.txt on www.deribit.com (8 of 20). Total 62.); Kraken API 80 (Keys with nine named permissions, optional expiry, IP restriction and nonce window, plus an OAuth sign-in from the CLI (authorisation code with PKCE, public client) that mints a no-withdrawal key expiring within 90 days or a read-only key (30). Read-only and no-withdrawal keys, position limits and pair allowlists in account settings, and MCP approval prompts for 33 dangerous tools (18 of 20). The API returns no untrusted content; the CLI docs warn that the feedback tool uploads a local file without approval (10). Keys and their permissions are listed in settings and ledgers record activity, but no per-call log for the operator was found (6 of 15). A valid security.txt, a bug bounty policy page, SECURITY.md and a secure SDLC workflow in the CLI; certifications not read (16 of 20). 30 + 18 + 10 + 6 + 16 = 80.)
- Maintenance & community, Kraken API +16: Deribit 65 (Read as a closed service. The JSON-RPC changelog's latest production entry is 13 October 2026 and an entry dated 5 November 2026 describes the next release; Deribit's posts of 14 October and 2 November 2026 change fees (30). Entries of 18 August, 15 September and 13 October 2026, three in 90 days (20). A public changelog and a support site; whether support answers wasn't tested and the support site refused our reader (10 of 15). No official SDK and no MCP registry entry (0). The OpenAPI and AsyncAPI files are maintained with the docs (5 of 10). Total 65.); Kraken API 81 (Read as a closed service with an open-source client. Changelog entry of 27 October 2026 and kraken-cli v0.5.1 on 29 October (30). Fourteen changelog entries since 19 August 2026 and CLI tags on 6 and 7 August and 28 and 29 October (20). A public changelog, api@kraken.com, a status page and a CLI repository merging pull requests at the end of October; issue replies not read (11 of 15). An official Rust SDK pushed in October 2026 and a Go module from January; the MCP server is not in the official registry (12 of 15). The CLI has release and secure SDLC workflows, deny.toml and a pinned toolchain; the SDK's CI not read (8 of 10). 30 + 20 + 11 + 12 + 8 = 81.)
- Payments & pricing, Kraken API +15: Deribit 25 (No machine payment protocol (0). The fee schedule is on support.deribit.com, which answered 403; Deribit's own posts give VIP4 to VIP7 taker fees and the 0 bps linear options maker fee, so partial prices are public but the lowest tier is unchecked (5 of 20). Public market data needs no key and the test environment is free, with no card anywhere (20). A person signs up in a browser with identity checks before any key exists (0). Total 25.); Kraken API 40 (No machine payment protocol (0). Maker and taker fees by tier published without login (20). Public market data, paper trading and the futures demo need no account or card (20). A person signs up, verifies and mints a key or approves the OAuth sign-in (0). 0 + 20 + 20 + 0 = 40.)
- Schema & documentation, Deribit +8: Deribit 88 (OpenAPI 3.0.0 for the whole JSON-RPC surface (Deribit API 2.1.1, about 1.4 million characters) plus AsyncAPI files for the WebSocket side (25). llms.txt with production and upcoming indexes, and a Markdown twin of every page (10). Each operation has a description such as "Places a buy order for an instrument." with parameter notes, and the articles say when to use WebSocket subscriptions over polling, but the reference seldom says when not to use a method (13 of 20). Parameters are typed with enums (order `type` has eight values, `time_in_force` four) and required flags, with `amount` or `contracts` as a documented either-or (13 of 15). Every reference page carries an example request and response, and the errors page lists about 159 codes with retry guidance, though most operations document only a 200 response and the smaller error tables disagree with the full one on two codes (12 of 15). A versioned path (/api/v2), a production and an upcoming docs branch, and a dated changelog of 64 entries since 21 January 2020 (15). Total 88.); Kraken API 80 (No OpenAPI file was found for the REST API in the docs read; the CLI's agents/tool-catalog.json gives JSON Schema inputs for all 188 commands and the 152 MCP tools (15 of 25). The docs serve Markdown twins such as quickstart.md and the CLI ships llms.txt, AGENTS.md and CONTEXT.md (10). Endpoint pages and guides on order lifecycle, errors and rate limits say what each call does, with less on when not to use one (15 of 20). Enums for order types, time in force and flags, and enums and required fields in the tool catalogue (12 of 15). Python, Node.js and cURL examples, an errors guide and the CLI's error-catalog.json with retry guidance (13 of 15). A changelog of 120 dated entries with deprecations dated (15). 15 + 10 + 15 + 12 + 13 + 15 = 80.)