Gate vs KuCoin

Gate 70

No public OpenAPI file was found, though the SDKs are generated and the MCP tools carry typed parameters per the tool reference; the hosted tools' JSON Schema could not be read without a session (12 of 25). The whole REST and WebSocket documentation is downloadable as Markdown and the agent guide is a plain page (10). The tool reference gives one line and the main parameters per tool, the API reference a description per endpoint, no when-not-to-use guidance (12 of 20). Required flags, enums for side, type and time_in_force (11 of 15). Examples per endpoint and a labelled error body with a fixed label list the docs tell you to branch on instead of messages (13 of 15). A versioned changelog, v4.106.177 on 2 November 2026 (12 of 15, since entries are terse). 70.

KuCoin 60

No OpenAPI or other machine-readable contract was found; the docs link a Postman workspace and the universal SDK is generated from an internal spec (8 of 25). No llms.txt; the skills hub ships Markdown SKILL.md files with endpoint tables for seven product areas, read-only (6 of 10). One docs page per endpoint with a description, permission and weight, but no when-to-use guidance (12 of 20). Typed parameter tables with enums for type and side and required flags (11 of 15). Request and response examples per endpoint and a unified six-digit error code scheme introduced with V2 (10 of 15). Dated changelog with V1 to V2 versioning (13 of 15). 60.

Gate 60

Gate OAuth 2 for the hosted trading MCP with eight scopes per the protected-resource metadata and revocation on the API management page, and API keys with disabled, read-only or read-write per product group, a separate withdrawal group and an IP allow-list of 20 addresses (30). A read-only key and a GATE_READONLY switch exist, and the guide says fund-moving actions need the person's confirmation in the client, with no server-side cap documented (15 of 20). The news and info servers return third-party content with no guidance on treating it as untrusted (5 of 15). Key changes and OAuth grants are visible on the API management page; no per-call log found (5 of 15). No security.txt, no disclosure policy or bounty on a page we read, a proof-of-reserves repository (5 of 20). 60.

KuCoin 55

API key with a user-set passphrase, HMAC-SHA256 signing, nine permission groups, IP allow-lists required for Withdrawal and FlexTransfers, trading keys without an IP disabled after 30 days of inactivity, revocation on the management page; no OAuth and no expiry on General keys (24 of 30). A General-only key is a true read-only mode and withdrawals are a separate permission; no confirmation step for writes beyond the key scope (12 of 20). Tools return the exchange's own data (10). The API key info endpoint shows permissions and IP lists; no per-call audit log was found (5 of 15). No security.txt, no disclosure policy or bounty on a page we could read, a whistleblower notice on the legal page (4 of 20). 55.

Gate 49

The editorial half. A closed hosted service with a clear user agreement that names no company; the MCP packages are MIT (12 of 30). The privacy policy names a DPO address and categories of recipients, with no retention numbers and no named subprocessors (12 of 30). The changelog records breaking changes such as the amend endpoint path move of 16 October 2026 with no notice period or policy (8 of 20). Transfers outside the user's jurisdiction are disclosed with no locations or provider names (5 of 20). 37.

KuCoin 54

The editorial half. A closed hosted service with terms that are clear on use, liability and law but name no company (12 of 30). The privacy policy gives retention periods by purpose and provider (2 years after closure, 14 months for Firebase, 3 years for Jumio, 5 years for Sumsub) and names 41 services, with no data centre locations (22 of 30). Endpoints are removed and fields deprecated in dated changelog entries with no notice period or policy (8 of 20). Third parties named by service, locations not stated beyond transfers around the globe (10 of 20). 52.