Gemini Exchange API vs Hyperliquid

Gemini Exchange API 88

Read as a closed hosted service with an open repository. The revision history's latest entry is 28 October 2026 and the repository was pushed on 5 October (30). Thirteen dated entries between 2 September and 28 October 2026 (20). The nine open items on the repository are all pull requests with replies, Dependabot included, and the docs name trading@gemini.com for developer support; no public issue tracker was tested (15 of 25). Not in the official MCP registry, but current official SDKs, TypeScript 0.1.1 of 23 September and Go 0.1.0 of 29 August 2026 (15). CI workflows validate and publish both SDKs and the MCP server has tests; dependencies are current (8 of 10). 30 + 20 + 15 + 15 + 8 = 88.

Hyperliquid 39

Read as a closed hosted service with open SDKs. The API has no dated changelog, so the last dated change is the Python SDK's 0.24.0 on 4 June 2026, 152 days before this check; the node repository was pushed on 10 August 2026 and the docs describe newer actions (HIP-4 outcome markets, borrow and lend) without dates. Judgement call (10 of 30). No three dated releases in 90 days (0). Support through Discord and the docs' FAQ, 112 open issues on the SDK whose replies couldn't be read (8 of 25). Official Python and Rust SDKs, the Rust one last pushed 21 October 2025; no MCP registry entry (15). CI on Python 3.9 and 3.13 with Poetry, Dependabot badge, a lock file (6 of 10). Total 39.

Gemini Exchange API 75

The editorial half. A closed service under a user agreement that names its entities by state, with the MCP server and SDKs open under Apache-2.0 (18 of 30). The privacy policy of 11 May 2026 names entities and processing countries, ties retention to need without numbers and names provider categories only, with no DPA or subprocessor list found (16 of 30). The revision history records removals and type changes with dates, but the upcoming-changes page is "TBD" and no notice period is stated (8 of 20). Processing countries are named (US, Ireland, UK, Malta, Singapore, Australia) and providers by category, with no named subprocessors (12 of 20). 18 + 16 + 8 + 12 = 54.

Hyperliquid 26

The editorial half. The SDKs are MIT and the node repository Apache-2.0 with a Dockerfile around a binary; the API servers and front end are closed and the terms were unreadable (12 of 30). No privacy policy read and nothing in the docs on data handling (0 of 30). Deprecated actions are marked in the docs without dates or a policy (8 of 20). No subprocessors or data locations (0 of 20). Total 20.

Gemini Exchange API 88

OpenAPI 3 for REST (specs/openapi/rest.yaml), AsyncAPI for WebSocket, a prediction-markets OpenAPI file and a specs/index.json catalogue; the MCP server's tools take zod schemas published as JSON Schema (25). llms.txt, llms-full.txt, agents.md, an agent card and an agent skills index (10). Endpoint pages state purpose, the Build an agent guide says what to establish before acting and when to stop, and MCP tool descriptions tell the model when to confirm; the docs don't say when not to use an endpoint (15 of 20). Typed inputs with enums for order types, options and sessions, required fields marked, decimals as strings since 7 July 2026 (12 of 15). Examples throughout, samples in three languages, and an error-codes page with 53 named reasons and their HTTP statuses (14 of 15). A revision history dated from 2015 to 28 October 2026 and versioned paths (v1, v2), but the upcoming-changes page reads "TBD" (12 of 15). 25 + 10 + 15 + 12 + 14 + 12 = 88.

Hyperliquid 42

No OpenAPI or other machine-readable contract; request and response shapes are tables and JSON examples in the docs (0 of 25). llms.txt and a Markdown twin of every page by appending .md (10). Each info type and exchange action has a short description of what it does, and the signing page lists common mistakes, but little says when to use one call over another (12 of 20). Fields are one-letter keys (a, b, p, s, r, t, c) with numbers as strings, enums such as tif Alo, Ioc or Gtc, and required fields marked in tables (9 of 15). An example for every call and a list of order and cancel error strings, with no HTTP error table (11 of 15). No API version, no changelog and no dated release notes; deprecated actions such as userDexAbstraction are marked in place (0 of 15). Total 42.

Gemini Exchange API 73

Read with the hosted lines on the REST API at api.gemini.com. status.gemini.com is a Statuspage site with component history (20). Its Atom feed for 10 September to 3 November 2026 holds 25 entries, mostly scheduled trading and FIX upgrades of 15 to 60 minutes with possible order timeouts, single-network deposit delays, and incorrect perpetual index prices for about 3.5 hours on 15 and 16 October; a 3-hour scheduled eOTC window was planned and outside the core API. Minor only (20). Rate limits with numbers, 120 a minute public and 600 private plus per-endpoint limits (15). 429 is documented but with no Retry-After or backoff guidance, and client order ids are recommended without duplicate rejection, so retries are not safe by contract; the heartbeat cancel is a safety net rather than idempotency (8 of 15). No SLA found (0). Generally available (10). 20 + 20 + 15 + 8 + 0 + 10 = 73.

Hyperliquid 40

Read with the hosted lines on the REST API at api.hyperliquid.xyz, the surface an agent calls; the chain behind it is noted under details. No status page found in the docs, on hyperliquid.xyz or at status.hyperliquid.xyz, which did not resolve (0). No readable history (5). Rate limits documented with numbers per IP, per address and per WebSocket connection (15). When limited, an address gets one request every 10 seconds; no 429 shape or Retry-After is documented, but cloid, per-signer nonces, expiresAfter and noop make retries safe (10 of 15). No SLA (0). Mainnet is generally available (10). 0 + 5 + 15 + 10 + 0 + 10 = 40.

Gemini Exchange API 40

No machine payment protocol (0). The API fee schedule is public per tier without login, 0.6% maker and 1.2% taker at the base tier (20). The API is free to call, public market data needs no key, and the sandbox credits test funds with no card (20). A person must sign up in a browser with identity checks, mint a key or approve an OAuth grant, and production OAuth apps wait for Gemini's review (0). 0 + 20 + 20 + 0 = 40.

Hyperliquid 55

No machine payment protocol (0). Fees published per tier without login (20). No card anywhere; public info endpoints are free and the testnet faucet gives 1,000 mock USDC, though only to an address that has deposited on mainnet (15 of 20). No signup; an agent with a funded EVM wallet deposits USDC on a bridged chain and trades, subject to the unread terms (20). Total 55.

Gemini Exchange API 78

Revocable API keys with one role each (Trader, Fund Manager, Auditor, Administrator), HMAC-SHA384 signing with a nonce, and OAuth 2.0 with scopes, PKCE S256, single-use refresh tokens and RFC 7009 revocation; no IP allow-list documented and no key expiry (28 of 30). Auditor is read-only, a Trader key cannot withdraw, approved withdrawal addresses are a Fund Manager action, and the MCP server refuses funds-moving tools without confirm: true (18 of 20). The MCP server wraps every response in untrusted-output markers, strips control and bidi characters and redacts memos, labels and agreement text; the REST docs say nothing on the subject (13 of 15). Order and transfer history are readable, but no per-key audit log or API access log was found (5 of 15). security.txt with a PGP contact and a bug bounty paying $150 to $20,000, scoped to the sandbox hosts; no certification was read and no public advisory process was found (14 of 20). 28 + 18 + 13 + 5 + 14 = 78.

Hyperliquid 64

No shared secrets. Actions are signed by the wallet key or by an API wallet the master approves with a name and optional expiry; API wallets can only sign, withdrawals and external sends are user-signed, and approving a new wallet deregisters the old. No IP allow-list or address allow-list (24 of 30). An API wallet is a trading-only credential and info needs no key, but nothing limits order size or marks an action as needing approval (10 of 20). The API returns no untrusted content (10). Fills, historical orders, userRole and nonces are queryable per account; no per-wallet action log (8 of 15). A bug bounty run by the Hyper Foundation with rewards up to under 1 million USDC, a Zellic audit of the bridge contract, a SECURITY.md on the SDK; no security.txt (403), no SOC 2 (12 of 20). Total 64.