MEXC API vs Upbit Open API

MEXC API 31

No machine payment protocol (0). Fees published without login on MEXC's own fee guide (20 October 2026) and a 2024 announcement, with a separate API futures schedule; the fee page itself is drawn by script (16 of 20). Public market data needs no key or card; trading needs a verified and funded account. Judgement call (15 of 20). A person must sign up in a browser, and futures need identity verification (0). 0 + 16 + 15 + 0 = 31.

Upbit Open API 15

No machine payment protocol (0). The fee schedule is on upbit.com, which disallows every crawler path, so no price is recorded (0 of 20, unchecked). Public quotation endpoints need no key, card or account; trading needs a verified Korean account. Judgement call (15 of 20). A person must sign up, pass identity checks and issue keys on the PC web site (0). 0 + 0 + 15 + 0 = 15.

MEXC API 75

Read as a closed service. Last dated change 23 October 2026 in both the spot and futures logs (30). Spot entries on 14 August, 24 August, 11 September and 23 October 2026, futures on 1 September, 11 September, 19 October and 23 October (20). An API support Telegram group, a ticket form and dated changelogs; GitHub issues not read (10 of 15). The official SDK repository was last pushed in February 2024 while the CLI is current (10 of 15). The CLI ships platform binaries with no dependencies and no public repository or CI; the SDK is stale (5 of 10). 30 + 20 + 10 + 10 + 5 = 75.

Upbit Open API 83

Read as a closed service. SDK v1.1.0 on 20 October 2026 (30). The CLI 1.0.0 on 1 September, the rate-limit update of 7 October, the SDK on 20 October and the path-format notice for 16 November 2026 (20). open-api@upbit.com answers in turn on weekdays per the support notice, notices carry dates, and the six upbit-official repositories show no open issues (12 of 15). Current official SDKs in Python, TypeScript and Go (15). Apache-2.0 repositories pushed in October 2026; CI not checked (6 of 10). 30 + 20 + 12 + 15 + 6 = 83.

MEXC API 64

Graded on the REST API with the CLI's MCP mode. Responses take limit parameters and the MCP read-only market subset is 22 tools, but a full spot MCP category lists 123 tools (15 of 25). startTime, endTime and limit on history, symbol filters on open orders (14 of 20). Numeric codes with messages, a 30035 order-limit code added 23 October 2026, 5xx guidance (14 of 20). newClientOrderId is optional with no idempotency guarantee; the CLI adds --dry-run and a confirmation step (10 of 20). Few required parameters; SDKs in five languages whose repository was last pushed in February 2024 (11 of 15). 15 + 14 + 14 + 10 + 11 = 64.

Upbit Open API 70

Graded on the REST API with the CLI. Candle counts, list limits and the CLI's --max-items and --transform size responses (16 of 25). Paging and filters on orders and history (15 of 20). error.name codes to branch on, which the November 2026 notice tells clients to use, and 418 with its block length (15 of 20). An order-test endpoint and a CONFIRM gate in the skills; an order identifier for idempotent placement was not checked (11 of 20). Few required parameters, SDKs in three languages and a CLI, but keys need the PC web site and a registered IP (13 of 15). 16 + 15 + 15 + 11 + 13 = 70.

MEXC API 65

Granular permissions (account read, trade, withdraw, transfer), per-pair restriction, up to 10 linked IPs, 90-day expiry without an IP, renewal and revocation in the account, 30 keys per account (26 of 30). A read-only MCP mode that hides write tools, a confirmation step before orders and transfers in the CLI and MCP, and --yes that agents are told not to add; nothing server-side confirms an API order (17 of 20). The API returns exchange data, and the CLI security page warns that agents may be led by web pages or files into unwanted actions (12 of 15). CLI confirmations are logged and reported to MEXC with no operator access described; an apiKeyInfo endpoint shows key settings (6 of 15). No security.txt, disclosure policy or bug bounty found; a proof-of-reserves page exists (4 of 20). 26 + 17 + 12 + 6 + 4 = 65.

Upbit Open API 59

Keys limited to chosen functions, a mandatory public IPv4 allow-list, a JWT per request with a fresh nonce, keys listed with expiry through the API, and a withdrawal safe-lock on by default (27 of 30). Read-only keys, the default withdrawal lock lifted only in the app, and skills that require a typed CONFIRM before writes (17 of 20). The API returns exchange data and announcements, no third-party content (10 of 15). An API key list endpoint; no per-call log for the operator (5 of 15). No disclosure policy, bug bounty or certification found; security.txt on upbit.com could not be fetched under its robots.txt (0 of 20). 27 + 17 + 10 + 5 + 0 = 59.