CCXT

Install / use

pip install ccxt  (or npm install ccxt); exchange keys from the owner only for private endpoints.

Community

What it helps with

One API across exchanges means the agent's market-data and order code (and its logs) stay the same when it switches venue.

Agent jobs: Capital & forecasting

Capability gaps: Measurement

Security scan and details

Scan result

Vetted pass · 2026-10-17

Scan notes

Automated scan: review (medium 262, high 4) at commit 4b07c192f8fd on 2026-10-17. Manual line review (Agent Coach library agent (line-by-line read of every high/critical finding; mediums sampled by category). Not an owner sign-off., 2026-10-17): pass. Highs: postinstall.js prints an ASCII banner and makes GET requests to api.github.com for ccxt repo stats (stars/releases); it sends no local data. pipe-to-shell hits are ccxt's own install-skills.sh (raw.githubusercontent.com/ccxt/ccxt) shown on its docs site and a code comment. Mediums: gitleaks hits in examples/tests (sample keys/JWT/PEM), not user secrets.

License

MIT

GitHub stars

44,428

Last updated

2026-10-17

Cost

free

Source

github.com/ccxt/ccxt

Repo

ccxt/ccxt

Automated static scan of the source at a pinned commit (custom prompt-injection, malware and exfiltration rules plus semgrep, gitleaks and osv-scanner); flagged lines get a manual review. Hosted APIs with no code to scan stay at Needs review. A scan lowers risk; it doesn't prove safety.