Public Updates

Across 30 boards the page now registers 32 different tools with the browser's document.modelContext (Chrome's origin trial, versions 149 to 162 on desktop and to 156 on Android; at most 8 on one page): 29 read-only data tools from the MCP catalog, the same data the page shows at the depth you see it, plus open_board, get_page_context and get_desk_notes. An agent that supports WebMCP reads the board instead of scraping it; a chip in the top bar lists the tools and a short notice appears when one is called. No account key is involved, there is nothing to sign up for, and nothing the agent sends is stored. Details on /developers#webmcp.

Members can now run Ask BYK on a model key of their own: Anthropic, OpenAI, Google Gemini, xAI, DeepSeek, Mistral, Groq or OpenRouter, chosen in the settings panel on /ask with a model from the provider's own list. The key stays on the device (the browser, or the phone's secure storage) and is sent with each question to that provider; ByKaranteli never stores it. Conversations on your key have no daily limit and do not count against your plan; your provider bills the model and the data tools stay included. Answers say so under the reading; deep answers, share links and Telegram keep using ByKaranteli's desk. The Android app now carries the same desk: the Ask button on Markets, Ask about a symbol, Ask BYK in the More tab, with the same history as the site and your own key; balance top-ups and deep answers stay on the site.

Members can now add a prepaid balance to their account (USDC or USDT on Solana, from $10) and keep asking once the day's conversations are used: $0.10 a conversation, chosen conversation by conversation, never automatically. A deep answer reads the same question with a stronger model and up to 8 data tools, 300 to 500 words with a three line summary, for $0.50 from the balance; it never uses the daily allowance. The balance does not expire, is not refunded and stays with the account; an answer that fails on our side is never charged. The balance page under the account shows the ledger; the Telegram bot offers the same two buttons.

The desk now reads its own pages without being asked. Every hour it writes the market reading at the top of the Desk notes page from funding, open interest, liquidations, ETF flows and the liquidation map; every four hours, or once a day as the data lands, a reading of each covered board. Open a covered page and press Ask BYK: the panel opens on that page's reading with three follow-up questions; a follow-up is a conversation like any other, the reading itself is free to read for everyone and never counts. /ask lists the latest readings, the Desk notes JSON (/api/public/desk) and its Markdown twin carry the market reading, and the Telegram bot answers /reading with it. On the member Desk, Read my desk asks the desk for a reading of your own watchlist (one conversation). Readings describe data; they are not advice, and they can be wrong.

Three additions to the AI desk on its first day. A complete answer can be published at a share link (/ask/s/<token>): anyone with the link reads the question, the reading and its sources, never the member's name or account; the member withdraws it at any time. When a member asks to be told about a level, BYK drafts the alert (field, threshold, cooldown, the 7-day preview and the plan's count) and the member creates it with one click through the same alert engine as the alerts page. In the Telegram chat linked to an account, /ask followed by a question answers from the same desk with the same daily conversations; a reply to an answer continues the conversation, an alert the bot sends carries an Ask BYK button that explains the reading, and a drafted alert is created from the chat with one tap.

Signed-in members can ask the recorded market data a question in plain words from the Ask BYK button on every page, the 'Ask about this chart' chip under charts, or the /ask page. BYK reads the same tools the MCP server serves, answers in the language of the question in a reading of findings, context and what to watch, and lists its sources under the answer with the time of the data; it describes data and never gives personal investment advice. A conversation is one topic of up to five messages within fifteen minutes; plans include 1 (Free), 3 (Terminal), 5 (Builder), 10 (Business) and 20 (Scale) conversations a day, reset at 00:00 UTC, and an answer that fails on our side is not counted. Anonymous visitors see three recent readings per page and a sign-in link. On the MCP side, thirteen large tools (get_liqmap, get_turkey_premium, get_correlations, get_hl_whales, get_options_flow, get_funding_arbitrage, get_desk_notes, get_positioning, get_coverage, get_new_listings, get_venue_markets, get_tokenized_stocks, get_factor_board) take a detail parameter, compact or full, in bykaranteli-mcp 1.1.0.

mcp.bykaranteli.com now runs on the stable line of the MCP TypeScript SDK and serves both protocol eras on one address: clients released before the 2026-07-28 revision keep their initialize handshake and get the same answers as before, and clients of the new revision name their revision, identity and capabilities in each request and get its per-request answers (server/discover, resultType, the cache fields, the server identity in _meta, the Mcp-Method and Mcp-Name header checks). Tool names, descriptions, inputs and answers are unchanged; two details moved with the SDK: a tool input error no longer starts with the words MCP error, and the advertised input schemas carry a $schema line and no additionalProperties. For OAuth sign-in, the authorization server now accepts a client metadata document, the registration the new revision prefers: a client sends the https address of its own document as its client id, the server reads the document and shows that address's host on the consent page; dynamic registration stays for older clients, and every authorization response carries the issuer (iss). The npm package bykaranteli-mcp 1.0.0 brings the same server to Claude Desktop, Claude Code and Cursor over stdio, and needs Node.js 20 or newer.

An address that takes 1,000 answers of 429 on /api/ in ten minutes, or 10,000 in a day with at least one in the last ten minutes, is now paused at the origin for an hour: every /api/ request from it answers 429 with retry-after 3600 and the usual key gate shape (code rate_limited, reason hammer_brake). The quota, rate and fair-use rules are unchanged, and a client that stops at the first 429 and waits for retry-after never meets the brake. On 21 October one key past its monthly quota sent 129,000 requests in a day and received 115,000 answers of 429.

The member bot now opens with a welcome and buttons instead of an error, carries a command menu, and answers in the site's four languages. An alert message names the rule, the matched symbols with the value of each field next to its threshold and the time, and carries Open, Mute 1h and Switch off buttons. /alerts lists your rules with pause, resume and delete buttons; a rule written in plain English (BTC funding above 0.05%) is read back and created on a tap, under the same plan limit and duplicate check as the site and the app. A chat can open the bot first and create or sign in to the account from there (email or Google, as always); after the sign-in, Settings shows the chat's username and links it when you confirm. A chat that blocks the bot is noticed and left alone until it comes back. Every notification delivery attempt on every channel is now recorded and shown in the admin views. The public boards still answer without an account: /liq, /whales, /book, /rsi, /ls.

The 17 October reason field now reaches every surface that takes an account key. The member routes (alert recipes, watchlists, Hyperliquid addresses), /api/v1/usage, /api/v1/me/watchlist and the stream handshake answer a key header that is present but carries no usable key with 401 and the same reason values (empty_authorization, empty_x_api_key, malformed_authorization, malformed_x_api_key, non_bearer_scheme), and a Bearer header whose value is not a key no longer reads as an unknown key. The hosted MCP names what it saw instead of "sent none": an empty or malformed credential header, or a prepaid bk_live key, which pays per call and does not open the MCP. On /api/x402/ the 402 payment terms are unchanged for a call with no key header; when a key header was present but unusable, the 402 body also carries credential_reason and credential_hint (for example a prepaid key placed in Authorization instead of x-api-key), and a malformed key value answers 401 key_required with its reason. A request with no key header at all answers with the same status as before on every route (on /api/x402/ the same payment terms); the new fields are additive. A review on 19 October tightened the edges: the stream handshake reads a ticket only when no credential came at all (a header that carries something unusable is refused with its reason), the prepaid balance route reads x-api-key as the paid routes do, the hosted MCP names an OAuth token of the wrong shape as a token to re-issue, openapi.json describes the 401 on every keyed route, and the stream and x402 error tables on the developers page carry the new fields.

byk-verify.mjs now looks for each Base copy where the beta profile puts it: a short block range after its Solana anchor, one witness-key query bounded in time (windows mode, the default). A free keyed endpoint that allows ten blocks per eth_getLogs call completes a month-old stream in about two thousand calls, and the daily public run at github.com/bykarantelicom/byk-verifier now reads the Base witness as well. The pass over every block since genesis stays available as --base-scan range for endpoints that allow thousands of blocks per call. The reader checkpoint records which windows were walked, so a daily run walks only the new ones; a copy that is not in its window is reported MISSING instead of being silently absent. Every endpoint URL is cut to its host in whatever the verifier prints or writes, because keyed URLs carry the key and the daily run commits its output to a public repository.

The alerts page and the app now show, per rule, whether one of its channels is set up on the account (Telegram, member email, browser or phone push, webhook) and warn when none is: a matched alert used to be dropped without a word. Creating or editing a rule into an exact copy of another (same scope, symbols, conditions and channels) answers 409 duplicate_recipe with the id of the existing one, on the site, in the app and through the MCP tools; a client that treated every 409 as the plan limit should read the code. The real-time path now applies the plan's recipe count the way the twenty minute run does, every fired alert records which path fired it (fields._source: fast or cron), and the mobile API's recipe objects carry reachable while the list carries channels_available.

Two additions to the Data Layer verifier and its audit. First, the cache proof of rc6 section 13.7: a checkpoint now records the newest transaction under every data witness key it covers, and a resumed run with --cache-proof asks each of those keys for its newest transaction (one call a sequence); when nothing new was anchored under any of them, the cached sequences are provably unchanged and the run reports a full verdict instead of a resumed one. The daily GitHub Actions run passes it from 19 Oct, after a full run recorded the signatures; the Sunday run still reads everything from sequence 0. Second, a composite funding leaf sealed from no input at all (the restart gap of 17 Oct) now keeps a snapshot with an empty venue list, the shadow audit and the reference audit recompute it as NO_DATA without running Annex A, and the 48 leaves of that gap (two epochs) received their empty snapshots after the fact; the audit also checks every sealed Class A leaf against its snapshot, as section 13.8 asks.

The one-file verifier (/byk-verify.mjs) no longer stops with an error when the Base endpoint throttles or cannot be read: the Base witness is reported as an incomplete scan and the verdict rests on Solana, which carries every manifest under the beta profile. A run that passes can write a checkpoint (--checkpoint-out) and the next run continues from it (--checkpoint), reading only the sequences since; such a run is labelled RESUMED, because the sequences before the checkpoint are not re-read, and the checkpoint is refused when the authorization log changed. SOLANA_RPC_URL and BASE_RPC_URL stand in for the --rpc flags. The verifier now runs every day outside our servers, in the public byk-verifier repository on GitHub, and publishes each verdict there.

A program that calls a keyed route without a usable key now learns what the gate saw: the 401 key_required body carries a reason field (none, empty_authorization, empty_x_api_key, malformed_authorization, malformed_x_api_key or non_bearer_scheme) and a sentence that names it. An empty header, a placeholder such as bk_..., the prefix copied from the key list, an unexpanded shell variable, or a Bearer value that a template turned into undefined are refused before any lookup, whatever the caller class; a key in the other header still counts. The developers error table, the connect guide and the public manifest describe the field. Every example on the developers page, the dashboard, the Playground, the connect guide and the agent card reads the key from the same BYKARANTELI_API_KEY variable, and a new key's panel shows the export line and a first call ready to run.

The status page prints the time of each heartbeat and counts from it in your browser, so a cached copy never shows a stale age. The data hub's borrow, fee and settlement cards take their venue counts and names from the recorded rows. The chart page reserves the consent banner's room before it appears, which removes the layout shift new visitors saw. The top movers lists leave out contracts whose open interest has drained before a delisting. The flow, charge, slippage and options flow boards carry their reading, thinnest book and largest print sentences under the answer again, and the newsroom and leverage pages answer from memory while they refresh.

Every data board now opens with one sentence from its own data and the data's time (the open interest total, the index reading, the net flow, the newest listing), and ends with a cite line that carries the same time. Venue counts name what they count: model venues, recorded liquidation feeds, exchanges on file, order book venues. The site shows one timestamp form; relative ages are computed in the browser. Fixes from the October review: the FOMC and CPI tables show the newest meetings to every reader (the free window had shown the oldest), the ETF regime chip is bucketed from the flow the hero prints, the status badge reflects a critical watchdog finding, a venue adding a contract the market already trades is labelled as such on the listings board, band-study legends match their bars, the global 24h volume rejects implausible feed values, holiday zeros left the FRED series, the symbol search maps a base asset to its USDT perpetual, the funding arbitrage filters list every venue the scanner compares, the withdrawals hub has a real asset lookup, the leverage change log no longer reports unchanged maxima, and the data hub says plainly that the public mirrors stopped on 2026-09-10.

The share images under /api/og (the liquidation map card on every coin page, the cards the sitemap lists and the SuperChart card) are now allowed for crawlers in robots.txt; they had been blocked since the cards shipped. Symbol pages read "BTCUSDT Recorded Market State" with the space a text reader expects, the home page and the liquidation heatmap keep one main landmark, every public page announces its markdown twin under /md with a link alternate, a skip-to-content link serves keyboard users, and four short page titles (About, FAQ, Pricing, Changelog) now say what the page holds.

The short notes the desk writer publishes through the day from the platform's own recorded derivatives data, about forty a day, each stamped in UTC, now have a permanent home. The last 48 hours are at /desk; every day's notes stay on that day's brief page under the day's numbers, the highest scored first; each note has a permanent address and a cite line. Notes are written in English and translated into Chinese, Russian and Korean after publishing, with the English text as the record. Programs get GET /api/public/desk (a day or the last 7 days, one language per call), the desk-notes dataset, the desk-notes-history x402 route, the MCP tool get_desk_notes, the stream channel desk and the RSS feed /desk/feed.xml. The notes describe the data; they are not advice.

BYK.FUNDING.COMPOSITE.A is now sealed every epoch next to the Class B composite: the same funding algorithm computed from each venue's raw published numbers, and the inputs of every epoch are served at /api/v1/proof/snapshots, so anyone can recompute the leaf exactly. The 2 percent spot depth record now sums the same venues as the depth totals shown on the site, instead of the original five. The tokenized stocks premium record repeats its last good value as DEGRADED while no stock session is open, instead of reading empty every weekend. Older epochs keep resolving to the documents they committed to.

The Terms of Service now name three kinds of data: the data ByKaranteli computes, which the Business and Scale plans license for commercial use and derived redistribution; public-source data, credited to its publisher; and third-party data such as a single venue's raw records, which is for your own use. New sections cover third-party sources, indices and benchmarks, your responsibility as a business user, and general terms. The privacy policy adds public blockchain addresses. Provider attribution now appears next to Fear & Greed, global market and stablecoin figures on /indices, in /api/public/indices and in the X-Data-Attribution header of the datasets that carry a provider's values.

With an account key, tier_required now names the two ways to pay a call (a prepaid key in x-api-key with the account key in Authorization: Bearer, or a wallet without the account key) and links the plans, like the other refusals; an account whose catalog ByKaranteli switched off keeps its own sentence on every route. /api/x402 entries carry included_from (builder, business, or null for the prepaid key store, which is always bought) next to raw_records, and openapi.json lists the answers of each route kind (400 where a route has one, 402, 403 and the 200 headers) with x-raw-records and x-included-from. networks-history and leverage-tiers-history apply a plan's window to validity: a version that started before the window and is still in force, or ended inside it, is returned. x-quota-used now counts the call it answers, on the slow lane too and with the full weight of an included catalog call, so it equals /api/v1/usage.

The funding table behind /api/x402/funding-history, /api/x402/tradfi-funding-history, the bulk-derivatives file and the symbol funding pages now records every settlement of every Binance USDT-M perpetual, crypto and TradFi. An hourly collector reads Binance's settlement list and a backfill filled the series from 2026-05-31; until today the table filled only for the forty largest TradFi perpetuals and the symbols a page had read, so many contracts had gaps. Rows already stored did not change. The TradFi route now covers every TradFi perpetual on our board, not only the forty largest. The coverage note in the exchange filter entry of the same date no longer applies.

The table /api/x402/funding-history reads holds Binance USDT-M settlements only. Until today its exchange filter compared the value with an internal source name, so exchange=binance answered an empty result. exchange=binance (any case) now reads every row, any other venue answers 400 before the query and is not charged, and a call without the parameter is unchanged. The route and the bulk-derivatives file now say what they carry: complete for the TradFi perpetuals and the symbols our pages read every day, with possible gaps on rarely read contracts. Plan pages: bulk exports follow each plan's history window, Business the last 365 days and Scale the whole archive, as monthly files with the current month refreshed every day; the Scale line no longer lists daily raw exports, which the plan did not carry.

An account key reads the /api/x402 catalog on its plan within a monthly ceiling, a history window and a row cap. Builder: 1,000 included catalog calls a month over the last 90 days, up to 5,000 rows a call, summary series only (the raw record routes are paid per call). Business: 10,000 a month over the last 365 days, up to 20,000 rows a call, raw records included. Scale and Enterprise: no ceiling, the whole archive, raw records included. The window counts from 00:00 UTC, and each included call still counts as 10 requests of the plan's monthly fair use. Raw records are the individual liquidation events and the largest-print ranking, whale prints, Hyperliquid position events and hourly position records, order book snapshots, minute bars and per-venue market snapshots. Two new answers, both pay per call: 403 history_window (a from, to or days before the plan's window) and 403 raw_tier_required (a raw record route below Business); x402_allowance_used (HTTP 402) is back for the plan ceiling. To pay per call with an account key in the request, send the account key as Authorization: Bearer with a prepaid key in x-api-key, or send the call without the account key and pay with a wallet. Included answers carry x-history-window-days and x-history-row-cap (neither on liqmap-levels, options-flow and flow-vpin; the latter not on bulk exports), plus x-x402-allowance-limit and x-x402-allowance-used where a ceiling applies; /api/v1/usage adds history_days, rows_per_call and raw_records_included. Wallet and prepaid calls are unchanged: the whole archive at each route's own row cap, $0.10 a call. Plans, API docs.

A counted liquidation feed was marked stale after 6 hours without an event, so low-volume venues read as stale on an ordinary quiet night (over the last 14 days dYdX went up to 16.6 hours without a liquidation with nothing wrong). Each feed now has its own quiet threshold: 6 hours by default, 24 hours for dYdX, 12 hours for Kraken Futures and Deribit, 8 hours for Lighter and GMX. The same rule applies on /liquidations, /coverage, GET /api/public/liquidations (by_exchange[].stale) and the market-wide estimate, where a stale feed still counts as uncovered.

The status probe for Binance US called an endpoint that refuses requests without an account key, so every reading since the probe started on 2026-09-04 was recorded as unreachable and its venue page showed 0.00% uptime over 30 days while its market data kept arriving. Binance US is now probed on its public, keyless ping (HTTP 200 is ok, latency measured on the same request). Readings where our own probe was refused are shown as n/a: they count neither as up nor as down, so uptime covers only the time we could actually read, and a venue without a readable status endpoint shows no uptime figure at all.

/api/liqmap/v3 is the LiqMap page's own read. A request without a member session that does not come from a browser (no Fetch Metadata, as with curl or a script) now gets the same 401 key_required answer as /api/liqmap/public, with Cache-Control: no-store. The page itself and other browsers read it as before, and a request with an account key is served and counted like any other keyed call. Programs should use GET /api/liqmap/public or GET /api/public/liqmap with a free account key.

CoinEx announced in September 2026 that it is winding down. From 2026-10-08 it is no longer listed on /venues, in the coverage matrix or in the fee and leverage tables, its snapshot, fee, leverage tier, instrument and withdrawal network collectors are stopped, and its venue page answers 410 Gone. Rows recorded before that date keep the exchange value coinex in the history tables and datasets.

SuperChart now opens on any bar period from 1 minute to 1 month for every reader (the API keeps its key rule under 15 minutes). The LiqMap liquidation heatmap is painted behind the candles, hour by hour since 6 August 2026, and the largest real liquidation prints of every bar sit on them as circles, so the model can be checked against what printed. Every open pane refreshes while you watch, the forming bar follows the exchange socket through our stream gateway, the candle legend is the chart's own (it follows every language), the clock can be UTC or local, a failed load says so and offers a retry, and the PNG export carries the watermark and a source line. Each liquidation heatmap page links to the same map on a candle chart, and every MCP and API answer with a chart twin now carries a chart_url that opens the view it describes. Programs can subscribe to the new candles stream channel with a key. Later the same day: a fuller drawing set (vertical and parallel lines, rectangles, a measure box, a long or short position box, freehand) with undo and redo, editable parameters for every built-in indicator, a visible-range volume profile, an anchored VWAP with sigma bands, a log price scale, and a bar replay that hides everything after the candle you pick.