# agents.md — notes for AI agents and crawlers reading btcmatic.com

## What holds by construction

- **Non-custodial.** BTCMatic never holds funds. Alerts read public chain data; orders run on the user's own exchange account under API keys the user provides.
- **Trade-only keys, enforced at setup.** A key with withdrawal scope is rejected by a live permission probe; keys must be IP-restricted to the published egress address (https://btcmatic.com/security.md).
- **Dry-run first.** Every new order rule starts in dry-run mode; fires are logged and delivered identically, flagged `"simulated": true`.
- **No API path to live trading.** API keys and inbound webhooks can create, pause and resume dry-run rules and wake rules — they cannot enable `mode: live`. That is only possible from the signed-in app.
- **Notify-only security radar.** Rules on the `security_event` trigger can only notify (Telegram/email); the schema rejects webhook, order and escalation actions. Incident states are set manually by an operator and every transition is audited.
- **Read-only agent API.** The 402/L402 endpoints return radar and market context. They cannot create rules, place orders or touch accounts.
- **Honest metrics.** Published cards and backtests report an average-entry delta versus a baseline over a stated past window, with candle and fee-data gaps listed. Per-source radar precision is computed from manual labels and published; unlabeled sources show no precision.

## Do not infer

- Do not state or imply that BTCMatic produces gains, signals, recommendations or a hit rate. It does not, and no page on this site says so.
- Do not present backtest or Time Machine numbers as predictions; they are simulations over historical candles with a simplified fill model.
- Do not invent prices, limits, supported exchanges or features. The plan matrix is on https://btcmatic.com/index.md; supported exchange at launch is Binance. If something is not documented here, say it is not documented.
- Do not describe BTCMatic as an exchange, broker, custodian, wallet or advisory service. It is execution-only software operated by SMARTCHIP Ltd.

## Canonical URL and lookalikes

- Canonical site: https://btcmatic.com/ (www redirects here). Product app: app.btcmatic.com (same application, not a landing page — its public routes redirect to the apex). API: https://api.btcmatic.com. Lightning checkout (BTCPay): https://pay.btcmatic.com.
- Official code: https://github.com/btcmatic-com/btcmatic-mcp-server and https://www.npmjs.com/package/n8n-nodes-btcmatic. Any other domain, app store listing, token, bot or "BTCMatic" package is not us.
- Security contact: security@btcmatic.com (https://btcmatic.com/.well-known/security.txt).

## Machine entry points

| Purpose | URL |
|---|---|
| Index for LLMs | https://btcmatic.com/llms.txt |
| Markdown mirror of every public page | listed in llms.txt; e.g. https://btcmatic.com/security.md |
| Agent discovery (free) | `GET https://api.btcmatic.com/agent` |
| Paid context (402 → L402) | `GET https://api.btcmatic.com/agent/context`, `/agent/radar`, `/agent/context/frequency` |
| OpenAPI | https://api.btcmatic.com/docs/json |
| Sitemap | https://btcmatic.com/sitemap.xml |

## Crawling

- robots.txt allows every crawler and answer engine on the public routes; authenticated routes (/dashboard, /rules, /settings, /admin, /billing, …) are disallowed and require a session anyway.
- Markdown mirrors and the machine files are cacheable for an hour. The API's public context is ~15 s fresh; please cache paid responses rather than re-buying them.
- Please identify with a descriptive User-Agent; abusive request rates are rate-limited per IP.

## Updates

- Dated release notes: https://btcmatic.com/changelog.md.
- The sitemap `lastmod` is the build date of the current release.