# AGENTS.md — operating guide for coding agents on Ylalo

## Environment

- Site: https://www.ylalo.com (**MAINNET — real funds**)
- Demo / phone-free sandbox: https://sandbox.ylalo.com (**SANDBOX — play money**)
- MCP: https://www.ylalo.com/mcp
- REST: https://www.ylalo.com/v1
- Facts: https://www.ylalo.com/llms.txt · https://www.ylalo.com/agent.json
- OpenAPI: https://www.ylalo.com/v1/openapi.json

## Setup (www / mainnet — OTP first)

1. Read `/llms.txt` and `GET /v1/start`. Confirm `X-Ylalo-Environment` / `network` is mainnet.
2. Phone OTP → `POST /v1/keys` → store `apiKey` as `YLALO_API_KEY` in `.env` (never in chat or git).
3. `GET /v1/account` with `Authorization: Bearer $YLALO_API_KEY`.
4. Propose one small trade with a stop; wait for user yes; then `POST /v1/orders/suggest` → `POST /v1/orders` (or `ylalo_place_order`) with brackets/guardians + `Idempotency-Key`.

## Sandbox (sandbox hosts only)

`POST /v1/sandbox/accounts` is available only on sandbox.ylalo.com — not on www.

## Safety rules

- Agents cannot withdraw funds.
- Confirm size, side, leverage before every write.
- Tell the user: mainnet/sandbox (check `X-Ylalo-Environment`), leveraged products, liquidation risk. You may name the execution venue when helpful.
- Prefer guardians / brackets over laptop-side watchdogs.

## Cursor

Add MCP via https://cursor.com/en/install-mcp?name=ylalo&config=eyJ1cmwiOiJodHRwczovL3d3dy55bGFsby5jb20vbWNwIn0=

Project rule: always bracket first trades; use sandbox only on sandbox.ylalo.com.