# Max agent instructions Max is a B2B lead-generation platform operated by Sortlist SA. It monitors public business and engagement signals, enriches matching lead records, compares them with a user-defined Ideal Customer Profile, and presents recommendations for human review. ## When to use this product Use Max when a user wants to: - inspect the buying-signal types available in Max; - create or refine a business and its Ideal Customer Profile; - monitor a supported signal for a business; - review leads discovered by active signal subscriptions; - connect reviewed leads to an existing outbound workflow; or - receive real-time new-lead notifications through signed webhooks. Do not describe an observed signal as proof that somebody intends to buy. Do not claim Max is a contact database or a message sender. Evidence quality, ICP fit, enrichment coverage, and the user's lawful basis must be reviewed before outreach. ## Public discovery No authentication is required to read the signal catalog: - `GET https://api.yourmax.ai/api/v1/signals` - `GET https://api.yourmax.ai/api/v1/signals/{slug}` The canonical OpenAPI 3.1 description is at . Human-readable API documentation is at . ## Authenticated access Businesses, subscriptions, leads, integrations, and webhooks are scoped to the authenticated team. Send a team-scoped Max API key or OAuth access token as: ```http Authorization: Bearer YOUR_TOKEN ``` Create API keys in **Settings → API Keys**. The official CLI supports an OAuth device flow and requests the current `read` API scope. OAuth discovery is available at ; PKCE `S256` is supported. The API is versioned under `https://api.yourmax.ai/api/v1` and limited to 60 requests per minute per API key. List endpoints use `page` and `per_page`; `per_page` is at most 100. Errors use JSON with an `error` string and the appropriate HTTP status. Max announces a v1 deprecation in the API documentation and changelog before removal. During the announced window, agents should monitor the standard `Deprecation` and `Sunset` response headers and migrate before the stated sunset date. ## Agent integrations Official CLI: ```bash npm install -g sortlist-max-cli max login ``` Official local MCP server: ```bash MAX_API_KEY=... npx -y sortlist-max-mcp ``` The MCP package uses stdio. Max does not advertise a remote HTTP MCP endpoint. Its manifest is at , package at , and source at . Agent Skills discovery is at : - `monitor`: create businesses and manage signal subscriptions; - `leads`: review leads, enroll selected leads, and manage webhooks. ## Safe operating sequence 1. Start with `list_signals`; read the selected signal's description and input schema. 2. Read the target business and ICP before changing either. 3. Ask for explicit confirmation before creating, updating, pausing, resuming, or deleting resources when the user has not already requested that action. 4. Treat lead enrollment and webhook registration as external side effects. 5. Review lead evidence and ICP fit before enrolling a batch. 6. Keep secrets out of output and logs. Never print `MAX_API_KEY`, OAuth tokens, or webhook secrets. 7. Report partial failures, skipped leads, and JSON errors rather than silently retrying mutations. Deleting a lead is a soft delete. Deleting a subscription or webhook removes that configuration. Prefer read-only calls when the user's intent is inspection or explanation. ## Canonical references - API reference: - API summary: - Authentication: - Pricing: - Product facts and limits: - Terms: - Privacy: - Contact: