generated: '2026-08-25' method: derived source: openapi/maicoin-max-v3-openapi.json + https://maicoin.github.io/max-websocket-docs/ + https://max-api.maicoin.com/api/doc/external/v3 + security/maicoin-domain-security.yml note: >- Assessed against the contract and the provider's own docs, not marketing copy. MAX is a bespoke-protocol exchange API: it implements no cross-cutting API standard beyond HTTP/JSON and HMAC signing. Nothing here is a claim MaiCoin makes; each entry records what the artifacts show. standards: - id: openapi conforms: true version: '2.0' evidence: >- openapi/maicoin-max-v3-openapi.json declares `swagger: "2.0"` with 51 paths, 54 operations, 51 definitions and unique operationIds throughout. Served publicly and unauthenticated at https://max-api.maicoin.com/api/doc/external/v3 (HTTP 200, application/json, 120KB). note: >- Swagger 2.0, not OpenAPI 3.x. The document is real, complete and machine-readable, but two generations behind: it cannot express the `servers` array, `components.securitySchemes`, webhooks, or JSON Schema 2020-12. Its own `info.version` is 3.0.0, which is the API version, not the spec version — easy to misread as OpenAPI 3. - id: rfc9457 conforms: false evidence: >- Error responses use a proprietary `{"success": false, "error": {"code", "message", "info"}}` envelope with content type application/json. No application/problem+json media type, and no `type`/`title`/`status`/`detail`/`instance` members anywhere in the contract. - id: oauth2 conforms: false evidence: No oauth2 flow is declared in the contract or documented anywhere. Authentication is HMAC-signed API key only. - id: oidc conforms: false evidence: '/.well-known/openid-configuration returned 404 on max-api.maicoin.com and campaign.maicoin.com (probed 2026-08-25).' - id: pagination conforms: partial evidence: >- limit/offset plus a from_id cursor and timestamp windowing are implemented consistently across 22 listing operations, but responses are bare JSON arrays with no envelope, no total count and no next-page token, so pagination is not self-describing. - id: idempotency conforms: partial evidence: >- client_oid provides account-scoped duplicate rejection with a stated 24-hour retention on order submission and cancellation. It is not the Idempotency-Key header convention and does not replay the original response. Withdrawals, transfers, loans and conversions have no equivalent. detail: See conventions/maicoin-conventions.yml - id: rfc9110-retry-after conforms: false evidence: >- The WebSocket docs state Retry-After carries "the Unix timestamp in seconds for when you can reconnect". RFC 9110 defines Retry-After as either delta-seconds or an HTTP-date; a Unix epoch integer is neither. A conforming client reading it as delta-seconds would wait ~54 years. severity: interoperability defect - id: hsts conforms: partial evidence: >- max-api.maicoin.com serves `strict-transport-security: max-age=63072000; includeSubDomains` on API paths (verified 2026-08-25 on /api/v3/timestamp) but NOT on the host root, which returns 200 with no HSTS header. campaign.maicoin.com serves HSTS with max-age=31536000. Preload is not asserted. - id: dnssec conforms: true evidence: maicoin.com is DNSSEC-signed. See security/maicoin-domain-security.yml. - id: caa conforms: true evidence: >- maicoin.com publishes CAA records restricting issuance to globalsign.com, letsencrypt.org, amazon.com and digicert.com, with `0 iodef "mailto:security@maicoin.com"` as the incident contact. - id: spf conforms: true evidence: SPF record present on maicoin.com. - id: dmarc conforms: true policy: quarantine evidence: DMARC record present on maicoin.com with p=quarantine. - id: asyncapi conforms: false evidence: >- MaiCoin publishes a real WebSocket streaming surface with documented channels but ships no AsyncAPI document. The event catalogue in asyncapi/ was generated by API Evangelist from MaiCoin's own channel documentation and is NOT provider-published. - id: json-api conforms: false evidence: Bare arrays and a bespoke success/error envelope; no JSON:API document structure. - id: odata conforms: false evidence: No $metadata surface and no OData query options. - id: scim conforms: false evidence: Not applicable — no identity provisioning surface. - id: mcp conforms: false evidence: >- No first-party MCP server. Probes of mcp.maicoin.com/mcp (DNS failure) and max-api.maicoin.com/mcp (404) both missed on 2026-08-25. A third-party community server exists (narumiruna/max-mcp) but is not MaiCoin's. - id: a2a conforms: false evidence: >- No agent card. /.well-known/agent-card.json and /.well-known/agent.json returned 404 on max-api.maicoin.com, campaign.maicoin.com and maicoin.github.io, and were answered by a Cloudflare challenge on max.maicoin.com and www.maicoin.com (probed 2026-08-25). - id: llmstxt conforms: true evidence: >- TWO real llms.txt files are served, both HTTP 200 — https://max-api.maicoin.com/llms.txt (the API-focused one, which names the OpenAPI location and an AI usage policy) and https://campaign.maicoin.com/llms.txt (a 15KB site index). This is a genuinely above-average agent-readiness signal and is how this profile located the machine-readable contract. domain_standards: assessed: true regime: cryptocurrency exchange / virtual asset service provider findings: - id: fix-protocol conforms: false evidence: No FIX gateway is published or referenced anywhere in MaiCoin's documentation. note: FIX 4.4/5.0 is the incumbent institutional standard for order entry and market data. MAX offers REST and a bespoke WebSocket protocol only. - id: iso-20022 conforms: false evidence: No ISO 20022 message type appears in the contract; TWD fiat withdrawal uses a proprietary body. - id: fdx conforms: false evidence: Not applicable — no open-banking account-aggregation surface. summary: >- REWARD-ONLY DIMENSION, NOT PENALISED. The crypto-exchange market has no mandatory machine-readable domain standard that MAX declines to implement; venue-specific REST plus a proprietary WebSocket protocol is the sector norm, and MAX's shape matches its peers. FIX is recorded above because it is the one recognised standard a venue at this tier could adopt, and its absence is a real (if unremarkable) differentiator against institutional-facing exchanges. compliance_certifications: published: false note: >- No trust centre, SOC 2, ISO 27001, PCI or equivalent certification page was found on any MaiCoin host (probe-security-programs.py returned vdp=none trust=none on 2026-08-25). MaiCoin is a registered Taiwanese VASP and publishes terms and a privacy policy, but no named security certification, so NO Compliance pointer is emitted.