# NodeGrade

> Live agent-readiness scanner for any public website. Enter a domain, get a score in ~12 seconds against five pillars (readability, discoverability, callability, monetization, trust). Every rule cites a public standard.

NodeGrade is a product of RENTSPIRE LLC (2219 Main Street STE 1126, Santa Monica, CA 90405). We publish this file so AI agents can find the parts of nodegrade.com that are useful to them without scraping the rendered UI.

## What NodeGrade does

- Scans publicly reachable files on a submitted domain.
- Produces a 0–100 operational readiness score across five pillars: Readability (25 pts), Discoverability (20 pts), Callability (20 pts), Monetization (25 pts), Trust & provenance (10 pts).
- Returns cited remediation for every non-passing finding.
- Optional paid Fix-Kit ships the remediation files ready to drop into a repo.
- Optional Monitoring re-scans weekly and emails when the score materially changes.

## Public API surface

- `GET /api/health` — liveness check; returns `{ ok, app, scanner, budgetMs }`.
- `POST /api/scans` — body: `{ "domain": "example.com" }`. Rate-limited to 10/min/IP. Returns a locked report with a `reportToken`. Remediation text is `null` until a lead is captured.
- `GET /api/reports/{token}` — returns the locked or unlocked report.
- `POST /api/leads` — body: `{ "reportToken", "email", "name?", "role?", "answers?" }`. Rate-limited to 15/min/IP. Unlocks the report for the token.
- `POST /api/events` — first-party analytics ingest; always returns 202.
- `GET /api/unsubscribe?token=...` — one-click unsubscribe (HMAC-signed).
- `POST /api/stripe/webhook` — Stripe webhook receiver (signature-verified).
- `GET /api/monitoring/weekly` — cron endpoint; requires `Authorization: Bearer <CRON_SECRET>`.

The OpenAPI 3.1 description is served at [/openapi.json](https://nodegrade.com/openapi.json).

## Public pages worth reading

- [Home](https://nodegrade.com/) — the pitch and the scan CTA.
- [Methodology](https://nodegrade.com/methodology) — how the score is calculated, tier definitions, and rule versioning.
- [Sources](https://nodegrade.com/sources) — every underlying standard (RFC 9309, llmstxt.org, MCP, C2PA, IETF, W3C, WHATWG) linked with attribution.
- [Privacy](https://nodegrade.com/privacy) — data collection, retention, subprocessors, opt-out.
- [Terms](https://nodegrade.com/terms) — refund policy, warranty disclaimer, governing law.
- [Sitemap](https://nodegrade.com/sitemap.xml).

## What agents can do here

- Score a website: `POST https://nodegrade.com/api/scans` with `{"domain":"..."}`. No auth required for the read-only scan.
- Retrieve a prior report: `GET https://nodegrade.com/api/reports/{token}`.
- Unlock a report programmatically: `POST /api/leads` with the token and an email.
- Buy the Fix-Kit for a scanned domain: [https://buy.stripe.com/4gM3cve6o1IB1pa8ZCg7e06](https://buy.stripe.com/4gM3cve6o1IB1pa8ZCg7e06) ($99 one-time, Stripe-hosted).
- Subscribe to weekly Monitoring for a domain: [https://buy.stripe.com/4gM4gz7I0af76JuejWg7e07](https://buy.stripe.com/4gM4gz7I0af76JuejWg7e07) ($29/mo, Stripe-hosted).
- Introspect the MCP server: [https://nodegrade.com/.well-known/mcp.json](https://nodegrade.com/.well-known/mcp.json).

## Crawl policy

Please respect `robots.txt`. The Allow list explicitly welcomes GPTBot, ClaudeBot, PerplexityBot, Google-Extended, and CCBot. Rate-limits are the same for agents as for humans (10 scans/min/IP). If you need higher volume, email `hello@nodegrade.com`.

## Provenance

NodeGrade does not fabricate findings, apply undisclosed proprietary weights, or run keyword tricks. Every rule maps to a public URL you can verify. Any citation NodeGrade emits carries the source URL inline.

## Contact

- General: hello@nodegrade.com
- Privacy: privacy@nodegrade.com
- Legal: legal@nodegrade.com
- Sources / corrections: sources@nodegrade.com