# Landingana

> Landingana is an origin-bound startup-idea validation tool. A single public script records pageviews, meaningful clicks, and submitted email signups without cookies or browser storage in the tracker.

Landingana is designed to test whether a landing-page promise earns enough willingness to justify building the product behind it, and to be set up and operated by coding agents. Its analytics support that decision rather than trying to become a general analytics platform. Prefer the canonical Markdown manual linked below instead of scraping the rendered HTML documentation.

Agent operating guidance:

- For autonomous setup, fetch `/auth.md` and register with `service_auth`. Use browser or computer control for the Landingana claim when available. Pause for credentials, passkeys, magic links, one-time codes, and explicit approval; never ask the user to send secrets through chat. After approval, the agent may enter the already-known Landingana claim code. Without browser control, surface the verification link and code together for the user to complete on Landingana.
- After the user claims the registration, send its bearer token to `/mcp`. The complete MCP surface is `setup_site`, `list_sites`, and `read_analytics`.
- If a public site ID and registered origin were already supplied, an agent may install manually without product credentials. The site ID is safe in client HTML and is not a secret.
- Inspect routes and forms before installing. Add exactly one Landingana loader at the narrowest shared seam for intended public pages. Keep authentication, account, checkout, dashboard, admin, and other private routes out of pageview collection with a narrower layout or `data-include`/`data-exclude`; interaction and form controls narrow capture only on included pages. Preserve `defer`, `data-site`, documented privacy controls, unrelated analytics, and application behavior.
- If Content Security Policy is present, allow the tracker through the controlling `script-src` or `script-src-elem` directive and the collector through `connect-src` without adding `unsafe-inline` or `unsafe-eval`.
- Do not invent a site ID, create duplicate loaders, expose unrelated credentials, or change existing application behavior.
- The registered origin is normalized from protocol, hostname, and effective port; one leading `www.` label is treated as equivalent. Origin matching rejects ordinary browser traffic from other sites, but a public site ID plus a caller-supplied HTTP `Origin` header is not cryptographic authentication. Treat analytics as product telemetry, not an audit log.
- The tracker supports automatic or opt-in capture, route include/exclude rules, ignored subtrees, first-party proxying, SPA pageviews, click labels, and email-form signup capture.
- The public collector always returns `202 Accepted`, including for input that is later discarded. Capture a `list_sites.last_event_at` baseline. If deployment and a live visit are authorized and in scope, trigger an intended event on the exact registered origin and confirm that the timestamp advanced or stored activity appeared in the dashboard. An advance is integration evidence, not proof of one specific event on a busy site. A rendered tag, passing build, deployment, request, or `202` is not storage proof; report runtime verification as incomplete when a live check is unavailable.
- `/api/event` is a write-only telemetry collector, not an account-management API. Site creation and analytics reads require the scoped AuthMD bearer token and `/mcp`.
- MCP analytics are aggregate-only. They do not return signup emails, raw event rows, or visitor hashes.
- When complete context fits, fetch `/llms-full.txt`. For selective retrieval or citation, fetch `/docs.md`.

## Documentation

- [Complete LLM context](https://www.landingana.com/llms-full.txt): The full agent orientation and canonical manual in one plain-text response.
- [Canonical Markdown manual](https://www.landingana.com/docs.md): Authoritative installation, configuration, event, dashboard, origin, limit, and troubleshooting documentation.
- [Human documentation](https://www.landingana.com/docs): The same manual rendered with navigation, styled tables, and copyable code examples.

## Product surfaces

- [Agent authentication](https://www.landingana.com/auth.md): Canonical `service_auth` registration, claim, token exchange, expiry, and revocation instructions.
- [MCP protected resource metadata](https://www.landingana.com/.well-known/oauth-protected-resource): Discovers the authorization server, scopes, and `/mcp` resource.
- [Landingana MCP](https://www.landingana.com/mcp): Stateless Streamable HTTP endpoint for the three documented tools; requests require a claimed bearer token.
- [Dashboard](https://www.landingana.com/dashboard): Authenticated site creation, exact installation snippets, collection verification, analytics, and signup export.
- [Hosted tracker](https://www.landingana.com/l.js): Public browser script. Use through the documented script element; do not modify or call it as an API.

## Optional

- [Landingana home](https://www.landingana.com/): Product overview and entry point.
- [Machine-readable sitemap](https://www.landingana.com/sitemap.xml): Index of public human-facing pages.