The other 5 read Companies House, your public website and published rates. Nobody needs your permission to read a public record, so those are open to any assistant, right now, with no account and no key. Your equipment, your bank statements are a different thing, and they are behind a key only you can hand out.
The public record and published rates. Any assistant can add this endpoint and call them today.
Your register, your position and your ledger. Absent from the list until a key is presented.
No key for a demo business is written down, so there is nobody to take one back. Running out is how one is withdrawn.
A key names one business and one job. There is no key that covers a book of clients, because an accountant acting for five businesses holds five of them: each client says yes for themselves. Nowhere in this product can a practice make a key for a client.
A key for a demo business is a signed sentence that nothing writes down. It runs out after 12 hours and it cannot be withdrawn before then, because this business belongs to nobody and there is nobody to take it back. A business on an account gets a key that can be ended.
A real exchange against Swiftline Couriers Ltd. Every figure and every tool return below is produced by the engine when this page loads, so it cannot drift from what the tools actually answer, and a test fails if it names a tool that does not exist. The calls are shown because a chat client hides them.
The endpoint is https://audit.itspickle.app/mcp, JSON-RPC over POST. Add it to any assistant that speaks MCP and the first 5 tools answer immediately. Your register is what the third call above was reading.
Three different readers, and they want different things. Something crawling wants text. Something driving the page wants to know which button is the point. Something holding a key wants tools. None of these is written by hand: each is generated from what the product already is.
| Where | What it holds | Worth knowing |
|---|---|---|
| /llms.txt | What this product is, what every screen is for, and how to act on it | Generated from the same registry the navigation is built from, so it cannot describe a screen that does not exist |
| /mcp | 7 tools over JSON-RPC, 5 of them open | The tool list is a function of the key presented, so ask for it after setting the header |
| /api/audit | The whole engine result as JSON, with every fact's source and confidence | For something that wants to compute rather than read |
| 4 screens as markdown | Append .md to /audit, /register, /dashboard, /practice | A second renderer over the same engine call this page makes, so neither holds the wording |
| A block inside the page | Which form on a page is the one action, and what each field means | For an assistant driving this page in a browser rather than calling the endpoint |
Every page above that has something to do carries a block telling an assistant which form does it. This one deliberately does not, and the reason is the whole point of it: the form on this page is the one that hands out permission, and an assistant that could submit it would be granting itself access. Issuing a key is a person's job, so it is described to a machine nowhere and reachable by one nowhere.
Every honest limit on this prototype is in /llms.txt as well as on the pages. Leaving the caveats out of the file a machine reads would be choosing which audience gets them. A ledger handed to https://audit.itspickle.app is read in the request that carried it and thrown away, whether you uploaded it or this fetched it from FreeAgent, and nothing here binds cover. What an account keeps is its own register, the corrections it has made, what a ledger it was given proved, and the keys it has handed out. Never the file, and never a key we could show anybody again.
Illustrative only. This is a statement of demands and needs based on public records and information you confirm, not a personal recommendation or a quote. Prices are banded estimates derived from published rates and are not an offer of cover.