# Prospektor > Prospektor tells a B2B sales team which companies to approach, and what to > send them. The second half is the product: a deck, a one-pager, emails and a > proposal written in one client's voice, grounded in the work that client has > already won. `studio.prospektor.ai` is the signed-in application. Six calls on it need no account and no key; a workspace's owner can mint a token for three more. Both lists are below, and together they are the whole machine surface. ## Free, no account, no key - [GET /api/scan?domain=example.com](https://studio.prospektor.ai/api/scan?domain=example.com) — the glance for one domain: identity, a fit score out of 100, the one argument the case rests on, signals for and against, and the roles worth approaching. `status: "none"` means nobody has asked about this domain yet. - [POST /api/scan](https://studio.prospektor.ai/api/scan) — `{"website": "example.com"}` starts a glance. It takes about fifteen seconds; poll the GET until `status` is `done`. - [GET /api/scan?dry_run=1](https://studio.prospektor.ai/api/scan?dry_run=1) — what a glance will cost, before you ask for one. Spends nothing and writes nothing. - [GET /api/scan?budget=1](https://studio.prospektor.ai/api/scan?budget=1) — what your day has left. Back off here rather than on the 429. - [POST /api/run](https://studio.prospektor.ai/api/run) — `{"website": "example.com"}` runs the free journey: read this company, then find companies it should approach. Answers `{"token": …}`; `GET /api/run?token=…` reads the run as it fills in. - [GET /api/help](https://studio.prospektor.ai/api/help) — the whole product documentation corpus as JSON, from this deploy. Readings are cached by domain and shared by everyone who asks, so a repeat is instant and costs nothing. New work is capped per caller per day; over the cap is a 429 with a plain sentence, never a queue. ## With a workspace token A workspace's owner mints one in **Workspace settings → API**. Send it as `Authorization: Bearer psk_…`. Scopes are ticked at mint and a token never gains one later. A token never expires unless its owner set a date at mint; `whoami` says which, so read it rather than waiting to be refused. - [GET /api/v1/whoami](https://studio.prospektor.ai/api/v1/whoami) — what this token is, what it may do, when it expires (`null` = never), and how much of its day is left. Costs nothing. Call it first. - [POST /api/v1/outcomes](https://studio.prospektor.ai/api/v1/outcomes) — `{"company": "Northwind", "stage": "meeting", "note": "…"}` records what happened with a prospect. Scope `context:write`. **Free and unmetered** — every outcome sharpens the next pitch, prep sheet and inbound judgment this workspace writes. `GET` the same path for the stage and ending vocabularies. - [POST /api/v1/scan](https://studio.prospektor.ai/api/v1/scan) — `{"website": "example.com"}` runs the glance above against this token's own daily budget rather than the public one. Scope `scan:run`. Poll `GET /api/v1/scan?domain=…`. - [POST /api/v1/pitch](https://studio.prospektor.ai/api/v1/pitch) — `{"company": "Northwind", "website": "northwind.com"}` researches the company and writes the pitch in the workspace's voice, deliverables included. Scope `work:run`; spends a run. Answers `202` and a job id; poll `GET /api/v1/pitch?id=…` until `status` is `done` — several minutes, so wait between polls. The answer carries the sources, the identity the run settled on and what compliance found. - [POST /api/v1/prep](https://studio.prospektor.ai/api/v1/prep) — `{"company": "Northwind", "callStage": "discovery", "note": "…"}` writes a one-page call sheet, drawn from the saved pitch when there is one. Scope `work:run`. `GET` bare for the call stages; `GET ?id=…` to poll. - [POST /api/v1/paths](https://studio.prospektor.ai/api/v1/paths) — `{"pitchId": "…"}` maps the workspace's imported network against a finished pitch. Scope `work:run`. The paths land on the pitch: poll `GET /api/v1/pitch?id=…` and read `warmPaths`. With no network imported it answers `400` and sends nothing to a model. - [GET /api/v1/library](https://studio.prospektor.ai/api/v1/library) — `?id=…` or `?company=…` reads **one** saved pitch, whole. Bare, or `?q=…`, is the index: id, company, score, verdict, one sentence — at most forty, never a body. Scope `library:read`. - [GET /api/v1/export](https://studio.prospektor.ai/api/v1/export) — a copy of the workspace: the brief, every run, the library, outcomes, the shelf, the ruled-out list. Scope `export:workspace`, ticked by name. Call it bare for a manifest of what is here and what is not, then `?kind=` and follow `next`. Twenty calls a day per workspace, and every one is logged. `/api/v1` shapes do not change under you; everything else here is free to. ## As an MCP server [/api/mcp](https://studio.prospektor.ai/api/mcp) is the same surface as a remote MCP server — streamable HTTP, JSON-RPC over `POST`, the workspace token as `Authorization: Bearer`. Nine tools: `whoami`, `scan_company`, `build_pitch`, `job_status`, `get_pitch`, `list_library`, `prep_for_call`, `find_warm_paths`, `record_outcome`. Each is metered under the same verb and scope as its `/api/v1` route; the handshake (`initialize`, `tools/list`, `ping`) is free. `GET` is a `405` — no stream, no session. A client that cannot send a header signs in by OAuth instead: a `401` names `/.well-known/oauth-protected-resource/api/mcp`, registration is open at `/oauth/register`, consent is `/oauth/authorize`, and `/oauth/token` hands back a workspace token (MCP authorization spec 2025-06-18, PKCE required). The studio's *Copy setup for your agent* button, beside a freshly minted token, hands a person the paste that wires it up. ## What ships with every answer - Sources. Every claim names the page or the search it came from. - The companies ruled out, and the reason each one was ruled out. - Roles, not names, on a glance — a name needs a source, and fifteen seconds does not buy one. ## What is not here - **No manifest.** The MCP server is `/api/mcp`, named here and in the help; `/.well-known/mcp-manifest.json` is a 404, because there is no manifest standard and a 200 of markup is a worse answer than a 404. The OAuth metadata beside it is real. - **No sign-in for an agent.** A token is a workspace credential, not a person. It cannot mint another token, and it reaches only the workspace that minted it. - **No ambient bulk read.** Every call is one unit of work, bar one: `export:workspace` is a copy of the workspace, and it is a scope you tick by name, capped at twenty calls a day and logged each time. No other endpoint enumerates anything, with or without a token. - **No directory.** `/api/scan` answers about the one domain you name. There is no listing of what has been read, and an export reaches one workspace — the one that minted the token. - **Nothing that is a way in.** An export carries the work and not the keys: no API tokens, no share links, no members, no read receipts. The manifest names everything it left out. - **No operator surface.** `/api/admin` is unreachable by any key or token, and always will be. ## The human pages - [prospektor.ai](https://prospektor.ai/) — what it is. - [prospektor.ai/pricing/](https://prospektor.ai/pricing/) — what it costs. - [prospektor.ai/help/](https://prospektor.ai/help/) — the corpus `/api/help` serves, rendered for a person. - [prospektor.ai/privacy/](https://prospektor.ai/privacy/) — what is kept, and what deletion leaves. - [studio.prospektor.ai/r](https://studio.prospektor.ai/r) — the free run, for a person: type a domain, get companies to approach.