Blog
Notes on agents and the apps they cannot reach
How we think about access, safety and pricing. Short reads.
- Latest Security
AI agent security: is it safe to let AI use your accounts?
Yes, if you limit what it can do. The five real risks of an AI agent acting in your accounts, the controls that work, and how agents should sign in. Cotlet team 10 min read Read post - Agents
MCP vs API: what actually changes when an agent is the client
An MCP server is usually a layer over an API, built for a model that picks tools at runtime. How they differ in discovery, auth and cost, and which you need. Cotlet team 9 min read - Agents
Browser automation vs API: what works when an app has none
Browser agents, RPA bots or the app's own requests behind a typed tool? Success rates, cost per task and what breaks, with a decision rule. Cotlet team 10 min read - Security
Can AI solve CAPTCHA? Yes. Here is why we still refuse to
Models and solver services beat most CAPTCHAs today. Why your agent should still let a person pass every CAPTCHA and MFA prompt, with the case law. Cotlet team 9 min read - Agents
Why companies don't offer a public API: the vendor's side
Every web app already has an API its own frontend calls. Seven reasons vendors keep it private, with real examples, and what you can do about it. Cotlet team 9 min read - Agents
Claude connectors: how to add one, and what if your app is missing
What Claude connectors are, how to add one in Claude.ai, Desktop and Claude Code, which plans allow custom ones, and your options when an app has none. Cotlet team 10 min read - Security
Is web scraping legal? Public data, logins and AI agents
Scraping public pages is usually legal in the US and EU, with limits. Logged-in automation is a different question. The cases, the rules and a checklist. Cotlet team 9 min read - Security
MCP security: a threat model before you connect an account
Tool poisoning, rug pulls, prompt injection and malicious packages, with real incidents, and a checklist for vetting an MCP server first. Cotlet team 9 min read - Product
Open source MCP servers for apps with no API: worth the risk?
A GitHub MCP server for an app with no API can work, but it runs on a private API that breaks. How to judge one, and a checklist before you npx it. Cotlet team 10 min read - Product
Remote MCP server vs local: how to run MCP and who should host it
A remote MCP server runs over Streamable HTTP at a URL, a local one runs on your machine over stdio. How auth, secrets, clients and hosting differ. Cotlet team 10 min read - Agents
Why your AI agent says "this app has no API"
Agents can only work in apps that expose an API or MCP server. Many tools still have neither. What that gap looks like and the options you have today. Cotlet team 2 min read - Pricing
How Cotlet credits will work: one unit, successful calls only
One billing unit for every app, charged only for calls that succeed, with a spending cap on by default. Nothing is charged until your access is active. Cotlet team 1 min read