# Notes on agents and the apps they cannot reach > Notes from the Cotlet team on AI agents, apps that never built an API, how we keep your accounts safe and how pricing will work. Source: https://cotlet.dev/blog How we think about access, safety and pricing. Short reads. Filter posts by topic All posts 12 Agents 5 Security 4 Pricing 1 Product 2 - [Connect account Password never stored Session saved Latest Security / Oct 10, 2026 AI agent security: is it safe to let AI use your accounts? Yes, if you limit what it can do. The five real risks of an AI agent acting in your accounts, the controls that work, and how agents should sign in. Cotlet team · 10 min read Read post](https://cotlet.dev/blog/ai-agent-account-security) - [Book a slot in my salon app That app has no API. Agents / Oct 10, 2026 MCP vs API: what actually changes when an agent is the client An MCP server is usually a layer over an API, built for a model that picks tools at runtime. How they differ in discovery, auth and cost, and which you need. Cotlet team · 9 min read](https://cotlet.dev/blog/mcp-vs-api) - [Book a slot in my salon app That app has no API. Agents / Oct 9, 2026 Browser automation vs API: what works when an app has none Browser agents, RPA bots or the app's own requests behind a typed tool? Success rates, cost per task and what breaks, with a decision rule. Cotlet team · 10 min read](https://cotlet.dev/blog/browser-automation-vs-api) - [Connect account Password never stored Session saved Security / Oct 9, 2026 Can AI solve CAPTCHA? Yes. Here is why we still refuse to Models and solver services beat most CAPTCHAs today. Why your agent should still let a person pass every CAPTCHA and MFA prompt, with the case law. Cotlet team · 9 min read](https://cotlet.dev/blog/captcha-mfa-ai-agents) - [Book a slot in my salon app That app has no API. Agents / Oct 7, 2026 Why companies don't offer a public API: the vendor's side Every web app already has an API its own frontend calls. Seven reasons vendors keep it private, with real examples, and what you can do about it. Cotlet team · 9 min read](https://cotlet.dev/blog/why-apps-have-no-api) - [Book a slot in my salon app That app has no API. Agents / Oct 6, 2026 Claude connectors: how to add one, and what if your app is missing What Claude connectors are, how to add one in Claude.ai, Desktop and Claude Code, which plans allow custom ones, and your options when an app has none. Cotlet team · 10 min read](https://cotlet.dev/blog/claude-connectors) - [Connect account Password never stored Session saved Security / Oct 6, 2026 Is web scraping legal? Public data, logins and AI agents Scraping public pages is usually legal in the US and EU, with limits. Logged-in automation is a different question. The cases, the rules and a checklist. Cotlet team · 9 min read](https://cotlet.dev/blog/is-web-scraping-legal) - [Connect account Password never stored Session saved Security / Oct 5, 2026 MCP security: a threat model before you connect an account Tool poisoning, rug pulls, prompt injection and malicious packages, with real incidents, and a checklist for vetting an MCP server first. Cotlet team · 9 min read](https://cotlet.dev/blog/mcp-server-security) - [MCP cotlet.dev/mcp/v1 REST cotlet.dev/api/v1 One key Product / Oct 4, 2026 Open source MCP servers for apps with no API: worth the risk? A GitHub MCP server for an app with no API can work, but it runs on a private API that breaks. How to judge one, and a checklist before you npx it. Cotlet team · 10 min read](https://cotlet.dev/blog/github-unofficial-api-vs-hosted) - [MCP cotlet.dev/mcp/v1 REST cotlet.dev/api/v1 One key Product / Oct 3, 2026 Remote MCP server vs local: how to run MCP and who should host it A remote MCP server runs over Streamable HTTP at a URL, a local one runs on your machine over stdio. How auth, secrets, clients and hosting differ. Cotlet team · 10 min read](https://cotlet.dev/blog/remote-mcp-server) - [Book a slot in my salon app That app has no API. Agents / Oct 1, 2026 Why your AI agent says "this app has no API" Agents can only work in apps that expose an API or MCP server. Many tools still have neither. What that gap looks like and the options you have today. Cotlet team · 2 min read](https://cotlet.dev/blog/why-your-agent-says-no-api) - [Credits Successful call Failed call 0 credits Pricing / Sep 30, 2026 How Cotlet credits will work: one unit, successful calls only One billing unit for every app, charged only for calls that succeed, with a spending cap on by default. Nothing is charged until your access is active. Cotlet team · 1 min read](https://cotlet.dev/blog/how-credits-work) - [1](https://cotlet.dev/blog) - [2](https://cotlet.dev/blog/page/2) [Next](https://cotlet.dev/blog/page/2) ## Want your app first? Pick it when you sign up. The most-picked apps open first. [Request access](https://cotlet.dev/signup)