trusted mcps72 integrations, one server
vendor-built mcps. not strangers from the internet.
Every integration Cogny offers runs on Cogny's own MCP server, built and patched by our team. Pulling a random MCP from a public registry is the pattern the NSA warned the industry about in May 2026.
72 integrations. one team responsible.
Each ships from our repository. The exception you choose yourself: a remote MCP server you add by URL runs wherever its vendor runs it.
- Ad platforms
Google Ads, Meta Ads, LinkedIn Ads, TikTok Ads, X Ads, Reddit Ads, Snapchat Ads, Bing Ads, Apple Search Ads.
- Analytics & search
GA4, Search Console, Bing Webmaster Tools, Mixpanel, PostHog, Matomo, Plausible, Microsoft Clarity.
- Tags & data
Google Tag Manager, Segment, Supabase, Metabase, Azure SQL.
- Commerce
Shopify, WooCommerce, Abicart, Litium, ShipStation.
- Email & CRM
Klaviyo, Mailchimp, Brevo, Braze, MailerLite, Pipedrive, Upsales, HubSpot Forms.
- Sites & content
WordPress, Webflow, Framer, Contentful, Sanity, Ghost, Wix.
four ways a wild mcp goes wrong.
Failure modes the NSA flagged in real-world MCP deployments.
- Tool poisoning
The NSA describes a malicious MCP server quietly switching from a benign tool description to a malicious one after install. Agents started exfiltrating WhatsApp messages with no user notice. The same pattern works against any MCP your agent has trusted.
- Naming collisions
Public MCP registries let two servers ship tools with the same name. The agent resolves to whichever one wins the race, often the malicious one. Cited in the NSA report as “parasitic toolchain attacks.”
- Blanket scopes
The GitHub MCP server, when installed, can read every private repo and write to public ones on your behalf, with no per-repo or per-action consent. The NSA flagged it by name. Many third-party MCPs follow the same all-or-nothing pattern.
- Supply-chain rot
“The MCP project documentation has identified that many popular servers are no longer actively maintained.” Orphaned servers don’t get patched. CVE-2025-49596 (RCE in MCP-Inspector) is what that looks like in practice.
a cogny mcp next to a random one.
| dimension | cogny | random mcp |
|---|---|---|
| Built by | Cogny engineers, in our own repository, released through review. | Anonymous maintainers. Often archived. No SLA. |
| Hosting | Run by Cogny in the EU, next to your workspace. | Wherever the maintainer chose. |
| Credentials | OAuth or an API key per integration, stored encrypted. Disconnecting deletes them. | Often blanket account access (the NSA flagged GitHub MCP by name). |
| Tool definitions | Defined in Cogny’s code. They change only with a Cogny release. | Can silently change between calls (the NSA flagged a WhatsApp MCP by name). |
| Output handling | In Cogny’s own agents, Cogny Shield can mask personal data and scan tool results for injected instructions. Both are per-workspace switches. | Whatever the server returns flows straight into your model’s context. |
| Fixes | Patched once, on Cogny’s server. Every workspace gets the fix. | You upgrade. Or you don’t. |
| Audit | Every write call is logged: tool, time, success or failure, and who authorised the connection. | Whatever the server chose to log. Often nothing. |
who approves a write.
It depends on where the change is made. We say it plainly so nobody assumes a second check.
- From your own AI
Your client (Claude, ChatGPT and others) is the approval step. Cogny runs a write it receives over MCP and does not hold it for a second approval. Keep write tools set to ask every time.
- In the Cogny app
Write tools ask a person first by default, per tool.
- Blocked tools
A tool set to blocked is not offered to your agent and is refused if called. Block every write tool and an integration is read-only.
- Per member (Cloud)
Owners choose which integrations and tools each member may use, in the app and over MCP.
“MCP's rapid proliferation has outpaced the development of its security model. Much like early web protocols, MCP was released with a flexible and underspecified design, allowing implementers freedom of design but also introducing ambiguity for safe usage.”