Cognia is a security-positioned product, and this package runs in the trust boundary of any MCP client that installs it. We take vulnerability reports seriously and respond quickly.

Do not open a public issue for security reports.

Use GitHub's private vulnerability reporting: https://github.com/cogniahq/cognia-mcp/security/advisories/new

You will get an acknowledgement within 48 hours and a remediation timeline within 5 business days.

If GitHub Security Advisories are not available to you, email security@cogniahq.tech with the details. PGP available on request.

In scope for this repository:

• The MCP server (src/server.ts, src/cli.ts)
• The bundled REST client (src/client.ts, exported as @cogniahq/mcp/client)
• Anything in dist/ shipped to npm under @cogniahq/mcp

Out of scope here (report to the Cognia security page instead):

• The Cognia API surface (api.cogniahq.tech)
• The encrypted backend, search pipeline, and admin console
• The web app at https://cogniahq.tech

For backend issues see https://cogniahq.tech/security and the public threat model.

Older versions are unsupported.