Coconut is betting that context outlives the tool

01 — The product

What Coconut actually does

Coconut connects an organization's scattered documents, tools, and undocumented know-how into one living, governed source that any AI tool draws from through a permission-aware MCP connector. It is not a chatbot, not a search box, and not a wiki. It is the layer underneath all three.

The problem, stated precisely

Coconut argues organizational AI context fails in three compounding ways, and the framing is worth repeating because it is the sharpest part of the pitch:

• Fragmented — AI tools do not share context with each other, so every session starts from zero.
• Stale — context goes out of date the moment things change, so AI works from last month's reality.
• Inconsistent — without a shared source, output varies across every tool, team, and session.

The distinction Coconut draws against enterprise search is the crispest sentence on the site: search helps people find information; a context layer gives AI the knowledge to act on it. That is a real difference, and it is the argument that has to survive contact with Glean.

What is genuinely differentiated

Three things hold up under scrutiny, and none of them is the five-layer taxonomy.

What is claimed but not yet shipped

Pricing and access

Three contact-sales tiers, no public figures. Team for a first pilot, Company for multi-team workspaces, Enterprise for org-wide rollout with SSO/SCIM and procurement support. Access is still invite-only and demo-gated as of 8 August 2026; the docs site says so on its front page.

Prior research recorded these tiers as Starter / Growth / Enterprise. They are now Team / Company / Enterprise. Small, but it dates every document that still says otherwise.

Security posture

AWS, AES-256 at rest, TLS 1.2+ in transit, RBAC, MFA, least privilege, audit logging, regular penetration testing. Three deployment models: multi-tenant SaaS, single-tenant hosted, and self-hosted in your own environment.

02 — Architecture

A context layer wrapped around a coding agent

The published architecture diagrams in circulation — including the one in the Notion brief — describe Coconut as connectors feeding a knowledge index feeding a context layer. That is accurate but incomplete, and the omission matters. Reading the API reference and the skills documentation changes the picture.

The distribution surface

The MCP server at app.coconut.dev/mcp exposes 26 tools gated by granular OAuth scopes — coconuts:read, tasks:write, knowledge:read, context:read, jobs:write, skills:write and others. Scope-level authorization is genuinely more careful than most MCP servers ship, and it is the concrete thing behind the "permission-aware" claim. Skill write operations are restricted to organization admins, with organizations managed through Clerk.

Coconut also publishes an A2A agent card endpoint. That is a bet on agent-to-agent interoperability beyond MCP, and neither prior research report noticed it.

Three architectural risks

1. A VM per organization is a heavy unit of deployment. It buys strong isolation and a credible self-hosted story. It also means per-tenant cost scales with tenants rather than usage, which is an uncomfortable shape for a seat-priced product and makes a free tier hard to offer against a competitor whose unit is a database row.
2. The agent runtime is selectable, but the skills shelf is not. The scheduler offers Claude, Gemini, or Codex per job and the coding-agent picker offers Claude Code or Codex, so the runtime is genuinely model-agnostic. What is not agnostic is distribution: skills ship through the Claude Code plugin marketplace and are written to Anthropic's SKILL.md spec, with a third-party tool (openskills, unaffiliated with either company) as the route into Cursor or Codex. The dependency is real, but it sits in the supply chain rather than the execution path.
3. Retrieval is undocumented. Coconut says knowledge is "indexed and available for retrieval" and stops there. Hyper publicly describes query expansion, reciprocal rank fusion over embeddings and Postgres full-text search, and a ZeroEntropy reranker. A technical evaluator comparing the two will notice which one is willing to show its work.

03 — End-user workflows

Four workflows, and only one of them is the demo

Coconut's documentation organizes usage around what it calls loops — recurring, scheduled agent workflows rather than one-off prompts. This is the most concrete articulation of the product and it is buried in the docs rather than on the marketing site.

A. Onboarding — the first two weeks

1. Request a demo Access is invite-only. There is no self-serve path, so evaluation begins with a 30-minute sales call.
2. Bootstrap from templates Coconut builds initial context from templates plus materials you already have. The explicit promise is "no blank screen."
3. Connect sources Slack, Google Drive, Notion, HubSpot, Linear, Asana, Box, Fireflies, Git, email.
4. Assign owners Each space gets an owner and role-based access. This is the step that makes the governance story real, and the step most likely to stall.
5. Install the MCP connector Added as a custom connector in Claude, ChatGPT, Copilot, or Gemini, with OAuth scopes chosen at grant time.
6. Verify grounding Ask a question whose answer you already know and check that every figure traces to a source.

B. Daily use — the drafting loop

A team member asks their normal AI tool for a board deck, a memo, or call prep. The MCP connector performs a permission check, fetches relevant pages across the five layers, and injects them. The output arrives sourced, with each figure traceable. Coconut's own illustration claims a first draft in about 12 minutes.

The return path matters more than the draft. When the user finds something wrong, they open a Task — a change proposal against the context layer. An owner reviews and approves, and the change propagates downstream. This is the loop that makes context compound instead of decay, and it is the part still marked coming soon.

C. Background — space agents on a schedule

Each space's agent runs unattended: folding new call transcripts into the right memo, appending the sources it used, refreshing research pages, flagging coverage that has gone stale. Documented recurring loops include:

"One validated proposal per run, or an honest report of why nothing cleared the bar" is a notably disciplined default. Most agent products in this category are tuned to always produce output.

D. The developer workflow — the hidden second product

nut init creates a git-versioned .nut directory. From there: nut context sets role and memory, nut skill installs packaged behaviors, nut code runs AI-assisted implementation, nut task opens change proposals, and full git operations run through the API — branches, worktrees, commits, diffs, push.

Who this is sold to

04 — Competitive landscape

The category got named, and then it got crowded

In its Summer 2026 Request for Startups, Y Combinator formally named this category the Company Brain: a system that pulls knowledge out of fragmented sources, structures it, keeps it current, and turns it into an executable skills file for AI. That is Coconut's pitch, published as an open invitation to build it. At least six funded teams accepted.

The six that are actually the same product

Funding rank understates the real threat. These teams are building Coconut's architecture, with Coconut's vocabulary, on Coconut's timeline — and most of them launched publicly while Coconut stayed invite-only.

Names to drop from any competitive deck

Prior research included several companies that use "brain," "memory," or "context" language while doing unrelated work: SuperHawk (revenue ops), Ego.ist (consumer identity), HeyClicky (screen tutor), Iris (personal calendar), Stamp (email client). None is an org-wide governed context layer. Including them in a competitive analysis dilutes its credibility.

One correction worth making in the other direction: Quivr has 39,393 GitHub stars and has not been pushed since 9 July 2025. It is the best available evidence that stars are not traction and that build-your-own second-brain projects decay — which is ammunition for Coconut's managed pitch, not against it.

→ Search the full 47-company database, filterable by tier, with each company's relationship to Coconut and a confidence flag on every entry.

05 — Existential threat

What actually kills this company

Not Glean. Not the YC cohort. The threats that end Coconut are structural, and two of the three are consequences of decisions already made.

Threat 1 — Anthropic owns the standards and the shelf

Skills ship through the Claude Code plugin marketplace. The AI chat endpoint defaults to Claude Sonnet 4.5. MCP — the distribution mechanism the entire product depends on — is an Anthropic-authored standard, as is the SKILL.md specification Coconut skills are written in.

Anthropic is simultaneously Coconut's default runtime, its skill distribution channel, its standards body, and the vendor of a competing product one layer up. Every capability Anthropic adds to Projects, Skills, or Cowork narrows the gap Coconut sells into, and Coconut has no leverage over that roadmap or its pricing. The same applies to OpenAI and Microsoft on the context-consumption side.

Threat 2 — The free option is good, and its author funds the competition

GBrain is MIT-licensed, Markdown-first, git-versioned, ships as an MCP server, has a multi-user company-brain mode, and reportedly runs a 25-person brain for under $100 a month. It has 28,015 stars four months after creation. It is written by Garry Tan, who is also president and CEO of the accelerator that funded Hyper, Cerenovus, Savant, Memory Store, and Glen.

A free, credible, well-distributed baseline does not have to win to hurt. It has to make every paid product justify its delta at the start of every sales conversation. Coconut's honest delta is managed connectors, permission enforcement done for you, deployment options, and someone to call at 2am. That is a real answer — it is the same answer GitLab gives against self-hosted git — but it prices Coconut against the engineering cost of a self-hosted alternative rather than against the value of the context itself. That is a much lower ceiling.

Threat 3 — Governance is the wedge, and the wedge is not finished

Against platform-native memory, against free open source, and against capture-first tools like Screenpipe, governance is the one defensible position Coconut has chosen. It is the right choice. But propose-then-publish review is marked coming soon, and there is no SOC 2 claim on the public site.

Meanwhile the deepest-pocketed competitors are moving onto the same ground: Glean sells a permissions-aware knowledge graph as the governed context layer, Stack Internal ships an MCP server over verified knowledge, and Guru has shipped verification workflows for years. Coconut is defending a hill that better-funded companies are already climbing, with part of its own fortification unbuilt.

Threat 4 — Surface area versus headcount

LinkedIn reports 2–10 employees. The shipped surface is: web Studio, Control Plane, iOS app, VS Code/Cursor extension, CLI, REST API, MCP server, A2A endpoint, connectors for ten-plus systems, an agent runtime, a skills marketplace, a mail system, image, audio and video generation, an interactive terminal, and full git operations including worktrees.

Every one of those needs maintenance, security review, and documentation. Some of it — the media generation, the mail system, the terminal — has no obvious connection to the buyer Coconut names on its own solutions pages. In a category where six funded teams are attacking the same wedge, breadth is the expensive way to lose.

Threat 5 — The name

"Coconut" collides with Coconut Software (banking), Coconut tax software, coconut.co (video encoding), and a Meta research paper. The company sits at coconut.dev while the Studio runs at app.coconut.md and the Control Plane at app.coconut.dev. Crunchbase and PitchBook return the wrong companies. For a company that will be researched by procurement teams and journalists, this is a persistent tax on every search.

06 — Stack map positioning

Where Coconut sits in the maps

Mapped against The AI Technology Stack (12 layers, silicon to verticals) and The Robotics Stack (14 layers, raw material to service).

The AI stack — three layers, not one

The robotics stack — the honest answer is no

Coconut does not fit the 14-layer robotics stack, and forcing it in would be the wrong call. That map runs raw material to service — magnets, actuators, lidar, end effectors, batteries, onboard silicon, ROS 2, simulators, teleoperation rigs, VLAs, fleet ops, OEMs, integrators, robot-delivered services. Every software layer in it is defined by physical embodiment: motion planning, real-time safety runtimes, world models, certification. Coconut has no embodied component and no robotics-specific data model.

Two honest adjacencies are worth stating rather than stretching:

• L11 · Fleet Ops, Safety & Certification — a robotics company operating a fleet has exactly the knowledge-governance problem Coconut solves: certification evidence, incident reviews, standards documentation, remote-operations runbooks, all of which must be current and traceable. Coconut would be a buyer-side tool for that team, not a component of the stack. The distinction matters.
• The vertical slot already has an occupant. Osseus (YC S26) is building a "secure research brain for R&D teams" — permissioned, version-aware memory connecting CAD, schematics, BOMs, firmware, simulations, tests, and supplier feedback for robotics and hardware R&D. That is precisely the shape a robotics-native Coconut would take, and someone is already building it. Entering would require CAD, BOM, and firmware-aware connectors, not Slack and Drive.

Recommendation: place Coconut on the AI stack map at L10 with cross-references to L09 and L11, and leave the robotics map alone. A context layer that claims to be everywhere is indistinguishable from one that is nowhere, and precision is the more credible position.

07 — Method

How this was built, and what it is not

Verification tiers

Every company in the database carries one of three flags:

• verified — confirmed 8 Aug 2026 against a primary source: the GitHub API, the company's own site, a YC company page, or a funding announcement.
• reported — consistent secondary sourcing (Tracxn, Sacra, trade press) without primary confirmation.
• thin — single-source or inherited from prior research and not re-confirmed. Treat as a lead, not a fact.

Conflicts log

Where sources disagreed, the disagreement is published rather than smoothed.

What this report does not cover

• Product quality. No hands-on evaluation. Retrieval accuracy, latency, connector reliability, and whether the five-layer model survives real use are all untested here.
• Funding and team. No disclosed rounds exist for Coconut AI Inc. Crunchbase and PitchBook return same-name companies. Leadership is not publicly named.
• Customers. One public reference: Ari Franklin, Group PM at Kohl's. No case studies, no scale metrics, no logo wall.
• Pricing. No public figures at any tier.

Known weaknesses in this analysis

1. The YC 2026 cohort is very early and moves weekly. Traction figures are point-in-time and self-reported at launch.
2. The VM-per-instance reading was originally inferred from the skills docs; it is now corroborated by the provisioning dialog, which asks for CPU, RAM, and disk. Still not confirmed by an architecture document from the company.
3. Absence of a SOC 2 claim on a public site is not proof of absence of SOC 2. It is proof that it is not being marketed, which is itself informative but weaker.
4. Funding data for Capacity, Shelf, Bloomfire, Swimm, and DevRev is inherited and thinly sourced.

Primary sources

• Coconut — Home
• Coconut — Platform
• Coconut — Pricing
• Coconut — Security
• Coconut — FAQ
• Coconut — Blog
• Coconut Docs
• Coconut Docs — llms.txt
• Coconut Docs — .nut directory
• Coconut Docs — Connectors & MCP
• Coconut Docs — Skills
• GitHub — lovelybunch (Coconut AI)
• GitHub — garrytan/gbrain
• YC — Hyper
• YC — Cerenovus
• YC — Savant
• YC — Memory Store
• YC — Glen
• Glean — Series F
• TechCrunch — Glean crosses $300M
• Dust — $40M Series B
• TechCrunch — Mem0 $24M
• ServiceNow completes Moveworks acquisition
• Contextual AI — Series A
• Guru — Series C
• The AI Technology Stack (report 01)
• The Robotics Stack (report 05)

08 — First-hand findings

What the connector shows that the docs do not

Everything in the other seven tabs is traceable to a public URL. This tab is not. It comes from connecting the Coconut MCP connector to a live beta instance on 9–10 August 2026 and reading the object model directly.

Finding 1 — The shipped connector is not the documented one

The public connectors documentation describes an MCP server exposing 26 tools shaped around instance management: coconuts_list, tasks_list, knowledge_search, jobs_list, skills_list. The connector that actually attaches exposes a different surface entirely, shaped around the context product.

Not one documented tool name appears. There is no knowledge_* namespace at all — the knowledge/context split the CLI documentation is built around does not exist in the shipped connector, where everything is a page in a space. The published API reference describes a different generation of the product.

This matters beyond tidiness. An evaluator who reads the docs, writes an integration against knowledge_search, and then connects will find nothing they planned for. It is also the second instance of the same pattern documented on the Product tab: what ships and what is described have drifted apart.

Finding 2 — The real object model

Three layers of content per page, not one — and this is the design detail that makes the "prose carries judgment, metadata carries facts that churn" claim actually work.

Finding 3 — Several things are better built than the marketing claims

This is the part worth telling the founder plainly: the engineering is ahead of the story being told about it.

• Metadata patches do not create a page revision. set upserts (JSON null deletes), append extends arrays atomically, and appendUnique is idempotent — explicitly safe for re-running agents. Metadata carries its own audit trail, separate from page versions. That is exactly the right design for "prose carries judgment, metadata carries the facts that churn," and no public page explains it.
• Real optimistic concurrency. Every update requires expectedVersion. Two agents cannot silently clobber one another — the second write fails rather than winning.
• The link graph is automatic. Indexed from Markdown bodies on every write, with backlinks and broken-target flagging. A dependency map that maintains itself, never mentioned in the marketing.
• Run observability is genuinely deep. Every run record carries status, timing, model, token usage, turn count, output, and an opt-in structured transcript of reasoning and tool calls. This is better instrumentation than most agent platforms expose.
• Agents really are principals. A run "executes as the space's agent principal" and writes its own record. The permission story is architectural, not cosmetic.

Finding 4 — Credit exhaustion degrades quality invisibly

Two things make this severe rather than cosmetic:

1. The quality gates cannot catch it. They interrogate reasoning — is the frustration real, is it genuinely unmet, is the scope honest. None of them asks whether evidence was actually retrieved. A well-reasoned argument from fabricated premises passes every gate.
2. The signal to catch it already exists and is not used. Run records carry a fetch count. Nothing consumes it. A run that fetched nothing is permitted to assert what a live page says.

The fix is small and sits in the product's own idiom: a run that performed zero retrievals should not be allowed to write a claim sourced to an external URL, and a degraded run should be marked as such on every page it touches. Provenance is the thing Coconut sells; this is the one place it is not enforced on itself.

In fairness: this is a degraded path, not the designed one. A properly executed agent run in the same instance — over a hundred tool calls, fetching live pages — recorded the same contested facts correctly. The architecture works. The failure mode is what happens when it cannot.

What this changes in the rest of the analysis