--- type: "article" title: "What’s Cookin’ in Hook-land? (Vol.7)" summary: "Vol 7… MCP security threats, 6-step workflow hacks, and why I stopped listening to startup podcasts" newsletter: "Left Hook" newsletter_handle: "left-hook" newsletter_url: "https://usecommune.com/n/left-hook" author: "Sean Matthews (@seanspeaks)" published: "2025-08-12T20:54:06.000Z" canonical_url: "https://usecommune.com/n/left-hook/a/what-s-cookin-in-hook-land-vol-7" markdown_url: "https://usecommune.com/n/left-hook/a/what-s-cookin-in-hook-land-vol-7.md" chat_url: "https://usecommune.com/n/left-hook/a/what-s-cookin-in-hook-land-vol-7/chat" source_url: "https://lefthook.kit.com/posts/7" body_source: "imported" likes: 0 replies: 0 body_words: 1532 --- # What’s Cookin’ in Hook-land? (Vol.7) *Hey There! Below is our/my weekly newsletter on anything integration and APIs. As always, please reply and let's talk about whatever catches your attention, or any questions you might have.* # On a personal note... Over the past ten-plus years, I've been a voracious consumer of podcasts and blogs that I found useful. Everything from This Week in Startups to Startups for the Rest of Us, Hard Fork, Reply All... basically anything that had to do with business building or something in the tech space. I was also listening to programming and developer podcasts like JavaScript Jabber, just to keep me informed and exposed to new ideas. Four to eight hours a week, easy. Eventually, I hit a point where I was just listening for listening's sake and wasn't executing. I'm sharing this because I find myself in a spot where I've been listening to a lot fewer podcasts these days. I still have my go-tos for news - Hard Fork remains a frequent listen, and The Vergecast is pretty good for their raw take on tech news. But as far as actual starting-a-company content? I don't find much value anymore. **The value is already there, in my head and in the content I've aggregated. Now it's just on execution.** So I'm curious - is anyone else running into that? Is it the stage of life I'm in? Or maybe my posture has shifted away from learning? That last part concerns me a bit, because I always want to maintain that learning posture. The fear is that I'm hardening, no longer neuroplastic, and that's... not great. What are your favorite podcasts that you listen to regularly? Is there anything that informs your day-to-day? And is there anything you think you'll listen to regardless of your day-to-day work? I'm all ears. Happy to listen. (Ah... should I remove the pun? 😂) Oh and I had another fun moment. I sent in a slew of questions to Startups For The Rest Of Us a while back. Rob answered another one recently. [Here's the episode! My question is at ~9:30 mark.](https://www.startupsfortherestofus.com/episodes/episode-785-choosing-between-ai-products-building-multiple-apps-and-more-listener-questions-a-rob-solo-adventure)​ ![](https://embed.filekitcdn.com/e/gMtzGmZ1nP1uogiQWhDnPA/jbWCSApUDG3PyUXoAiYLTk/email) *I was on a show!* Best, ~Sean # What we're seeing **Every provider should manage their own MCP server (for security reasons)** This week, [Emmanuel Paraskakis (a really solid API design consultant) posted](https://www.linkedin.com/posts/emmanuelparaskakis_hands-on-mcp-from-api-to-live-mcp-server-activity-7360751485611098112-J9eB?utm_source=share&utm_medium=member_desktop&rcm=ACoAAAebMZ8BQwmRCusyaW979DrWyU07mcA4Vxo) about how every provider should manage their own MCP server. At first, I thought this was just about opportunity - you know, control your developer experience, make it better, etc. But then he said the magic words: **"Why? Because you’ll need to ensure the quality and integrity of that server. It’s like being in control of your domain name."** And that's when it clicked. This is actually a pretty dangerous situation across the industry. LLMs are notoriously vulnerable to prompt injection attacks and poisoned seed attacks. That alone is reason to hesitate, especially for enterprise usage. But the more people use LLM tools that allow plugging in MCP servers, the more risk we're creating. Here's the scary part: The LLM itself might search for and find a server that pretends to be, or presents itself as, the actual server you should be using. And users wouldn't know it's not certified or official. They'd just plug it in and start using it. The real danger? Bad actors could put out legitimate-seeming MCP servers that capture the LLM audience. And unlike SDKs (where the security risk is limited to developers who generally know enough to be careful), with MCP servers, the attack vector is everyone - from junior associates to C-suite executives. **You cannot guarantee the technical expertise of the person adopting it.** So Emmanuel's take to manage your own server is both an opportunity (better experience, forward-thinking) AND risk mitigation. The downside of not doing this is way worse than just "we didn't optimize our developer experience." **So... what's this mean If you're a user:** Only install MCP (or "integrations") from certified sources. Check the provider's website. Double-check the source. If it's from a random website, check again. **And If you're a provider:** Start educating your users about this security threat. And seriously consider managing your own MCP server. **Mind Studio's clever workflow optimization hack** ​[Sean Thielen, CTO of Mind Studio (an AI-native workflow builder), shared something pretty remarkable this week](https://www.linkedin.com/posts/sean-thielen-10691268_if-youve-seen-people-sharing-screenshots-activity-7360774077973766145-xvFa?utm_source=share&utm_medium=member_desktop&rcm=ACoAAAebMZ8BQwmRCusyaW979DrWyU07mcA4Vxo). He took a 15-20 step n8n workflow, broke it down using ChatGPT, fed it into Mind Studio's AI, and Mind Studio generated a 6-step workflow that did the same thing. ​ ![](https://embed.filekitcdn.com/e/gMtzGmZ1nP1uogiQWhDnPA/6FSR5kvzPHpKm61MnxcQf6/email) *Breaking down the complex flow using ChatGPT and reproducing it in 6 steps in MindStudio* His understatement: "That's pretty cool." My take: **That's remarkable.** What's happening here is that Mind Studio handles retry logic, checking logic, etc. under the hood. But more importantly, this approach works across platforms. You could take a workflow image, run the same playbook, and generate workflows for Zapier, Make, n8n, or any platform with AI generation capabilities. This is leveling the playing field. The old-school integration platforms required you to think like a developer to do anything advanced. With AI-native builders, that requirement is disappearing. You're just thinking about the steps, not the implementation details. The fun hack here: If you see workflows floating around that you want to try, just screenshot them and use this approach. It's a great way to see what different platforms do better or worse than others. # What we're hearing **Integrations are tied to engineering roadmaps (and that's a bottleneck)** This week's theme continues from last week - when fires are burning, integrations get pushed aside. But there's another layer we're seeing: integrations are often tightly tied to engineering and product roadmaps in ways that create bottlenecks. I don't mean "we'll get to building that integration when we have time." I mean the API itself, the developer experience, the core infrastructure - those things aren't ready and take time to build. And that time isn't replaceable by AI waving a magic wand. In growing organizations, even if the integration itself is theoretically fast to build, you have to let the product and engineering teams catch up to the capabilities needed for a good API. **If you're a product manager trying to get integrations built, here's my advice:** - Find quick wins that leverage your existing API - Put pressure on the roadmap to improve your API - Design ahead - if you know the API will improve in certain ways, get your integrations ready in parallel **For end users:** The maturity of a product's API often dictates when integrations get built. If they have no integrations listed, they probably haven't built up the product enough yet. If they have an API, you can at least do something about it yourself (use an integration platform, have Claude or ChatGPT spit out a piece of script, or get developer help). **In-product integration discovery is still a mystery** Had a conversation with someone trying to figure out how to surface integration points inside their app. Their current solution? A link to their app marketplace in a modal. Not exactly seamless. The whole flow of "let me find integrations that have exactly this feature I want, install it, and come right back to where I was" - that's still largely unsolved. Slack does something interesting with domain recognition - if you share a link, they ask if you want to install that app. That's pretty clever. **Have you seen any great examples of in-product integration discovery?** I'd love to hear about experiences you've appreciated. These are the things I could post about at length. # What we're doing **Building Frigg health checks** We've been implementing health check endpoints for Frigg's integration management API. Once Frigg is deployed somewhere, unless we have full system access, it's actually hard to know if there's anything funky about the unique environment. This health check lets us ping and ask "how are we doing? Everything looking good?" before we push integration logic in. It's a sanity check that helps us crystallize how Frigg sits inside someone's architecture. Been on my mind for a long time, so having the justification to build it feels really nice. **Automating integration documentation with AI (but not how you'd think)** We've been working through automating quick videos and support docs for integrations. Here's the interesting part: **it's actually better to write documentation with a coding assistant than a general LLM.** The approach that's working: 1. Take an existing support doc (written for end users, not developers) 2. Bring it into your code environment 3. Ask your coding agent: "Look at the repo, understand what we've just added, and create change log notes in the same style and conversational manner as this doc" This gets us 80-90% ready-to-go support docs. It's a no-brainer to ship these with integrations because users need to know where to find help. *** **Anywho, we're still looking for more companies to take us up on our**[5 company unlimited integrations offer](https://learn.lefthook.com/unlimited-integrations)**. We have a few spots left.** Reply to let me know your thoughts. What do you want to know more of? Smash that unsubscribe button below if you don't like it. Forward to a friend if you do! ## Until next time! Sean Matthews Co-Founder ​[Left Hook](https://lefthook.com)​ *** ## Discussion No replies yet.