NAS (SFTP)

The NAS integration lets Cosmo browse, search and read files on a NAS or file server you reach over SFTP — Synology, QNAP, TrueNAS, a Linux server, or anything else that offers SFTP. It is read-only by default: Cosmo can look at your files but cannot change them. You can turn on write access when you want Cosmo to save files, make folders, move, copy and delete.

What it can do

With write access turned on, Cosmo also gets these:

Search matches names, not file contents. A scan, an image, a locked or very large file (over 25 MB) cannot be read, and Cosmo tells you so rather than guessing.

Before you connect

You need:

• SFTP turned on on the NAS. On Synology this is Control Panel → File Services → FTP → SFTP; on QNAP and TrueNAS it is part of the SSH/SFTP service settings.
• A user account on the NAS. If you only want Cosmo to look at files, use an account with read-only access to the folder you want to share — it is the strongest protection there is, whatever any software promises. If you turn on write access, use an account that can write only where you want Cosmo to.
• The NAS's address (for example 192.168.1.20 or nas.local) and, if it is not the default, its SFTP port (22 is the default; some Synology setups use a different one).

Cosmo must run on a computer on the same network as the NAS. The NAS usually has a private address that only your own network can reach, so it works from the Cosmo desktop app but not from scheduled Routines, which run on Cosmo's servers. A Routine can use a NAS only if the NAS is reachable from the internet (for example through a public address) — see Routines.

Connecting

1. Open Cosmo Desktop → Customize → Integrations.

2. Find NAS (SFTP) under "Add new integration" and click Connect.

3. Enter a label (for example Office NAS).

4. In SFTP connection address, enter the address in this form:

   sftp://USER:PASSWORD@HOST/FOLDER

   For example sftp://ada:s3cret@192.168.1.20/Projects. Add :2222 after the host if the port is not 22.

5. Click Connect. Cosmo logs in to the NAS to check the details before saving anything; a wrong password, an unreachable NAS or a folder that does not exist is rejected on the spot, with nothing stored.

The folder is a fence

The folder at the end of the address is the only place Cosmo can see. Paths are relative to it, and Cosmo cannot go above it — not with .., and not by following a shortcut (symbolic link) that points outside it. To share your whole NAS, end the address at the volume you want; to share one project, end it at that project's folder.

Special characters in the password

The address is a web-style address, so a few characters in the password must be written as a code:

A password of p@ss/word is entered as p%40ss%2Fword.

Letting Cosmo change files

By default the connection is read-only: the save, move, copy and delete tools do not exist for Cosmo at all. To turn them on, add access=readwrite to the end of the address:

sftp://ada:s3cret@192.168.1.20/Projects?access=readwrite

(With a fingerprint too: ?fingerprint=SHA256:...&access=readwrite.) To go back to read-only, reconnect without it.

What stays true with write access on:

• The folder is still a fence. Cosmo can only change things inside the folder at the end of the address — a path that leads outside it, including through a shortcut, is refused.
• Cosmo asks first. In the desktop app, saving, creating, moving and copying ask for your approval, and deleting asks with a stronger warning and can never be set to "always allow". Scheduled Routines never ask — a Routine you set up to save files will save them on its own.
• Nothing is replaced by accident. Saving and copying refuse an existing file unless Cosmo is explicitly told to overwrite it; moving never replaces anything.
• Deleting is permanent and narrow. There is no recycle bin over SFTP, and no "delete a whole folder" — only a single file or an empty folder.
• The NAS account still has the last word: if it cannot write to a folder, Cosmo cannot either.

Optional: pin the NAS's identity

To make sure Cosmo only ever talks to your real NAS, add its host-key fingerprint to the end of the address:

sftp://ada:s3cret@192.168.1.20/Projects?fingerprint=SHA256:...

You can read the fingerprint from the NAS's SSH settings, or run ssh-keyscan -t ed25519 HOST | ssh-keygen -lf -. If the NAS later presents a different key, Cosmo refuses to connect. Without a fingerprint, Cosmo trusts the NAS you named.

Security notes

• The address, including the password, is stored with your connection on the Cosmo server, like the key for any other connector. It is yours alone: nobody else in your organization can see or use it. Use a dedicated NAS account — read-only unless you turn on write access — so the password is worth little if it ever leaked.
• Cosmo never shows the password back, and error messages do not contain it.
• The connection is made from your own computer, directly to the NAS.

Example requests

• "What's in the Projects folder on the NAS?"
• "Find the budget spreadsheet for 2026 on the NAS and summarize it."
• "Read /Contracts/supplier-agreement.pdf and list the termination clauses."

With write access on:

• "Save this summary as /Projects/2026/summary.md on the NAS."
• "Create a folder /Archive/2026 and move last year's invoices into it."

Troubleshooting

• "The NAS refused the user name or password" — check them, and that SFTP is allowed for that user. If the password contains special characters, write them as in the table above.
• "The NAS refused the connection" — the SFTP service is off, or the port is wrong.
• "Could not find the NAS at that address" — the host name does not resolve from this computer. Try the NAS's IP address.
• "The NAS did not answer in time" — the NAS is off, or this computer is not on the same network (a VPN or guest Wi-Fi can be the cause).
• "…does not match the fingerprint saved for this connection" — the NAS presented a different identity than the one you pinned. If you did not reinstall or reset the NAS, do not continue.
• "This NAS is on a private network, which can only be reached from the Cosmo desktop app…" — a scheduled Routine tried to use the NAS. Routines run on Cosmo's servers, which cannot reach a private network.
• "This NAS connection is read-only" — Cosmo tried to change something, but the address has no access=readwrite. Reconnect with it if you want that.
• "The NAS user is not allowed to open or change that" — the NAS account has no write permission on that folder. Fix it on the NAS.
• "…is not empty" — Cosmo only deletes empty folders. Delete or move what is inside first.
• The search stopped early — large NAS volumes are searched up to a limit. Ask Cosmo to search a narrower folder.
• "This folder is too large to read in full" — Cosmo reads at most the first 20,000 items of one folder, in the NAS's own order. Ask it to search by name, or to open a subfolder.