The fear that kills most AI platform decisions is lock-in. If you build an operating rhythm around CorpusIQ, what happens if you want to switch? If the answer is "rebuild from scratch," CorpusIQ is a risky bet. If the answer is "export and go," the risk compresses.
CorpusIQ ships a portable export format: .cnw.zip. This post explains what it is, why it exists, and what it means for evaluating AI infrastructure.
The lock-in pattern in AI tooling
Most AI platforms built in the last two years have an implicit lock-in. Their value depends on the configurations, workflows, and integrations you build on top. Those configurations live in a proprietary format, in a proprietary database, accessible only through the vendor's UI.
The lock-in is not malicious. It is convenient. Vendors build what is fast to build, which is usually a closed system. Openness is an engineering choice that costs more.
The cost to the customer is real, though. Switching vendors means rebuilding. Getting acquired by a company that uses a different stack means rebuilding. Negotiating renewal terms means rebuilding is the only alternative, which limits negotiation leverage.
What .cnw.zip contains
.cnw.zip is a structured archive that describes a CorpusIQ deployment in portable form.
Contents:
- manifest.json: Metadata about the export. Format version, export timestamp, source deployment.
- connectors/: For each connected connector, a JSON file describing the connector type, authorization scopes requested, and any customization.
- tools/: MCP tool definitions exposed to AI clients. Tool names, descriptions, input/output schemas, mega-tool mappings.
- workflows/: Saved prompts and workflow definitions. The weekly pulse prompt, the contract audit prompt, any custom workflows the user has built.
- policies/: Access policies and rate limits defined per tenant.
- audit-schema.json: The schema definition for log events, so logs exported separately remain interpretable.
What is not included:
- OAuth tokens. Credentials stay in Azure Key Vault. The export contains the configuration that would let a new system re-establish OAuth flows, not the tokens themselves.
- Raw connector payloads from direct MCP. CorpusIQ does not retain those payloads for export; optional indexed-search metadata and retained operational/compliance records follow their own export and deletion rules.
- User credentials. The customer's login and auth mechanisms stay with the customer.
Why open it up
Three reasons.
First, customer confidence. Enterprises evaluating a new AI platform ask about exit strategy. "What happens if we leave?" A credible answer ("here is the export format, here is the schema, here is a tool to convert it") clears that objection.
Second, operational resilience. .cnw.zip is also useful for backup, disaster recovery, and migration between environments (dev, staging, prod). A portable format is not just for leaving; it is for any situation where the configuration needs to move.
Third, protocol health. MCP is an open standard. If the infrastructure layer on top of MCP is also open, the whole stack is more durable. CorpusIQ benefits from a healthy ecosystem more than from proprietary lock-in.
The format specification
.cnw.zip uses a simple open structure:
my-corpusiq-export.cnw.zip
├── manifest.json
├── connectors/
│ ├── quickbooks.json
│ ├── shopify.json
│ ├── slack.json
│ └── ...
├── tools/
│ ├── mega-tools.json
│ └── direct-tools.json
├── workflows/
│ ├── weekly-pulse.json
│ ├── contract-audit.json
│ └── ...
├── policies/
│ └── access-policy.json
└── audit-schema.json
Each JSON file follows a documented schema. The schemas are versioned and backward-compatible.
Full specification lives at docs.corpusiq.io/cnw-format (or equivalent). The format is open for any vendor or tool to implement import and export.
Import from another MCP platform
The format is designed to be importable. If a customer is moving from another MCP-based platform to CorpusIQ, and that platform exports a compatible format (or can be scripted to), the import path is:
- Upload the
.cnw.zipthrough CorpusIQ's dashboard or API. - CorpusIQ reads the manifest and begins re-establishing OAuth flows for each connector. The user is prompted to authorize each connector once.
- Tools and mega-tool mappings are restored.
- Saved workflows become available in the CorpusIQ interface.
The OAuth re-authorization is the only step that requires user interaction. The rest is automatic.
What this means for Anthropic platform risk
CorpusIQ's business depends on Anthropic's Claude, OpenAI's ChatGPT, and Perplexity continuing to support MCP. That is a real platform dependency. Customers evaluating CorpusIQ sometimes raise it.
The .cnw.zip format is part of the answer. If a vendor in the MCP ecosystem changes terms unfavorably, CorpusIQ customers can export their configuration and point it at a different MCP-compatible stack. The exit path is not theoretical; it is a documented format and a supported workflow.
This does not eliminate platform risk. Nothing eliminates platform risk. But it bounds the risk to "we have to switch MCP hosts" rather than "we have to rebuild everything."
The engineering cost of openness
Worth naming: openness is not free.
Maintaining a documented schema takes engineering attention. Every new feature in CorpusIQ has to either fit the existing schema or update it with backward compatibility. That is slower than moving fast and breaking things.
Writing import parsers for potentially hostile input (imported files from other systems) is security-sensitive work. Every validation gap is a vector.
Supporting "export, leave, maybe come back" workflows means building UX around configurations that are not currently active. That is more edge cases.
The tradeoff is worth it. Every customer who tests the export path increases trust. Every enterprise review that sees the format clears faster. Every potential partner in the MCP ecosystem has a lower barrier to building on top.
What we will not do with the format
Two commitments.
No phone-home telemetry in exports. A .cnw.zip can be created and consumed entirely offline. CorpusIQ does not log or track the contents.
No format version gating. Older .cnw.zip files will continue to import into newer CorpusIQ versions. A customer who exported in 2026 can still import that file in 2030.
See also
FAQ
What is in a .cnw.zip file?
Connector configuration manifests, MCP tool definitions, auth scope specifications (not the tokens themselves), and workflow templates. It is the portable definition of your CorpusIQ setup, not the underlying business data.
Can I import a .cnw.zip into a competitor's tool?
In principle, yes. The format is open and documented. Adoption by other vendors is up to them.
Does this affect my OAuth tokens?
No. Tokens stay in Azure Key Vault. The export contains configuration, not credentials.
Is the format stable?
It is versioned. Current version is 1.0. Changes will be additive and backward-compatible. Breaking changes would get a major version bump.