Account MCP connector

Remote account access

Add https://api.kastra.ai/mcp/account as a custom MCP connector in a client that supports the OAuth flow. Complete browser authorization for the intended workspace and environment scope. The account-read scope is kastra.account.read.

This is separate from the public onboarding endpoint and the remote gateway proxy. An account-read grant does not authorize third-party tools.

Local inspection server

After an Edge login:

kastra-edge install-mcp

This registers kastra-mcp under the host server name kastra-edge for Claude Code. Use kastra-edge install-mcp --target cursor or kastra-edge install-mcp --target codex for those clients. Preview with --dry-run, then restart the selected client and verify that it can read the intended workspace. Configuration is separate from a successful connection or hook enforcement.

Available read-only tools

The shared tool set includes:

• search_decisions, get_active_policy, list_policies, list_policy_revisions.
• list_environments, list_incidents, list_checkpoints.
• get_rule_stats, get_activity_stats, get_governance_preferences.
• verify_audit_chain, list_audit_events, list_api_keys.

get_active_policy takes an environment name; list_policy_revisions takes a policy ID from list_policies. MCP environment arguments use names, not environment IDs. Update saved prompts and tool permissions to the current names.

API-key listings are masked. Tool schemas define filters and scope; an environment-scoped OAuth connection cannot be treated as a tenant-wide view. Local-only diagnostic tools may add capabilities outside the shared set.

Verify and disconnect

Ask for the active policy in a known environment and compare it with the console. Verify a sample decision by ID rather than assuming similarly named workspaces are the same. Revoke the connector grant when access is no longer needed. Read-only inspection does not install a blocking hook; follow an Edge integration guide for enforcement.