Local MCP gateway

Prerequisites

Install the Edge bundle, sign in, and confirm that the downstream MCP server already works. This guide covers a host configuration with a local command entry. Remote URL entries and Claude Desktop extension bundles are not wrapped by this command.

Preview and wrap selected servers

kastra-edge login
kastra-edge wrap-claude-desktop --dry-run --server YOUR_SERVER_NAME
kastra-edge wrap-claude-desktop --server YOUR_SERVER_NAME

Use a server name from your existing Claude Desktop configuration. The command preserves its original command and arguments after the gateway’s -- separator. Fully quit and restart Claude Desktop after the change.

For another compatible host, the launch shape is:

kastra-mcp-gateway --server-name YOUR_SERVER_NAME -- ABSOLUTE_SERVER_COMMAND server-arguments

Use absolute executable paths when the host does not inherit your shell PATH. This is a launch template, not a command to paste without substituting a working server.

Verify the boundary

1. Confirm the host discovers the expected tools.
2. Call a harmless tool and inspect its Kastra decision.
3. Add a narrow test denial and confirm that the downstream side effect does not occur.
4. Test a HOLD and resolve it from the console.
5. Test a hidden tool both through discovery and an explicit call.

Tool names and arguments become policy context. Tool-result content scanning is not a blanket feature of this local gateway. .mcpb extensions do not appear in the JSON configuration and cannot be discovered by the wrapper command.

Failure behavior and removal

Missing login, evaluation failures, and discovery failures can fail open. Discovery failures forward the original catalog. This preserves server availability while leaving the affected action or discovery ungoverned; inspect the fail-open signal.

Restore the selected server with kastra-edge unwrap-claude-desktop --server YOUR_SERVER_NAME, then restart the host. Consult the platform matrix before assuming cross-platform validation.