Choose the right MCP connection
Separate downstream tool governance, account inspection, and onboarding.
On this page
Three different jobs
| Connection | Purpose | Authentication |
|---|---|---|
| Local gateway | Govern tools on a wrapped local stdio server | Edge device login |
| Account connector | Read Kastra policies, decisions, and governance state | OAuth account grant or local device login |
| Onboarding server | Begin and inspect a signup handoff | Public; the user completes signup in a browser |
The public onboarding endpoint is https://api.kastra.ai/mcp. Account inspection uses https://api.kastra.ai/mcp/account. Neither endpoint is an anonymous policy-evaluation service.
Govern a third-party server
Use the local gateway when the host launches the MCP server as a local command. The gateway checks tool discovery and individual tool calls. Hiding a tool from discovery is paired with a call-time check; a remembered tool name still needs authorization.
Hosted remote MCP governs remote tools through a server-scoped OAuth connection; its security review is complete, while workspace enablement and actual client/server compatibility remain separate checks. A vendor logo or an implemented connector catalog is not proof that a hosted connection is ready for general use.
Read governance data
Use the account connector or Claude plugin to ask about policies and decisions. These tools are read-only and do not add action enforcement to an assistant by themselves.