# Choose the right MCP connection

Separate downstream tool governance, account inspection, and onboarding.

Updated: 2026-09-22

Canonical: https://docs.kastra.ai/mcp/overview

## Three different jobs

| Connection | Purpose | Authentication |
| --- | --- | --- |
| [Local gateway](https://docs.kastra.ai/mcp/local-gateway) | Govern tools on a wrapped local stdio server | Edge device login |
| [Account connector](https://docs.kastra.ai/mcp/account) | Read Kastra policies, decisions, and governance state | OAuth account grant or local device login |
| [Onboarding server](https://docs.kastra.ai/mcp/onboarding) | Begin and inspect a signup handoff | Public; the user completes signup in a browser |

The public onboarding endpoint is `https://api.kastra.ai/mcp`. Account inspection uses `https://api.kastra.ai/mcp/account`. Neither endpoint is an anonymous policy-evaluation service.

## Govern a third-party server

Use the local gateway when the host launches the MCP server as a local command. The gateway checks tool discovery and individual tool calls. Hiding a tool from discovery is paired with a call-time check; a remembered tool name still needs authorization.

[Hosted remote MCP](https://docs.kastra.ai/mcp/hosted-status) governs remote tools through a server-scoped OAuth connection; its security review is complete, while workspace enablement and actual client/server compatibility remain separate checks. A vendor logo or an implemented connector catalog is not proof that a hosted connection is ready for general use.

## Read governance data

Use the account connector or [Claude plugin](https://docs.kastra.ai/mcp/claude-plugin) to ask about policies and decisions. These tools are read-only and do not add action enforcement to an assistant by themselves.