Choose your setup
The decisions you make once and live with: local or remote servers, API keys or OAuth, a gateway or direct connections. Each page gives the tradeoff and then says which way to go. Finding the servers already running on your machines is in here too, because it usually comes first.
Choose your setup
- Shadow MCP: finding unsanctioned MCP servers on your team's laptopsShadow MCP is a developer adding an MCP server to their own Claude Desktop, Cursor or VS Code config without review. Where to look, why it matters, and how to fix it.
- Local vs remote MCP servers: which should you run?MCP defines two transports: stdio for a local process and Streamable HTTP for a remote one. How they differ on setup, credentials, isolation, updates, sharing and audit, and which to pick.
- API keys vs OAuth for MCP serversStatic API keys and PATs are simpler to wire up than MCP's OAuth 2.1 authorization spec, but they fail at scope, expiry, revocation and per-caller identity. Here is when each is the right call.
- What is an MCP gateway?An MCP gateway sits between agents and MCP servers to centralize auth, per-tool access, credential storage and logging. What it does, how it differs from an LLM gateway, and when you need one.