SSH, Cloud SQL, IAP, SSM: one switch per tunnel, the port checked before opening, and everything back up after the Mac sleeps. Then your projects and their state, your services watched, your scripts, and an MCP server that opens all of it to your assistant, inside the limits you set. No account to create, nothing to sync.
macOS 11+ · Windows soon
What it does
Postgres, Redis, MySQL: on your own servers, on Google Cloud or AWS, even behind a bastion. Paste the instance, Kestro works out the rest and opens the tunnel. It reopens when the machine wakes, closes when you stop using it.
Kestro finds your code folders for you, here and on your remote machines: Google Cloud VMs, EC2, anything ssh can reach. It shows you what it found, you keep what you want.
Websites, APIs, databases, ports: Kestro keeps checking that each one answers. The moment one goes down, the menu bar icon changes, and the panel gives you the error code and how long it has been down, not just a red dot.
Kestro reads your npm, make and docker scripts and pins them. Output shows up in the panel, and if the program asks a question (a password, a yes or no), you answer right there.
The branch, the changed files, what’s left to push. Start the dev server, open the folder in your editor or a terminal.
Kestro is also an MCP server: Claude, Cursor or Copilot see your tunnels, your projects and what your programs print, and can start them. Every family of actions has its own switch, production is closed from the moment you install, and anything you have not opened is asked for in a window, at the moment it matters, with the port and the address in plain sight.
Works with what you already haveSSH · Google Cloud · AWS · Cloudflare · Docker · PostgreSQL · Redis · Git
On your machine
Your connections run from your computer to your servers, never through us.
Nothing to create, no password.
SSH, Google Cloud, AWS: Kestro uses your own tools, locally.
We don’t know what you open, or when.
Your licence renews with us. Nothing else leaves.
And your assistant
Claude Code, Cursor and the rest can type commands, and that is what makes them useful. But a shell has never refused anything: nothing in psql "postgres://…" tells staging apart from production. Kestro does not replace that terminal, it adds the one thing the terminal cannot have: a door that says no, and says why.
With a terminal
$ psql "postgres://app:[email protected]/app" # nothing says 10.0.3.4 is production app=# DELETE FROM orders WHERE … DELETE 1284
With Kestro
Kestro refused. “notes-prod” is marked “Production”, and that environment is not open to AI. No password went anywhere.
Four ways in
Not four products, not four sets of settings to learn: one interface, three ways to open it, and a command that talks to the same one.
The panel anchors under the icon. One click, or ⌃⌥K from any app.
On recent MacBooks the notch itself expands and the panel appears inside it. Hover and it’s there; move away and it closes.
Need it to stay open during a deploy? Detach it. Same content, more room.
The kestro command does what the panel does, without leaving the keyboard. And it composes: psql "$(kestro url notes-db)".
Five states, none carried by colour: they stay readable in light mode, in dark mode, and for eyes that can’t tell red from green.
Pricing
A tool you open forty times a day shouldn’t send an invoice every month.
Kestro licence
1 computer · one-time
Or download it for free first →
Refunded within 14 days, no questions asked.
Questions we get asked
No, more like the thing that saves you from keeping six of them open. Your terminals stay for writing code; Kestro holds what you used to leave running in them: tunnels, servers, scripts, monitoring. And there’s nothing to reconfigure: it relies on your ~/.ssh/config and the gcloud, aws or docker tools already on your machine. And if you’d rather not leave the keyboard, the kestro command does the same from your shell, with nothing popping up over what you were doing.
No, and it doesn’t need an account either. You download it and you get 7 full days. No card is asked for until you decide to buy.
You buy a key, it arrives by email, you paste it into Kestro. One key, whatever the number of computers: it activates as many seats as you bought. If you have a desktop and a laptop, buy two seats and paste the same key on both. No account to create.
You enter your key at kestro.dev/machine, no password, no account, you see your computers under the names you gave them, and you release whichever one you want. As many times as needed, no limit. Lost your key? Give us your email address and we’ll send it again.
Soon. Kestro runs on macOS for now; the Windows version is in the works. Same product, same price, the icon will sit in the notification area instead of the menu bar, and one key will activate both.
No. Kestro stores none of them: SSH tunnels use your keys and your ~/.ssh/config, Google Cloud and AWS access goes through your already-authenticated gcloud and aws tools. Everything opens directly between your machine and your servers. None of it passes through our infrastructure, and since there is no account, we don’t even know you use Kestro.
No, you can work offline, on a plane, on a closed network. Kestro quietly renews its authorisation whenever a connection is around, without asking you anything; that’s what lets you release a seat remotely. If your corporate network blocks us, write to us: we issue a licence that never needs to reach us. Service monitoring, of course, needs the network to reach the addresses you give it.