Connect Claude, Cursor or any MCP client to Kestro: your assistant knows what is running, reads the output of the server that just crashed, and opens the tunnels it needs. Production stays closed from the first launch, you have to go and open it yourself, in the app. Everything happens on this Mac: no network port, no connection string to copy anywhere, no account.
macOS 11+ · Windows soon
The assistant
This is the real reason to connect an AI, and the one nobody admits: pasting three hundred log lines into a chat means truncating them. Your assistant asks for a program’s output and Kestro hands it over, the dev server, the compose stack, the command that just failed.
It is the one setting switched off at install, and it sits at the top of the list so you cannot miss it. A tunnel labelled production stays visible in the inventory: your assistant knows it exists and can tell you so, but without its host, its instance or its remote port. Nothing to open, and nothing to copy elsewhere.
Answer a passphrase a program is waiting for. Type into the terminal of a running program. Run a command you have never read and approved yourself. Open a public port that did not already exist. And change its own permissions: that setting is reachable from the window only, in front of you.
“Never production, except that one database” is a sentence everyone needs eventually. It is a checkbox in the tunnel’s settings, and it overrides the general rule. The reverse too: an object you take out of what the AI can see disappears from the inventory, not greyed out, gone.
Kestro knows a tunnel is called notes-prod and holds a port. It has no idea it is the billing database, that it is restored nightly, that nobody ever writes to it. One sentence in its settings, and your assistant reads it before acting instead of guessing: because guessing, on a database, is precisely what you do not want.
Works with what you already haveSSH · Google Cloud · AWS · Cloudflare · Docker · PostgreSQL · Redis · Git
From a switch to a useful conversation
Kestro does not become one more account. The server lives inside the app, the door opens when you switch it on, and it does not exist until you do.
One toggle in Settings › AI. While it is off the door does not exist: the server cannot connect at all, whatever the settings below say. They stay on screen so you can see what you would be granting before granting it.
Kestro shows the configuration to paste into your client, and the one-line command for Claude Code. No API key, no token to create, no connection string to write down somewhere: the server talks to the app through a socket in your user directory.
Every action is weighed by the app before it runs: never by the server, which is only a file on your disk. What passes runs; what does not is refused flatly: no window pops up, and no “yes” gets clicked out of fatigue.
A refusal is not a wall: it says what blocked and where to lift it, in your language. Your assistant relays it to you word for word, you click, you try again. If you want a record of everything it asked for, a history can be switched on in the settings, it stays on this Mac.
On your machine
Your connections run from your computer to your servers, never through us.
Nothing to create, no password.
SSH, Google Cloud, AWS: Kestro uses your own tools, locally.
We don’t know what you open, or when.
Your licence renews with us. Nothing else leaves.
And the rest
The MCP server is not a separate product: it opens up to your AI what Kestro already holds for you. Same app, same shortcut, same price.
Postgres on RDS, Redis behind a bastion, a Google VM with no public address. Opened with a switch, with the environment written on the row.
The branch, what changed, what is left to push. And the dev server, or the compose stack, started from the row: with its output in the panel.
Sites, APIs, ports: checked continuously from your machine. The moment one goes down, the menu bar icon changes.
Pricing
A tool you open forty times a day shouldn’t send an invoice every month.
Kestro licence
1 computer · one-time
Or download it for free first →
Refunded within 14 days, no questions asked.
Questions we get
Any that speak MCP, the open protocol published by Anthropic: Claude Desktop, Claude Code, Cursor, and the list grows every month. Kestro ships an ordinary MCP server, over stdio, launched by your client like any other. Nothing is tied to one editor, and you can connect several to the same app.
No, and there is no server of ours in this story. The MCP server is a program shipped inside the app that talks to Kestro through a socket in your user directory, not over the network: a local TCP port would be reachable from any page open in your browser, and we did not want that door. What reaches your AI vendor is what you write to it and what it asks for, exactly as when you paste text into a chat.
It can, and we would rather say so. Kestro bounds its own door, not your machine’s shell: an assistant with terminal access can type whatever it likes, including the kestro command. What these settings protect is the door Kestro just opened, and that is already the point, because the real risk is not a malicious assistant, it is one that gets it wrong or that some text it read along the way manipulated. The instructions Kestro gives yours explicitly tell it not to look for a workaround, and to relay the refusal to you.
Yes, if you switch it on: a history records every action asked for, when, what, on which object, allowed or refused. The refusals are often worth more than the rest: they show what your assistant tried. It is off by default and never leaves this Mac. Kestro keeps no record of what you do, and will not start keeping one unasked.
No, and it is the one rule in the whole design that is not adjustable. The permission settings are not among what the MCP server may request, nor among what the kestro command may do: they are reachable from the app window only, in front of their owner. An assistant asking you to go and tick a box is doing its job; one ticking it itself would not be.
No. The MCP server is in the app, like the kestro command: it is not sold separately, asks for no account and calls no service. You pay for Kestro once, and what it does today it will still do in two years, offline included.
No, and it does not ask for an account either. You download it and you get 7 full days. No card is requested until you decide to buy.