The demo, straight from your machine
You give the port, Kestro returns an https address. Nothing to install for whoever is watching: the client from their desk, you from your phone, everyone sees your machine.
Your localhost, open to the web: the client demo, the Stripe webhook, the test on your phone.
One port, one switch: Kestro opens a public https address onto your machine, random and account-free, or demo.yourdomain.com for good. The address is already in your clipboard, every request that crosses it shows up before your eyes, and closing erases everything.
macOS 11+ · Windows soon
Kestro1 tunnel open · 1 service isn’t answering
Dev serverephemerallocalhost:3000logsclosed
Stripe webhookshooks.notes-app.devlocalhost:4242logsclosed
Running on this machine
notes-applocalhost:5173Share
⌘K palette↑↓ navigate␣ togglecloses if you click elsewhere
run-tracker , zsh
➜
Applying 2 migrations to shop-staging-db…
20240612_add_orders_index ok
done in 1.4s
run-tracker , zsh
# your doors onto the web, and which ones are open
➜
share demo-front ouvert demo.atelier.fr
share hooks-stripe fermé
Sharing
Six things that no longer wait for a deploy.
Webhooks, delivered to your desk
Stripe, GitHub or Twilio want a public https address: yours leads straight to your local server. Every delivery arrives before your eyes, and replays in one click once your code is fixed.
An address that holds, on your domain
Connect your Cloudflare account: demo.yourdomain.com outlives sessions. Pasted once into an OAuth console or a webhook configuration, it stays true there.
Your dev servers work as they are
Vite answers 403 behind most tunnels, webpack “Invalid Host header”. Kestro rewrites the Host header and lets WebSockets through: hot reload holds up under the public address.
Nothing is recorded, anywhere
Requests live in memory, on your machine, nowhere else. Close the share and everything disappears: that is the contract, written at the bottom of the window.
Your assistant proposes the address, you approve it
Kestro is an MCP server: your assistant can propose a share, never open one on its own. The review screen shows the port, the address and who will be able to get in, and the “your AI can reopen it” box is the only one on the whole screen that starts unchecked.
Works with what you already haveSSH · Google Cloud · AWS · Cloudflare · Docker · PostgreSQL · Redis · Git
From a port to an address
You give the port. It returns an address.
The plumbing is cloudflared, Cloudflare’s own tool, but you never see it. Nothing passes through our servers: traffic goes from the visitor to Cloudflare, then straight to your machine.
Pick the port
3000, 5173, 8080: wherever your server listens. Ephemeral by default, stable once your Cloudflare account is connected: you only type the subdomain.
The address arrives, already copied
Six to ten seconds, and it is in your clipboard: by the time you are back in the conversation, there is nothing left to do but paste.
You watch what crosses
Every request joins the list, whether the client is clicking or Stripe is delivering: you see what answers, what drags, what fails.
Close it, it is closed
The door shuts in one gesture, and everything the inspector saw is erased. It will never reopen on its own: a public address reopens because you asked.
On your machine
Everything stays with you.
Your connections run from your computer to your servers, never through us.
No account
Nothing to create, no password.
Your keys stay put
SSH, Google Cloud, AWS: Kestro uses your own tools, locally.
No usage statistics
We don’t know what you open, or when.
One exception
Your licence renews with us. Nothing else leaves.
And the rest
Kestro does more than sharing.
Sharing is the tunnels’ opposite direction: they answer “what can I reach?”, it answers “who can reach me?”. Both live in the same panel, along with everything you used to leave running in terminal tabs.
Your tunnels
Postgres behind a bastion, Cloud SQL, an EC2 through Session Manager: opened with a switch, reopened when your Mac wakes.
Your projects
The branch, what has changed, what is left to push. And the dev server you are showing right now, started from the same row.
Your services
Sites, APIs, ports: checked continuously from your own machine. The moment one goes down, the menu bar icon changes.
Pricing
You pay once. That’s it.
A tool you open forty times a day shouldn’t send an invoice every month.
Kestro licence
€29.99$29.99£25.99CHF 25.90CA$40.99A$45.99€39.99$39.99£34.99CHF 33.90CA$54.99A$61.99 · Launch offer · upcoming price
1 computer · one-time
- Every feature of the app, no tiers, no “Pro” edition
- One year of updates included, then renew if you want to
- The app stays yours, renewed or not
- One key, the same on all your computers
- Switch machines whenever you like, no limit
- No account to create: the key arrives by email
Or download it for free first →
Refunded within 14 days, no questions asked.
Questions we get asked
Do I need a Cloudflare account?
Not for the ephemeral address: you click, an address on trycloudflare.com arrives, and there is no account anywhere, neither with them nor with us. The stable address does ask for a free Cloudflare account with your domain on it: that is what carries the subdomain you choose. Kestro opens the sign-in page, you pick the domain, and it takes over again on its own.
Who can see my site while I am sharing?
Anyone holding the address, and that is exactly what Kestro points out before the very first opening. The ephemeral address is long and random, nobody guesses it, but it is not a password: only share what you would show. And the door never stays open by accident: it never reopens on its own, not even after a restart.
What do you see of my traffic?
Nothing. Traffic goes from the visitor to Cloudflare, then straight to your machine: nothing passes through our servers, and there is no Kestro account. The inspector lives on your machine and in memory only: not one byte is written to disk, and closing the share erases everything.
My Vite server answers 403 behind this kind of tool. Here too?
No, and it is a plumbing decision: dev servers keep an allow-list of hosts, and a public address will never be on it. Kestro rewrites the Host header to localhost, keeps the real origin in X-Forwarded-Host, and forwards WebSockets: Vite, webpack and Django answer as if at home, hot reload included.
Does the address change every time?
The ephemeral one, yes: it is born when you open and dies when you close. That is its definition, and what makes it free and account-less. If you want an address that holds, connect your Cloudflare account and pick a subdomain: demo.yourdomain.com will outlive sessions, restarts and weeks. Kestro builds the plumbing at the first switch, and never overwrites an existing DNS record.
And for receiving webhooks (Stripe, GitHub)?
The provider wants a public https address; Kestro gives you one that leads straight to your local server, and the request window shows every delivery as it arrived: the signature headers, the exact body, the code your server returned. Fix your code, replay the very same delivery in one click, instead of triggering a new payment or hunting for the resend button at the provider’s. And when nothing is listening on the port, you see the 502 at home instead of digging for it in their dashboard.
Is this an ngrok alternative?
For sharing a port and watching what crosses it, yes: https address, request inspector, replaying a delivery. The differences: no account for the ephemeral address, your own domain through your Cloudflare account rather than a subscription, no warning page in front of your site, and a licence paid once. ngrok stays ahead for raw TCP tunnels or authentication placed in front of the door.
Does the trial ask for a card?
No, and it does not ask for an account either. You download, you get 7 full days. No card is asked for until you decide to buy.