Postgres on RDS, Redis behind a bastion, a Google Cloud VM with no public address. Kestro reads your ~/.ssh/config, works out the rest and opens the door with a switch. In the evening, “Close all” shuts them all. And you never had an extra terminal to keep an eye on.
macOS 11+ · Windows soon
Tunnels
A bastion in front of the database, and the line becomes unreadable: one hop, a local port, a key per machine. Kestro takes your ~/.ssh/config entries exactly as they are (the jump, the user, the key) and turns them into a single switch.
Cloud SQL, a Google VM, an EC2 instance through Session Manager: Kestro leans on your gcloud and aws tools, already signed in. It lists what it finds in your project, you pick the line.
Tick reconnection on a tunnel: a closed lid, a change of Wi-Fi or a VPN coming back no longer kill it. It comes back on the same local port, and your SQL client’s saved connection still works. Off by default: a door onto production does not reopen unless you asked for it.
Every tunnel carries its environment, and the production row a red edge. You see what you are opening onto before you click, and the count of open doors says how many of them are production.
kestro with notes-db -- npm run migrate opens the tunnel, waits until it actually answers, then runs the command in this very terminal. psql "$(kestro url notes-db)" slots into a sentence no interface will ever write for you.
Kestro is an MCP server: ask Claude or Cursor for staging, and the tunnel opens. A tunnel marked “prod” stays visible without its host, its instance or its port, it knows the tunnel exists, it has nothing to open. The rest lives in switches, and whatever is closed gets asked for at the moment it matters.
Works with what you already haveSSH · Google Cloud · AWS · Cloudflare · Docker · PostgreSQL · Redis · Git
From an address to an open door
It replaces neither SSH nor gcloud: it uses them. Nothing to reconfigure, nothing copied into a store of its own, nothing to clean up the day you uninstall it.
A host from your ~/.ssh/config, a Cloud SQL instance as project:region:instance, an EC2 identifier. Kestro recognises the shape, fills in the port and infers the environment from the name.
Is the local port free? It says so while you are filling in the form, not three minutes later in a log. A tunnel reported as open is a tunnel where something answered.
On the tunnels where you asked for it: reconnects when the machine wakes and when the network comes back, with the retry count in plain sight. This is not a terminal you find dead an hour later.
No door ever closes behind your back: a tunnel vanishing mid-transfer would be worse than the problem it solves. “Close all” shuts them all in one gesture, and the count of what is open stays in the menu bar.
On your machine
Your connections run from your computer to your servers, never through us.
Nothing to create, no password.
SSH, Google Cloud, AWS: Kestro uses your own tools, locally.
We don’t know what you open, or when.
Your licence renews with us. Nothing else leaves.
And the rest
It holds everything you used to leave running in those other terminal tabs. Same panel, same shortcut, same price.
The branch, what has changed, what is left to push. And the dev server, or the compose stack, started from the row.
Sites, APIs, ports: checked continuously from your own machine. The moment one goes down, the menu bar icon changes.
npm, make, docker: pinned, run from a shortcut, with their output in the panel rather than in yet another window.
Pricing
A tool you open forty times a day shouldn’t send an invoice every month.
Kestro licence
1 computer · one-time
Or download it for free first →
Refunded within 14 days, no questions asked.
Questions we get asked
No, it reads it. Your hosts, your jump hosts, your keys and your users stay where they are and stay the reference: Kestro borrows them as they are. Nothing is copied into a store of its own, nothing is rewritten in your file, and the day you uninstall Kestro there is nothing to clean up: your ssh keeps working exactly as before.
That is the common case, not the exception. If your configuration already describes the hop, Kestro borrows it; if not, you name the jump host in the tunnel’s form and it builds both hops. The only port you see afterwards is the local one, the one you hand to your client.
No. Kestro copies none and stores none: it runs ssh the way you would, with your agent and your keys where they already are. For Google Cloud and AWS it goes through gcloud and aws, already signed in on your machine. Everything opens directly between your machine and your servers: nothing passes through our infrastructure, and since there is no account, we do not even know that you are opening a tunnel.
Kestro sees it while you are filling in the form and tells you right then: “free” or “taken”, under the field. You pick another in one keystroke, instead of discovering a bind error after the fact. The chosen port shows on the tunnel’s row, and it is the one kestro url returns.
As many as your machine can carry. “Open all” brings them up in one gesture, each with its own connection and its own transition. In the morning, it is one click for the day. The button flips to “Close all” once there is nothing left to open, so there are never two buttons to choose between.
Yes: those are databases behind a private network, and that is precisely what a tunnel crosses. Cloud SQL by its instance, a Google VM by its name, an EC2 through Session Manager, a database behind a bastion through the hop your SSH configuration already describes.
No, and it does not ask for an account either. You download, you get 7 full days. No card is asked for until you decide to buy.