Kestro does not replace Google’s proxy: it runs it. Same binary, your gcloud credentials, same security. But from the menu bar, with the port checked before it even tries, recovery when your Mac wakes, and the exact command in plain sight.
macOS 11+ · Windows soon
The same work, twice
This is not a rewrite: it is the line Kestro runs, exactly as it shows it to you in the tunnel’s settings.
Today
$ gcloud config configurations activate staging $ cloud-sql-proxy my-project:europe-west1:pg-staging \ --port 5432 --address 127.0.0.1 --gcloud-auth Authorizing with gcloud user credentials Listening on 127.0.0.1:5432 # the Mac goes to sleep connection refused # …and back up the history you go, looking for the command
With Kestro
One switch, in the menu bar. The port was checked before it tried. The gcloud configuration travels with the tunnel. On wake it comes back, if you asked it to. # and if you would rather keep the keyboard: $ psql "$(kestro url pg-staging)"
Point by point
| cloud-sql-proxy alone | With Kestro | |
|---|---|---|
| The program that opens the tunnel | cloud-sql-proxy, by Google | The same one, launched by Kestro |
| Your credentials | gcloud’s | gcloud’s, untouched |
| Opening it | a command to find again | a switch, or kestro start |
| The local port is already taken | the error arrives on launch | “free” or “taken”, before you confirm |
| When the Mac wakes | relaunch it by hand | comes back on its own, if you ticked it |
| Several gcloud configurations | activate the right one, then launch | the configuration is attached to the tunnel |
| The command being run | you are the one writing it | shown as-is, and replaceable |
| A database that is not on Cloud SQL | another tool, another command | the same list: SSH, bastion, EC2, Google VM |
| In CI, on a server | yes, that is what it is for | no, Kestro is a desktop app |
| Cost | free, Apache 2.0 | €29.99$29.99£25.99CHF 25.90CA$40.99A$45.99 once |
Checked on 4 August 2026 · cloud-sql-proxy v2
What Kestro adds
None of them touches how the tunnel opens: Google’s proxy is still the one doing the work. They are about everything around it.
Is the local port free? Kestro says so while you are filling in the form. The proxy can only find out by trying to bind to it, which is to say, too late.
A closed lid, a network that changes: the proxy dies and you go hunting for the command. Kestro brings it back when the machine wakes and when the network returns, on the tunnels where you asked for it. Never by default: a door onto production does not reopen on its own.
The exact line it runs is shown in the tunnel’s settings, and you can replace it with your own. What you read is what runs: there is no translation between the two, and nothing to guess the day something goes wrong.
Cloud SQL, a Google VM through IAP, an EC2 through Session Manager, a database behind an SSH bastion: four tools, four commands. One list, and the same switch.
On your machine
Your connections run from your computer to your servers, never through us.
Nothing to create, no password.
SSH, Google Cloud, AWS: Kestro uses your own tools, locally.
We don’t know what you open, or when.
Your licence renews with us. Nothing else leaves.
When the proxy alone is enough
Better said here than discovered after paying.
Kestro is a desktop app: it needs a session to be open. In a container, in a CI job, in a systemd unit, the bare proxy is what you want, and nothing else.
Kestro only runs on macOS 11 and later. The Windows version is in the works; there is no Linux version planned.
A command you rarely type costs nothing. Kestro pays for itself in gestures saved: it starts being worth something around the third door, or the third time your machine wakes in a day.
Pricing
A tool you open forty times a day shouldn’t send an invoice every month.
Kestro licence
1 computer · one-time
Or download it for free first →
Refunded within 14 days, no questions asked.
Questions we get asked
No, it runs it. Kestro executes the cloud-sql-proxy binary you installed, with the instance, the port and your gcloud credentials: exactly the command you would have typed, and it is shown in the tunnel’s settings. There is no reimplementation, no in-house protocol, no relay: the path between your machine and your database is Google’s.
Yes, and Kestro tells you rather than failing quietly: when the tool is missing it names it and offers the install line (brew install cloud-sql-proxy). The same goes for gcloud, aws and the Session Manager plugin. Kestro never downloads a binary on your behalf.
No, and Kestro never sees any of them. The proxy borrows gcloud’s credentials, already on your machine: gcloud carries the authentication, Kestro only launches the program. Nothing passes through our servers, and since there is no account to create, we do not even know that you are opening a tunnel.
That is exactly the case that wastes time on the command line: activate the right configuration, launch the proxy, then remember to put it back. In Kestro the configuration is attached to the tunnel: it travels with it, and two tunnels onto two different projects open side by side without switching anything.
You can: a tunnel’s command can be replaced with yours, and Kestro then runs the line you wrote. That is useful for a flag the interface does not expose, or for a setup of your own. Everything else keeps working, including recovery and the state in the menu bar.
Nothing in particular: your gcloud, your cloud-sql-proxy and your ~/.ssh/config are where they were, untouched. Kestro writes to none of them and copies their contents nowhere. You go back to typing your commands as before.
No, and it does not ask for an account either. You download, you get 7 full days. No card is asked for until you decide to buy.