With a terminal
$ psql "postgres://app:[email protected]/app" # the string came from a .env it read # nothing says 10.0.3.4 is production app=# DELETE FROM orders WHERE … DELETE 1284 # and the password is in your shell history
Your AI already has a terminal. That is the problem.
Claude Code, Cursor and the rest can type commands, and that is what makes them useful. But a shell has never refused anything: nothing in psql "postgres://…" tells staging apart from production. Kestro does not replace that terminal, it adds the one thing a shell cannot have: a door that says no, and says why.
macOS 11+ · Windows soon
The same request, twice
On the left, nothing stands in the way. On the right, something decides.
“Have a look at why today’s orders are duplicated in the database.” The left column is what an assistant holding a shell makes of that sentence.
With Kestro
Kestro refused. “notes-prod” is labelled “Production”, and that environment is not open to the AI. Settings › AI › Environments › Production No password went anywhere.
Point by point
What a shell cannot do, by construction.
| A terminal | With Kestro | |
|---|---|---|
| What the AI can reach | everything your shell can reach | what you opened, object by object |
| Production | nothing tells it apart from any other database | closed by default, at the top of the settings |
| Credentials | in the command, then in the history | none: the tunnel is a local door |
| A passphrase being asked for | it answers whatever it likes | never, whatever you set |
| A command you never read | it runs it | refused until you have approved it yourself |
| Reading the output of a server you started | no: it only sees what it started itself | yes: Kestro holds it, and hands it over |
| When something is refused | nothing refuses | a message naming the setting to change |
| What you can review afterwards | the shell history, if it left one | a log of its actions, if you switch it on |
| Writing code, reading a repo, committing | yes, and that is what it is for | no, that is not its job |
| Cost | free | €29.99$29.99£25.99CHF 25.90CA$40.99A$45.99 once |
Two practices compared, not two products · August 2026
What Kestro adds
Four things no shell can bring.
The terminal stays: your assistant keeps writing code and reading your repos with it. What changes is what sits between it and your machines.
A boundary that actually exists
Every action is weighed by the app before it runs, not by the program the AI drives. An MCP server is a file on your disk; the decision lives in Kestro, and the setting that governs it is reachable from the window only.
The output of what was already running
This is the blind spot of an assistant handed a shell: it cannot see the dev server you started this morning, nor the migration that failed in another tab. Kestro holds them all, and hands over their lines on request.
No credentials along the way
No connection string to write into a config file, no password in a command, so nothing to revoke if the conversation goes elsewhere. The tunnel is a local door Kestro holds, and it closes it when you say so.
A refusal that comes back to you
The message names what blocked and the exact setting that lifts it, in your language. Your assistant relays it instead of inventing an explanation: the instructions Kestro gives it say so explicitly, and also tell it not to look for a workaround.
Kestro1 tunnel open · 1 service isn’t answering
bastion-prodprodSSHshellbastion.kestro.internalclosed
notes-dbstagingPostgreslocalhost:5432pg-staging.eu-west-1.rdsopen
run-eventsprodMongolocalhost:27017mongo-prod.atlasclosed
⌘K palette↑↓ navigate␣ togglecloses if you click elsewhere
run-tracker , zsh
➜
Applying 2 migrations to shop-staging-db…
20240612_add_orders_index ok
done in 1.4s
run-tracker , zsh
# the exact line is in Settings › AI, ready to copy
➜
Added stdio MCP server kestro
On your machine
Everything stays with you.
Your connections run from your computer to your servers, never through us.
No account
Nothing to create, no password.
Your keys stay put
SSH, Google Cloud, AWS: Kestro uses your own tools, locally.
No usage statistics
We don’t know what you open, or when.
One exception
Your licence renews with us. Nothing else leaves.
When the terminal is still the right tool
Three cases where Kestro has nothing to offer.
Better said here than discovered after paying.
Everything that is not a door
Writing code, reading a repo, running tests, committing: that is your assistant’s job, it does it in a terminal, and Kestro has no reason to step in. Both live in the same session, without conflict.
An AI that has a shell anyway
If your assistant can type commands, it can type kestro. We bound our own door, not your shell: this protects against an assistant that gets it wrong or that some text manipulated, not against one you meant to lock in.
In CI, on a server, in a container
Kestro is a desktop app, on macOS 11 and later: Windows in the works. An agent running without a session has nothing to gain from it, and neither does a CI script.
Pricing
You pay once. That’s it.
A tool you open forty times a day shouldn’t send an invoice every month.
Kestro licence
€29.99$29.99£25.99CHF 25.90CA$40.99A$45.99€39.99$39.99£34.99CHF 33.90CA$54.99A$61.99 · Launch offer · upcoming price
1 computer · one-time
- Every feature of the app, no tiers, no “Pro” edition
- One year of updates included, then renew if you want to
- The app stays yours, renewed or not
- One key, the same on all your computers
- Switch machines whenever you like, no limit
- No account to create: the key arrives by email
Or download it for free first →
Refunded within 14 days, no questions asked.
Questions we get
If my AI can type kestro in a terminal, what is the point?
That is the right question, and the answer is a distinction: the real risk is not an assistant deciding to harm you, it is one that picks the wrong database, or that some text it read along the way, a README, a page, a log line, manipulated. Against that one, a door that refuses and explains changes everything, because it does not insist: it relays the refusal and asks you. Against an assistant you truly want to lock in, you need a sandbox at the system level, and no application setting, ours no more than anyone’s, will do.
Concretely, what gets refused?
By default, anything labelled production: the tunnel does not open, and the object shows up in the inventory without its host, its instance or its remote port. And four things are refused whatever you set: answering a passphrase a program is waiting for, typing into the terminal of a running program, running a command you have never read and approved, opening a public port that did not already exist.
Do I lose convenience?
On staging and development, no: everything is open on first launch, program output included, and you have nothing to tick to get started. What you lose is the chance of a production tunnel opening without you deciding, and the day you need it, a checkbox in that tunnel’s settings opens that one alone.
Do my commands go through your servers?
No, and there is no server of ours. The MCP server ships inside the app and talks to it through a socket in your user directory, not over the network: a local TCP port would be reachable from any page open in your browser. What reaches your AI vendor is what you write to it, as when you paste text into a chat.
Which assistant does it work with?
Any that speak MCP: Claude Desktop, Claude Code, Cursor, and others as they adopt it. Kestro ships an ordinary stdio server, launched by your client like any other, nothing is tied to one editor.
Does the trial ask for a card?
No, and it does not ask for an account either. You download, you get 7 full days. No card is asked for until you decide to buy.