Kestrel CLI

Command-line interface for Kestrel — AI Agents for Platform Engineering.

Install

macOS / Linux (Homebrew)

brew install KestrelAI/tap/kestrel

Binary download

Download from GitHub Releases.

From source

go install github.com/KestrelAI/kestrel-cli@latest

Authentication

New account

kestrel register                       # sign up with a work email, verify, and log in
kestrel register --create-api-key      # same, then mint and store a full-access API key (agents, CI)
kestrel whoami                         # server, auth mode, user, tenant
kestrel status                         # onboarding checklist and the next recommended step
kestrel account                        # plan, trial days left, credits

API key (recommended)

kestrel auth kestrel_sk_...

Email/password

kestrel login

Commands

kestrel workflows list              # List all workflows
kestrel workflows get <id>          # Show workflow details + DAG diagram
kestrel workflows create --file wf.json
kestrel workflows activate <id>
kestrel workflows pause <id>
kestrel workflows test <id>         # Dry-run execution
kestrel workflows generate "..."    # AI-generate from description
kestrel workflows executions <id>   # List executions
kestrel workflows stats             # Aggregate statistics

kestrel approvals list              # Pending approval gates
kestrel approvals approve <id>
kestrel approvals reject <id>
kestrel approvals request-changes <id>  # Re-run RCA with feedback (refine loop)

kestrel requests list               # Workflow requests
kestrel requests approve <id>

kestrel apikeys list                # List API keys
kestrel apikeys create <name>       # Create new key
kestrel apikeys revoke <id>         # Revoke a key
kestrel apikeys delete <id>         # Delete permanently

kestrel integrations list           # All integrations + connection status
kestrel integrations connect <name> # Connect an integration (flags vary per integration)
kestrel integrations test <name>    # Test an integration's credentials
kestrel integrations disconnect <name>

kestrel mcp                         # Start MCP server for Claude/Cursor

Connecting integrations

Each integration has its own authentication requirements — run kestrel integrations connect <name> --help to see the exact flags.

# Token integrations (credentials via flags; secrets prompt interactively if omitted)
kestrel integrations connect cloudflare --api-token <token> --account-id <id>
kestrel integrations connect pagerduty --api-token <token> --webhook-secret <secret>

# Knowledge sources
kestrel integrations connect confluence --base-url https://acme.atlassian.net --email me@acme.com --api-token <token>

# OAuth integrations print a browser URL to finish the flow; --wait polls until it lands
kestrel integrations connect github --wait

# Kubernetes generates the operator token + Helm values file and prints the install command
kestrel integrations connect kubernetes --cluster-name prod --wait

# AWS is a two-step IAM role flow
kestrel integrations connect aws                 # step 1: prints CloudFormation/CLI instructions
kestrel integrations connect aws --role-arn <arn> --external-id <id>  # step 2: verify

# GCP is a two-step Workload Identity flow
kestrel integrations connect gcp --bootstrap --project-id my-proj   # step 1: prints the Cloud Shell setup script
kestrel integrations connect gcp --project-id my-proj               # step 2: verify

# Normalized connection state for any integration
kestrel integrations status github

# Prototype before anything is connected
kestrel workflows generate "when a pod crash-loops, post RCA to #oncall" --simulated --save

MCP Integration

The CLI includes a built-in MCP (Model Context Protocol) server for AI assistant integration:

kestrel mcp

The server starts even with no account. Unauthenticated it exposes whoami, register, verify_email, login, and create_api_key; once a key exists (both verify_email and login mint one for the connected harness) the full tool set is registered and tools/list_changed is emitted, so an agent can go from zero to a running workflow on its own. Human steps are returned explicitly: the emailed verification code, OAuth consent in a browser (connect_integration returns the URL, wait_for_connection polls), cloud IAM / Helm when the agent lacks cloud access, and card entry for billing (get_account_status).

Other agent-oriented tools: get_onboarding_status (what is left to set up), get_account_status (trial, credits, blocked reasons), get_connection_status, and simulated=true on generate_workflow / create_workflow to prototype before integrations are connected.

Every request identifies the client to Kestrel (X-Kestrel-Client: mcp/<harness>/<version>, or cli; set KESTREL_AGENT=<name> when an agent shells out to the CLI).

License

Apache 2.0