Kastra is live · free plan; paid plans on request · last verified 9 Nov 2026 · viability healthy
Kastra
Runtime authorization for AI agents — allow, deny, redact, or hold every action before it executes
Pre-execution enforcement is the part most agent stacks are still missing, and Kastra sells it instead of a dashboard. The four-decision model — allow, deny, redact, hold — plus ed25519-signed, hash-chained traces is what an auditor actually asks for. Onboarding is cheap to test: a no-signup sandbox at kastra.ai/sandbox and a 15-day self-serve trial at app.kastra.ai/signup with API keys created in the console, no sales call. Compared with monitoring-only tools like LangSmith-style observability, Kastra blocks before the action lands. Compared with an identity provider, it governs actions rather than logins. Its deliberate scope limit — it does not filter model prose or route between model
Verdict generatedVerified 5d ago · liveness 79/100 · cite: rightaichoice.com/tools/kastra
- Development teams running Claude Code, Cursor, or Codex on machines with real write access
- Platform teams enforcing one policy set across every agent in the fleet
- Security engineers who need allow/deny/redact/hold decisions before execution, not monitoring after
- Compliance and audit teams needing cryptographically chained, explainable decision records
- Teams that only need to filter model prose or route between model vendors
- Read-only agents in sandboxes where no real-world action can occur
- Anyone looking to replace their identity provider — Kastra governs actions, not logins
We scan live Reddit threads, YouTube comments, X posts, G2 reviews and other communities — and hand you an honest verdict in under a minute.
- Honest verdict, not marketing
- Real pros & cons from real users
- Attributed quotes with receipts
3 free scans · no card needed
Skip Kastra if your agents are read-only or sandboxed with no real-world blast radius — Kastra exists to gate actions that can actually change systems, and you'd be paying overhead for a checkpoint nothing needs to pass.
Team and Enterprise tiers are quoted on contact rather than published as a rate card, so budgeting those seats requires a sales conversation before you can model spend.
Entry is cheap to evaluate: a free tier for local AI enforcement, a no-signup sandbox, and a 15-day self-serve Pro trial at app.kastra.ai/signup with API keys created in the console — no sales call. Team and Enterprise are quoted on contact, so the real comparison is against monitoring-only observability tools that cost less but only tell you what happened after an agent acted, and against building your own enforcement shim in-house, which most teams underestimate once audit trails and SIEM
In short
Kastra — Runtime authorization for AI agents — allow, deny, redact, or hold every action before it executes. Best for Development teams running Claude Code, Cursor, or Codex on machines with real write access, Platform teams enforcing one policy set across every agent in the fleet, Security engineers who need allow/deny/redact/hold decisions before execution, not monitoring after. Free to start; it also has paid plans whose price we could not confirm — see the pricing table.
What is Kastra?
Kastra — Runtime authorization for AI agents — allow, deny, redact, or hold every action before it executes. Best for Development teams running Claude Code, Cursor, or Codex on machines with real write access, Platform teams enforcing one policy set across every agent in the fleet, Security engineers who need allow/deny/redact/hold decisions before execution, not monitoring after. Free to start; it also has paid plans whose price we could not confirm — see the pricing table.
Kastra is the authorization layer that sits in the execution path of AI agents. Before an action runs — a shell command, a file write, a database query, an API request, a browser click — Kastra evaluates attribute-based policy in under one millisecond and returns one of four decisions: allow, deny, redact, or hold. You connect to it three ways: the Kastra HTTP API from production agents, Kastra Edge installed on developer machines to govern Claude Code, Cursor, and Codex, or an MCP client that reads governance data. Policies span shell, file, network, database, and browser actions, and sensitive operations can route into real-time approval workflows instead of hitting a hard block. Every decision lands in a cryptographically chained audit trail that is ed25519-signed and can stream to Datadog, Splunk, or S3, so operators, auditors, and the agents themselves can explain why something was permitted. Kastra Recon scans agent history for past risky actions and drafts a starter policy set from what it finds — useful when nobody wants to hand-write the first rules. Self-hosted and air-gapped deployments are available. If your agents only read and summarize, you don't need this yet. If they can touch production, Kastra is the checkpoint between intent and execution.
Key features
- Attribute-based policy evaluation in under one millisecond
- Four-decision model: allow, deny, redact, or hold before execution
- Governs prompts, tool calls, shell commands, database operations, API requests, and agent workflows
- Kastra HTTP API for production agents
- Kastra Edge for local enforcement on developer machines
- Governs Claude Code, Cursor, and Codex via Kastra Edge
- MCP client connection to read governance data
- Kastra CLI for command-line policy operations
- Cryptographically chained audit trail with ed25519-signed traces
- Kastra Recon scans agent history and drafts policies from what it finds
- Real-time approval workflows for sensitive actions
- Real-time decision streaming to Datadog, Splunk, and S3
- Self-hosted and air-gapped deployment options
- No-signup sandbox for testing policy decisions
- 15-day self-serve Pro trial with API keys created in the console
Behind the verdict
Kastra is a narrow tool with a clear thesis: agents that can take real-world actions need a deterministic decision point before the action executes, not a log after the fact. That thesis holds up. The product returns allow, deny, redact, or hold in under one millisecond on attribute-based policy, covering prompts, tool calls, shell commands, database operations, API requests, and browser automation. Three surfaces cover the common shapes of adoption: the HTTP API for production agents, Kastra Edge on developer laptops for Claude Code, Cursor, and Codex, and an MCP client for reading governance data. The audit trail is cryptographically chained and ed25519-signed, with real-time streaming to Datadog, Splunk, and S3 — that combination is the difference between an incident review that ends in a defensible answer and one that ends in a shrug. Strengths: the decision vocabulary. Most tools in this space either allow or block. Redact and hold map onto how real teams operate — you don't always need to stop the agent, you need to strip the secret out of the payload, or park the action until a human approves. Kastra Recon is the pragmatic on-ramp: it reads agent history, finds risky actions already taken, and drafts policies from them, which is the only realistic way to get a first rule set in place without hiring someone to write it. Self-hosted and air-gapped options plus a HIPAA BAA and a SOC 2 Type II / ISO 27001 posture mean regulated buyers aren't excluded. Weaknesses and cautions. Coverage is uneven by surface — Kastra governs Claude Code, Cursor, Codex, the HTTP API, and MCP, and enforcement capabilities differ across them, so a team running an agent framework outside those surfaces won't get equivalent coverage from the same install. Team and Enterprise pricing is quoted on contact rather than published as a rate card, so budgeting requires a conversation. Self-hosted and air-gapped deployments exist but carry setup work that the hosted path does not. Post-inference validation of model output is supported but adds latency. Where it fits: platform teams who want one policy set across every agent in the fleet; security engineers who are tired of discovering what an agent did from a diff; compliance teams who need explainable, tamper-evident records of every permitted action. Where it doesn't: read-only agents in sandboxes where nothing can actually break, solo hobby projects with no blast radius, and anyone shopping for an identity provider or a model-prose filter — Kastra explicitly says it's the wrong tool for those.
Limitations
- Coverage depends on the install surface: Kastra Edge governs Claude Code, Cursor, and Codex, the HTTP API covers production agents, and an MCP client reads governance data — enforcement capabilities differ across those surfaces, so an agent framework outside them won't get the same protection.
- Self-hosted and air-gapped deployments are available but require setup work.
- Scoped deliberately narrow: Kastra does not filter model prose and does not route between model vendors.
as of 2026-09-27
Researching Kastra? Get your full AI stack in 60 seconds.
Free, no signup — tell us your goal and get tools matched to your budget & existing stack.
Is Kastra still active?
Kastra is live · free plan; paid plans on request · last verified 9 Nov 2026 · viability healthy.
Viability score
How well maintained and how widely used is Kastra? Built from what the vendor actually publishes (docs, changelog, tutorials, integrations, pricing), whether the site is live, and how much real users discuss it. How we calculate this
Last calculated: November 2026
How we score →What do users say about Kastra?
What people actually say about Kastra — is it worth it?
Our community sentiment research written Jul 23, 2026 is more than 90 days old, so it is being re-reviewed against current data and is not shown.
How we verified this
Every listed fact about Kastra — pricing, features, links, status — is re-read from the vendor's own pages by our verification pipeline and each change is logged with a date; the last pass ran on 9 Nov 2026. Analysis is drafted with AI models and checked against our editorial standards before publishing; see how we verify.
Verification history
We have re-verified Kastra 8 times since . Each pass re-reads the vendor's own pages and re-checks every listed field against that evidence; passes where nothing had changed are marked as such.
- — changed SSL certificate
- — changed limitations
- — changed who it suits, description, our verdict, features, hidden costs, limitations, switching in, switching out, who should skip it, pricing tiers, pricing fit, setup time, summary, use cases
- — changed who it suits, who should skip it, pricing tiers, summary, our verdict, features, integrations, description
- — changed pricing page
- — changed SSL certificate, domain expiry
Showing the 6 most recent of 8 verification passes.
Free to cite with attribution — this page re-verifies continuously.
How much does Kastra cost in 2026?
Kastra: Free to start; it also has paid plans whose price we could not confirm — see the pricing table. Pricing last verified 9 Nov 2026.
Plans compared
Every published Kastra tier, its price as the vendor publishes it, who it fits, and what it adds over the tier below. The 12-month cost projection follows.
| Plan | Price | Billing | Who it's for |
|---|---|---|---|
| Free | Free | — | Individual developers who want local AI enforcement on their own machine without signing up, plus anyone who wants to try the sandbox before commiting.Adds: Starting tier and free entry point — local enforcement via Kastra Edge and the no-signup sandbox, governing Claude Code, Cursor, and Codex. |
| Pro (15-day trial) | 15-day self-serve trial | trial | A small team or solo engineer evaluating Kastra on production agents who wants API access and MCP governance data without talking to sales.Adds: Adds the Kastra HTTP API and MCP client connection, with self-serve signup and API keys created directly in the console during a 15-day trial. |
| Team | Custom | quote | Platform and security teams that need one policy set, shared management, and audit records across every agent in the fleet.Adds: Adds centralized governance, shared policy management, the cryptographically chained audit trail, and SIEM streaming to Datadog, Splunk, and S3. |
| Enterprise | Custom | quote | Regulated organizations that need dedicated infrastructure, air-gapped operation, or a signed BAA before agents can touch sensitive systems.Adds: Adds dedicated deployment with self-hosted and air-gapped options, a HIPAA BAA, and the SOC 2 Type II / ISO 27001 compliance posture. |
12-month cost
Project the real annual outlay, including the implied monthly cost when only an annual tier is published.
Vendor list price only. Add-on usage, seat overages, and contract minimums are surfaced under Hidden costs & gotchas.
Where the pricing makes sense
The company stage and team size where Kastra's pricing actually pencils out — and where peers do it cheaper.
Entry is cheap to evaluate: a free tier for local AI enforcement, a no-signup sandbox, and a 15-day self-serve Pro trial at app.kastra.ai/signup with API keys created in the console — no sales call. Team and Enterprise are quoted on contact, so the real comparison is against monitoring-only observability tools that cost less but only tell you what happened after an agent acted, and against building your own enforcement shim in-house, which most teams underestimate once audit trails and SIEM
Has Kastra's pricing changed?
No plan price for Kastra has moved since we began logging in Aug 2026; the pricing page is re-read on every verification pass.
Who should pick Kastra?
Pick Kastra if you are Development teams running Claude Code, Cursor, or Codex on machines with real write access, Platform teams enforcing one policy set across every agent in the fleet, Security engineers who need allow/deny/redact/hold decisions before execution, not monitoring after, Compliance and audit teams needing cryptographically chained, explainable decision records.
Look elsewhere if you are Teams that only need to filter model prose or route between model vendors, Read-only agents in sandboxes where no real-world action can occur, Anyone looking to replace their identity provider — Kastra governs actions, not logins, Solo hobby projects with no compliance or blast-radius concerns.
Skip it if Skip Kastra if your agents are read-only or sandboxed with no real-world blast radius — Kastra exists to gate actions that can actually change systems, and you'd be paying overhead for a checkpoint nothing needs to pass.
GeneratedReal-world workflow fit
Concrete scenarios for the personas Kastra actually fits — and what changes day-one when you adopt it.
Install Kastra Edge on developer machines so Claude Code, Cursor, and Codex are evaluated against a policy set before any shell command or file write lands; route anything touching production config or credentials into a hold for real-time approval.
Outcome: Agents stay productive on routine work while destructive actions require a human decision, and every allow/deny/redact/hold is recorded.
Call the Kastra HTTP API from production agents as the single authorization check, then stream every decision to Datadog and S3 so the platform team has one place to review fleet-wide agent behavior.
Outcome: One policy set governs every agent in the fleet, with tamper-evident traces available in existing observability tooling.
Start with Kastra Recon scanning historical agent activity to surface past risky actions and draft an initial policy set, then move to a self-hosted or air-gapped deployment with a HIPAA BAA.
Outcome: Auditors get cryptographically chained, ed25519-signed decision records that explain why each action was permitted, without telemetry leaving the environment.
Use cases
- Prevent AI coding agents from modifying sensitive configuration files without human approval.
- Audit every shell command an AI assistant executes on a developer machine.
- Give agents read-only access to production databases while blocking all writes.
- Enforce compliance by restricting agent network access to an approved endpoint list.
- Govern browser agents to control clicks, form fills, and navigation.
- Draft a starter policy set from real agent history using Kastra Recon.
- Meet audit requirements with ed25519-signed traces streaming into your SIEM.
- Run an authorization layer for agents inside an air-gapped environment.
Setup time & first value
How long it actually takes to get something useful out of Kastra — broken out by persona, not the marketing-page minute.
For a developer testing locally, the no-signup sandbox at kastra.ai/sandbox gives you a first policy decision in minutes, and Kastra Edge on a laptop gets Claude Code, Cursor, or Codex under governance in a single install. For a platform team wiring the HTTP API into production agents, budget a few days: key creation in the console is immediate, but policy authoring and SIEM streaming to Datadog,
Switching to or from Kastra
How to bring data in from common predecessors and how to get it back out — written for the switcher, not the buyer.
- →From manual code review of agent diffs: run Kastra Recon over agent history to draft a policy set, then install Kastra Edge so the same gate applies before the action instead of after.
- →From a monitoring-only observability tool: keep it for tracing, and put the Kastra HTTP API in the execution path to convert after-the-fact logs into pre-execution allow/deny/redact/hold decisions.
- →From an in-house shell wrapper or allowlist script: replace it with attribute-based policy in Kastra and pick up the chained audit trail and approval workflows you'd otherwise build yourself.
- ↗To a monitoring-only observability tool: you gain post-hoc visibility but lose pre-execution enforcement, so agent actions that already landed stay landed.
- ↗To an identity provider: you can govern who logs in, but not which actions an autonomous agent takes once it has access — a different problem than Kastra solves.
Integrations
Resources & guides
Tutorials & Learning
YouTube returned 6 videos for “Kastra”, and we withheld 6: 6 could not be judged, because “Kastra” is a single word that other videos use for other things. We are showing none, because we could not prove any of them are about Kastra.
Official links
What are the best Kastra alternatives?
The closest alternatives to Kastra we list are Kontext Cli, Arcade AI and Permit. Ranked by direct product-type match, not category overlap.
| Alternative | Pricing | Starts at | Last verified |
|---|---|---|---|
| Kontext Cli | Freemium | Pricing not published | — |
| Arcade AI | Freemium | Pricing not published | — |
| Permit | Freemium | Pricing not published | — |
Alternatives to Kastra
View all
Kontext Cli
Kontext delivers runtime authorization for AI agents — allow-or-deny on every tool call before it executes.
Tools that pair well with Kastra
Common stack mates teams adopt alongside Kastra, with the specific reason each pairing earns its keep.
Kontext Cli
Kontext delivers runtime authorization for AI agents — allow-or-deny on every tool call before it executes.
Arcade AI
Arcade AI is the MCP authorization runtime that governs every action your AI agents take.
Permit
Pre-execution action authorization for AI agents — a deterministic, signed gate on every tool call before it runs.
Kastra vs its closest rival
Kastra's closest head-to-head is with Audioeye — Kastra and AudioEye solve entirely different problems. Choose Kastra if you run AI coding agents and need real-time guardrails to prevent harmful actions; it's free to start and deeply technical. Choose AudioEye if you need automated web accessibility compliance backed by human experts; it's a paid enterprise tool. No overlap — your decision is about which problem you have. Verdict generated
Head-to-head comparisons
Kastra vs Audioeye
Kastra and AudioEye solve entirely different problems. Choose Kastra if you run AI coding agents and need real-time guardrails to prevent harmful actions; it's free to start and deeply technical. Choose AudioEye if you need automated web accessibility compliance backed by human experts; it's a paid enterprise tool. No overlap — your decision is about which problem you have.
GeneratedKastra vs Push Security
Push Security and Kastra solve different problems: Push protects against browser-level attacks and shadow AI tool use across all browsers, while Kastra prevents AI coding agents from executing dangerous actions in real time. If your priority is defending users from AiTM phishing, malicious OAuth, and data leakage to AI sites, go with Push Security. If you need runtime guardrails for Claude Code, Cursor, or similar agents to stop destructive commands, choose Kastra.
GeneratedKastra vs Sublime Security
Kastra and Sublime Security serve completely different domains: Kastra is for controlling AI coding agents (think guardrails for Claude Code/Cursor), while Sublime defends against email attacks. If you run AI dev agents and need real-time enforcement, pick Kastra's freemium model. If you're an enterprise SOC fighting BEC/phishing with transparent AI-driven detection, go with Sublime. They are not direct competitors but complementary tools for separate workflows.
GeneratedFrequently asked questions
Categories
Topics
For makers of Kastra
- Get a Verified Listing for Kastra ($39): a written decision within 1 working day.
- Free listing for another tool: Free reviews are decided in order, within 3 weeks of the review starting.
Used Kastra? Help shape our editorial sentiment research.