NewWe launched on Y Combinator.Check it out
Y Combinator
Backed by Y Combinator

AI Agents for Platform Engineering.

Automate incident response, cloud provisioning, CI/CD, and developer requests with AI agents that build deterministic workflows across your entire stack.

No credit card required · Onboard in seconds

Built by engineers from

BAIR
Illumio
Square
Coursera
DNAnexus

Automate the hardest parts of platform engineering.

Use natural language to build automations for incident response, cloud provisioning, CI/CD pipelines, security, and more. Edit with words, visually, or in code.

WORKFLOW AGENT

From words to production-ready workflows

Use your words to build automations for incident response, cloud provisioning, CI/CD pipelines, developer requests, and more — with 200+ pre-built actions across 40+ integrations, and any number of custom actions.

Words → workflowDeterministic execution40+ integrations
Workflow Agent

Describe your workflow in plain English. The AI agent will generate a workflow graph you can edit.

Cmd+Enter to generate
Generate
AWS IAM Privilege Escalation Response
Investigate and respond to detected IAM privilege escalation events in AWS, including RCA, alerting, ticketing, and containment with approval.
TRIGGER
IAM Privilege Escalation Ev...
KESTREL
Investigate Cloud RCA
CONDITION
Is Real Privilege Escalati...
rca_result.is_application_level_failur...
True →False →
PAGERDUTY
Alert PagerDuty
JIRA
Create Jira Ticket with RCA
KESTREL
Generate AWS CLI Contain...
APPROVAL
Cloud Security Team Appro...
Approved →Rejected →
KESTREL
Apply Containment Comma...
Describe workflow in natural language...
</>Python SDK Code
pip install kestrel-sdk✦ Create PR
REFINE & CONFIGURE

Refine with words, drag-and-drop, or code

Add steps, parameters, or approvals using natural language, edit visually on a DAG canvas with 200+ actions, or jump into the CLI and SDK for full programmatic control.

Natural languageVisual DAG editorCLI & SDK
K8s Rollout Failure: Rollback, RCA, and Slack Notify
On Kubernetes deployment rollout failure, trigger rollback via GitHub Actions and Slack notify, plus RCA and GitOps PR with Slack update on merge.
TRIGGER
Deployment Replicas Failing
GITHUB
Trigger Rollback GH Action
SLACK
Notify #k8s-incidents
KESTREL
Trigger RCA
KESTREL
Create GitOps PR for Fix
APPROVAL
Wait for PR Merge
Approved →Rejected →
SLACK
Update #k8s-incidents
Describe workflow in natural language...
Workflow Agent

Describe your workflow in plain English. The AI agent will generate a workflow graph you can edit.

When a Kubernetes deployment rollout fails, in parallel: trigger the rollback GitHub actions and send a Slack message to #k8s-incidents; run RCA, create a GitOps PR for the fix, and on PR merge update the message in #k8s-incidents

Cmd+Enter to generate
Generate
DETERMINISTIC BY DESIGN

No hallucinations or surprises

Once configured, workflows always run the exact code you define. AI builds the workflow — deterministic execution ensures it runs reliably, every time.

Exact code executionPredictable outcomes
Vercel Firewall Attack Alert Response
Investigate, notify Slack, raise PagerDuty, block attacker IP via Vercel WAF API.
Running
TRIGGER
Vercel Firewall Attack
VERCEL
Investigate Vercel Firewall Attack
SLACK
Notify Slack #incidents
PAGERDUTY
Raise PagerDuty Alert
VERCEL
Block Attacker IP via WAF API
</>Python SDK Code
from kestrel import KestrelClient
from kestrel.workflows import (
Workflow, Trigger, Action
)
 
def main() -> None:
wf = (
Workflow("Firewall Attack Response")
.description(
"Investigate, notify, alert,"
" block attacker IP.",
)
.trigger(
Trigger.vercel_firewall()
.events("firewall.attack")
.label("Firewall Attack"),
)
.cooldown(minutes=0)
.max_concurrent(3)
.then(
Action.investigate()
.query(
"Analyze the attack and"
" summarize root cause.",
)
.max_iterations(5)
.label("Investigate"),
)
.then(
Action.slack_message()
.channel("incidents")
.message(
":alert: *Attack!*\n"
"{{outputs.summary}}",
)
.label("Notify Slack"),
)
.then(
Action.pagerduty_alert()
.severity("critical")
.title(
"Firewall Attack: "
"{{signal.type}}",
)
.label("PagerDuty Alert"),
)
.then(
Action.vercel_firewall()
.action("deny")
.ip("{{signal.ip}}")
.label("Block Attacker"),
)
)
 
client = KestrelClient(
api_key="kestrel_sk_KEY"
)
client.workflows.deploy(wf)
 
if __name__ == "__main__":
main()
pip install kestrel-sdk● Executing workflow...
ACCESS CONTROL

Control access and approvals

Define who can trigger workflows and who needs to approve before execution. In-platform, Slack-based, and PR-based approval gates.

RBAC per workflowApproval gatesFull audit trail
Search Kestrel AI
Kestrel AI
Channels
incidents-staging
k8s-self-serve
dev-chat
Apps
Kestrel AI
k8s-self-serve
Message #k8s-self-serve
Search Kestrel AI
Kestrel AI
Channels
incidents-staging
platform-ops
customer-support
Apps
Kestrel AI
platform-ops
Alex Kim11:22 PM
Rolled out the new node pool autoscaler config to staging. Watching for the next 30min.
Jamie Rivera11:24 PM
👍 I see the new nodes spinning up. Memory pressure looks stable so far.
Priya Patel11:26 PM
Nice. Also finished the Terraform drift detection module — PR is up if anyone wants to review.
Message #platform-ops
OBSERVABILITY

Full visibility into every execution

Track every workflow run with a real-time dashboard. Execution history, step-level logs, latency, and failure reasons.

Real-time dashboardStep-level logsFailure alerts

Workflow Executions

Browse, filter, and inspect all workflow execution runs.

Search workflow...
All Statuses
All Workflows
All Sources
WorkflowStatusTriggerStartedDuration
CrashLoopBackOff RCA & Fix with Slack Approval
a4f62b2e
Running
Kubernetes
May 4, 2026 09:23:46 PM UTC
IAM Privilege Escalation Response
b7e91c3f
Running
AWS
May 4, 2026 09:22:31 PM UTC
Vercel Firewall Attack Alert Response
c3d84a1e
Running
Vercel
May 4, 2026 09:21:18 PM UTC
Pod CrashLoopBackOff Service Dependency Alert
7ced7b04
Completed
Kubernetes
May 4, 2026 09:17:39 PM UTC
13s
Deployment Rollback & Slack Notify
d92f1a5b
Completed
Kubernetes
May 4, 2026 09:15:22 PM UTC
24s
S3 Bucket Policy Change Alert
e1c73d9a
Completed
AWS
May 4, 2026 09:12:04 PM UTC
8s
PostHog Error Spike Investigation
f8b24e6c
Awaiting Approval
PostHog
May 4, 2026 09:08:51 PM UTC
New Namespace Provisioning Request
g5a91b7d
Completed
Slack Request
May 4, 2026 09:05:33 PM UTC
18s
PagerDuty Incident Auto-Investigation
h2d63e8f
Completed
PagerDuty
May 4, 2026 09:01:47 PM UTC
11s
Showing 1–9 of 847
PreviousPage 1 of 95Next

CrashLoopBackOff RCA & Fix with Slack Approval

Detect pod failures, generate RCA, notify Slack, apply fix on approval.
Running
KUBERNETES
Pod CrashLoopBackOff Detected
KESTREL
Trigger RCA & Generate Fix
SLACK
Notify #incidents Channel
APPROVAL
Wait for Slack Approval
KESTREL
Apply YAML Fix to Cluster
DEVELOPER TOOLS

Manage from CLI, SDK, or MCP

The Kestrel CLI, Python SDK, and MCP server give developers full control of Kestrel workflows from the terminal, application code, or AI coding assistants.

kestrel — zsh
SUGGESTED WORKFLOWS

Move fast with suggested workflows

AI agents analyze your connected integrations and suggest ready-to-use workflows for your organization — so you know exactly what to automate next.

Integration-awareReady to deployZero setup

Workflows

Automate operations with signal-driven, composable pipelines.

Total Executions1,009
Completed vs Failed779 completed
Blocked on Approval8 pending
Pod Crash RCA and Jira EpicActive
When a pod crashes in the gke-staging-cluster, trigger RCA, generate a fix, and create a Jira Epic.
3 steps · ○ 134 triggers
On-Demand K8s Resource Provision with Approval and Slack DMActive
Provision any Kubernetes resource from Slack. Includes approval gate and DMs the requester.
6 steps · ○ 5 triggers
APIGateway CrashLoopBackOff RCA & DocsActive
When apigateway-svc pods crashloop, trigger RCA, generate fix, create Jira ticket, publish to Confluence.
4 steps · ○ 9 triggers
PostHog Rage Click RCA & NotifyActive
When a user rage clicks more than 3 times, summarize the cause and notify via Slack and Jira.
4 steps · ○ 19 triggers
CrashLoopBackOff RCA & Fix with Slack Approval (GKE Staging)Active
Alert via Slack, trigger RCA and fix, wait for approval, then apply fix and notify.
6 steps · ○ 5 triggers
Vercel Firewall Attack Alert ResponseActive
Investigate Vercel firewall attacks, notify Slack, raise PagerDuty alert, and block attacker IP via WAF API.
5 steps · ○ 0 triggers

What can you automate with workflows?

Incident Response

Detect, investigate, and remediate in seconds

Incident Response
Cloud Provisioning

Self-serve infrastructure for developers

Cloud Provisioning
Developer Requests

Self-serve with justification and approval gates

Developer Requests
CI/CD Pipelines

Ship with confidence, automate the glue

CI/CD Pipelines
Cost Optimization

Monitor spend, cut waste, enforce budgets

Cost Optimization
Security

Detect threats and respond instantly

Security

Connects to your entire stack

40+ integrations across infrastructure, PaaS, CI/CD, security, observability, databases, and more. Plus custom webhooks and HTTP APIs for anything else.

Infrastructure

PaaS

Vercel
Vercel
Railway
Railway
Fly.io
Fly.io

AI Compute

Nebius
Nebius
Daytona
Daytona
Beam
Beam

Observability

OTel
OTel
PostHog
PostHog
Datadog
Datadog

On-Call

Slack
Slack
PagerDuty
PagerDuty
incident.io
incident.io

Secrets

Vault
Vault
Infisical
Infisical
OpenBao
OpenBao

Project Mgmt

Jira
Jira
Linear
Linear
Confluence
Confluence
Notion
Notion

Security

SonarCloud
SonarCloud
Okta
Okta
Kyverno
Kyverno
Trivy
Trivy

Networking

Cloudflare
Cloudflare
Cilium
Cilium
Envoy
Envoy
Istio
Istio

Databases

Supabase
Supabase
PlanetScale
PlanetScale
Neon
Neon
ClickHouse
ClickHouse

CI/CD

GitHub
GitHub
GitLab
GitLab
ArgoCD
ArgoCD
Helm
Helm

IaC & GitOps

Terraform
Terraform
Pulumi
Pulumi
OpenTofu
OpenTofu
CFN
CFN
+ custom webhook triggers and HTTP API action blocks

Build a workflow in seconds, right here

Describe the workflow in plain English and the Workflow Agent will build it live.

112/500

Enterprise-grade security, by design

Your data stays isolated, your models stay private, and every action is audited.

Tenant Isolation

Complete data isolation at the application and database layer.

No Model Training

Your data is never used to train AI models. Inference only.

SOC 2 Compliant

Independently audited security controls and practices.

Read-Only by Default

Write access is opt-in and scoped per action.

Full Audit Trail

Immutable logs of every user and AI action.

SSO & MFA

Single sign-on via SAML/OIDC and multi-factor authentication for all users.

Available as Cloud or Self-Hosted

Pay for what you use

Three independent products — subscribe to any combination. 14-day free trial, no credit card required.

Start free trial

Workflows

Usage-based — pay per execution

~$0.50/ execution avg
200+ pre-built actions across 40+ integrations
Custom HTTP actions & webhook triggers
Build with natural language, visual editor, CLI, SDK, or MCP
Approval gates & RBAC per workflow
Unlimited workflows
Light blocks ($0.10)100
Regular blocks ($0.20)60
Heavy blocks ($0.40)40
100 × $0.10 + 60 × $0.20 + 40 × $0.40
200 blocks / month$38.00/mo
TierPriceActions
Light$0.10Slack, Jira, Linear, GitHub, GitLab, Confluence, Notion, PagerDuty, ArgoCD, Datadog, PostHog, Vercel, AWS Cost queries, custom HTTP APIs and webhooks, conditions, approvals, wait steps
Regular$0.20K8s manifest generation, Helm values generation, cloud resource generation, AI cost analysis
Heavy$0.40K8s RCA & fix generation, Cloud RCA & fix generation, AI code investigation, AI code fix generation, K8s investigation, cloud investigation, Vercel investigation

Incident Response

Per cluster + cloud account

$200/mo

1 Kubernetes cluster + 1 cloud account

24/7 AI monitoring & detection
Automatic root cause analysis
Production-ready fixes
Causal PR detection
Community support

Cloud AI Copilot

Subscription + overage

$100/mo

Up to 150 messages/month, then $1/message

Natural language infrastructure queries
Investigate & fix incidents in chat
Dashboard + Slack access
Community support
Always free
Topology MapCloud InventoryIntegrationsAudit LogSDK, CLI & MCP

What You'll Experience

50% of your platform workflows automated in 14 days. Guaranteed.

Phase 1

Connect

Meet your deployment team

Connect your infrastructure and core integrations

Introduce foundational automations

Phase 2

Build

Identify your highest-impact automation opportunities

Build workflows tailored to your integrations and team

Phase 3

Deploy

Deploy workflows to production with guardrails

Iterate on workflows based on real usage

Phase 4

Optimize

Expand coverage across your cloud stack and teams

Audit and refine your workflows

Frequently asked questions

Workflows are event-driven automation pipelines built as DAGs. They chain triggers, actions, conditions, and approval gates across 40+ integrations. Build them five ways: natural language, drag-and-drop canvas, CLI, Python SDK, or MCP for AI agent integration.
Incident response, cloud provisioning requests, CI/CD orchestration, developer self-service, and so much more. Any sequence of actions across your integrations can be automated.
Yes. All three products — Workflows, Incident Response, and Cloud AI Copilot — are independent. Subscribe to any combination that fits your needs.
Each time a workflow is triggered counts as one execution. The cost depends on the blocks in that workflow: light blocks (e.g. Slack, Jira, approvals, custom HTTP APIs and webhooks) are $0.10, regular blocks (e.g. K8s/cloud resource generation, AI cost analysis) are $0.20, and heavy blocks (e.g. RCA, code investigation, code fixes) are $0.40.
All Kubernetes and cloud infrastructure and application incidents — CrashLoopBackOff, OOMKilled, failed rollouts, node issues, RBAC denials, IAM changes, network misconfigurations, security findings, cost anomalies, resource failures, and more. We also process signals from PagerDuty, PostHog, Vercel, Datadog, and custom webhooks.
Under 5 minutes. Install the Kubernetes operator via Helm, connect your cloud accounts, and add integrations. The operator is read-only by default and requires no cluster modifications.
SOC 2 compliant with tenant-scoped data isolation. Your data is never used to train AI models. All integrations are read-only by default with write access opt-in. Full audit trail for every action.
Yes. Self-hosted deployment on AWS, GCP, Azure, and OCI, including fully air-gapped environments. Deploys as a unified Helm chart with support for Amazon Bedrock, Vertex AI, Azure OpenAI, and OCI Generative AI.
40+ integrations, including Kubernetes, AWS, GitHub, GitLab, ArgoCD, Vercel, Slack, PagerDuty, Jira, Confluence, Datadog, PostHog, Terraform, Helm, and any custom HTTP API and webhook.
Yes — 14 days, no credit card required. The trial includes up to 100 workflow executions/day, 1 Incident Response unit (1 K8s cluster + 1 cloud account), and up to 10 Cloud AI Copilot chats/day.

Ready to automate your platform workflows?

Connect your integrations in minutes. Automate what used to take hours.

No credit card required · Onboard in seconds