Manage Workflows from the CLI & MCP

The workflow builder is great for designing and refining automations visually. But platform engineers live in the terminal and, increasingly, in AI coding assistants. Today we're bringing Kestrel Workflows to both: the Kestrel CLI for managing workflows from your shell and CI/CD, and an MCP server that lets AI coding agents manage workflows for you.

The Kestrel CLI

Install with Homebrew (or grab a binary), authenticate with an API key, and you're ready to go:

brew install KestrelAI/tap/kestrel
kestrel auth kestrel_sk_...

Create an API key in the platform under Workflows → API Keys — scoped to exactly the permissions you want — or sign in with kestrel login. Credentials are stored locally and reused across the CLI and MCP server.

Generate a workflow from your shell

The same Workflow Agent that powers the builder is available from the command line. Describe what you want and save it as a draft in one command:

kestrel workflows generate --save \
  "When a pod crashloops, run RCA, create a Jira ticket, and notify #incidents on Slack"

kestrel workflows get <id> even renders an ASCII diagram of the workflow DAG right in your terminal.

The full lifecycle, scriptable

Everything you can do in the UI, you can do from the CLI — which makes it a natural fit for CI/CD pipelines and GitOps:

• Manage — list, get, create --file, edit, duplicate, delete.
• Ship — activate, pause, test for a dry run.
• Operate — executions, stats, replay (from the beginning or --from-failed).
• Govern — approvals list / approve / reject, plus versions and rollback.
• Request — workflows request submits a natural-language request, the CLI equivalent of /kestrel-workflow in Slack.

Workflows in your AI coding assistant

The Kestrel MCP server exposes workflow management as tools your AI coding agent can call directly — so you can build, change, and operate workflows in plain conversation inside Cursor, Claude Desktop, OpenAI Codex, and any other MCP-compatible client.

It runs as a subcommand of the CLI and reuses your existing credentials, so setup is a few lines of config. For Cursor, add it to ~/.cursor/mcp.json:

{
  "mcpServers": {
    "kestrel": { "command": "kestrel", "args": ["mcp"] }
  }
}

Let the agent do the wiring

With the MCP server connected, you can simply tell your assistant what you want:

The agent generates the workflow, reviews it, creates it, and activates it on your behalf. It can also answer operational questions — "show me the last 5 failed executions and what went wrong" or "are there any pending approvals? approve the production deployment one" — by calling the right tools for listing executions, inspecting step results, and resolving approval gates. API-key scopes apply here too, so the agent can only do what you've allowed.

Scoped API keys you control

Both the CLI and MCP server authenticate with API keys you create and manage on the API Keys page. Give each key a name (like ci-deploy or monitoring), choose its scopes, set an expiration, and click Create Key.

Scopes are granular, so a key only ever gets the access it needs: Full Access, or any combination of Workflows: Read / Write / Activate / Delete, Executions: Read / Cancel, Approvals: Read / Manage, Requests: Read / Manage, and Catalog: Read. Expirations can be No expiration, 30 days, 90 days, or 1 year.

The page lists every key with its scopes, status, when it was last used, when it expires, and when it was created — so you always know what each key can do and whether it's still active. Revoke a key the moment it's no longer needed, or delete it outright. A read-only monitoring key, a write-scoped CI key, and a full-access break-glass key can all live side by side, each independently auditable and revocable.

Getting Started

Install the CLI with brew install KestrelAI/tap/kestrel, create a scoped API key under Workflows → API Keys, and run kestrel auth. For MCP, point your AI tool at kestrel mcp. Full command and tool references are in the CLI and MCP docs.