NewWe launched on Y Combinator.Check it out
Kestrel vs StackStorm

Looking for a StackStorm alternative?

StackStorm pioneered if-this-then-that automation for infrastructure. Kestrel gives you event-driven workflows from plain English, with approval gates, AI investigation, and no rules engine to maintain.

No credit card required · Onboard in seconds

What StackStorm is good at

StackStorm pioneered event-driven infrastructure automation: sensors, rules, and actions composed into workflows. The model is powerful and genuinely general, and it runs entirely on your own infrastructure.

Where Kestrel is different

Kestrel keeps the event-driven model but removes the authoring burden. Instead of writing sensors, rule definitions, and Orquesta workflows by hand, you describe the automation in plain English and get a workflow you can review, test, and version — with the triggers already wired up.

Side by side

 StackStormKestrel
Authoring modelSensors, rules, and action-chain or Orquesta YAML you maintainPlain-English description compiled into a reviewable workflow graph
Trigger setupWrite and deploy a sensor per event sourcePre-built triggers across Kubernetes, cloud, CI/CD, alerting, and Slack
Operational overheadYou run and upgrade the platform and its packsManaged service; on-premise available
AI investigationNot part of the productBuilt-in RCA that reads logs, metrics, and cloud state before acting
Approvals on risky stepsImplemented yourself inside the workflowFirst-class approval gates in Slack with a full audit trail
Editing surfacesYAML and the CLINatural language, visual canvas, or the Python SDK — same workflow

Which one fits you

Both are reasonable choices. These are the cases where each one wins.

Stay with StackStorm

If you have invested in StackStorm packs, need everything self-hosted with no managed component, and your team is comfortable maintaining the rules engine.

Try Kestrel

If sensor and rule maintenance has become the work, you want investigation before remediation, or you want approvals and audit without building them.

Automate the hardest parts of platform engineering.

Use natural language to build automations for incident response, cloud provisioning, CI/CD pipelines, security, and more. Edit with words, visually, or in code.

WORKFLOW AGENT

From words to production-ready workflows

Use your words to build automations for incident response, cloud provisioning, CI/CD pipelines, developer requests, and more — with 200+ pre-built actions across 40+ integrations, and any number of custom actions.

Words → workflowDeterministic execution40+ integrations
Workflow Agent

Describe your workflow in plain English. The AI agent will generate a workflow graph you can edit.

Cmd+Enter to generate
Generate
AWS IAM Privilege Escalation Response
Investigate and respond to detected IAM privilege escalation events in AWS, including RCA, alerting, ticketing, and containment with approval.
TRIGGER
IAM Privilege Escalation Ev...
KESTREL
Investigate Cloud RCA
CONDITION
Is Real Privilege Escalati...
rca_result.is_application_level_failur...
True →False →
PAGERDUTY
Alert PagerDuty
JIRA
Create Jira Ticket with RCA
KESTREL
Generate AWS CLI Contain...
APPROVAL
Cloud Security Team Appro...
Approved →Rejected →
KESTREL
Apply Containment Comma...
Describe workflow in natural language...
</>Python SDK Code
pip install kestrel-sdk✦ Create PR
REFINE & CONFIGURE

Refine with words, drag-and-drop, or code

Add steps, parameters, or approvals using natural language, edit visually on a DAG canvas with 200+ actions, or jump into the CLI and SDK for full programmatic control.

Natural languageVisual DAG editorCLI & SDK
K8s Rollout Failure: Rollback, RCA, and Slack Notify
On Kubernetes deployment rollout failure, trigger rollback via GitHub Actions and Slack notify, plus RCA and GitOps PR with Slack update on merge.
TRIGGER
Deployment Replicas Failing
GITHUB
Trigger Rollback GH Action
SLACK
Notify #k8s-incidents
KESTREL
Trigger RCA
KESTREL
Create GitOps PR for Fix
APPROVAL
Wait for PR Merge
Approved →Rejected →
SLACK
Update #k8s-incidents
Describe workflow in natural language...
Workflow Agent

Describe your workflow in plain English. The AI agent will generate a workflow graph you can edit.

When a Kubernetes deployment rollout fails, in parallel: trigger the rollback GitHub actions and send a Slack message to #k8s-incidents; run RCA, create a GitOps PR for the fix, and on PR merge update the message in #k8s-incidents

Cmd+Enter to generate
Generate
DETERMINISTIC BY DESIGN

No hallucinations or surprises

Once configured, workflows always run the exact code you define. AI builds the workflow — deterministic execution ensures it runs reliably, every time.

Exact code executionPredictable outcomes
Vercel Firewall Attack Alert Response
Investigate, notify Slack, raise PagerDuty, block attacker IP via Vercel WAF API.
Running
TRIGGER
Vercel Firewall Attack
VERCEL
Investigate Vercel Firewall Attack
SLACK
Notify Slack #incidents
PAGERDUTY
Raise PagerDuty Alert
VERCEL
Block Attacker IP via WAF API
</>Python SDK Code
from kestrel import KestrelClient
from kestrel.workflows import (
Workflow, Trigger, Action
)
 
def main() -> None:
wf = (
Workflow("Firewall Attack Response")
.description(
"Investigate, notify, alert,"
" block attacker IP.",
)
.trigger(
Trigger.vercel_firewall()
.events("firewall.attack")
.label("Firewall Attack"),
)
.cooldown(minutes=0)
.max_concurrent(3)
.then(
Action.investigate()
.query(
"Analyze the attack and"
" summarize root cause.",
)
.max_iterations(5)
.label("Investigate"),
)
.then(
Action.slack_message()
.channel("incidents")
.message(
":alert: *Attack!*\n"
"{{outputs.summary}}",
)
.label("Notify Slack"),
)
.then(
Action.pagerduty_alert()
.severity("critical")
.title(
"Firewall Attack: "
"{{signal.type}}",
)
.label("PagerDuty Alert"),
)
.then(
Action.vercel_firewall()
.action("deny")
.ip("{{signal.ip}}")
.label("Block Attacker"),
)
)
 
client = KestrelClient(
api_key="kestrel_sk_KEY"
)
client.workflows.deploy(wf)
 
if __name__ == "__main__":
main()
pip install kestrel-sdk● Executing workflow...
ACCESS CONTROL

Control access and approvals

Define who can trigger workflows and who needs to approve before execution. In-platform, Slack-based, and PR-based approval gates.

RBAC per workflowApproval gatesFull audit trail
Search Kestrel AI
Kestrel AI
Channels
incidents-staging
k8s-self-serve
dev-chat
Apps
Kestrel AI
k8s-self-serve
Message #k8s-self-serve
Search Kestrel AI
Kestrel AI
Channels
incidents-staging
platform-ops
customer-support
Apps
Kestrel AI
platform-ops
Alex Kim11:22 PM
Rolled out the new node pool autoscaler config to staging. Watching for the next 30min.
Jamie Rivera11:24 PM
👍 I see the new nodes spinning up. Memory pressure looks stable so far.
Priya Patel11:26 PM
Nice. Also finished the Terraform drift detection module — PR is up if anyone wants to review.
Message #platform-ops
OBSERVABILITY

Full visibility into every execution

Track every workflow run with a real-time dashboard. Execution history, step-level logs, latency, and failure reasons.

Real-time dashboardStep-level logsFailure alerts

Workflow Executions

Browse, filter, and inspect all workflow execution runs.

Search workflow...
All Statuses
All Workflows
All Sources
WorkflowStatusTriggerStartedDuration
CrashLoopBackOff RCA & Fix with Slack Approval
a4f62b2e
Running
Kubernetes
May 4, 2026 09:23:46 PM UTC
IAM Privilege Escalation Response
b7e91c3f
Running
AWS
May 4, 2026 09:22:31 PM UTC
Vercel Firewall Attack Alert Response
c3d84a1e
Running
Vercel
May 4, 2026 09:21:18 PM UTC
Pod CrashLoopBackOff Service Dependency Alert
7ced7b04
Completed
Kubernetes
May 4, 2026 09:17:39 PM UTC
13s
Deployment Rollback & Slack Notify
d92f1a5b
Completed
Kubernetes
May 4, 2026 09:15:22 PM UTC
24s
S3 Bucket Policy Change Alert
e1c73d9a
Completed
AWS
May 4, 2026 09:12:04 PM UTC
8s
PostHog Error Spike Investigation
f8b24e6c
Awaiting Approval
PostHog
May 4, 2026 09:08:51 PM UTC
New Namespace Provisioning Request
g5a91b7d
Completed
Slack Request
May 4, 2026 09:05:33 PM UTC
18s
PagerDuty Incident Auto-Investigation
h2d63e8f
Completed
PagerDuty
May 4, 2026 09:01:47 PM UTC
11s
Showing 1–9 of 847
PreviousPage 1 of 95Next

CrashLoopBackOff RCA & Fix with Slack Approval

Detect pod failures, generate RCA, notify Slack, apply fix on approval.
Running
KUBERNETES
Pod CrashLoopBackOff Detected
KESTREL
Trigger RCA & Generate Fix
SLACK
Notify #incidents Channel
APPROVAL
Wait for Slack Approval
KESTREL
Apply YAML Fix to Cluster
DEVELOPER TOOLS

Manage from CLI, SDK, or MCP

The Kestrel CLI, Python SDK, and MCP server give developers full control of Kestrel workflows from the terminal, application code, or AI coding assistants.

kestrel — zsh
SUGGESTED WORKFLOWS

Move fast with suggested workflows

AI agents analyze your connected integrations and suggest ready-to-use workflows for your organization — so you know exactly what to automate next.

Integration-awareReady to deployZero setup

Workflows

Automate operations with signal-driven, composable pipelines.

Total Executions1,009
Completed vs Failed779 completed
Blocked on Approval8 pending
Pod Crash RCA and Jira EpicActive
When a pod crashes in the gke-staging-cluster, trigger RCA, generate a fix, and create a Jira Epic.
3 steps · ○ 134 triggers
On-Demand K8s Resource Provision with Approval and Slack DMActive
Provision any Kubernetes resource from Slack. Includes approval gate and DMs the requester.
6 steps · ○ 5 triggers
APIGateway CrashLoopBackOff RCA & DocsActive
When apigateway-svc pods crashloop, trigger RCA, generate fix, create Jira ticket, publish to Confluence.
4 steps · ○ 9 triggers
PostHog Rage Click RCA & NotifyActive
When a user rage clicks more than 3 times, summarize the cause and notify via Slack and Jira.
4 steps · ○ 19 triggers
CrashLoopBackOff RCA & Fix with Slack Approval (GKE Staging)Active
Alert via Slack, trigger RCA and fix, wait for approval, then apply fix and notify.
6 steps · ○ 5 triggers
Vercel Firewall Attack Alert ResponseActive
Investigate Vercel firewall attacks, notify Slack, raise PagerDuty alert, and block attacker IP via WAF API.
5 steps · ○ 0 triggers

What can you automate with workflows?

Incident Response

Detect, investigate, and remediate in seconds

Incident Response
Cloud Provisioning

Self-serve infrastructure for developers

Cloud Provisioning
Developer Requests

Self-serve with justification and approval gates

Developer Requests
CI/CD Pipelines

Ship with confidence, automate the glue

CI/CD Pipelines
Cost Optimization

Monitor spend, cut waste, enforce budgets

Cost Optimization
Security

Detect threats and respond instantly

Security

Connects to your entire stack

40+ integrations across infrastructure, PaaS, CI/CD, security, observability, databases, and more. Plus custom webhooks and HTTP APIs for anything else.

Infrastructure

PaaS

Vercel
Vercel
Railway
Railway
Fly.io
Fly.io

AI Compute

Nebius
Nebius
Daytona
Daytona
Beam
Beam

Observability

OTel
OTel
PostHog
PostHog
Datadog
Datadog

On-Call

Slack
Slack
PagerDuty
PagerDuty
incident.io
incident.io

Secrets

Vault
Vault
Infisical
Infisical
OpenBao
OpenBao

Project Mgmt

Jira
Jira
Linear
Linear
Confluence
Confluence
Notion
Notion

Security

SonarCloud
SonarCloud
Okta
Okta
Kyverno
Kyverno
Trivy
Trivy

Networking

Cloudflare
Cloudflare
Cilium
Cilium
Envoy
Envoy
Istio
Istio

Databases

Supabase
Supabase
PlanetScale
PlanetScale
Neon
Neon
ClickHouse
ClickHouse

CI/CD

GitHub
GitHub
GitLab
GitLab
ArgoCD
ArgoCD
Helm
Helm

IaC & GitOps

Terraform
Terraform
Pulumi
Pulumi
OpenTofu
OpenTofu
CFN
CFN
+ custom webhook triggers and HTTP API action blocks

Pay for what you use

Workflows is usage-based — you pay per execution, not per seat. 14-day free trial, no credit card required.

Workflows

Usage-based — pay per execution

~$0.50/ execution avg
200+ pre-built actions across 40+ integrations
Custom HTTP actions & webhook triggers
Build with natural language, visual editor, CLI, SDK, or MCP
Approval gates & RBAC per workflow
Unlimited workflows
Light blocks ($0.10)100
Regular blocks ($0.20)60
Heavy blocks ($0.40)40
100 × $0.10 + 60 × $0.20 + 40 × $0.40
200 blocks / month$38.00/mo
TierPriceActions
Light$0.10Slack, Jira, Linear, GitHub, GitLab, Confluence, Notion, PagerDuty, ArgoCD, Datadog, PostHog, Vercel, AWS Cost queries, custom HTTP APIs and webhooks, conditions, approvals, wait steps
Regular$0.20K8s manifest generation, Helm values generation, cloud resource generation, AI cost analysis
Heavy$0.40K8s RCA & fix generation, Cloud RCA & fix generation, AI code investigation, AI code fix generation, K8s investigation, cloud investigation, Vercel investigation

See it on your own platform stack

Describe an automation in plain English and Kestrel builds a workflow you can review, test, and run. 14-day free trial with $1,000 in credits — no credit card required.