Kastra

About Kastra

Kastra is a runtime authorization layer for AI agents. It intercepts tool calls, prompts, inputs, and outputs before they execute, returning an allow or deny decision in under a millisecond. A single control plane enforces policies across Claude Code, Cursor, Codex, OpenClaw, the Anthropic SDK, and the OpenAI SDK.

Review

Most teams monitoring AI agents only see what an agent already did. Kastra inserts a deterministic check into the execution path, so actions that violate policy never run at all. The tool's makers describe it as a way to "trust the rules, not the agents," and the architecture reflects that intention.

Key Features

• Sub‑1 ms policy evaluation. Every agent action is evaluated against policy and receives an allow or deny decision within a millisecond, keeping the authorization check fast enough for production workloads.
• Cross‑framework enforcement. One policy plane governs agents across Claude Code, Cursor, Codex, OpenClaw, and both the Anthropic and OpenAI SDKs. The same rules apply regardless of the tool or model underneath.
• Deterministic engine. Policies are not probabilistic prompts; the engine applies rules that produce the same result every time. Nested tool calls are evaluated independently, so an authorized parent action does not automatically grant permission to downstream calls.
• Fail‑open and fail‑closed modes. Teams can test policies in a sandboxed environment first - one mode logs every decision without blocking, the other logs and blocks - and switch modes on the dashboard when ready for production.
• Human‑in‑the‑loop approval. When an action requires a person to approve it, the review completes in roughly one second across the desktop app, web console, and macOS notifications.

Pricing and Value

The runtime and policy pack library are open source. The enterprise control plane is commercial; specific pricing tiers are not yet publicly detailed. New users can try the tool for free and run a local scan of existing agent activity to surface risks that would benefit from policies.

Pros

• Policy decisions happen before execution, not after, closing the gap between observability and prevention.
• Deterministic rules remove the uncertainty that comes with prompt‑based guardrails.
• Cross‑framework support means a single policy set applies to multiple coding and SDK‑based agents.
• Per‑environment testing with fail‑open and fail‑closed modes lets teams measure the impact of blocking before enforcing it in production.
• The open‑source runtime lowers the barrier to inspecting how authorization decisions are made.

Cons

• Teams that don't run autonomous agents with tool access - or that use agents outside the currently supported frameworks - won't find a use case.
• The commercial control plane's pricing is unclear, which makes budgeting difficult for organizations that need the enterprise features.
• Running the authorization layer adds a component to the stack that must remain highly available; a full outage of the Kastra runtime would block actions if configured in fail‑closed mode.

Kastra fits teams that already deploy coding agents, support agents, or infrastructure agents in environments where a single unauthorized shell command or API call can cause real damage. It's less relevant for lightweight experimentation, but for production use where deterministic, pre‑execution authorization is missing, the tool fills a gap that prompt engineering and post‑action monitoring do not address.

Open 'Kastra' Website