Kastra – Policy Guard for Claude Code, Cursor, and Codex

TL;DR

TL;DR: Kastra is a runtime authorization layer for AI coding agents that intercepts tool calls and evaluates them against deterministic policies before they execute — preventing destructive actions like production database deletes from ever running.

Source and Accuracy Notes

⚠️ This section is MANDATORY. All links must be verified from actual source, not guessed.

• Project page: kastra.ai ← verified via curl, returned 200
• HN launch thread: news.ycombinator.com/item?id=48847526
• OG image: kastra.ai/og-image.jpg ← verified, 1536x1024 JPEG
• Source last checked: 2026-07-10

Note: Kastra does not appear to have a public source repository. All claims below are verified from the official site and HN launch thread only.

What Is Kastra?

Kastra is a runtime authorization layer for AI coding agents. It sits between an agent and the tools it calls, intercepting every action and evaluating it against user-defined deterministic policies before the action executes.

The founders built Kastra after a Cursor agent almost executed DELETE FROM customers WHERE status='test' against a production database. The action was caught in time, but it revealed a gap: nothing in their stack deterministically decided what the agent was allowed to do. LLMs are probabilistic, and prompts influence behavior — but neither enforces hard constraints.

Kastra pushes an allow, hold, or deny decision before any action runs. Policies are defined in plain English from the web app. The interception engine evaluates the tool name, targets, and parameters of every action.

Supported agents (per HN launch): Claude Code, Codex, Cursor, OpenClaw.

Setup Workflow

Step 1: Install Kastra Edge (CLI)

Kastra Edge provides the local CLI and agent interception engine. Install via Homebrew:

brew install kastra-labs/tap/kastra-edge

After installation, authenticate:

kastra-edge auth login

Step 2: Run a Recon Scan

Before writing any policies, run Recon to audit what your agents have already done. This reads local agent session history on your machine — secrets never leave:

kastra-edge scan

The scan surfaces:

• Risky actions already taken by agents
• Secrets written to tracked files
• Production database touches
• Force pushes
• curl-to-shell conversions

# Example output (from HN demo)
kastra-edge scan
# Scanning agent history...
# Found 3 high-risk actions in this session

Step 3: Convert Findings to Policies

Each Recon finding can be converted into a runtime policy directly from the Kastra dashboard. Policies are written in plain English — no code required.

For example, a policy blocking DELETE FROM on production databases might read:

“Deny any SQL tool call targeting a production database connection.”

Step 4: Enforce Policies at Runtime

With policies active, Kastra intercepts all tool calls and evaluates them in real time. According to the launch thread, policy evaluations typically complete in under one millisecond:

# Start Kastra in enforce mode
kastra-edge run --policy-set production

# Agent tool calls now evaluated against policies before execution
# allow → executes
# hold → pauses for human review
# deny → blocked with explanation

Deeper Analysis

Why This Matters

Coding agents operate with broad access to your codebase, package managers, shell, and database clients. A single misinterpreted prompt or prompt injection can trigger destructive actions. The gap is deterministic enforcement — something that says “no” with certainty, regardless of what the LLM was told to do.

Kastra addresses this by separating policy enforcement from the LLM’s probabilistic output. Instead of trusting the model to “understand” safety instructions, you trust deterministic rules that govern its actions.

Policy Packs

Kastra ships with pre-built policy packs covering common high-risk scenarios. These can be imported and customized rather than building from scratch.

Audit Trail

Every decision (allow, hold, deny) is recorded in an immutable audit trail. This gives security teams visibility into what agents attempted to do, even when actions were blocked.

Multi-Agent Challenge

The founders noted on HN that managing teams of agents with conflicting policies is still an open problem. If you are building multi-agent systems, your feedback on this scenario is explicitly welcome.

Practical Evaluation Checklist

• [ ] Install Kastra Edge (brew install kastra-labs/tap/kastra-edge)
• [ ] Run kastra-edge scan on your existing agent history
• [ ] Review findings — how many surprised you?
• [ ] Import a policy pack relevant to your stack
• [ ] Write a custom policy in plain English
• [ ] Test a deny scenario with a synthetic risky action
• [ ] Check the audit trail for the blocked action record

Security Notes

• Data locality: Recon scans run entirely on your machine. Agent session data does not leave your local environment.
• Policy evaluation speed: Sub-millisecond evaluation (per HN launch) means minimal latency added to agent tool calls.
• No model-level trust: Kastra enforces behavior regardless of prompt content or model version.

FAQ

Q: Does Kastra work with all AI coding agents? A: The launch specifically mentions Claude Code, Codex, Cursor, and OpenClaw. Coverage for other agents may vary.

Q: Is there a public source repository? A: No public GitHub repo was found. Kastra appears to be a closed-source commercial product.

Q: What does the free tier include? A: Per the HN launch, the desktop app, CLI, dashboard, and Recon scan are free for developers.

Q: Can policies be version controlled? A: The dashboard supports policy management. For detailed version control workflows, refer to the official docs.

Conclusion

Kastra fills a real gap in AI agent deployments: deterministic enforcement of what agents are allowed to do, regardless of prompt content. The near-miss story (production DELETE blocked by a human rather than a policy) is likely familiar to anyone who has deployed coding agents at scale.

The free developer tier — CLI, Recon scan, dashboard, and audit trail — is a practical entry point. If you run Claude Code, Cursor, or Codex in any environment touching production systems, Kastra is worth evaluating before the first incident rather than after.

Try it: kastra.ai