Kastra - Policy Enforcement for AI Coding Agents

TL;DR

TL;DR: Kastra is an authorization layer for AI coding agents (Claude Code, Cursor, Codex) that intercepts and approves or blocks every tool call, shell command, and API request in real time — with a free tier and one-click self-hosted deployment.

Source and Accuracy Notes

⚠️ This section is MANDATORY. All links must be verified from actual source, not guessed.

• Project page: kastra.ai ← MUST visit and verify
• HN launch thread: news.ycombinator.com/item?id=48847526 ← verified
• Pricing: Free / Pro / Team / Enterprise (verified on pricing page)
• License: Not confirmed open source; website does not list a GitHub repo

What Is Kastra?

AI coding agents like Claude Code, Cursor, and Codex operate with broad permissions — they can execute shell commands, call APIs, read files, and spawn processes. Kastra adds an authorization layer that intercepts every action before it runs and lets you define policies for what each agent is allowed to do.

From the product description: “Control what your AI is allowed to do. Sub-millisecond authorization for every prompt, tool call, shell command, and API request.”

Kastra splits into two components:

• Kastra Recon — discovers what actions your AI is actually taking (audit trail)
• Kastra Edge — enforces policies at the point of execution (block or allow)

Both are included in all plan tiers.

How It Works

Kastra runs as a local proxy or self-hosted service alongside your existing AI coding setup. When an AI agent attempts an action, the request goes through Kastra’s policy engine first. Policies are defined as plain configuration files and can target:

• Specific tools (e.g., allow Bash only for npm test, block curl to external IPs)
• File system paths (allow reads under src/, block writes outside the project root)
• Network destinations (block API calls to unknown endpoints)
• Time-of-day or session-based constraints

Setup

Prerequisites

• macOS, Linux, or a VPS for self-hosted deployment
• An AI coding agent (Claude Code, Cursor, or Codex)
• No credit card required for the free tier

Self-hosted Deployment

# Pull the Kastra Docker image
docker pull kastra/kastra:latest

# Run with your config directory mounted
docker run -d \
  --name kastra \
  -p 8080:8080 \
  -v ./kastra-config:/etc/kastra \
  kastra/kastra:latest

Point your AI agent’s proxy settings to http://localhost:8080 to route all tool calls through Kastra.

Connect Claude Code

In your Claude Code config (~/.claude.json or project-level), add:

{
  "http_proxy": "http://localhost:8080"
}

Restart Claude Code. All tool calls will now be evaluated against your policies before execution.

Free Tier Limits

The free tier covers individual developers with basic policy needs. Pro, Team, and Enterprise add higher rate limits, team management, and advanced policy conditions.

Practical Evaluation Checklist

• [ ] Policy file syntax is readable and human-editable (not a proprietary DSL)
• [ ] Recon dashboard shows a real-time log of intercepted actions
• [ ] Block decisions happen in under 1ms per call (sub-millisecond target)
• [ ] Self-hosted deployment completes in under 5 minutes
• [ ] Compatible with all three major agents: Claude Code, Cursor, Codex
• [ ] Audit trail is exportable (JSON / CSV)
• [ ] Free tier covers solo developer usage

Security Notes

Running an authorization proxy between your agent and the system means Kastra has significant access to every action the agent takes. Review the following before production use:

• Data residency — self-hosted keeps all audit data on your infrastructure
• Policy scope — overly permissive policies defeat the purpose; start restrictive
• Agent updates — verify Kastra remains compatible after agent version upgrades

FAQ

Q: Does Kastra work with local models via Ollama? A: Kastra is designed for agent platforms that support proxy configuration. Check the docs for Ollama-specific setup if your agent uses an Ollama backend.

Q: Is there an open-source version? A: The project page does not list a public source repository. The self-hosted Docker deployment is available without a subscription.

Q: How does it compare to a simple allowlist shell alias? A: A shell alias only covers CLI commands. Kastra intercepts the full tool-call surface area of the agent, including file reads, network calls, and MCP tool invocations that never touch a shell.

Q: Does it work on Windows? A: Self-hosted Docker deployment requires Linux. For Windows, WSL2 or a Linux VM would be needed.

Conclusion

Kastra fills a real gap in the AI coding agent workflow — the step between “agent decides to act” and “action reaches the system.” Sub-millisecond enforcement means it won’t slow down an agent’s natural pace, and the free tier makes it accessible to solo developers who want to understand what their agent is doing without blocking it outright.

For teams, the Team and Enterprise tiers add shared policy management and audit trails across multiple agents. For individuals, Kastra Recon alone (the discovery mode) is worth running just to see what your agent actually touches when you are not watching.

Try it at kastra.ai.