Your AI agent can delete your database. Kastra says no first.
Your AI coding agent can delete your database, or force-push straight to main, on its own. Kastra is the layer that says no first, before the command runs.
It decides before your agent acts, not after.
Everything else watches your agent after it acts. Logs, monitoring, and evals only show what already broke. Kastra decides before it acts. It sits in front of every command, allow or deny. The maker calls it new infrastructure, not a feature.
Your agent already holds the keys.
Agents run in production with real credentials, and nothing stops one from doing whatever it decides. Almost nobody has a layer that blocks one action before it fires. It's for anyone running Claude Code, Cursor, or Codex.
Every action clears four checks first.
It works like a bouncer for every move your agent makes. Each action runs four checks first. Is the caller who it claims to be. Is this action allowed. Does a guardrail match, like a block on wiping a system folder. Then it signs the verdict to a log nobody can edit. The answer is allow, deny, or hold for a human. Watch the agent's rm -rf get denied, before it runs. Kastra says that clears in under a millisecond, and it decides by rule, not a guess.
It shows you what your agent already did.
Here's the nice part. Run one scan, and Kastra Recon reads your agent's history, redacted on your machine, and shows what it already did. A secret written to a tracked file. A force-push to main. A read of your production database. Then it drafts a policy for each.
Free for one machine. Pay as the fleet grows.
There's a real free tier. Zero dollars, solo, fifty thousand decisions a month, with Claude Code and Codex CLI. Paid tiers add fleet-wide control, about twenty a month. The launch calls the runtime open source. Today the public repo ships the releases, not the source. Built by Carlos Jimenez at Kastra Labs.
Kastra
The coding tools are growing their own permission prompts, so the open question is how much they absorb. For now, Kastra sits in front of every action, yes or no, before it runs.
