Open-source security for SaaS
Kestrel connects to the SaaS applications you already run, normalizes their users, groups, roles, permissions, resources, settings, and OAuth grants into one identity/access graph, and tells you who can reach what — across applications, not one admin console at a time.
It snapshots that graph on every sync, diffs the snapshots into a classified change feed, evaluates Python policies against the inventory, and produces findings with the evidence that created them and guidance to fix them. Self-hosted and Apache-2.0.
Website · Documentation · Quick start · Why Kestrel · Integrations · Architecture · Contributing
Quick start
No cloud credentials required. Pick the path that matches what you want to do.
Run it with Docker
Everything runs in containers; nothing else to install.
git clone https://github.com/kestrel-security/kestrel.git && cd kestrel
cp deployments/compose/.env.example deployments/compose/.env
# Edit deployments/compose/.env and set:
# KESTREL_MASTER_KEY -> openssl rand -base64 32
# POSTGRES_PASSWORD -> openssl rand -hex 24
# APP_URL -> http://localhost:3000 (the default)
# KESTREL_HTTP_PORT -> only if something else holds 3000; change APP_URL to match
docker compose -f deployments/compose/docker-compose.yml up -d --build
Kestrel doesn't publish container images. Compose builds the three images
(api, worker, web) from the Dockerfiles in deployments/docker/,
on the official python and node base images; the first build takes several
minutes. Migrations run automatically before the API and worker start.
Kestrel is not on PyPI either: pip install kestrel installs an unrelated
project, and this project is unrelated to the Kestrel threat hunting language
(kestrel-core / kestrel-lang). Run it from Docker or from a checkout.
Create the first admin. The password is generated and printed once:
docker compose -f deployments/compose/docker-compose.yml run --rm api \
kestrel init --admin-email [email protected]
Optionally load the fixture demo — four synthetic tenants and a three-month
drift timeline — so every page has data behind it:
docker compose -f deployments/compose/docker-compose.yml run --rm api kestrel demo up
docker compose -f deployments/compose/docker-compose.yml run --rm api kestrel demo change
Open http://localhost:3000/login. To put it on a network, behind TLS, see
docs/deployment.md.
Develop on it
make demo-up builds the same four synthetic tenants against a development
stack with live reload.
git clone https://github.com/kestrel-security/kestrel.git && cd kestrel
make sync # uv sync && pnpm install
make demo-up # Postgres + Redis, migrations, admin, four fixture tenants, drift timeline, API, worker, web
Open http://localhost:3010 and sign in with [email protected] / kestrel-dev-password (local development defaults — never use them on a reachable network). The Docker path above serves on 3000; the development stack shifts its host ports so it can run next to a host next dev server or the Docker deployment.
| Prerequisite | Docker path | Developer path |
|---|
| Docker with Compose v2 | Required | Required (PostgreSQL 16, Redis 7, and the app containers) |
Python 3.12+ with uv | — | Required |
Node.js 22+ with pnpm 10 (corepack enable, or install pnpm directly on a Node build without corepack) | — | Required |
make | — | Required |
Allow about 4 GB of free memory for the build and the running stack. On the
developer path, host ports are shifted to avoid collisions: web 3010, API
8010, Postgres 5433, Redis 6380. make demo-down tears it down.
Migrations, the .env file, and the admin operator are created for you; the
individual steps are in docs/getting-started.md.
The development stack's Compose project is always named kestrel, so every
checkout on a machine shares one set of containers and one database, and
make demo-down or docker compose down -v acts on whichever is running. Set
COMPOSE_PROJECT_NAME before make demo-up to give a second checkout its own.
Then connect a real tenant: Integrations → Add integration walks you through minting read-only credentials for GitHub, Okta, Slack, or Google Workspace without leaving the product. Setup guides: docs/connectors/.
Clean up or start over
# Docker path
docker compose -f deployments/compose/docker-compose.yml run --rm api kestrel demo down --yes # remove the demo tenants
docker compose -f deployments/compose/docker-compose.yml down # stop the stack; data is kept
docker compose -f deployments/compose/docker-compose.yml down -v # stop and delete all data (database, queue, certificates)
# Developer path
make demo-down # remove the demo tenants, then stop the containers
docker compose down -v # also delete the development database
This is the beginning of the README. Read the rest at the original. Read the full README ↗
