Kestrel

Open-source security for SaaS

Kestrel connects to the SaaS applications you already run, normalizes their users, groups, roles, permissions, resources, settings, and OAuth grants into one identity/access graph, and tells you who can reach what — across applications, not one admin console at a time.

It snapshots that graph on every sync, diffs the snapshots into a classified change feed, evaluates Python policies against the inventory, and produces findings with the evidence that created them and guidance to fix them. Self-hosted and Apache-2.0.

Website · Documentation · Quick start · Why Kestrel · Integrations · Architecture · Contributing

---

Quick start

No cloud credentials required. Pick the path that matches what you want to do.

Run it with Docker

Everything runs in containers; nothing else to install.

git clone https://github.com/kestrel-security/kestrel.git && cd kestrel
cp deployments/compose/.env.example deployments/compose/.env
# Edit deployments/compose/.env and set:
#   KESTREL_MASTER_KEY  -> openssl rand -base64 32
#   POSTGRES_PASSWORD   -> openssl rand -hex 24
#   APP_URL             -> http://localhost:3000 (the default)
#   KESTREL_HTTP_PORT   -> only if something else holds 3000; change APP_URL to match
docker compose -f deployments/compose/docker-compose.yml up -d --build

Kestrel doesn't publish container images. Compose builds the three images (api, worker, web) from the Dockerfiles in deployments/docker/, on the official python and node base images; the first build takes several minutes. Migrations run automatically before the API and worker start.

Kestrel is not on PyPI either: pip install kestrel installs an unrelated project, and this project is unrelated to the Kestrel threat hunting language (kestrel-core / kestrel-lang). Run it from Docker or from a checkout.

Create the first admin. The password is generated and printed once:

docker compose -f deployments/compose/docker-compose.yml run --rm api \
  kestrel init --admin-email [email protected]

Optionally load the fixture demo — four synthetic tenants and a three-month drift timeline — so every page has data behind it:

docker compose -f deployments/compose/docker-compose.yml run --rm api kestrel demo up
docker compose -f deployments/compose/docker-compose.yml run --rm api kestrel demo change

Open http://localhost:3000/login. To put it on a network, behind TLS, see docs/deployment.md.

Develop on it

make demo-up builds the same four synthetic tenants against a development stack with live reload.

git clone https://github.com/kestrel-security/kestrel.git && cd kestrel
make sync        # uv sync && pnpm install
make demo-up     # Postgres + Redis, migrations, admin, four fixture tenants, drift timeline, API, worker, web

Open http://localhost:3010 and sign in with [email protected] / kestrel-dev-password (local development defaults — never use them on a reachable network). The Docker path above serves on 3000; the development stack shifts its host ports so it can run next to a host next dev server or the Docker deployment.

Prerequisite	Docker path	Developer path
Docker with Compose v2	Required	Required (PostgreSQL 16, Redis 7, and the app containers)
Python 3.12+ with uv	—	Required
Node.js 22+ with pnpm 10 (corepack enable, or install pnpm directly on a Node build without corepack)	—	Required
make	—	Required

Allow about 4 GB of free memory for the build and the running stack. On the developer path, host ports are shifted to avoid collisions: web 3010, API 8010, Postgres 5433, Redis 6380. make demo-down tears it down. Migrations, the .env file, and the admin operator are created for you; the individual steps are in docs/getting-started.md. The development stack's Compose project is always named kestrel, so every checkout on a machine shares one set of containers and one database, and make demo-down or docker compose down -v acts on whichever is running. Set COMPOSE_PROJECT_NAME before make demo-up to give a second checkout its own.

Then connect a real tenant: Integrations → Add integration walks you through minting read-only credentials for GitHub, Okta, Slack, or Google Workspace without leaving the product. Setup guides: docs/connectors/.

Clean up or start over

# Docker path
docker compose -f deployments/compose/docker-compose.yml run --rm api kestrel demo down --yes   # remove the demo tenants
docker compose -f deployments/compose/docker-compose.yml down      # stop the stack; data is kept
docker compose -f deployments/compose/docker-compose.yml down -v   # stop and delete all data (database, queue, certificates)

# Developer path
make demo-down          # remove the demo tenants, then stop the containers
docker compose down -v  # also delete the development database

여기까지가 README 앞부분입니다. 나머지는 원문에서 읽을 수 있습니다. README 전문 보기 ↗