An interactive coding CLI in one static binary. Bring the agent CLI you already run, or bring a key. $99, once.
Thesis
kestrel is a coding CLI of the Claude Code class, shipped as one static Rust binary. It drives the agent CLIs already installed on your machine, or it talks straight to an API key. Six harness packs, detected from the repo, go in with whichever engine runs.
So the conventions, the review rubric and the post-edit checklist do not change when the model does. You change the engine. The standard stays bolted to the repository.
Session / one ticket, start to finish
Transcript: kestrel greps and reads app/api/refunds.py, edits it, asks permission before running a shell command, generates an Alembic migration, runs ruff, mypy and pytest, clears the FastAPI and Postgres post-edit checklist, then a four-way fan-out returns a ship verdict and the merge command.
Seven tools sit in the loop: read, write, edit, glob, grep, shell and git. The three read-only ones never prompt. Everything that writes asks first, and answering a once writes the rule into .kestrel/settings.toml so it never asks again.
Engines / 5 CLIs, 6 presets, any endpoint
Agent CLIs it drives
Found on your PATH, probed for a version, then handed the task with the harness prepended.
claudeClaude Codecursor-agentCursorkimiKimi CLIgeminiGemini CLIcodexCodex CLIEndpoints it speaks
Three wire protocols, six presets you name with one word, and a base URL field for everything else.
anthropicapi.anthropic.comopenaiapi.openai.comopenrouteropenrouter.ai/apigeminigenerativelanguage.googleapis.commoonshotapi.moonshot.aiollamalocalhost:11434, no keyKeys resolve in one order: environment variable, then smbk, then the OS keychain. kestrel auth writes to the keychain only. A key never lands in a plaintext file and is never echoed back to the terminal.
Harness / 6 packs, read off the repo
Each pack is a set of conventions, a review rubric and a deterministic post-edit checklist. kestrel reads the repository, picks the packs that apply, merges them into one document, and injects it into whichever engine runs the task.
detectsfastapi in pyproject or requirements
requests inside an async def path.dict. response_model is set on every route.detectsmanage.py
select_related/prefetch_related on every list endpoint that touches a foreign key or reverse relation. An N+1 query is a bug, not a performance nit.post_save/pre_save are for cross-cutting concerns like cache invalidation, never for charging the customer.makemigrations --check is clean.detectsCargo.toml
thiserror in libraries, anyhow in binaries..unwrap()/.expect() outside tests, main's outermost boundary, or a comment proving the invariant that makes panic impossible.cargo clippy -- -D warnings), not just run locally and ignored.detectsgo.mod
%w, never %v or %s, when the caller might need errors.Is/errors.As on the cause.context.Context is the first parameter of every function that can block, call out, or be cancelled, named ctx, never stored on a struct.go vet and staticcheck (or golangci-lint) run clean in CI, not just go build.detectspostgres in docker-compose, or a migrations directory
SELECT * in application code.timestamptz always, never bare timestamp. Migrations reversible, or explicitly and permanently not, with a comment saying why.EXPLAIN (ANALYZE, BUFFERS) is run on every new or materially changed list query before it ships.detectspackage.json, or any .html or .css
Packs stack. A Django service with a migrations/ directory gets both layers, merged under one header. Run kestrel harness export and the merged document lands at .kestrel/HARNESS.md, readable by you and by any other agent you point at the repository.
Design / 11 aesthetics, 13 pairings
Runs the design rubric over the files you name and prints a scored ledger. Every criterion gets a score from 0.0 to 1.0 and one line of justification anchored to a path:line or to command output, because a score without a pointer is an opinion. The verdict ends with the judge naming the score it would need to see to reverse itself.
Deterministic checks run first and are final. If the grep finds an em-dash, or the page scrolls sideways at 390px, no judge gets to argue it away.
Eleven named aesthetics
Ask for one by name and get the real pattern, built in flat colour.
Thirteen curated pairings
Display, body and mono, chosen together, all free for commercial use. Five of the thirteen:
summit.js 0.4.3 ships inside the design pack, 17KB gzipped. Behaviour composed directly in HTML, no build step, no virtual DOM, no eval, so it passes a strict CSP. Scaffolds come wired to the local copy, which means a generated page makes zero external requests on first load.
Fan-out / many attempts, one verdict
One judge reading four diffs is a single point of failure, so --ultra replaces the judge with a court. Your working tree is never touched. Every attempt settles on its own branch, and you merge the one that won.
Fleet / every agent CLI on the machine, each in its own git worktree
Panel / three judges read every diff, one lens each, in parallel
And every commit crosses one desk. ak refuses to commit on main, never force-pushes, holds the history to conventional commits, and opens the pull request from the same place.
Price / once, not monthly
$99LifetimeAll updates included
kestrel update. One purchase, forever.Book the call, that is the checkout.
Thirty minutes with the person who built it. You watch it run against a repository of your choosing, ask whatever you want, and leave with a personal download link.
Status: v1 in build. Buy now and you are on the list from the first release onward, at this price, for good.
FAQ / six answers
kestrel update checks a version file, compares the sha256, and pulls the new binary from your own link. Every release, for as long as there are releases. There is no renewal to forget.claude, cursor-agent, kimi, gemini and codex when they are on your PATH, and it speaks Anthropic, OpenAI, OpenRouter, Gemini, Moonshot and Ollama by name. Anything else with an OpenAI-compatible base URL is one line of config, which covers Groq, DeepSeek, Together, vLLM, and any open-weight model you host yourself.smbk, then the keychain. Keys are never written to a config file and never printed back to you. Ollama needs no key at all.