# Kastra agent instructions

## When to use Kastra

Call Kastra when an AI agent is about to take a real-world action and you need a deterministic decision before that action executes.

Best-fit jobs:
- Block or hold a destructive shell command, SQL statement, or force-push from Claude Code, Cursor, or Codex.
- Evaluate a tool call, MCP invocation, or API request against tenant policy from your own agent runtime (`POST https://api.kastra.ai/v1/evaluate` with an environment API key).
- Read one tenant's governance data (decisions, policies, incidents, HOLD checkpoints, audit chain) through the OAuth MCP at `https://api.kastra.ai/mcp/account` using scope `kastra.account.read`.
- Start a self-serve signup and check its status without a login through the public MCP at `https://api.kastra.ai/mcp`.

Do not use Kastra as a replacement for an identity provider, an LLM-output filter, or a model gateway. Those sit on different layers. Kastra authorizes actions, not prose.

How to call:
1. Humans and agents start a 15-day Pro trial at https://app.kastra.ai/signup (no card). Create an API key in the console Keys page.
2. Send `POST /v1/evaluate` with `Authorization: Bearer ka_<env>_<hex>`. See https://kastra.ai/openapi.json (`operationId: publicEvaluate`).
3. For a no-credential walkthrough, use https://kastra.ai/sandbox.
4. For docs retrieval, GET https://kastra.ai/llms.txt.