Activepieces API + MCP vs Kestra

Activepieces API + MCP

MIT core, self-hostable, with the enterprise parts clearly separated. Docs say API keys come from the platform dashboard in Platform and Enterprise editions, while the pricing page lists the API on every plan.

Kestra

Kestra's open-source edition has a 216-operation OpenAPI spec, Markdown docs for agents and weekly patch releases on two long-term support lines. Its only credential is one basic-auth username and password with full access, and five critical advisories were published between March and September 2026, all fixed.

Activepieces API + MCP

1. Run ap_validate_flow before publishing a flow
2. Use ap_search_actions with a plain task description rather than listing pieces
3. Turn off the Flow Building and Tables groups for a project the agent should only read
4. Page with limit and cursor and stop when next is null
5. Cloud runs stop at 10 minutes of active time. Waits and approvals don't count

Kestra

1. Run 2.0.5 or 1.3.42 or later. Earlier builds carry unauthenticated remote code execution advisories fixed in 1.3.38 and 2.0.3
2. Set kestra.server.basic-auth in the config file before first start. Without it the setup page is open to anyone who reaches the port
3. Put the tenant in the path. Open-source instances use main, as in /api/v1/main/executions/{namespace}/{id}
4. Send flow inputs as multipart form fields, and add wait=true to get the finished execution in the same call
5. Keep port 8081 off any shared network. The management endpoints there skip the API's basic auth