Kestra vs Kognitos

Kestra

Kestra's open-source edition has a 216-operation OpenAPI spec, Markdown docs for agents and weekly patch releases on two long-term support lines. Its only credential is one basic-auth username and password with full access, and five critical advisories were published between March and September 2026, all fixed.

Kognitos

Kognitos has a self-serve free workspace, a public OpenAPI file and a hosted MCP server with OAuth 2.1 and scoped, expiring tokens. The 21 October AI Employees and Context Graphs are in preview for existing customers only, and their REST and MCP access isn't documented, so an outside agent can reach the automation platform but not the new parts.

Kestra

1. Run 2.0.5 or 1.3.42 or later. Earlier builds carry unauthenticated remote code execution advisories fixed in 1.3.38 and 2.0.3
2. Set kestra.server.basic-auth in the config file before first start. Without it the setup page is open to anyone who reaches the port
3. Put the tenant in the path. Open-source instances use main, as in /api/v1/main/executions/{namespace}/{id}
4. Send flow inputs as multipart form fields, and add wait=true to get the finished execution in the same call
5. Keep port 8081 off any shared network. The management endpoints there skip the API's basic auth

Kognitos

1. Don't plan on Context Graph or AI Employee calls. Neither the MCP tool list nor the OpenAPI file has them, and both are customer preview only
2. Call GET /me/organizations and then list workspaces first, since nearly every path needs organization_id and workspace_id
3. Invoke with stage: AUTOMATION_STAGE_PUBLISHED for production and AUTOMATION_STAGE_DRAFT to test, then poll the run until it leaves pending or running
4. Treat a waiting run as a question for a person. Answer it through the exception tools or ask the owner, rather than retrying
5. Use OAuth with callback port 3777 for the MCP server. Another port can fail with a callback URL mismatch