Kestra vs Pipedream API + MCP

Kestra

Kestra's open-source edition has a 216-operation OpenAPI spec, Markdown docs for agents and weekly patch releases on two long-term support lines. Its only credential is one basic-auth username and password with full access, and five critical advisories were published between March and September 2026, all fixed.

Pipedream API + MCP

Managed OAuth per end user across 3,000+ apps, through API, SDK or MCP. Public changelog's last entry is 1 October 2025.

Kestra

1. Run 2.0.5 or 1.3.42 or later. Earlier builds carry unauthenticated remote code execution advisories fixed in 1.3.38 and 2.0.3
2. Set kestra.server.basic-auth in the config file before first start. Without it the setup page is open to anyone who reaches the port
3. Put the tenant in the path. Open-source instances use main, as in /api/v1/main/executions/{namespace}/{id}
4. Send flow inputs as multipart form fields, and add wait=true to get the finished execution in the same call
5. Keep port 8081 off any shared network. The management endpoints there skip the API's basic auth

Pipedream API + MCP

1. Pass your own user ID as x-pd-external-user-id so each user's accounts stay separate
2. Send x-pd-app-slug to load one app's tools rather than 10,000
3. Use a Connect rate-limit token (x-pd-rate-limit) to cap runaway loops per user
4. Check isError on tool results before treating a call as done
5. Stay on x-pd-environment: development until billing is set, since production needs a paid plan