Kestra vs Windmill API + MCP

Kestra

Kestra's open-source edition has a 216-operation OpenAPI spec, Markdown docs for agents and weekly patch releases on two long-term support lines. Its only credential is one basic-auth username and password with full access, and five critical advisories were published between March and September 2026, all fixed.

Windmill API + MCP

Token scopes down to a single script path, with expiry. The default MCP URL puts the token in ?token= unless a superadmin turns that off.

Kestra

1. Run 2.0.5 or 1.3.42 or later. Earlier builds carry unauthenticated remote code execution advisories fixed in 1.3.38 and 2.0.3
2. Set kestra.server.basic-auth in the config file before first start. Without it the setup page is open to anyone who reaches the port
3. Put the tenant in the path. Open-source instances use main, as in /api/v1/main/executions/{namespace}/{id}
4. Send flow inputs as multipart form fields, and add wait=true to get the finished execution in the same call
5. Keep port 8081 off any shared network. The management endpoints there skip the API's basic auth

Windmill API + MCP

1. Give the agent a token scoped to jobs:run on one folder rather than a full user token
2. Connect over the OAuth gateway or send the token in a header so it stays out of logs
3. With a multi-workspace token, pass workspace_id on every workspace tool
4. Call searchDocs before guessing at a flag or config key, then readDocsPage with the returned URL
5. Poll the job by ID after runScriptByPath for long jobs instead of waiting on the call