An App is an executable plugin manifest that gives Kestrel One agents a set
of named capabilities. Its driver may be built into Kestrel, call an API or CLI,
or connect through MCP. Open Apps at /apps to browse the catalog.
Apps are capability providers, not workflow prompts. Installing or enabling an App does not inject a procedure into the conversation or grant an effect by itself.
Read an App card
Each card combines three independent lifecycle states: installed, configured, and enabled. It also identifies the plugin driver, version, capabilities, and current readiness:
| Status | Meaning |
|---|---|
| Ready | The App can be used with its current installation and connection state |
| Setup required | The App needs a required connection |
| Available | An organization administrator must install it |
| Needs attention | A connection is degraded |
| Disabled | The organization has disabled the App |
Open an App to see its capabilities, connection requirements, driver, plugin version, and advanced runtime names. The catalog is the current source for which Apps and operations are available in your organization.
Personal and shared connections
A personal connection belongs to the person who connected the account. For example, an App may use a person's own service authorization when acting for that person. A shared connection belongs to an Environment and is configured by an organization administrator.
Some Apps require no connection. Others accept a personal connection, an Environment connection, or either form. The App detail page shows the model used by that App.
Installation and access
Organization members can browse available Apps and manage supported personal connections. Organization owners and administrators can install or disable explicit Apps and configure shared Environment connections.
An Environment sets the maximum App capability available to every Project that uses it. A Project may narrow that access for its own work, but it cannot enable a capability the Environment has denied. This keeps a Project from silently expanding its authority.
Custom Apps
Organization administrators can add a private MCP-backed App from Environment settings. Kestrel records the capabilities reported by the server and keeps them disabled until an administrator reviews and enables them.
MCP services
Remote and Environment-installed MCP servers use the same capability snapshot and grant model. Connection ownership, OAuth, health, descriptors, and enabled operations remain explicit.
Network and execution policy
An Environment chooses full or isolated network behavior. OCI/MCP egress is default-deny unless the owning policy allows the required destination. Container isolation does not itself authorize outbound access or additional workspace data.
Per-action authorization
An installed App can make a capability visible without pre-authorizing every effect. Consequential operations may still require a grant bound to the exact actor, target, parameters, and action.
Confirm availability
Verify the plugin is installed, configured, and enabled; its connection is ready; the Environment allows the capability; the Project has not narrowed it; and the effective agent can see the expected descriptor.
Continue to Context revisions, or read Environments for shared execution and App policy.