Security and project

Status and support

Where to get help, which Kraft versions and platforms are supported, what its version numbers promise, and its license.

This page says where to get help, which versions and platforms Kraft supports, and what its version numbers promise. Kraft is young, and it changes quickly: expect rough edges, and read the release notes on GitHub before you upgrade.

Getting help

A work item stopped, or Kraft will not start. See Troubleshooting. kraft admin doctor checks the install and says what to fix.
A bug or a question. Ask in GitHub issues. The bug report form asks for kraft --version, the output of kraft admin doctor, your operating system, and your agent harness and its version.
A security problem. Report it privately instead; see Reporting a vulnerability.

Supported versions

Only the latest release gets fixes, security fixes included. Kraft has no long-term support branch.

kraft admin update installs the latest release on your channel. A stable install follows stable, and a pre-release install follows its own channel. --channel picks another. The release notes on GitHub say what each release changed. What's new in 2.0 covers the 2.0 release.

Supported platforms

What	Supported	Notes
Operating system	macOS and Linux	Windows is not supported, and Windows Subsystem for Linux (WSL) is untested.
Python	3.12, 3.13 and 3.14	CI runs the tests on each. uv installs one for you if the machine has none.
Container runtime	Docker or Podman	Only if you use the optional sandbox.

Vector search on an Intel Mac, or on Apple Silicon before macOS 14, needs Python 3.12 or 3.13.

Versioning and stability

Kraft follows semantic versioning. These are its public interfaces:

the kraft command line: its verbs, flags, exit codes and --json output;
the HTTP endpoints meant for other programs: POST /api/triggers and GET /api/health;
the YAML config schema under $KRAFT_HOME/config;
the MCP tools.

Every other HTTP route exists for the board and can change in any release.

Release	May change
Major (`3.0.0`)	Anything, including a breaking change to the CLI, the API, the config schema or the state on disk. The release notes say what breaks and how to move.
Minor (`2.1.0`)	New capabilities that do not break an existing one.
Patch (`2.0.1`)	Fixes to something that already shipped.

Licenses

Kraft is Apache-2.0 licensed: see LICENSE.

The web interface and the VS Code extension bundle open-source packages. Their license texts are in THIRD_PARTY_LICENSES.txt. A running Kraft serves it at /THIRD_PARTY_LICENSES.txt on its own address, such as http://127.0.0.1:8765/THIRD_PARTY_LICENSES.txt. It also ships in the Python wheel (kraft/_bundled/web/) and in the .vsix (extension/dist/).

Security: what Kraft protects against and how to report a vulnerability.
Upgrade Kraft: how to update, pin or roll back a version.

Edit this pageorReport an issue

What's new in 2.0

What to do before you upgrade from 1.4, and what Kraft 2.0 brings, from a new interface and code-host review to a repo connect that reads more of the repo and safer sharing.

Architecture

One FastAPI process, the executor inside it, the worker sessions it spawns, how a work item flows through them, and where each trust boundary is enforced.