feat(kiro): ship the MCP registry disabled-by-default with per-persona grants (2.5.71) by jeromevdl · Pull Request #412 · awslabs/aidlc-workflows

jeromevdl · 2026-06-19T16:03:39Z

Summary

Kiro CLI now ships the same five MCP servers as Claude Code (context7 + the four AWS servers), declared in .kiro/settings/mcp.json and disabled by default. Maintainer rebuild of @jeromevdl's original branch onto current v2 (the original predated the 15-config Kiro agent layout); recreates #358.

Enable a server: flip "disabled": false on that entry in .kiro/settings/mcp.json.

Changes

harness/kiro/settings/mcp.json (new): five-server registry mirroring Claude's .mcp.json, every server shipped with "disabled": true so no fetched code runs until a user opts in per server. The @latest launchers stay aligned with the Claude registry; under opt-in they execute only after an explicit enable.
context7 ships keyless on Kiro. Live verification on kiro-cli 2.12.1 showed Kiro sends MCP HTTP header values verbatim ($VAR, ${VAR}, and ${env:VAR} all arrive unexpanded), so a configured header is either a broken placeholder or a committed secret. The registry therefore declares no headers, and a test pins that policy.
All 14 delegated persona configs set includeMcpJson: true and grant the five @<server> tools. The conductor (aidlc.json) is excluded and keeps its locked-down surface. Grants are never added to allowedTools, so MCP tool calls keep prompting.
Persona configs drop the upstream $schema: that schema sets additionalProperties: false and does not define includeMcpJson, so keeping it would make each file fail validation against its own declared schema. The unchanged conductor retains its schema.
Docs: Kiro CLI harness comparison row, Kiro onboarding (AGENTS.md fill), and the composer CodeKB paragraph in docs/guide/05-scopes-and-depth.md (the MCP mechanism now exists on Kiro CLI; Kiro IDE remains workspace-scan fallback).
Tests: tests/unit/t281-kiro-mcp-registry.test.ts (registry integrity, Claude parity minus disabled, dynamic agent-roster grant matrix, no-headers policy, allowedTools guard) and the gated live e2e tests/e2e/t-acp-kiro-mcp-headers.serial.test.ts (workspace MCP discovery plus the verbatim-header limitation pin; runs under AIDLC_KIRO_ACP_LIVE=1, skips cleanly otherwise).
Version 2.5.71, CHANGELOG entry, README badge; all dists regenerated (bun scripts/package.ts --check green).
Kiro IDE is intentionally untouched; that surface is being reworked separately (fix(kiro-ide): ship only IDE-native agent and settings surfaces (#555) #653).

Verification

Full default tier (smoke + unit + integration): 316 files, 7348 assertions, PASS.
Live on authenticated kiro-cli 2.12.1: workspace .kiro/settings/mcp.json discovery and @server grants work end to end (a local MCP fixture received tools/list); "disabled": true servers never connect; header values arrive verbatim, which is what drove the keyless context7 decision.

Checklist

I have reviewed the contributing guidelines
I have performed a self-review of this change
Changes have been tested
Changes are documented

Acknowledgment

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of the project license.

apackeer

Thanks, Jerome. This remains a useful direction, and the predecessor’s Kiro CLI mechanics were reviewed favorably. I’m requesting changes because current v2 has outgrown the access model in this branch and the default/runtime policy is not settled yet.

Please scope this PR to Kiro CLI v2. Kiro IDE’s native agent/config surface is being reworked in #653, and Kiro CLI v3 is tracked separately in #582. Before implementation, we need an explicit decision on (1) whether the five servers ship enabled, disabled, or as documented configuration only, and (2) which current execution contexts receive which servers. Kiro now has 14 persona configs, inline stages run in the conductor, and the composer can use CodeKB when exposed.

After those decisions, the current-v2 integration should update the MCP/composer documentation, broaden the policy and host-access tests, and include the required version, changelog, and README badge updates. There is no need to chase the moving base while the design is unsettled; maintainers can handle the current-v2 integration afterward. I did not run the branch tests because the branch is conflicting and predates the current Kiro contracts.

apackeer · 2026-08-04T00:47:51Z

  "name": "aidlc-architect-agent",
  "description": "AI-DLC Architect Agent \u2014 delegation target for the reverse-engineering (2.1) synthesis step. Use for delegated architecture-analysis tasks.",
  "prompt": "file://aidlc-architect-agent.md",
+  "includeMcpJson": true,


The architect/developer-only grant policy was designed for the older three-config layout. Current v2 ships 14 persona configs, and inline stages execute in the conductor rather than a delegate. Please define an explicit role-to-server policy for the current roster, including deliberate conductor and composer decisions, before wiring individual grants.

apackeer · 2026-08-04T00:47:51Z

+    "aws-mcp": {
+      "command": "uvx",
+      "args": [
+        "mcp-proxy-for-aws@latest",


Please settle the default and supply-chain policy before shipping this registry. Configured Kiro MCP servers are enabled by default, and these AWS entries execute mutable @latest packages that may use local AWS credentials. The implementation should reflect an explicit choice such as disabled-by-default entries and/or exact package versions, with the rationale documented.

apackeer · 2026-08-04T00:47:51Z

+] as const;
+
+// The three Kiro agent configs.
+const AGENT_FILES = ["aidlc.json", "aidlc-architect-agent.json", "aidlc-developer-agent.json"] as const;


This fixed three-file list pins the old agent layout and cannot validate the current 14-persona access policy. Please discover the current agent configs and assert the agreed role/server matrix. A credential-free local MCP fixture or equivalent host discovery/access check is also needed; registry-shape checks alone do not prove Kiro exposes the tools as intended.

apackeer · 2026-08-04T00:47:51Z

    // + the --check drift guard. (The roll-forward latch lines are inert on Kiro IDE,
    // which has no userPromptSubmit/preToolUse seam, but are kept for parity.)
    { src: "dot-gitignore", dst: ".gitignore", projectRoot: true },
+    { src: "settings/mcp.json", dst: "settings/mcp.json" },


Please remove Kiro IDE from this PR and keep the scope to Kiro CLI v2. PR #653 is replacing the IDE’s CLI-style JSON agent surface with native Markdown agents, so landing a parallel MCP contract here would couple this change to an unsettled integration.

…a grants (2.5.71) Rebuild of community PR awslabs#412 on current v2. Kiro CLI now ships the same five MCP servers as Claude Code in .kiro/settings/mcp.json, every server disabled until a user opts in. All 14 delegated personas set includeMcpJson: true and grant the five @<server> tools; the conductor keeps its locked-down surface and gets none. Persona configs drop the upstream $schema (it rejects includeMcpJson via additionalProperties). Live-verified on kiro-cli 2.12.1: workspace discovery works, disabled servers never connect, and HTTP header values are sent verbatim (no env placeholder expansion) - so context7 ships keyless and the registry declares no headers. t281 pins the registry shape, Claude parity, and the dynamic-roster grant matrix; a gated live e2e pins discovery and the verbatim-header limitation. Kiro IDE is untouched (its surface is being reworked separately). Co-authored-by: Jerome Van Der Linden <jeromevdl@gmail.com>

apackeer

Approving the rebuilt head 30d3359, which resolves all asks from my August 4 review: scoped to Kiro CLI v2 only (IDE untouched, reworked in #653), disabled-by-default enablement with the supply-chain rationale documented, the full 14-persona/conductor-none access matrix pinned by a dynamic-roster test, docs and composer/CodeKB guidance updated, and the version/changelog/badge contract met at 2.5.71. Runtime behavior is live-verified on kiro-cli 2.12.1: workspace registry discovery and @server grants work end to end, disabled servers never connect, and header values are sent verbatim, which is why context7 ships keyless and the registry declares no headers.

…a grants (2.5.71) Rebuild of community PR awslabs#412 on current v2. Kiro CLI now ships the same five MCP servers as Claude Code in .kiro/settings/mcp.json, every server disabled until a user opts in. All 14 delegated personas set includeMcpJson: true and grant the five @<server> tools; the conductor keeps its locked-down surface and gets none. Persona configs drop the upstream $schema (it rejects includeMcpJson via additionalProperties). Live-verified on kiro-cli 2.12.1: workspace discovery works, disabled servers never connect, and HTTP header values are sent verbatim (no env placeholder expansion) - so context7 ships keyless and the registry declares no headers. t281 pins the registry shape, Claude parity, and the dynamic-roster grant matrix; a gated live e2e pins discovery and the verbatim-header limitation. Kiro IDE is untouched (its surface is being reworked separately). Co-authored-by: Jerome Van Der Linden <jeromevdl@gmail.com>

jeromevdl force-pushed the fix/kiro-mcp branch 2 times, most recently from 99d291d to 93c1630 Compare June 29, 2026 08:08

apackeer requested changes Aug 4, 2026

View reviewed changes

apackeer requested a review from leandrodamascena August 4, 2026 00:47

apackeer force-pushed the fix/kiro-mcp branch from 93c1630 to 30d3359 Compare August 13, 2026 05:12

apackeer changed the title ~~feat: add MCP support for Kiro (same servers than claude code)~~ feat(kiro): ship the MCP registry disabled-by-default with per-persona grants (2.5.71) Aug 13, 2026

apackeer approved these changes Aug 13, 2026

View reviewed changes

leandrodamascena force-pushed the fix/kiro-mcp branch from 30d3359 to c0c964b Compare August 13, 2026 07:33

leandrodamascena merged commit bf1a9c3 into awslabs:v2 Aug 13, 2026
5 checks passed

SiddhJog mentioned this pull request Aug 13, 2026

feat: domain-design + contract-design restructure; infra-design conso… #711

Merged

Navigation Menu

Uh oh!

feat(kiro): ship the MCP registry disabled-by-default with per-persona grants (2.5.71) - #412

feat(kiro): ship the MCP registry disabled-by-default with per-persona grants (2.5.71)#412
leandrodamascena merged 1 commit into
awslabs:v2from
jeromevdl:fix/kiro-mcp

jeromevdl commented Jun 19, 2026 •

edited by apackeer

Loading

Uh oh!

apackeer left a comment

Uh oh!

apackeer Aug 4, 2026

Uh oh!

apackeer Aug 4, 2026

Uh oh!

apackeer Aug 4, 2026

Uh oh!

apackeer Aug 4, 2026

Uh oh!

apackeer left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

jeromevdl commented Jun 19, 2026 • edited by apackeer Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Verification

Checklist

Acknowledgment

Uh oh!

apackeer left a comment

Choose a reason for hiding this comment

Uh oh!

apackeer Aug 4, 2026

Choose a reason for hiding this comment

Uh oh!

apackeer Aug 4, 2026

Choose a reason for hiding this comment

Uh oh!

apackeer Aug 4, 2026

Choose a reason for hiding this comment

Uh oh!

apackeer Aug 4, 2026

Choose a reason for hiding this comment

Uh oh!

apackeer left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

jeromevdl commented Jun 19, 2026 •

edited by apackeer

Loading