Kiro Crew is a persistent development workspace where agents continue multi-step software work across sessions, schedules, and connected interfaces. Developers use it locally or remotely through a desktop app, web dashboard, CLI, Slack, or Discord, with unattended tasks and recurring jobs. The catalogue contains skills and instructions for working with this workspace.
Borrowing it
Nothing to install: this file belongs to kirodotdev/KiroCrew. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/kirodotdev/KiroCrew/main/AGENTS.mdgit clone --depth 1 https://github.com/kirodotdev/KiroCrewWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/kirodotdev/kirocrew/agents-md)<a href="https://agentmods.dev/instructions/kirodotdev/kirocrew/agents-md"><img src="https://agentmods.dev/badge/instructions/kirodotdev/kirocrew/agents-md/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/instructions/kirodotdev/kirocrew/agents-md"><img src="https://agentmods.dev/badge/instructions/kirodotdev/kirocrew/agents-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.07082 | $0.07082 |
| Opus 5.5 | $0.02833 | $0.02833 |
| Sonnet 5.5 | $0.01416 | $0.01416 |
| Haiku 4.5 | $0.00708 | $0.00708 |
Grade A, and why
KiroCrew AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 381 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Rules for AI Assistants
This file is a ROUTER, not a manual. It carries only the rules whose violation
causes damage before a pointer could be read. Everything else is a link you MUST
open before touching that subsystem: see
Read before you touch. The frontend has its own router,
website/AGENTS.md.
What this is
Kiro Crew is an open-source personal AI agent: chat from the web dashboard, the CLI, or a messaging channel like Slack and Discord; run multi-step tasks unattended; schedule cron jobs; keep memory across sessions.
Kiro Crew's sole LLM provider speaks ACP. Its default backend runs kiro-cli
over ACP JSON-RPC; other verified ACP harnesses are selected with
agent.acp_backend. MCP tools supply the agent's host capabilities.
- Backend: Python package
kiro_crewinsrc/kiro_crew/. Frontend: React- TS + Vite SPA in
website/, built intosrc/kiro_crew/static/dist/and served by the backend.
- TS + Vite SPA in
- Data home:
~/.kiro/crew, overridden withKIROCREW_HOME. - Distribution: public GitHub, plain setuptools, public PyPI / public npm.
Full map: overview. This repo is the de-Amazoned
public fork of an internal package; what must never come back is
oss-fork-boundaries, gated by
the internal-content-scan check (blocking on pull requests, forks included) and
the
no-new-builtin-apps rule in AUTOSDE.yaml.
Read before you touch
Load the doc for the row you are working in before you change code. Update it in the same commit when you change what it documents.
| If you are touching… | Read first |
|---|---|
platform/, editions, CPP seam, governance |
platform-context + governance |
security.py, hooks.py, hook_runtime/, denied commands, sensitive paths |
security + sel |
config/ — the live watcher, restart=True marks, appliers, config.json writes |
config |
| the security model as a whole, threat boundaries | security-deep-dive |
computer_use/ |
computer-use |
monitoring loops, monitoring/, irq.py, watches |
monitor-architecture (the paradigm) + agent-interrupt-controller + babysit-pr-watch |
acp/, kiro-cli transport, providers |
acp-client + providers |
| picking or defaulting a model anywhere | model-selection + model-fallback |
| adding or adapting an agent harness (BYO, KAS, claude) | harness-parity (invariants) + harness-parity-gate (CI) |
an agent spec: agent_discovery.py and its agent_discovery_parts/ owners, agent_spec_format.py, agent.py's spec writers, its agent_parts/ owners and agent_materialization/, acp/kas_agents.py, or any field a spec carries |
agent-spec-fields (what each field does, per backend) + agent-host-contract (the per-harness table) |
| the publicly selectable Claude backend | claude-code-provider |
| sessions, slots, session keys, PIDs | session + history |
shared_crew/, attributing work to a person, per-person fair admission, presence, shared approvals |
shared-crew |
killing a runtime, leases and tenancies, sweeps and reapers, runtime_ownership.py, runtime_reconcile.py, the kill paths of session_pid.py and its session_pid_*.py owners |
runtime-ownership |
| session summaries, the chat summary panel, intent extraction | session-summary |
| memory, embeddings, vectors, lessons, skills, hooks | memory-skills-hooks |
context.py, context_blocks.py, context_assembly/, what reaches the model's context |
context-management + memory-skills-hooks: Context Builder (module ownership) |
| MCP servers or tools (adding, changing, statelessness) | mcp |
mcp_gateway/ — gatewayd.py, daemon/, the daemon's lifecycle and facade |
mcp-gateway-daemon-lifecycle + mcp |
| apps, App Kit, manifests, app agents | app-kit-platform + app-kit/ |
| artifacts, companion chat | artifacts |
stt/, transcribe.py and its transcribe_*.py owners, voice_reply.py, the mic, dictation, TTS |
stt-streaming + voice-streaming |
| cron, learn, dashboard handlers | learn-cron-dashboard |
| Slack, Discord, any channel, messaging, approvals | messaging + slack-gateway |
| subagents, spawn, orphan recovery | subagent |
crews, select_crew, crew bindings, Crew Mode slots |
crew-mode |
| the pipeline conductor agent or its skill | pipeline-conductor |
| task runner | task + taskrunner |
workflows/ (the dynamic-workflow engine) |
workflows |
| themes | themes + theming-contract |
anything under website/ |
website/AGENTS.md |
| user-facing strings, dates, numbers, sort order | i18n-catalog (authoring) + i18n-gates (CI) |
tests: flakes, hangs, speed, memory, fixtures, sharding, side effects, host state (~/.kiro, Path.home(), the systemd user manager), conftest isolation, monkeypatch.undo(), env-var leaks, host-dependent tests (Windows, Python 3.13, per-user tools, version-manager shims), spawning a real child or reaping one, .worktrees/ in a repo-wide scan, what TMPDIR must not be, what a worker costs, collection-time probes that build a singleton, a MagicMock the code converts with int(), sizing a ReDoS / complexity guard, clocks and time, sleeps, ordering and timestamp ties, ports, timezone and locale, randomness, repeat and shuffle proof, a flaky CI red |
testing-conventions + the writing-tests skill; frontend and Electron tests: website/docs/testing.md |
| browser E2E | e2e-gate |
| proving a worktree change against an isolated running gateway | worktree-verification-recipes |
| CI, PR flow, review gates (a lane says PASS or BLOCK, with a Trigger and an Outcome), commit messages | ci-and-reviews + CONTRIBUTING.md |
a PR that hides, deletes, tightens or migrates something (the Reader: list) |
take-away-changes |
| constants, comments, lint, code style, the brand name | code-style |
| connections, connectors, an external account link | connections |
| the connector campaign's manifest schema or work-stream DAG | connector-capability-manifest |
| the GitHub connector's operation data or wire parsing (pagination, rate limits, error mapping) | connector-github |
connections/vendors/microsoft/graph/, the Microsoft Graph runtime base (locator, payload shaping, @odata.nextLink paging) |
microsoft-graph-runtime |
connections/vendors/zoom/ — Zoom identity/paging/processing/errors contract logic |
connector-zoom |
| a POSIX call: locks, signals, PIDs, chmod, RSS | platform-compat + windows-install |
injected [Cron notification] / [Subagent completion event] |
injected-messages |
| build, install, dev mode | CONTRIBUTING.md + install |
| cutting a release | release |
CHANGELOG.md |
changelog |
| a user-facing label, wording, placement or behaviour a person may already have decided | docs/decisions/README.md |
| errors, retries, user-facing failure text | error-handling |
| what this public fork must never re-introduce | oss-fork-boundaries |
| any doc: moving, renaming, indexing it | docs/README.md |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed · +3 lines · +86 tokens per session b137659dd530
- 2d ago Changed · +3 lines · +54 tokens per session 54a37a65a2e5
- 5d ago Changed · +10 lines · +148 tokens per session f10bfcabbbdf
- 7d ago Changed · +5 lines · +84 tokens per session 152e96c25f28
- 8d ago Changed · +22 tokens per session 97e5e786e0d3
- 9d ago Changed · +3 lines · +71 tokens per session 88feea72f997
- 10d ago Changed · +10 tokens per session a11ac0eaf848
- 14d ago Changed · +17 tokens per session bcedc2c222a3
- 15d ago Changed · +6 lines · +104 tokens per session 6d1f8f35db52
- 17d ago First seen · 351 lines · 6,486 tokens per session scan A 0a545a3e2a89
KiroCrew AGENTS.md is an instructions file published in the GitHub repository kirodotdev/KiroCrew (4,644 stars, last pushed today), licensed Apache-2.0. It adds 7,082 tokens to every session, about $0.0283 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
vscode buildNext.instructions.md
Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).
next.js AGENTS.md
AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.
vscode oss-third-party-notices.instructions.md
Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, cache eligibility and rollout and applying the notice (cutover).
langchain AGENTS.md
AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.
vscode copilot-instructions.md
Copilot instructions for microsoft/vscode, covering vs code copilot instructions, project overview, root folders, core architecture (src/ folder) and built-in extensions (extensions/ folder).
deepseek-harness AGENTS.md
AGENTS.md instructions for deepseek-ai/deepseek-harness, covering agents.md, pre-stable apis and released session data, repository layout, commands and host sandbox failures.