Kiro

Why scan Kiro?

Kiro grants MCP servers filesystem and shell authority from a project-local config, so a server entry can arrive with a cloned repository.

Usage

CallLint can auto-discover and scan Kiro configurations:

calllint scan --agent kiro

How to start

Install nothing globally — run CallLint straight from npm:

npx calllint scan --auto

Then scan Kiro specifically:

calllint scan --agent kiro

How to verify it worked

Scan the project config as well as the user one. `.kiro/settings/mcp.json` travels with the repository, so a server entry there was authored by whoever last pushed — not necessarily by you.

What CallLint does to Kiro

Offline by default. Deterministic. Never executes the server it judges. SAFE means no blockers observed, not a proof of runtime safety.

A No blockers observed verdict means exactly that — no blocker under the evidence CallLint could collect. It is not a guarantee, and Insufficient evidence never becomes it on its own. See Coverage Boundary for what this scan does not look at.

Configuration Paths

CallLint looks for Kiro configurations in:

• <project>/.kiro/settings/mcp.json
• ~/.kiro/settings/mcp.json

Authority Surfaces

Kiro can grant tools the following authority surfaces:

• mcp
• filesystem
• shell

Distribution

CallLint is available for Kiro through:

• mcp-stdio (via officialMcpRegistry) — Listing not yet verified
• kiro-workspace-config — Listing not yet verified
  Config paths are now documented by the vendor; a thin adapter for the mcpServers JSON is evaluable but unbuilt. Support stays unimplemented until a discovery adapter exists and is fixture-covered.

Support Status

Auto-detects — CallLint finds this host’s config on its own.

The commands under Usage are the ones CallLint actually supports for Kiro today. Anything not listed there is not claimed.

Official Sources

• https://kiro.dev/docs/mcp/configuration/
• https://github.com/kirodotdev/Kiro