moonbridge
Moonbridge is a local MCP server that lets compatible MCP clients invoke Kimi Code for independent second opinions, structured code reviews, and delegated coding tasks.
Check readiness and inventory (free):
kimi_statusverifies the Kimi CLI, authentication, version, and resolved defaults;kimi_capabilitieslists tools/tiers/contracts;kimi_modelslists available model aliases and reasoning efforts.Consult Kimi (paid):
kimi_consult/_asyncruns read-only Q&A or second opinions under a restricted agent profile with no shell or write tools.Review git changes (paid):
kimi_review_changes/_asyncreviews working-tree, branch, or commit changes and returns structured findings, coverage, and a verdict.Delegate coding tasks (paid):
kimi_delegate/_asyncimplements a task in a throwaway git worktree and returns a reviewable diff that is never applied automatically.Preview before spending (free):
kimi_dry_runandkimi_delegate_dry_runshow scope, prompt size, redactions, truncation, and deadline advisories without calling Kimi.Manage background jobs (free):
kimi_job_status,kimi_job_result,kimi_job_consume_result,kimi_job_cancel, andkimi_job_listlet you poll, recover, fetch, consume, cancel, and list long-running work.Configure behavior: environment variables control timeouts, default model/effort, isolation, input/diff size limits, job TTL/max/count, logging, and supported Kimi versions.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@moonbridgeGet Kimi's second opinion on this approach."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Moonbridge
Moonbridge is a local MCP server that lets compatible MCP clients invoke Kimi Code for independent second opinions, structured code reviews, and delegated coding tasks.
It gives your primary coding agent another model to ask—one that can challenge a plan, inspect a diff, or try an implementation while you keep control of the result. Moonbridge ships plugin integrations for Claude Code and Codex; other clients can use its local stdio server.
Contents: Why Moonbridge? · Requirements · Quick start · Safety model · Tools · Configuration · Development · Documentation
Why Moonbridge?
Different models notice different things. Moonbridge lets one coding agent bring Kimi into the conversation without making you switch tools or manually shuttle context between terminals.
Workflow | What Kimi does | What you get |
Consult | Reasons under a read-only agent profile | An answer or independent second opinion |
Review | Inspects your git changes without shell or write tools | Structured findings with coverage and verdict |
Delegate | Implements a task inside a throwaway worktree | A reviewable diff that is never applied automatically |
Every workflow returns a structured result to the calling client. Long-running work can run in the background and be recovered after a dropped connection.
Before using Moonbridge with sensitive code, read the safety model. The Kimi CLI has no sandbox or approval prompts, and a throwaway worktree is not a security boundary.
Related MCP server: Kimi MCP Server
Requirements
kimi(Kimi Code) 0.35.x or 0.39.x — the supported minors. Probed on0.35.0and0.39.1; other patch releases in those minors are assumed compatible, not verifiedPython ≥ 3.11,
uv, andgitmacOS or Linux
Claude Code, Codex, or another MCP client that can launch a local stdio server
Make sure Kimi is installed and has at least one configured provider and model alias:
kimi --version
kimi doctor configSee the Kimi Code documentation for CLI installation and authentication.
Quick start
No clone is required. The plugin integrations launch the server from the release tag pinned in
.mcp.json.
Codex
codex plugin marketplace add briandconnelly/moonbridge
codex plugin add moonbridge@moonbridgeStart a new Codex session so it loads the bundled skill and tools.
Claude Code
Run these commands inside Claude Code:
/plugin marketplace add briandconnelly/moonbridge
/plugin install moonbridge@moonbridgeOther MCP clients
Moonbridge can work with another client if it supports local stdio servers. Adapt the moonbridge
entry in .mcp.json to that client's configuration format. Claude Code and Codex are
the integrations currently packaged and documented by this project.
Try it
Ask your coding agent:
Check whether Kimi is ready.— a free readiness check with no model callGet Kimi's second opinion on this approach.Have Kimi review my current changes.Delegate this task to Kimi and show me the proposed diff.
Claude Code also provides /kimi:status, /kimi:consult, /kimi:review, and /kimi:delegate
shortcuts. In Codex, /plugins lets you browse, enable, or disable the installed plugin.
Safety model
Read this before pointing it at anything sensitive. Every statement below was verified by running
kimi-code 0.35.0 and again on 0.39.1, not inferred from its documentation.
The kimi CLI has no sandbox and no approval prompts. Prompt mode (kimi -p) forces
autonomous mode and runs shell commands and file writes with your own user's privileges. Unlike
Codex, there is no --sandbox flag to hand it. So this server constrains runs itself:
consult and review get an agent profile whose
tools:list omits every shell and write tool. This is the real control, and it works: an agent declaringRead, Glob, Grepreports exactly those three, and a shell write attempt produces nothing.every run uses a throwaway git worktree. This is defense in depth, not a boundary — asked to write outside its working directory, Kimi will do it. Treat the worktree as keeping honest runs tidy, not as containment.
Three limits that follow, stated plainly because they are easy to assume away:
Read-only prevents modification, not disclosure. Kimi's Read tool accepts absolute paths, so a prompt-injected repository can make a consult read files elsewhere on your machine and send them to your provider. Do not point any workflow at a workspace whose contents you would not hand to that provider.
Delegate is not network-isolated. A delegated task can push, fetch, install dependencies, and call out. The returned diff shows what changed in the worktree — not everything the run did.
Kimi loads context you did not mention. It auto-loads the workspace's
AGENTS.mdand discovers skills from its own user/project directories and from theextra_skill_dirsentries in itsconfig.toml, which may point anywhere on disk. Its built-in skills always load. Theisolationsetting reduces this but cannot eliminate it.
Secret redaction covers gathered diffs and Kimi's returned output. It does not cover what you type, or files Kimi reads for itself.
For the complete threat model and disclosure policy, see SECURITY.md and COMPATIBILITY.md.
Tools
“Paid” means the tool makes a Kimi model call and consumes quota from your configured provider; Moonbridge itself is not a paid service.
Tool | Cost | Notes |
| free | readiness, version, provider configuration, resolved defaults |
| free | full inventory, schemas, per-tool error codes |
| free | model aliases from your |
| paid | read-only Q&A |
| paid | structured review of |
| paid | returns a reviewable diff, never applied |
| free | preview scope, diff size, redactions before spending |
| free | background job lifecycle |
Two details prevent surprising runs:
modeltakes an alias, not a provider model id — whatever you defined as[models."<alias>"]inconfig.toml. An unknown alias is rejected asinvalid_model.reasoning_effortis validated locally. Kimi silently ignores an effort it does not recognize rather than rejecting it, so this server refuses one the alias does not declare — a run that quietly used the default while reporting your requested effort would be worse than an error.
Configuration
Environment variables, all prefixed MOONBRIDGE_:
Variable | Default | Meaning |
| 300 | per-call wall clock, clamped 10–600 |
| unset | default model alias |
| unset | default effort |
|
|
|
| 200000 | bound on gathered context |
| 200000 | bound on a returned diff |
| 86400 / 1800 / 50 | background job limits |
|
| job records |
|
| logging |
|
| supported |
| unset | no safe passthrough exists — any value is refused, see below |
MOONBRIDGE_EXTRA_ARGS accepts nothing today, deliberately. Kimi exposes no config-override,
profile, or feature flags, and reuses two short flags for other purposes: -p is prompt and
-c is continue. Passing them through would override the run's real instructions or resume an
unrelated session, so the allowlist is empty and a configured value fails loudly rather than being
silently ignored.
Development
Set up the project and run the focused test suites from the repository root:
uv sync
uv run pytest
uv run pytest -m integration --no-cov # optional: calls the real Kimi CLIThe authoritative quality gate and contribution workflow live in AGENTS.md and CONTRIBUTING.md.
To exercise the plugin manifest from a checkout, register that checkout as a marketplace:
codex plugin marketplace add <path to this checkout>
codex plugin add moonbridge@moonbridgeIn Claude Code, run /plugin marketplace add <path to this checkout>, then install as above. This
tests the plugin files in your checkout, but the MCP server still comes from the released tag
pinned in .mcp.json; Python edits in the checkout do not affect it.
To run the working tree in Codex, register a separate development server:
codex mcp add moonbridge-dev -- uv run --directory <path to this checkout> moonbridge-mcpIn Claude Code, override the server in the consuming project's own .mcp.json:
{
"mcpServers": {
"moonbridge": {
"command": "uv",
"args": ["run", "--directory", "<path to this checkout>", "moonbridge-mcp"]
}
}
}Documentation
Tool reference — the full caller-facing contract: envelopes, error codes, detail levels, idempotency, jobs. Read it when calling the MCP tools directly.
Compatibility — what the
kimiCLI does and does not guarantee, and every deliberate non-guarantee.Security policy — the verified security model, and how to report a vulnerability.
Contributing — set up a checkout and prepare a pull request.
Agent conventions — the authoritative working rules for humans and agents.
Upgrading kimi — the probes to re-run before supporting a new
kimiversion.Releasing — the ordered release runbook.
Changelog · Architecture decision records — decision history, not current policy.
Available Tools
16 toolskimi_capabilitiesList server capabilities (free)ARead-only
List this server's tools, tiers, and the result fingerprint. Free — no model call. Clients can cache by the fingerprint.
detail="summary" (default) returns each tool's name, cost, stability, and
error_codes — the facts tools/list does not already carry — plus async_lifecycle,
but only for the *_async tools. detail="full" adds
use_when/returns/required_params/key_optional_params, restating what you already hold.
detail="contracts" omits tool_details.
Pass include_schemas to also embed the full 'error-envelope', 'result-meta', 'capabilities-result', and/or 'status-result' schema, and/or the 'parameter-contracts' document (a contract doc, not a JSON Schema) — a tool-reachable fallback to the kimi:// resources for resource-blind clients. It works in any detail mode.
| Name | Required | Description | Default |
|---|---|---|---|
| detail | No | What to return: 'summary' (default) returns each tool's name, cost, stability, and error_codes; the *_async tools also get async_lifecycle. 'full' adds use_when, returns, and the parameter lists (which tools/list already carries). 'contracts' drops tool_details: fetch a schema, or recheck fingerprint, without re-paying for the inventory. | summary |
| include_schemas | No | Opt-in tool-reachable fallback for resource-blind clients: also embed the full 'error-envelope', 'result-meta', 'capabilities-result', and/or 'status-result' schema, and/or the 'parameter-contracts' document (a contract doc, not a JSON Schema, sourced from the kimi://params resource body), in the response — the default payload omits them and points at the kimi:// resources instead. |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the readOnlyHint annotation, the description discloses that no model call is made, that responses are cacheable via fingerprint, and that certain detail modes restate data the client already has. It also explains the fallback behavior for resource-blind clients and clarifies that parameter-contracts is a contract document, not a JSON Schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is long but front-loaded with the core purpose, cost, and caching behavior. The detail-mode explanations are dense and information-rich, with each sentence adding a distinct fact. It could be tightened slightly, but the structure makes the complexity navigable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the output schema exists and annotations cover read-only safety, the description provides everything an agent needs to call this tool correctly: purpose, cost model, caching, detail-level tradeoffs, include_schemas behavior, and fallback rationale. No significant gap remains.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema already documents both parameters. The description adds meaningful nuance beyond the schema: which tools get async_lifecycle, that 'full' restates existing data, and that include_schemas is an opt-in fallback sourced from kimi:// resources. This helps an agent reason about payload tradeoffs.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'List this server's tools, tiers, and the result fingerprint.' It clearly distinguishes this from the sibling tools by emphasizing that it is free, caching-friendly, and returns capability metadata rather than status, models, or job operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives strong usage context: it is free, makes no model call, and is designed for clients to cache by fingerprint. It also explains when to use different detail modes and when to pass include_schemas, though it does not explicitly name sibling tools as alternatives or provide when-not-to-use conditions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
kimi_consultConsult Kimi (paid)A
Ask Kimi (a different model) for a read-only second opinion or answer.
PAID — this spends Kimi quota on every new call; there is no dry-run preview for a consult, so run kimi_status (free) first to confirm the CLI is installed and authenticated.
Runs kimi -p under a generated read-only agent profile — Kimi holds no shell and
no write tool, so it never edits files. A STATIC review, not a verify mode: without
those tools it cannot run a test/build/lint pass to confirm its claims —
treat findings as unvalidated claims you verify yourself. Pass workspace_root
(absolute) for a repo-grounded question; omit it for pure Q&A. Returns a result
envelope.
Data egress: this sends your question and extra_context to your configured
Kimi provider via the
kimi CLI. Kimi always runs with a resolved working directory (workspace_root, else the
server's cwd as a fallback — MCP roots are unavailable), so it may read files there and
Kimi auto-loads the resolved workspace's AGENTS.md and discovers skills from its own
config (including extra_skill_dirs, which may point outside the workspace). Skill
names and descriptions are exposed to the model up front, so that content can be sent
even if your prompt never mentions it. The isolation setting does not suppress any of
it: kimi's built-in skills always load, and AGENTS.md is read regardless.
Your inputs are sent raw and unredacted. Secret redaction is best-effort and covers the gathered diff and Kimi's returned output — not what you type, and not the files Kimi reads for itself.
Progress & recovery: blocks up to the resolved deadline (timeout_seconds, clamped
10-600s; when omitted, the server-configured value, built-in default 300s). If that deadline
expires the run is terminated and its partial output is not recoverable or resumable, so for a
high-reasoning_effort or broad repo-grounded consult that may exceed it, prefer
kimi_consult_async (a background job, built-in default 1800s deadline; poll
kimi_job_status). Coarse notifications/progress streams while it blocks when your client
requests it; some MCP clients background a long call before the deadline, so
timeout_seconds bounds the run, not necessarily the inline wait — either way the detached run
(meta.job_id) is recoverable via kimi_job_list→kimi_job_status→kimi_job_result.
| Name | Required | Description | Default |
|---|---|---|---|
| model | No | Override the Kimi model slug for this call; defaults to the server/Kimi default when unset. | |
| detail | No | Response verbosity: 'summary' (default) omits the raw model text; 'full' includes it. | summary |
| question | Yes | The question or prompt to send Kimi (a different model) for a read-only answer. Must be non-blank: empty or whitespace-only is rejected before any model call. | |
| isolation | No | Which skills Kimi loads: 'inherit' (own user/project discovery) or 'ignore-skills' (empty dir). Built-ins load either way; this reduces loading, not isolation. Default: server-configured, per kimi_status. More: kimi://params. | |
| extra_context | No | Optional author intent/background context, added as clearly-labeled UNTRUSTED prompt data. Redaction does NOT cover it — no live secrets. Full caveats and bounds: kimi://params. | |
| workspace_root | No | Absolute path to the target repo root — pass it to target the intended repo (MCP roots are unavailable); otherwise the call falls back to the server's own cwd and sets meta.workspace_warning. | |
| idempotency_key | No | Optional dedup key scoped to THIS tool + workspace. Same key + same args replays the prior result with no new spend; different args are refused (idempotency_conflict). Sync and _async are separate tools and never share a key. Omit for none; retention is bounded. Lifecycle: kimi://params. | |
| timeout_seconds | No | Per-call wall-clock timeout in seconds, clamped to 10..600 (out-of-range values are coerced, not rejected). Defaults to the server's configured timeout. | |
| reasoning_effort | No | Override the Kimi reasoning effort for this call (a model_reasoning_effort override); omit or pass null for the server default (MOONBRIDGE_REASONING_EFFORT) or Kimi's own resolution. An open, per-model string the backend validates at run time — commonly minimal|low|medium|high|xhigh; kimi_models lists each model's advertised set (advisory). Rejection and bounds detail: kimi://params. |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Discloses far beyond the annotations: the read-only agent profile (no shell/write tool), the static-review limitation ('treat findings as unvalidated claims you verify yourself'), data egress of question and extra_context to the provider, best-effort redaction that does not cover typed inputs or files Kimi reads, AGENTS.md auto-loading with skills that can point outside the workspace, and timeout termination with unrecoverable partial output. The readOnlyHint=false annotation is consistent — the tool is read-only for files but is PAID and makes external calls — so the description adds context without contradicting the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with purpose, then cost, safety, data flow, and recovery — each paragraph carries a distinct critical topic with no filler. It is long (~380 words), but the length is largely earned given 9 params, paid quota, and external egress; minor redundancy exists where the description restates schema-level isolation/redaction notes.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a high-complexity tool (paid external call, 9 parameters, blocking timeout, async fallback, data egress), every operational concern is covered: preconditions, cost, safety profile, data handling, redaction limits, timeout/recovery, and when to route to the async sibling. The output schema covers return values, so the 'result envelope' mention suffices.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with rich per-parameter descriptions, so the baseline is 3; the description adds operational value on top: workspace_root targeting decision ('omit it for pure Q&A'), clamp/default semantics for timeout_seconds (10-600s, 300s default), isolation's non-suppression of built-ins/AGENTS.md, and redaction bounds for extra_context. It also cross-references kimi://params rather than duplicating full lifecycle details, which is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Opens with a specific verb+resource: 'Ask Kimi (a different model) for a read-only second opinion or answer,' which pinpoints the tool's role as a cross-model consult and distinguishes it from every sibling (not status, not delegate, not review_changes). It further disambiguates from kimi_consult_async by framing this as the synchronous, paid variant.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit preconditions and routing: 'run kimi_status (free) first to confirm the CLI is installed and authenticated,' and it states the no-dry-run limitation. For long or high-effort consults it names kimi_consult_async as the preferred alternative with concrete deadline numbers (300s vs 1800s), and provides a recovery chain via kimi_job_list/kimi_job_status/kimi_job_result. It also tells the caller when to pass workspace_root vs omit it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
kimi_consult_asyncConsult Kimi in background (paid)A
Ask Kimi for a read-only second opinion in the background; get a job_id
back immediately instead of blocking.
PAID — this spends Kimi quota on every new call; there is no dry-run preview for a consult, so run kimi_status (free) first to confirm the CLI is installed and authenticated.
Same read-only behavior as kimi_consult (Kimi never edits files), but detached —
prefer it for a high-reasoning_effort or broad repo-grounded consult that can exceed the
synchronous deadline (built-in default 300s), since a sync run whose deadline expires loses
its partial work; this job's own deadline is separately configured (built-in default 1800s).
Starting a job commits to spend (it runs to completion or its wall-clock deadline even if
you never poll). Poll kimi_job_status; read/consume the consult envelope with
kimi_job_result/kimi_job_consume_result; stop with kimi_job_cancel.
Data egress: same as kimi_consult — sends your question and extra_context
(raw, unredacted) to your configured provider via the kimi CLI, plus files Kimi reads from its
resolved working directory (workspace_root, else the server cwd — MCP roots are unavailable).
Kimi auto-loads the resolved workspace's AGENTS.md and discovers skills from its own
config (including extra_skill_dirs, which may point outside the workspace).
Your inputs are sent raw and unredacted. Secret redaction is best-effort and covers the gathered diff and Kimi's returned output — not what you type, and not the files Kimi reads for itself.
| Name | Required | Description | Default |
|---|---|---|---|
| model | No | Override the Kimi model slug for this call; defaults to the server/Kimi default when unset. | |
| question | Yes | The question or prompt to send Kimi (a different model) for a read-only answer. Must be non-blank: empty or whitespace-only is rejected before any model call. | |
| isolation | No | Which skills Kimi loads: 'inherit' (own user/project discovery) or 'ignore-skills' (empty dir). Built-ins load either way; this reduces loading, not isolation. Default: server-configured, per kimi_status. More: kimi://params. | |
| extra_context | No | Optional author intent/background context, added as clearly-labeled UNTRUSTED prompt data. Redaction does NOT cover it — no live secrets. Full caveats and bounds: kimi://params. | |
| workspace_root | No | Absolute path to the target repo root — pass it to target the intended repo (MCP roots are unavailable); otherwise the call falls back to the server's own cwd and sets meta.workspace_warning. | |
| idempotency_key | No | Optional dedup key scoped to THIS tool + workspace. Same key + same args replays the prior result with no new spend; different args are refused (idempotency_conflict). Sync and _async are separate tools and never share a key. Omit for none; retention is bounded. Lifecycle: kimi://params. | |
| reasoning_effort | No | Override the Kimi reasoning effort for this call (a model_reasoning_effort override); omit or pass null for the server default (MOONBRIDGE_REASONING_EFFORT) or Kimi's own resolution. An open, per-model string the backend validates at run time — commonly minimal|low|medium|high|xhigh; kimi_models lists each model's advertised set (advisory). Rejection and bounds detail: kimi://params. |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only provide coarse flags (readOnlyHint=false, idempotentHint=false), but the description reveals substantial behavioral context: it is paid and spends quota on every call, has no dry-run, commits to spend once started, has a separate 1800s default deadline, sends raw and unredacted inputs, auto-loads AGENTS.md, and has best-effort secret redaction. The phrase 'read-only' refers to Kimi not editing files, so it does not contradict readOnlyHint=false; the tool still has job and quota side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is long but appropriately so given the tool's side effects, cost, and lifecycle. It is front-loaded: purpose, paid warning, and sync-vs-async tradeoff appear first, followed by job lifecycle and data egress. Each paragraph adds necessary information and none is filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers purpose, cost, deadline behavior, lifecycle tools, data egress, workspace resolution, redaction limits, and parameter caveats. Since an output schema exists, return-value details are not needed in prose. An agent has everything needed to decide whether to call this tool and how to handle the resulting job.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all parameters and the baseline is 3. The description adds valuable operational semantics beyond the schema, especially for question and extra_context (sent raw and unredacted) and workspace_root (fallback to server cwd when MCP roots are unavailable). This extra context justifies a 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Ask Kimi for a read-only second opinion in the background; get a job_id back immediately instead of blocking.' It also explicitly differentiates from kimi_consult by noting the same read-only behavior but detached execution. This makes the tool's purpose and distinction from siblings immediately clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit when-to-use guidance: prefer this async variant for high-reasoning_effort or broad repo-grounded consults that may exceed the 300s synchronous deadline. It also prescribes the surrounding workflow: run kimi_status first, poll kimi_job_status, consume via kimi_job_result, and cancel with kimi_job_cancel. This is strong routing and lifecycle guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
kimi_delegateDelegate a coding task (paid)A
Delegate a coding task to Kimi (a different model) in an isolated git worktree, and get back a reviewable diff that is NOT applied to your tree.
PAID — this spends Kimi quota on every new call; use kimi_delegate_dry_run or kimi_status (both free) first if you only need to check scope or readiness.
Kimi edits files with workspace-write, but only inside a throwaway worktree
seeded from your current tracked state. The returned diff is Kimi's changes;
review it, then apply it yourself if you want it. Requires a git repo with at
least one commit. Pass workspace_root (absolute).
NETWORK IS NOT BLOCKED: kimi has no sandbox, so a delegated task CAN reach the
network — it may git push/fetch, run gh, curl, publish, or install
dependencies, and it runs shell commands with your own user's privileges. Scope
tasks accordingly and review the returned diff before applying it; the diff shows
what changed in the worktree, not what else the run did. The Kimi model call also
sends your task to your configured provider and lets Kimi read tracked files in
the worktree and send their content.
Kimi auto-loads the resolved workspace's AGENTS.md and discovers skills from its own
config (including extra_skill_dirs, which may point outside the workspace). Skill
names and descriptions are exposed to the model up front, so that content can be sent
even if your prompt never mentions it. The isolation setting does not suppress any of
it: kimi's built-in skills always load, and AGENTS.md is read regardless.
Your inputs are sent raw and unredacted. Secret redaction is best-effort and covers the gathered diff and Kimi's returned output — not what you type, and not the files Kimi reads for itself.
Progress & recovery: blocks up to the resolved deadline (timeout_seconds, clamped
10-600s; when omitted, the server-configured value, built-in default 300s). If that deadline
expires the run is terminated and its partial output is not recoverable or resumable, so for a
substantial or multi-file task that may exceed it, prefer kimi_delegate_async (a background
job, built-in default 1800s deadline; poll kimi_job_status). Coarse notifications/progress
streams while it blocks when your client requests it; some MCP clients background a long call
before the deadline, so timeout_seconds bounds the run, not necessarily the inline wait —
either way the detached run (meta.job_id) is recoverable via
kimi_job_list→kimi_job_status→kimi_job_result.
| Name | Required | Description | Default |
|---|---|---|---|
| task | Yes | The coding task for Kimi to implement inside a throwaway git worktree; the resulting diff is returned for review, not applied to your tree. Must be non-blank: empty or whitespace-only is rejected before any model call. | |
| model | No | Override the Kimi model slug for this call; defaults to the server/Kimi default when unset. | |
| detail | No | Response verbosity: 'summary' (default) omits the raw model text; 'full' includes it. | summary |
| isolation | No | Which skills Kimi loads: 'inherit' (own user/project discovery) or 'ignore-skills' (empty dir). Built-ins load either way; this reduces loading, not isolation. Default: server-configured, per kimi_status. More: kimi://params. | |
| workspace_root | No | Absolute path to the target repo root — pass it to target the intended repo (MCP roots are unavailable); otherwise the call falls back to the server's own cwd and sets meta.workspace_warning. | |
| idempotency_key | No | Optional dedup key scoped to THIS tool + workspace. Same key + same args replays the prior result with no new spend; different args are refused (idempotency_conflict). Sync and _async are separate tools and never share a key. Omit for none; retention is bounded. Lifecycle: kimi://params. | |
| timeout_seconds | No | Per-call wall-clock timeout in seconds, clamped to 10..600 (out-of-range values are coerced, not rejected). Defaults to the server's configured timeout. | |
| reasoning_effort | No | Override the Kimi reasoning effort for this call (a model_reasoning_effort override); omit or pass null for the server default (MOONBRIDGE_REASONING_EFFORT) or Kimi's own resolution. An open, per-model string the backend validates at run time — commonly minimal|low|medium|high|xhigh; kimi_models lists each model's advertised set (advisory). Rejection and bounds detail: kimi://params. |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description goes far beyond annotations. It discloses the paid/quota cost, the non-blocked network and lack of sandbox, execution with the user's own privileges, that AGENTS.md and skills are loaded even with isolation settings, raw input exposure, best-effort redaction limits, timeout/deadline behavior, and non-recoverable partial output. Annotations already mark readOnlyHint=false and openWorldHint=true, and the description expands on that meaningfully.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is dense and information-rich, with critical facts front-loaded: the headline diff-not-applied behavior, the paid cost, and the free alternatives. It is longer than average, but every section covers high-stakes facts an agent needs before invoking a paid, un-sandboxed, potentially network-accessible tool. Slight structural improvement could consolidate the warnings, but overall it is well organized with clear topic shifts.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's genuine complexity, a high-stakes paid model delegation with 8 parameters, no sandbox, and many sibling alternatives, the description covers prerequisites, cost, security boundaries, failure modes, timeouts, recovery paths, and routing to async variants. An output schema exists, so the description need not enumerate return values. This is as complete as an agent could reasonably need.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents each parameter. However, the description adds context beyond the schema, especially for workspace_root (MCP roots unavailable, fallback to server cwd, workspace_warning), isolation (built-ins load either way), idempotency_key (scoped to tool+workspace, replay semantics, conflict refusal), and timeout_seconds (clamping behavior). It also explains how parameters relate to runtime behavior (e.g., timeout_seconds bounds the run, not necessarily the inline wait).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb (delegate), resource (a coding task to Kimi), and the key behavioral outcome (a reviewable diff that is not applied to the tree). It is clearly distinguished from siblings by naming alternatives like kimi_delegate_dry_run, kimi_status, and kimi_delegate_async.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says when to use the tool (when you want Kimi to implement a coding task and inspect the diff before applying), when to avoid it (for mere scope/readiness checks, use kimi_delegate_dry_run/kimi_status), and when to use an alternative (kimi_delegate_async for substantial tasks likely to exceed the deadline). It also notes the workspace_root requirement and the prerequisite of a git repo with at least one commit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
kimi_delegate_asyncDelegate in background (paid)A
Delegate a coding task to Kimi in the background and get a job_id back
immediately (does not block on the run).
PAID — this spends Kimi quota on every new call; use kimi_delegate_dry_run or kimi_status (both free) first if you only need to check scope or readiness.
Same propose-tier behavior as kimi_delegate — Kimi works in a throwaway git
worktree and the result carries a reviewable diff that is NOT applied — but
detached; prefer it for a substantial or multi-file implementation task that can exceed the
synchronous deadline (built-in default 300s), since a sync run whose deadline expires loses
its partial work (this job's own deadline is separately configured, built-in default 1800s).
Starting a job commits to spend (it runs to completion or its wall-clock deadline even if
you never poll). Poll kimi_job_status; read/consume with
kimi_job_result/kimi_job_consume_result; stop with kimi_job_cancel. Requires a git
repo with at least one commit; pass workspace_root (absolute).
NETWORK IS NOT BLOCKED: like kimi_delegate, this has no sandbox — a delegated task
CAN push, fetch, install dependencies, or call out, running with your own user's
privileges. Scope tasks accordingly and review the returned diff before applying it.
The Kimi model call also sends your task (raw) to your configured provider and lets
Kimi read tracked files in the worktree and send their content.
Kimi auto-loads the resolved workspace's AGENTS.md and discovers skills from its own
config (including extra_skill_dirs, which may point outside the workspace).
Secret redaction is best-effort and does not cover your task or the files Kimi
reads for itself.
| Name | Required | Description | Default |
|---|---|---|---|
| task | Yes | The coding task for Kimi to implement inside a throwaway git worktree; the resulting diff is returned for review, not applied to your tree. Must be non-blank: empty or whitespace-only is rejected before any model call. | |
| model | No | Override the Kimi model slug for this call; defaults to the server/Kimi default when unset. | |
| isolation | No | Which skills Kimi loads: 'inherit' (own user/project discovery) or 'ignore-skills' (empty dir). Built-ins load either way; this reduces loading, not isolation. Default: server-configured, per kimi_status. More: kimi://params. | |
| workspace_root | No | Absolute path to the target repo root — pass it to target the intended repo (MCP roots are unavailable); otherwise the call falls back to the server's own cwd and sets meta.workspace_warning. | |
| idempotency_key | No | Optional dedup key scoped to THIS tool + workspace. Same key + same args replays the prior result with no new spend; different args are refused (idempotency_conflict). Sync and _async are separate tools and never share a key. Omit for none; retention is bounded. Lifecycle: kimi://params. | |
| reasoning_effort | No | Override the Kimi reasoning effort for this call (a model_reasoning_effort override); omit or pass null for the server default (MOONBRIDGE_REASONING_EFFORT) or Kimi's own resolution. An open, per-model string the backend validates at run time — commonly minimal|low|medium|high|xhigh; kimi_models lists each model's advertised set (advisory). Rejection and bounds detail: kimi://params. |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses far more than annotations could: it is paid, spends quota on every new call, runs without a sandbox, can push/fetch/install with user privileges, sends the raw task to the provider, reads tracked files, auto-loads AGENTS.md, and only best-effort redacts secrets. It also explains that the job runs to completion or its deadline even if never polled. No contradiction with annotations exists.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Despite being long, every sentence earns its place: purpose is front-loaded, then cost, sync-vs-async tradeoff, lifecycle, requirements, network risk, data handling, and redaction limits. The paragraph structure uses bold semantic labels and makes the critical operational and safety facts scannable without fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given that this is a paid, asynchronous, side-effectful operation, the description is operationally complete. It covers what is returned (job_id), how the result is delivered (reviewable diff not applied), how to poll/consume/cancel, prerequisites (git repo with at least one commit), deadlines, sandbox absence, and data exposure. An output schema exists, so return-value details are not the description's burden.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and each parameter is already well-documented in the schema. The description reinforces key usage points such as passing an absolute workspace_root and using idempotency_key to replay without new spend, but it does not add substantial new parameter-level meaning beyond the schema's own descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Opens with a specific verb-plus-resource statement: 'Delegate a coding task to Kimi in the background and get a job_id back immediately.' It clearly separates this from kimi_delegate (sync) and explicitly names related sibling tools for follow-up, so an agent can distinguish it without opening schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit when-to-use guidance: prefer this for substantial/multi-file tasks that may exceed the 300s sync deadline, and use free tools (kimi_delegate_dry_run, kimi_status) first for scope/readiness checks. It also names the companion tools for polling, consuming, and canceling, leaving no ambiguity about the operational workflow.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
kimi_delegate_dry_runPreview a delegate (free)ARead-only
Preview what a kimi_delegate/kimi_delegate_async call would do — the
baseline it seeds from (HEAD commit, tracked file count/size, uncommitted and
untracked counts), the prompt size that would be sent, and the resolved
workspace/isolation. Free — no model call, no spend, no worktree created.
Use it before delegating to confirm scope and repo before committing to cost,
exactly as kimi_dry_run previews kimi_review_changes. Mirrors the real
delegate's zero-spend validation (workspace, isolation, task size, git repo), so
a failure here is a failure the paid call would also hit. The returned
tier/sandbox describe the previewed propose run, not this read-only preview;
the result echoes the effective model/reasoning_effort overrides the paid
call would send (unvalidated). deadline_advisory is non-null when size or
reasoning effort risks the synchronous deadline and names kimi_delegate_async
verbatim — the async counterpart of the previewed call, not of this dry-run tool.
A hint, not a refusal.
| Name | Required | Description | Default |
|---|---|---|---|
| task | Yes | The coding task you want Kimi to implement via a real kimi_delegate call; this dry run only previews the seeded baseline and prompt size — it does NOT call Kimi or return a diff. Must be non-blank: empty or whitespace-only is rejected here too, not previewed. | |
| model | No | The Kimi model slug the previewed paid call would use; defaults to the server default (MOONBRIDGE_MODEL) when unset, so the preview mirrors the paid call's resolution. This dry run does not call Kimi or validate the model. | |
| isolation | No | Which skills Kimi loads: 'inherit' (own user/project discovery) or 'ignore-skills' (empty dir). Built-ins load either way; this reduces loading, not isolation. Default: server-configured, per kimi_status. More: kimi://params. | |
| workspace_root | No | Absolute path to the target repo root — pass it to target the intended repo (MCP roots are unavailable); otherwise the call falls back to the server's own cwd and sets meta.workspace_warning. | |
| reasoning_effort | No | The reasoning effort the previewed paid call would send (as a `model_reasoning_effort` config override); defaults to the server default (MOONBRIDGE_REASONING_EFFORT) when unset, so the preview mirrors the paid call's resolution. This dry run does not call Kimi or validate the value beyond the paid params' shape bounds (no control or surrogate characters, ≤128 chars). |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description goes well beyond the readOnlyHint annotation by detailing exactly what happens and what does not: no model call, no spend, no worktree created. It also transparently explains subtle return semantics — tier/sandbox describe the previewed run, overrides are unvalidated, and deadline_advisory is only a hint — which prevents misinterpreting the tool's output.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is long, but it is information-dense and front-loaded with the most critical facts (free, no model call, no spend, no worktree). The caveats about tier/sandbox, overrides, and deadline_advisory are valuable and earn their place, though a slightly tighter structure would improve scannability.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a preview tool with an output schema, the description completely covers the behavioral contract: what is previewed, what is not, validation parity with the paid call, and the meaning of special return fields. It even resolves potential confusion about deadline_advisory naming the async counterpart. Nothing critical is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema description coverage is 100%, so the schema already fully documents every parameter. The description adds useful context about the previewed call's resolutions, but it does not need to compensate for schema gaps. Baseline 3 is appropriate here.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description identifies a specific action ('Preview what a kimi_delegate/kimi_delegate_async call would do'), names the exact resources involved (HEAD commit, file counts, prompt size, workspace/isolation), and distinguishes this tool from related siblings like kimi_dry_run. The 'exactly as kimi_dry_run previews kimi_review_changes' analogy makes the purpose immediately recognizable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description says explicitly when to use it: 'Use it before delegating to confirm scope and repo before committing to cost.' It also states that a failure here mirrors a failure the paid call would hit, giving the agent a concrete preflight decision rule. It names the paid counterparts (kimi_delegate/kimi_delegate_async) and the analogous dry-run sibling.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
kimi_dry_runPreview a review (free)ARead-only
Preview what a kimi_review_changes call would send — scope, diff size,
redactions, truncation. Free — no model call, no spend. Use it before a
review to inspect the scope and the reported redactions; redaction is
best-effort, so treat the preview as a check on scope, not as confirmation
that no secret remains. Pass the same extra_context and untracked policy
you would give the review so the preview matches it. would_call_model reports
whether the paid call would actually run the model (False on an empty diff, where
prompt_bytes is 0), and coverage discloses omitted untracked files just as the
review would. The result echoes the effective model/reasoning_effort overrides
the paid call would send (unvalidated). deadline_advisory is non-null when size
or effort risks the synchronous deadline (null whenever would_call_model is
False) and names kimi_review_changes_async verbatim — the async counterpart of
the previewed call, not of this dry-run tool. A hint, not a refusal.
| Name | Required | Description | Default |
|---|---|---|---|
| base | No | Base git ref for scope='branch'; the review covers base...HEAD. | |
| model | No | The Kimi model slug the previewed paid call would use; defaults to the server default (MOONBRIDGE_MODEL) when unset, so the preview mirrors the paid call's resolution. This dry run does not call Kimi or validate the model. | |
| paths | No | Repo-relative paths to narrow the review ('/' separators, no '..'); omit to review all changes in scope. | |
| scope | No | Which changes to review: 'working_tree' (tracked changes vs HEAD; untracked files follow the `untracked` policy, off by default), 'branch' (needs base), or 'commit' (needs commit). | working_tree |
| commit | No | Commit SHA or ref to review for scope='commit'. | |
| isolation | No | Which skills Kimi loads: 'inherit' (own user/project discovery) or 'ignore-skills' (empty dir). Built-ins load either way; this reduces loading, not isolation. Default: server-configured, per kimi_status. More: kimi://params. | |
| untracked | No | How working_tree scope treats untracked files: 'explicit_only' (default) includes only those named in `paths`; 'include' reviews all non-ignored untracked files (SENDS their contents to your configured provider — opt-in egress); 'exclude' includes none. Omitted ones are disclosed in `coverage`. Inert for branch/commit scopes. | explicit_only |
| extra_context | No | Optional author intent/background context, added as clearly-labeled UNTRUSTED prompt data. Redaction does NOT cover it — no live secrets. Full caveats and bounds: kimi://params. | |
| workspace_root | No | Absolute path to the target repo root — pass it to target the intended repo (MCP roots are unavailable); otherwise the call falls back to the server's own cwd and sets meta.workspace_warning. | |
| reasoning_effort | No | The reasoning effort the previewed paid call would send (as a `model_reasoning_effort` config override); defaults to the server default (MOONBRIDGE_REASONING_EFFORT) when unset, so the preview mirrors the paid call's resolution. This dry run does not call Kimi or validate the value beyond the paid params' shape bounds (no control or surrogate characters, ≤128 chars). |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint: true, so the 'Free — no model call, no spend' claim is consistent. The description goes beyond the annotation by detailing effective behavior: would_call_model is False on empty diff, prompt_bytes is 0, coverage discloses omitted untracked files, model/reasoning_effort are echoed unvalidated, and deadline_advisory is non-null only when size/effort risks the synchronous deadline. This meaningfully explains what the call will do and what side effects (none) it has, though some behaviors are described at a high level. No contradiction with the read-only/hint annotations exists.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is long but informational; it front-loads the core purpose in the first sentence and the free/no-spend trait. Each sentence adds a distinct behavioral fact (would_call_model, coverage, unvalidated overrides, deadline_advisory). It is not tautological or bloated, but it is verbose and could be tightened around the deadline_advisory/async sentence. The structure earns a 4 not a 5 because some sentences are dense enough to require rereading, though all of them earn their place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is complete for an agent to invoke correctly: it names the sibling alternatives, explains the free/read-only behavior, explains the return value semantics (would_call_model, prompt_bytes, coverage, deadline_advisory) even though an output schema exists, and it adheres to the annotation profile. For a 10-parameter tool with 100% schema coverage, the description fills the gaps the schema can't — when to use it, what the preview can't guarantee (redaction), and how parameters should be passed to match the paid call. No missing information for selecting or invoking this tool is apparent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents every parameter. However, the description adds important cross-parameter guidance: 'Pass the same extra_context and untracked policy you would give the review so the preview matches it', and it explains that model/reasoning_effort mirror the paid call's defaults. It also explains the relationship between deadline_advisory and would_call_model, which the schema alone does not convey. Slightly above the baseline 3 because the description explains how parameters interact, though it does not restate individual parameter meanings from the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Preview what a kimi_review_changes call would send') plus a concrete resource (the review call's scope, diff size, redactions, truncation). It names the sibling it is not ('async counterpart of the previewed call, not of this dry-run tool') and distinguishes it from kimi_review_changes. This allows an agent to tell it apart from both the paid review and the dry-run sibling without opening schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says 'Use it before a review to inspect the scope and the reported redactions', provides a concrete precondition, and warns about the redaction limitation. It also says to 'Pass the same extra_context and untracked policy you would give the review so the preview matches it', which is a direct how-to for correct invocation. The 'not a refusal' closing phrase clarifies the advisory hint semantics, further guiding use.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
kimi_job_cancelCancel a job (free)AIdempotent
Cancel a running background Kimi job.
Asks the worker to shut down gracefully so it tears down its throwaway worktree,
then force-kills it if it overstays, and marks the job cancelled (cancelled jobs
cannot be resumed). If the worktree could not be removed, cleanup_warnings
names the leftover path. Already-terminal jobs are returned unchanged, so cancel
is idempotent — a retry after a lost response is safe. Free — no model call.
| Name | Required | Description | Default |
|---|---|---|---|
| job_id | Yes | The job_id from an *_async call or a sync call's meta.job_id; recover lost ids with kimi_job_list. | |
| workspace_root | No | Absolute path to the target repo root — pass it to target the intended repo (MCP roots are unavailable); otherwise the call falls back to the server's own cwd and sets meta.workspace_warning. |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses far beyond the annotations: the graceful-shutdown-then-force-kill lifecycle, teardown of a throwaway worktree, non-resumability of cancelled jobs, cleanup_warnings for leftover paths, idempotent retry safety, and the 'free — no model call' cost profile. This aligns with and enriches readOnlyHint=false and idempotentHint=true with no contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The purpose is front-loaded in the first sentence, and each subsequent sentence earns its place by covering a distinct behavioral facet: shutdown process, force-kill fallback, non-resumably, cleanup warnings, idempotency, and cost. It is dense but not bloated; only a small trim would tighten it further.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With a 100%-covered schema, an output schema present, and annotations covering idempotency and destructiveness, the description still adds substantial context: lifecycle, edge cases (terminal jobs, cleanup failure), and retry safety. The only untold edge case is behavior for a genuinely unknown job id, which is a minor gap given how much is already covered.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the schema itself is unusually rich: job_id explains where to find it and how to recover lost ids via kimi_job_list, and workspace_root explains the MCP-roots fallback and workspace_warning behavior. The description adds no parameter-level meaning beyond the schema, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The opening sentence states a specific verb (Cancel) and resource (a running background Kimi job), making the tool's function immediately unambiguous. It is plainly distinct from sibling tools like kimi_job_status, kimi_job_result, and kimi_job_list, none of which perform cancellation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear usage context: it applies to running jobs, and the statement that already-terminal jobs are returned unchanged effectively defines when the tool adds no value. It explicitly names kimi_job_list as the recovery path for lost job ids. It stops short of an explicit when-not statement against sibling status/result tools, but cancellation is unique among the siblings, so little exclusion guidance is needed.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
kimi_job_consume_resultFetch and delete job result (free)A
Fetch a finished background Kimi job's result and delete the stored record.
Same envelope as kimi_job_result (matching the job's kind — branch on tool),
then removes completed job state — but only once the stored result has been read
intact and validated (a success or the job's own error envelope): a stored result
this release cannot read (job_result_incompatible or a corruption internal_error)
is NOT deleted, so it stays inspectable via kimi_job_result. Deletion precedes
the response, so a response lost in transit does not restore the record; a failed
removal retains the record until its TTL (kimi_job_status still shows it). Use
only when you no longer need to poll or re-read the job. Non-done jobs are not
deleted. Free — no model call.
detail works as in kimi_job_result (#56).
| Name | Required | Description | Default |
|---|---|---|---|
| detail | No | Response verbosity: 'summary' (default) omits the raw model text; 'full' includes it. | summary |
| job_id | Yes | The job_id from an *_async call or a sync call's meta.job_id; recover lost ids with kimi_job_list. | |
| workspace_root | No | Absolute path to the target repo root — pass it to target the intended repo (MCP roots are unavailable); otherwise the call falls back to the server's own cwd and sets meta.workspace_warning. |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes | true = success result, false = error result |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The prose is extremely transparent: deletion conditions, ordering relative to the response, TTL retention on failed removal, and non-done behavior are all described. However, the annotations declare destructiveHint=false while the description says the tool 'deletes the stored record' and 'removes completed job state.' This is a direct contradiction, so the dimension must be scored 1 per the rubric.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is long but information-dense; every sentence contributes a distinct operational fact. It front-loads the core purpose and then uses a tight paragraph for deletion semantics, making the structure appropriate for the behavioral complexity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the output schema exists and the input schema is fully documented, the description covers all the remaining behavioral context an agent needs: when deletion happens, what is retained on incompatible/corrupt results, what happens if removal fails, and that non-done jobs are untouched. Nothing material is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already documents all three parameters, including the detail enum's summary/full semantics and job_id provenance, so schema coverage is 100%. The description adds minimal parameter-specific meaning beyond a cross-reference to kimi_job_result for detail; it does not need to compensate, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb-resource pair: 'Fetch a finished background Kimi job's result and delete the stored record.' It also distinguishes itself from the sibling kimi_job_result by emphasizing deletion and one-shot consumption, so an agent can tell them apart immediately.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly states when to use it ('Use only when you no longer need to poll or re-read the job') and what it does not do ('Non-done jobs are not deleted'). It names the analogous envelope of kimi_job_result and clarifies the free/no-model-call behavior, giving clear selection context among siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
kimi_job_listList background jobs (free)ARead-only
List the background jobs known for this workspace, newest first.
Free — no model call. Use to recover job_ids lost across context compaction or
interruption. Returns each job's id, kind, status, start time, result_available,
result_ok (a done job's outcome — true/false/null; see kimi_job_status), and expiry,
so a stored failure is triageable without fetching each result.
Returns every retained job by default; pass limit (1-1000) or status to narrow. They
narrow independently — omitting limit returns every job matching status, not every
job. Only an explicit limit truncates: when more jobs match, the response sets
truncated: true with a truncation_hint — the extra rows are dropped, not paged, so
omit limit to get them all rather than looking for a cursor.
Read a job's result promptly — a finished record can silently drop off. This list is
not permanent storage: terminal records expire after the TTL (default 24h), and a
per-workspace soft cap (default 50, clamped 1-1000) evicts the oldest terminal records
as new jobs start, so a finished job can disappear even before its expires_at.
Running jobs are never evicted, so a busy workspace can hold more than the cap — and
more than limit's 1000 ceiling.
Includes sync-originated records (any sync consult/review/delegate call); the cap/TTL
eviction covers both.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum jobs to return, newest first (1-1000). Omit (or pass null) to return every retained job that matches — the default; it caps nothing, and does not override `status`. Only an explicit limit truncates: then the response sets truncated=true and the extra rows are dropped. | |
| status | No | Return only jobs in this lifecycle state ('running', 'done', 'failed', 'cancelled', 'timeout'); omit for all states. | |
| workspace_root | No | Absolute path to the target repo root — pass it to target the intended repo (MCP roots are unavailable); otherwise the call falls back to the server's own cwd and sets meta.workspace_warning. |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes far beyond the readOnlyHint annotation by disclosing TTL/eviction behavior, the soft cap of 50, eviction order, running-job exemption, truncation behavior, filter independence, and inclusion of sync-originated records. This is rich behavioral context that annotations alone do not provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Long but dense and front-loaded with purpose and cost. Each paragraph covers a distinct behavioral concern, and there is no filler or repetition beyond what is needed to prevent common misuse. The structure earns its length.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Provides everything an agent needs to call and interpret this tool correctly: return field overview, defaults, filter interactions, truncation semantics, expiry/eviction caveats, and a pointer to kimi_job_status for result_ok interpretation. With an output schema present, detailed return values are handled elsewhere, so no critical gap remains.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Although schema descriptions already cover all three parameters, the description adds crucial semantics not visible in the schema: limit and status narrow independently, omitted limit returns every matching job, a single explicit limit truncates and drops rows rather than paging, and there is no cursor to follow. This materially improves correct invocation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States exactly what the tool does: lists background jobs for a workspace, newest first, and explicitly notes it is free with no model call. It also names the key returned fields and implies the distinction from sibling job tools by saying stored failures are triageable without fetching each result.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives a concrete use case: recover job_ids lost across context compaction or interruption. It also references kimi_job_status for result_ok semantics and advises reading results promptly, which implies when deeper inspection is needed. It does not explicitly tell the agent to use kimi_job_result for full results, so a small exclusionary detail is missing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
kimi_job_resultFetch job result (free)ARead-only
Fetch a finished background Kimi job's result WITHOUT deleting the record.
Works for any async job or sync consult/review/delegate (whose meta.job_id names
its record) — kimi_delegate_async (a diff), kimi_consult_async (a consult
answer), or kimi_review_changes_async (a review with verdict). Use when
kimi_job_status reports result_available=true; the envelope matches the job's
kind, so branch on tool. meta.job_id is set. A still-running/cancelled/timed-
out/failed job returns an error envelope — as does a done job whose stored result
this release cannot read (job_result_incompatible). To fetch and delete, use
kimi_job_consume_result. Free — no model call.
detail="summary" (default) omits the raw model text; pass detail="full" for
the complete raw output and metadata (#56).
| Name | Required | Description | Default |
|---|---|---|---|
| detail | No | Response verbosity: 'summary' (default) omits the raw model text; 'full' includes it. | summary |
| job_id | Yes | The job_id from an *_async call or a sync call's meta.job_id; recover lost ids with kimi_job_list. | |
| workspace_root | No | Absolute path to the target repo root — pass it to target the intended repo (MCP roots are unavailable); otherwise the call falls back to the server's own cwd and sets meta.workspace_warning. |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes | true = success result, false = error result |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, and the description adds meaningful behavioral context: the call does not delete the record, failure modes include job_result_incompatible for unreadable stored results, the envelope matches the job kind so callers should branch on 'tool', and the operation is free with no model call. These details go well beyond the annotation alone.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the core behavior and non-destructive guarantee, then efficiently covers usage conditions, failure modes, and the alternative deletion tool. Every sentence adds distinct value, and the detail parameter behavior is explained compactly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the presence of an output schema, the description need not restate return values. It covers when to call, what kinds of jobs are supported, how to branch on the result, failure scenarios, the deletion alternative, and the detail option, making it fully contextual for an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the schema already documents job_id, detail, and workspace_root with equivalent semantics. The description reinforces the 'summary'/'full' detail distinction but does not materially add parameter meaning beyond what the input schema provides, so a baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource: 'Fetch a finished background Kimi job's result WITHOUT deleting the record.' It clearly distinguishes itself from kimi_job_consume_result and enumerates which async/sync job kinds it applies to, making sibling differentiation straightforward.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states when to use this tool ('Use when kimi_job_status reports result_available=true'), when not to use it (running/cancelled/timed-out/failed jobs), and which alternative to prefer when deletion is desired (kimi_job_consume_result). This leaves no ambiguity about tool selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
kimi_job_statusCheck job status (free)ARead-only
Check a background job's lifecycle state without fetching the full result.
Use after any *_async call (kimi_delegate_async, kimi_consult_async,
kimi_review_changes_async) or any sync consult/review/delegate (whose meta.job_id
names its record). Returns status, elapsed time, expiry, and result_available; when
it is true, call kimi_job_result. result_ok reports a done job's producer-declared
outcome — true (success), false (a stored error envelope), or null (running, no stored
envelope, an unclassifiable payload, or a record finalized before this field) — so you
can spot a stored FAILURE without fetching it. It does not guarantee the payload is
still fetchable; a cross-release record may report an outcome yet fail kimi_job_result
with job_result_incompatible. Free — no model call.
Honor poll_after_ms between polls — for a running job it GROWS with elapsed
runtime (bounded), so following it backs you off instead of tight-looping (a
delegate often runs ~20s). expires_at is null while running and is set once the
job finishes; results are then retained ttl_seconds past that completion.
| Name | Required | Description | Default |
|---|---|---|---|
| job_id | Yes | The job_id from an *_async call or a sync call's meta.job_id; recover lost ids with kimi_job_list. | |
| workspace_root | No | Absolute path to the target repo root — pass it to target the intended repo (MCP roots are unavailable); otherwise the call falls back to the server's own cwd and sets meta.workspace_warning. |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Despite readOnlyHint=true, the description adds substantial non-obvious behavior: result_ok's three-state semantics, the possibility of job_result_incompatible on cross-release records, poll_after_ms backing off, expires_at lifecycle, and ttl retention. It also notes it is free/no model call. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Long but dense and front-loaded: purpose, then usage, then state semantics, then polling protocol. Every sentence carries behavioral or routing information; the parentheticals ('a delegate often runs ~20s') are relevant, not filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a polling/status tool with complex lifecycle semantics, the description covers the full call path (when to poll, what fields mean, when to escalate to kimi_job_result, edge cases like incompatible payloads). Output schema exists, so return-value detail is not required here.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema coverage is 100% and both parameter descriptions are already complete; the tool description restates job_id's origin but adds no new meaning for the input parameters. The poll_after_ms discussion is output behavior, not an input parameter, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The first sentence uses a specific verb and resource ('Check a background job's lifecycle state') and immediately differentiates from kimi_job_result with 'without fetching the full result.' It also names the async/sync origins of job_id, making it unmistakable which call is being described.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says to use after any *_async call or sync consult/review/delegate whose meta.job_id names the record, tells the agent to call kimi_job_result when result_available is true, and instructs honoring poll_after_ms. This is clear when-to-use guidance with named alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
kimi_modelsList Kimi models (free)ARead-only
List Kimi model slugs you can pass as model, with each model's advertised
reasoning-effort set for reasoning_effort. Free — no model call.
Advisory discovery only: read from Kimi's on-disk cache when present, else a
bundled fallback (source says which; the fallback carries no effort data).
The kimi CLI validates the real slug and the backend validates the real effort, so
an unlisted value may still work and a listed one may be unavailable to your
account. Same payload as the kimi://models resource. Not fingerprint-stable — do
not cache it by the capabilities fingerprint.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the readOnlyHint annotation, it discloses the data source (on-disk cache vs bundled fallback), that the fallback lacks effort data, that the real CLI/backend validate values, and that the payload is identical to kimi://models while not being fingerprint-stable. This is far more behavioral context than the annotation provides.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The core statement is front-loaded and every sentence adds information, but the middle sentences are dense with caveats and parentheticals (cache source, fallback data, validation behavior). It is efficient but slightly more complex than necessary.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no parameters, an output schema present, and a readOnly annotation, the description covers all decision-relevant behavior: free/no call, sources, validation caveats, payload equivalence, and cacheability. Nothing needed for correct invocation is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so there is nothing to document; baseline is 4. The description still adds relevant semantic value by explaining how the returned slugs/effort values are meant to be used as `model` and `reasoning_effort` in other calls.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description starts with a concrete verb and object: 'List Kimi model slugs you can pass as `model`' and specifies the output includes each model's advertised reasoning-effort set for `reasoning_effort`. This makes the tool's function unambiguous and clearly distinct from siblings like kimi_status or kimi_capabilities.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides clear context: 'Free — no model call', 'Advisory discovery only', and warns not to cache by fingerprint. It does not explicitly name alternative tools or state when not to use it, so it stops just short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
kimi_review_changesReview git changes (paid)A
Ask Kimi (a different model) to review your git changes for an independent second opinion.
PAID — this spends Kimi quota on every new call; use kimi_dry_run or kimi_status (both free) first if you only need to check scope or readiness.
scope: working_tree (tracked changes vs HEAD — untracked files follow the
untracked policy and are NOT reviewed by default), branch (needs base, reviews
base...HEAD), or commit (needs a commit SHA). The diff is gathered, secret-
redacted, and bounded by this server; Kimi reviews it read-only and returns
structured findings. Pass workspace_root (absolute) for the right repo. Optional
extra_context (author intent, bounded like the diff) cuts false positives.
The result's top-level review_status and coverage disclose whether the model
actually ran and what it was shown: a pass over partial coverage is surfaced as
unknown, and a tree with nothing reviewable returns not_run, never a pass.
STATIC review, not a verify mode: the read-only agent profile gives Kimi no shell and no write tool, so it cannot run the project's checks to confirm its findings — treat them as unvalidated claims you verify yourself before acting.
Data egress: this sends the gathered diff to your configured provider via the
kimi CLI. The diff is
secret-redacted (best-effort), but your extra_context is sent raw (unredacted),
Kimi auto-loads the resolved workspace's AGENTS.md and discovers skills from its own
config (including extra_skill_dirs, which may point outside the workspace). Skill
names and descriptions are exposed to the model up front, so that content can be sent
even if your prompt never mentions it. The isolation setting does not suppress any of
it: kimi's built-in skills always load, and AGENTS.md is read regardless.
Your inputs are sent raw and unredacted. Secret redaction is best-effort and covers the gathered diff and Kimi's returned output — not what you type, and not the files Kimi reads for itself.
Progress & recovery: blocks up to the resolved deadline (timeout_seconds, clamped
10-600s; when omitted, the server-configured value, built-in default 300s). If that deadline
expires the run is terminated and its partial output is not recoverable or resumable, so for a
multi-file or whole-branch review that may exceed it, prefer kimi_review_changes_async (a
background job, built-in default 1800s deadline; poll kimi_job_status). Coarse
notifications/progress streams while it blocks when your client requests it; some MCP
clients background a long call before the deadline, so timeout_seconds bounds the run, not
necessarily the inline wait — either way the detached run (meta.job_id) is recoverable via
kimi_job_list→kimi_job_status→kimi_job_result.
| Name | Required | Description | Default |
|---|---|---|---|
| base | No | Base git ref for scope='branch'; the review covers base...HEAD. | |
| model | No | Override the Kimi model slug for this call; defaults to the server/Kimi default when unset. | |
| paths | No | Repo-relative paths to narrow the review ('/' separators, no '..'); omit to review all changes in scope. | |
| scope | No | Which changes to review: 'working_tree' (tracked changes vs HEAD; untracked files follow the `untracked` policy, off by default), 'branch' (needs base), or 'commit' (needs commit). | working_tree |
| commit | No | Commit SHA or ref to review for scope='commit'. | |
| detail | No | Response verbosity: 'summary' (default) omits the raw model text; 'full' includes it. | summary |
| isolation | No | Which skills Kimi loads: 'inherit' (own user/project discovery) or 'ignore-skills' (empty dir). Built-ins load either way; this reduces loading, not isolation. Default: server-configured, per kimi_status. More: kimi://params. | |
| untracked | No | How working_tree scope treats untracked files: 'explicit_only' (default) includes only those named in `paths`; 'include' reviews all non-ignored untracked files (SENDS their contents to your configured provider — opt-in egress); 'exclude' includes none. Omitted ones are disclosed in `coverage`. Inert for branch/commit scopes. | explicit_only |
| extra_context | No | Optional author intent/background context, added as clearly-labeled UNTRUSTED prompt data. Redaction does NOT cover it — no live secrets. Full caveats and bounds: kimi://params. | |
| workspace_root | No | Absolute path to the target repo root — pass it to target the intended repo (MCP roots are unavailable); otherwise the call falls back to the server's own cwd and sets meta.workspace_warning. | |
| idempotency_key | No | Optional dedup key scoped to THIS tool + workspace. Same key + same args replays the prior result with no new spend; different args are refused (idempotency_conflict). Sync and _async are separate tools and never share a key. Omit for none; retention is bounded. Lifecycle: kimi://params. | |
| timeout_seconds | No | Per-call wall-clock timeout in seconds, clamped to 10..600 (out-of-range values are coerced, not rejected). Defaults to the server's configured timeout. | |
| reasoning_effort | No | Override the Kimi reasoning effort for this call (a model_reasoning_effort override); omit or pass null for the server default (MOONBRIDGE_REASONING_EFFORT) or Kimi's own resolution. An open, per-model string the backend validates at run time — commonly minimal|low|medium|high|xhigh; kimi_models lists each model's advertised set (advisory). Rejection and bounds detail: kimi://params. |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Despite annotations only giving readOnlyHint=false/openWorldHint=true/idempotentHint=false/destructiveHint=false (no safety assertions), the description discloses extensively: it spends Kimi quota, sends the diff to the provider, secret-redaction is best-effort and does NOT cover extra_context or user inputs, AGENTS.md and skills are auto-loaded regardless of isolation, results can be lost on timeout (not recoverable/resumable), and review_status/coverage disclose partial/not_run states. It even explains that skill names/descriptions are exposed to the model before the prompt. This significantly enriches beyond annotations and surfaces the risk profile clearly. No contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is long but every paragraph earns its place: pricing/quota, scope, egress/privacy, progress/recovery, and limitations are all substantive and non-redundant. It is structured with bold labels (scope, Data egress, Progress & recovery) and front-loaded with the most decision-critical facts (PAID, free alternatives). It loses one point because the volume of detail, while valuable, is dense enough that a quick-skimming agent might miss the egress warnings embedded in the middle; a brief upfront risk summary would improve scanability.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 13 parameters, 0 required, an output schema, and a rich sibling set, the description is exceptionally complete: it covers cost, egress/privacy, timeout behavior, async alternatives, dedup semantics, result disclosure semantics (review_status/coverage, not_run), and the read-only/static limitation. The only minor gap is not describing the output schema's structure, but the presence of an output schema plus the description's statements about top-level review_status/coverage makes that unnecessary. Nothing an agent needs to correctly select or invoke this tool is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so baseline 3. The description adds substantial compensating value on top: it explains scope semantics (working_tree vs branch vs commit), untracked policy behavior, timeout clamping (10-600s), idempotency_key replay/refusal rules, and that workspace_root avoids fallback to server cwd. It also flags that extra_context is sent raw/unredacted and that isolation does not suppress built-in skills/AGENTS.md. This goes well beyond what the schema's individual parameter descriptions provide.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Review git changes') and resource ('git changes'), and immediately contrasts it with siblings: 'PAID — this spends Kimi quota on every new call; use kimi_dry_run or kimi_status...'. It distinguishes from kimi_review_changes_async (prefer for long runs), kimi_consult/kimi_delegate (different Kimi interactions), and explains what it actually does (gathers diff, secret-redacts, bounded, read-only review). This makes the tool's purpose and scope unmistakable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly provides when-to-use guidance: 'use kimi_dry_run or kimi_status (both free) first if you only need to check scope or readiness', 'prefer kimi_review_changes_async ... for a multi-file or whole-branch review that may exceed it', and describes the recovery path via kimi_job_list→kimi_job_status→kimi_job_result. It also explains scope selection semantics, workspace_root necessity, and extra_context usage. This is comprehensive routing guidance with exclusions (e.g., 'STATIC review, not a verify mode: ... cannot run the project's checks').
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
kimi_review_changes_asyncReview git changes in background (paid)A
Review your git changes in the background; get a job_id back immediately.
PAID — this spends Kimi quota on every new call; use kimi_dry_run or kimi_status (both free) first if you only need to check scope or readiness.
Same read-only behavior as kimi_review_changes (the diff is gathered, secret-
redacted, and bounded, then reviewed read-only), but detached — prefer it for a multi-file
or whole-branch review that can exceed the synchronous deadline (built-in default 300s),
since a sync run whose deadline expires loses its partial work; this job's own deadline is
separately configured (built-in default 1800s). The diff is gathered inside the job, so a bad
base/commit comes back as the same structured error with zero spend (a bad
scope is rejected by MCP input validation before the job starts). Starting a job commits to
spend. Poll kimi_job_status; read/consume the review envelope with
kimi_job_result/kimi_job_consume_result; stop with kimi_job_cancel. Pass
workspace_root (absolute).
Data egress: same as kimi_review_changes — sends the secret-redacted diff plus
your raw (unredacted) extra_context to your configured provider via the kimi
CLI; Kimi may also
Kimi auto-loads the resolved workspace's AGENTS.md and discovers skills from its own
config (including extra_skill_dirs, which may point outside the workspace).
Your inputs are sent raw and unredacted. Secret redaction is best-effort and covers the gathered diff and Kimi's returned output — not what you type, and not the files Kimi reads for itself.
| Name | Required | Description | Default |
|---|---|---|---|
| base | No | Base git ref for scope='branch'; the review covers base...HEAD. | |
| model | No | Override the Kimi model slug for this call; defaults to the server/Kimi default when unset. | |
| paths | No | Repo-relative paths to narrow the review ('/' separators, no '..'); omit to review all changes in scope. | |
| scope | No | Which changes to review: 'working_tree' (tracked changes vs HEAD; untracked files follow the `untracked` policy, off by default), 'branch' (needs base), or 'commit' (needs commit). | working_tree |
| commit | No | Commit SHA or ref to review for scope='commit'. | |
| isolation | No | Which skills Kimi loads: 'inherit' (own user/project discovery) or 'ignore-skills' (empty dir). Built-ins load either way; this reduces loading, not isolation. Default: server-configured, per kimi_status. More: kimi://params. | |
| untracked | No | How working_tree scope treats untracked files: 'explicit_only' (default) includes only those named in `paths`; 'include' reviews all non-ignored untracked files (SENDS their contents to your configured provider — opt-in egress); 'exclude' includes none. Omitted ones are disclosed in `coverage`. Inert for branch/commit scopes. | explicit_only |
| extra_context | No | Optional author intent/background context, added as clearly-labeled UNTRUSTED prompt data. Redaction does NOT cover it — no live secrets. Full caveats and bounds: kimi://params. | |
| workspace_root | No | Absolute path to the target repo root — pass it to target the intended repo (MCP roots are unavailable); otherwise the call falls back to the server's own cwd and sets meta.workspace_warning. | |
| idempotency_key | No | Optional dedup key scoped to THIS tool + workspace. Same key + same args replays the prior result with no new spend; different args are refused (idempotency_conflict). Sync and _async are separate tools and never share a key. Omit for none; retention is bounded. Lifecycle: kimi://params. | |
| reasoning_effort | No | Override the Kimi reasoning effort for this call (a model_reasoning_effort override); omit or pass null for the server default (MOONBRIDGE_REASONING_EFFORT) or Kimi's own resolution. An open, per-model string the backend validates at run time — commonly minimal|low|medium|high|xhigh; kimi_models lists each model's advertised set (advisory). Rejection and bounds detail: kimi://params. |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations, the description discloses spend, zero-spend error cases, the 1800s job deadline, best-effort secret redaction, egress of raw extra_context, AGENTS.md auto-loading, and skill discovery. The 'read-only behavior' clause is consistent with readOnlyHint=false because the tool creates a job and spends quota; the description clarifies that the review itself does not modify the code.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is dense and front-loaded with the core async behavior, cost, and free alternatives. It is somewhat long and contains a broken sentence ('Kimi may also' followed by 'Kimi auto-loads'), plus minor redundancy around spend, but nearly every sentence carries material guidance.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For an 11-parameter paid async tool, the description covers the full job lifecycle, cost model, failure modes, data-egress boundaries, timeouts, and relationships to all relevant sibling tools. Output shape is delegated to the existing output schema, so nothing critical is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema already documents all 11 parameters. The description adds useful runtime semantics: bad base/commit yields a structured error with zero spend, bad scope is rejected before the job starts, workspace_root should be passed, and inputs are sent raw/unredacted.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The first sentence states a specific action ('Review your git changes in the background') and immediate result ('get a job_id back'), and the title/description mark it as the paid async variant. It explicitly distinguishes itself from kimi_review_changes by the detached execution model and from kimi_dry_run/kimi_status by cost and purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear selection criteria: use kimi_dry_run or kimi_status first for free scope/readiness checks, prefer this tool for multi-file or whole-branch reviews likely to exceed the 300s sync deadline, and use the listed kimi_job_* siblings to poll, read, consume, or cancel. It also warns that starting a job commits spend.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
kimi_statusCheck Kimi readiness (free)ARead-only
Check that the kimi CLI is installed, authenticated, and a supported
version, and report the resolved defaults. Free — no model call. Run it before
your first paid call in a session to confirm setup, and again whenever a run
fails with a setup error.
Spend: do not plan spend around rate_limit — it always reports unavailable, and that
is not a failure. kimi exposes no quota-read channel and its provider is user-configured,
so there is nothing authoritative to report. The only quota signal this server can give
you is the kimi_rate_limited error on a call that was actually throttled; it carries
retry_after_ms.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint=true and openWorldHint=false, so the safety profile is covered. The description adds valuable behavioral detail: the tool always reports `rate_limit` as `unavailable`, that this is not a failure, and that the only quota signal is the `kimi_rate_limited` error with `retry_after_ms`. This goes beyond what annotations provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded: first sentence states the purpose and the free/no-model-call nature, second sentence gives when to use it, and the final paragraph gives crucial behavioral caveats. Slightly longer than strictly minimal, but every sentence carries meaningful guidance. A 4 rather than 5 because the last paragraph could be tightened slightly, but it's well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, read-only status check with an output schema, the description is complete. It tells the agent when to call, what to expect, what not to plan around, and how to interpret the only quota signal. There is nothing an agent needs to know to invoke it correctly that is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so schema coverage is trivially 100% and there is no parameter documentation burden. The description appropriately explains the output semantics (rate_limit reports unavailable) even though there is an output schema. A 4 is appropriate because the description compensates for the fact that the output schema likely just lists fields and may not explain the always-`unavailable` behavior.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Check' and the specific scope: installed, authenticated, supported version, and resolved defaults. It also labels it as 'Free — no model call,' which distinguishes it from paid tools. It doesn't explicitly name a sibling that performs an overlapping check, but the title and description together make the purpose clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says when to run it: 'before your first paid call in a session to confirm setup, and again whenever a run fails with a setup error.' It also provides a strong 'do not' guidance about spend planning and `rate_limit`, which prevents incorrect use. This is excellent usage guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
TDQS
Each tool has a clearly distinct role: setup introspection, model/capability discovery, three separate paid operation modes, their async counterparts, per-mode dry runs, and job lifecycle management. Even the job tools split cleanly into status, result, consume, cancel, and list functions.
All tools share the kimi_ prefix and snake_case convention, with predictable suffixes like _async, _dry_run, and kimi_job_*. The naming is uniform and easy to navigate even though discovery tools are noun-style while operation tools are verb-style.
At 16 tools, this is slightly above the typical well-scoped range, but the count is justified by the three natural groups: metadata/status, paid operations with dry-run and async variants, and job lifecycle. No tool feels redundant, though the surface is a bit large.
The tool surface covers the full intended workflow: preflight status, capability and model discovery, three operation modes, dry-run previews, and a complete async job lifecycle from start through list, status, fetch, consume, and cancel. Sync calls also expose job IDs for recovery, leaving no obvious dead ends.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
A paid remote MCP for OpenAI Codex agent coordination MCP, built to return verdicts, receipts, usage
Use AI models for chat, image, and video generation from Claude Code and other MCP hosts.
A paid remote MCP for CodeG, built to return verdicts, receipts, usage logs, and audit-ready JSON.
A paid remote MCP for code graph MCP for AI coding, built to return verdicts, receipts, usage logs,
Related MCP Servers
- FlicenseNot gradedqualityDmaintenanceEnables LLM-powered code analysis, generation, debugging, and context management through MCP integration with IDEs like Cursor and Claude Desktop.
- AlicenseNot gradedqualityDmaintenanceAn MCP bridge that enables Claude Code to consult the Kimi AI model in a structured challenge-loop for code review, debugging, and architecture evaluation.372MIT
- AlicenseNot gradedqualityCmaintenanceEnables users to request a second opinion from a locally authenticated Claude Code model via MCP tools, supporting asynchronous jobs with restricted tools for safety.MIT
- AlicenseBqualityBmaintenanceBridges Codex Desktop with Kimi Code CLI, enabling direct control of AI coding sessions via MCP tools for prompt, status, cancel, and CLI operations.133MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/briandconnelly/moonbridge'
If you have feedback or need assistance with the MCP directory API, please join our Discord server