Skip to main content
Glama

Moonbridge

License: MIT

Moonbridge is a local MCP server that lets compatible MCP clients invoke Kimi Code for independent second opinions, structured code reviews, and delegated coding tasks.

It gives your primary coding agent another model to ask—one that can challenge a plan, inspect a diff, or try an implementation while you keep control of the result. Moonbridge ships plugin integrations for Claude Code and Codex; other clients can use its local stdio server.

Contents: Why Moonbridge? · Requirements · Quick start · Safety model · Tools · Configuration · Development · Documentation

Why Moonbridge?

Different models notice different things. Moonbridge lets one coding agent bring Kimi into the conversation without making you switch tools or manually shuttle context between terminals.

Workflow

What Kimi does

What you get

Consult

Reasons under a read-only agent profile

An answer or independent second opinion

Review

Inspects your git changes without shell or write tools

Structured findings with coverage and verdict

Delegate

Implements a task inside a throwaway worktree

A reviewable diff that is never applied automatically

Every workflow returns a structured result to the calling client. Long-running work can run in the background and be recovered after a dropped connection.

Before using Moonbridge with sensitive code, read the safety model. The Kimi CLI has no sandbox or approval prompts, and a throwaway worktree is not a security boundary.

Related MCP server: Kimi MCP Server

Requirements

  • kimi (Kimi Code) 0.35.x or 0.39.x — the supported minors. Probed on 0.35.0 and 0.39.1; other patch releases in those minors are assumed compatible, not verified

  • Python ≥ 3.11, uv, and git

  • macOS or Linux

  • Claude Code, Codex, or another MCP client that can launch a local stdio server

Make sure Kimi is installed and has at least one configured provider and model alias:

kimi --version
kimi doctor config

See the Kimi Code documentation for CLI installation and authentication.

Quick start

No clone is required. The plugin integrations launch the server from the release tag pinned in .mcp.json.

Codex

codex plugin marketplace add briandconnelly/moonbridge
codex plugin add moonbridge@moonbridge

Start a new Codex session so it loads the bundled skill and tools.

Claude Code

Run these commands inside Claude Code:

/plugin marketplace add briandconnelly/moonbridge
/plugin install moonbridge@moonbridge

Other MCP clients

Moonbridge can work with another client if it supports local stdio servers. Adapt the moonbridge entry in .mcp.json to that client's configuration format. Claude Code and Codex are the integrations currently packaged and documented by this project.

Try it

Ask your coding agent:

  • Check whether Kimi is ready. — a free readiness check with no model call

  • Get Kimi's second opinion on this approach.

  • Have Kimi review my current changes.

  • Delegate this task to Kimi and show me the proposed diff.

Claude Code also provides /kimi:status, /kimi:consult, /kimi:review, and /kimi:delegate shortcuts. In Codex, /plugins lets you browse, enable, or disable the installed plugin.

Safety model

Read this before pointing it at anything sensitive. Every statement below was verified by running kimi-code 0.35.0 and again on 0.39.1, not inferred from its documentation.

The kimi CLI has no sandbox and no approval prompts. Prompt mode (kimi -p) forces autonomous mode and runs shell commands and file writes with your own user's privileges. Unlike Codex, there is no --sandbox flag to hand it. So this server constrains runs itself:

  • consult and review get an agent profile whose tools: list omits every shell and write tool. This is the real control, and it works: an agent declaring Read, Glob, Grep reports exactly those three, and a shell write attempt produces nothing.

  • every run uses a throwaway git worktree. This is defense in depth, not a boundary — asked to write outside its working directory, Kimi will do it. Treat the worktree as keeping honest runs tidy, not as containment.

Three limits that follow, stated plainly because they are easy to assume away:

  1. Read-only prevents modification, not disclosure. Kimi's Read tool accepts absolute paths, so a prompt-injected repository can make a consult read files elsewhere on your machine and send them to your provider. Do not point any workflow at a workspace whose contents you would not hand to that provider.

  2. Delegate is not network-isolated. A delegated task can push, fetch, install dependencies, and call out. The returned diff shows what changed in the worktree — not everything the run did.

  3. Kimi loads context you did not mention. It auto-loads the workspace's AGENTS.md and discovers skills from its own user/project directories and from the extra_skill_dirs entries in its config.toml, which may point anywhere on disk. Its built-in skills always load. The isolation setting reduces this but cannot eliminate it.

Secret redaction covers gathered diffs and Kimi's returned output. It does not cover what you type, or files Kimi reads for itself.

For the complete threat model and disclosure policy, see SECURITY.md and COMPATIBILITY.md.

Tools

“Paid” means the tool makes a Kimi model call and consumes quota from your configured provider; Moonbridge itself is not a paid service.

Tool

Cost

Notes

kimi_status

free

readiness, version, provider configuration, resolved defaults

kimi_capabilities

free

full inventory, schemas, per-tool error codes

kimi_models

free

model aliases from your config.toml, with each alias's declared efforts

kimi_consult / _async

paid

read-only Q&A

kimi_review_changes / _async

paid

structured review of working_tree, branch, or commit

kimi_delegate / _async

paid

returns a reviewable diff, never applied

kimi_dry_run, kimi_delegate_dry_run

free

preview scope, diff size, redactions before spending

kimi_job_{status,result,consume_result,cancel,list}

free

background job lifecycle

Two details prevent surprising runs:

  • model takes an alias, not a provider model id — whatever you defined as [models."<alias>"] in config.toml. An unknown alias is rejected as invalid_model.

  • reasoning_effort is validated locally. Kimi silently ignores an effort it does not recognize rather than rejecting it, so this server refuses one the alias does not declare — a run that quietly used the default while reporting your requested effort would be worse than an error.

Configuration

Environment variables, all prefixed MOONBRIDGE_:

Variable

Default

Meaning

TIMEOUT_SECONDS

300

per-call wall clock, clamped 10–600

MODEL

unset

default model alias

REASONING_EFFORT

unset

default effort

ISOLATION

inherit

inherit or ignore-skills

MAX_INPUT_BYTES

200000

bound on gathered context

MAX_DELEGATE_DIFF_BYTES

200000

bound on a returned diff

JOB_TTL / JOB_MAX_SECONDS / JOB_MAX_COUNT

86400 / 1800 / 50

background job limits

STATE_DIR

~/.cache/moonbridge/jobs

job records

LOG_LEVEL / LOG_FILE

WARNING / unset

logging

SUPPORTED_VERSIONS

0.35,0.39

supported kimi minors (probed at 0.35.0, 0.39.1)

EXTRA_ARGS

unset

no safe passthrough exists — any value is refused, see below

MOONBRIDGE_EXTRA_ARGS accepts nothing today, deliberately. Kimi exposes no config-override, profile, or feature flags, and reuses two short flags for other purposes: -p is prompt and -c is continue. Passing them through would override the run's real instructions or resume an unrelated session, so the allowlist is empty and a configured value fails loudly rather than being silently ignored.

Development

Set up the project and run the focused test suites from the repository root:

uv sync
uv run pytest
uv run pytest -m integration --no-cov  # optional: calls the real Kimi CLI

The authoritative quality gate and contribution workflow live in AGENTS.md and CONTRIBUTING.md.

To exercise the plugin manifest from a checkout, register that checkout as a marketplace:

codex plugin marketplace add <path to this checkout>
codex plugin add moonbridge@moonbridge

In Claude Code, run /plugin marketplace add <path to this checkout>, then install as above. This tests the plugin files in your checkout, but the MCP server still comes from the released tag pinned in .mcp.json; Python edits in the checkout do not affect it.

To run the working tree in Codex, register a separate development server:

codex mcp add moonbridge-dev -- uv run --directory <path to this checkout> moonbridge-mcp

In Claude Code, override the server in the consuming project's own .mcp.json:

{
  "mcpServers": {
    "moonbridge": {
      "command": "uv",
      "args": ["run", "--directory", "<path to this checkout>", "moonbridge-mcp"]
    }
  }
}

Documentation

  • Tool reference — the full caller-facing contract: envelopes, error codes, detail levels, idempotency, jobs. Read it when calling the MCP tools directly.

  • Compatibility — what the kimi CLI does and does not guarantee, and every deliberate non-guarantee.

  • Security policy — the verified security model, and how to report a vulnerability.

  • Contributing — set up a checkout and prepare a pull request.

  • Agent conventions — the authoritative working rules for humans and agents.

  • Upgrading kimi — the probes to re-run before supporting a new kimi version.

  • Releasing — the ordered release runbook.

  • Changelog · Architecture decision records — decision history, not current policy.

Available Tools

16 tools
kimi_capabilitiesList server capabilities (free)A
Read-only

List this server's tools, tiers, and the result fingerprint. Free — no model call. Clients can cache by the fingerprint.

detail="summary" (default) returns each tool's name, cost, stability, and error_codes — the facts tools/list does not already carry — plus async_lifecycle, but only for the *_async tools. detail="full" adds use_when/returns/required_params/key_optional_params, restating what you already hold. detail="contracts" omits tool_details.

Pass include_schemas to also embed the full 'error-envelope', 'result-meta', 'capabilities-result', and/or 'status-result' schema, and/or the 'parameter-contracts' document (a contract doc, not a JSON Schema) — a tool-reachable fallback to the kimi:// resources for resource-blind clients. It works in any detail mode.

ParametersJSON Schema
NameRequiredDescriptionDefault
detailNoWhat to return: 'summary' (default) returns each tool's name, cost, stability, and error_codes; the *_async tools also get async_lifecycle. 'full' adds use_when, returns, and the parameter lists (which tools/list already carries). 'contracts' drops tool_details: fetch a schema, or recheck fingerprint, without re-paying for the inventory.summary
include_schemasNoOpt-in tool-reachable fallback for resource-blind clients: also embed the full 'error-envelope', 'result-meta', 'capabilities-result', and/or 'status-result' schema, and/or the 'parameter-contracts' document (a contract doc, not a JSON Schema, sourced from the kimi://params resource body), in the response — the default payload omits them and points at the kimi:// resources instead.

Output Schema

ParametersJSON Schema
NameRequiredDescription
okYes

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnlyHint annotation, the description discloses that no model call is made, that responses are cacheable via fingerprint, and that certain detail modes restate data the client already has. It also explains the fallback behavior for resource-blind clients and clarifies that parameter-contracts is a contract document, not a JSON Schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but front-loaded with the core purpose, cost, and caching behavior. The detail-mode explanations are dense and information-rich, with each sentence adding a distinct fact. It could be tightened slightly, but the structure makes the complexity navigable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the output schema exists and annotations cover read-only safety, the description provides everything an agent needs to call this tool correctly: purpose, cost model, caching, detail-level tradeoffs, include_schemas behavior, and fallback rationale. No significant gap remains.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already documents both parameters. The description adds meaningful nuance beyond the schema: which tools get async_lifecycle, that 'full' restates existing data, and that include_schemas is an opt-in fallback sourced from kimi:// resources. This helps an agent reason about payload tradeoffs.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'List this server's tools, tiers, and the result fingerprint.' It clearly distinguishes this from the sibling tools by emphasizing that it is free, caching-friendly, and returns capability metadata rather than status, models, or job operations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives strong usage context: it is free, makes no model call, and is designed for clients to cache by fingerprint. It also explains when to use different detail modes and when to pass include_schemas, though it does not explicitly name sibling tools as alternatives or provide when-not-to-use conditions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

kimi_consultConsult Kimi (paid)A

Ask Kimi (a different model) for a read-only second opinion or answer.

PAID — this spends Kimi quota on every new call; there is no dry-run preview for a consult, so run kimi_status (free) first to confirm the CLI is installed and authenticated.

Runs kimi -p under a generated read-only agent profile — Kimi holds no shell and no write tool, so it never edits files. A STATIC review, not a verify mode: without those tools it cannot run a test/build/lint pass to confirm its claims — treat findings as unvalidated claims you verify yourself. Pass workspace_root (absolute) for a repo-grounded question; omit it for pure Q&A. Returns a result envelope.

Data egress: this sends your question and extra_context to your configured Kimi provider via the kimi CLI. Kimi always runs with a resolved working directory (workspace_root, else the server's cwd as a fallback — MCP roots are unavailable), so it may read files there and Kimi auto-loads the resolved workspace's AGENTS.md and discovers skills from its own config (including extra_skill_dirs, which may point outside the workspace). Skill names and descriptions are exposed to the model up front, so that content can be sent even if your prompt never mentions it. The isolation setting does not suppress any of it: kimi's built-in skills always load, and AGENTS.md is read regardless.

Your inputs are sent raw and unredacted. Secret redaction is best-effort and covers the gathered diff and Kimi's returned output — not what you type, and not the files Kimi reads for itself.

Progress & recovery: blocks up to the resolved deadline (timeout_seconds, clamped 10-600s; when omitted, the server-configured value, built-in default 300s). If that deadline expires the run is terminated and its partial output is not recoverable or resumable, so for a high-reasoning_effort or broad repo-grounded consult that may exceed it, prefer kimi_consult_async (a background job, built-in default 1800s deadline; poll kimi_job_status). Coarse notifications/progress streams while it blocks when your client requests it; some MCP clients background a long call before the deadline, so timeout_seconds bounds the run, not necessarily the inline wait — either way the detached run (meta.job_id) is recoverable via kimi_job_listkimi_job_statuskimi_job_result.

ParametersJSON Schema
NameRequiredDescriptionDefault
modelNoOverride the Kimi model slug for this call; defaults to the server/Kimi default when unset.
detailNoResponse verbosity: 'summary' (default) omits the raw model text; 'full' includes it.summary
questionYesThe question or prompt to send Kimi (a different model) for a read-only answer. Must be non-blank: empty or whitespace-only is rejected before any model call.
isolationNoWhich skills Kimi loads: 'inherit' (own user/project discovery) or 'ignore-skills' (empty dir). Built-ins load either way; this reduces loading, not isolation. Default: server-configured, per kimi_status. More: kimi://params.
extra_contextNoOptional author intent/background context, added as clearly-labeled UNTRUSTED prompt data. Redaction does NOT cover it — no live secrets. Full caveats and bounds: kimi://params.
workspace_rootNoAbsolute path to the target repo root — pass it to target the intended repo (MCP roots are unavailable); otherwise the call falls back to the server's own cwd and sets meta.workspace_warning.
idempotency_keyNoOptional dedup key scoped to THIS tool + workspace. Same key + same args replays the prior result with no new spend; different args are refused (idempotency_conflict). Sync and _async are separate tools and never share a key. Omit for none; retention is bounded. Lifecycle: kimi://params.
timeout_secondsNoPer-call wall-clock timeout in seconds, clamped to 10..600 (out-of-range values are coerced, not rejected). Defaults to the server's configured timeout.
reasoning_effortNoOverride the Kimi reasoning effort for this call (a model_reasoning_effort override); omit or pass null for the server default (MOONBRIDGE_REASONING_EFFORT) or Kimi's own resolution. An open, per-model string the backend validates at run time — commonly minimal|low|medium|high|xhigh; kimi_models lists each model's advertised set (advisory). Rejection and bounds detail: kimi://params.

Output Schema

ParametersJSON Schema
NameRequiredDescription
okYes

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Discloses far beyond the annotations: the read-only agent profile (no shell/write tool), the static-review limitation ('treat findings as unvalidated claims you verify yourself'), data egress of question and extra_context to the provider, best-effort redaction that does not cover typed inputs or files Kimi reads, AGENTS.md auto-loading with skills that can point outside the workspace, and timeout termination with unrecoverable partial output. The readOnlyHint=false annotation is consistent — the tool is read-only for files but is PAID and makes external calls — so the description adds context without contradicting the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with purpose, then cost, safety, data flow, and recovery — each paragraph carries a distinct critical topic with no filler. It is long (~380 words), but the length is largely earned given 9 params, paid quota, and external egress; minor redundancy exists where the description restates schema-level isolation/redaction notes.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a high-complexity tool (paid external call, 9 parameters, blocking timeout, async fallback, data egress), every operational concern is covered: preconditions, cost, safety profile, data handling, redaction limits, timeout/recovery, and when to route to the async sibling. The output schema covers return values, so the 'result envelope' mention suffices.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with rich per-parameter descriptions, so the baseline is 3; the description adds operational value on top: workspace_root targeting decision ('omit it for pure Q&A'), clamp/default semantics for timeout_seconds (10-600s, 300s default), isolation's non-suppression of built-ins/AGENTS.md, and redaction bounds for extra_context. It also cross-references kimi://params rather than duplicating full lifecycle details, which is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Opens with a specific verb+resource: 'Ask Kimi (a different model) for a read-only second opinion or answer,' which pinpoints the tool's role as a cross-model consult and distinguishes it from every sibling (not status, not delegate, not review_changes). It further disambiguates from kimi_consult_async by framing this as the synchronous, paid variant.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit preconditions and routing: 'run kimi_status (free) first to confirm the CLI is installed and authenticated,' and it states the no-dry-run limitation. For long or high-effort consults it names kimi_consult_async as the preferred alternative with concrete deadline numbers (300s vs 1800s), and provides a recovery chain via kimi_job_list/kimi_job_status/kimi_job_result. It also tells the caller when to pass workspace_root vs omit it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

kimi_consult_asyncConsult Kimi in background (paid)A

Ask Kimi for a read-only second opinion in the background; get a job_id back immediately instead of blocking.

PAID — this spends Kimi quota on every new call; there is no dry-run preview for a consult, so run kimi_status (free) first to confirm the CLI is installed and authenticated.

Same read-only behavior as kimi_consult (Kimi never edits files), but detached — prefer it for a high-reasoning_effort or broad repo-grounded consult that can exceed the synchronous deadline (built-in default 300s), since a sync run whose deadline expires loses its partial work; this job's own deadline is separately configured (built-in default 1800s). Starting a job commits to spend (it runs to completion or its wall-clock deadline even if you never poll). Poll kimi_job_status; read/consume the consult envelope with kimi_job_result/kimi_job_consume_result; stop with kimi_job_cancel.

Data egress: same as kimi_consult — sends your question and extra_context (raw, unredacted) to your configured provider via the kimi CLI, plus files Kimi reads from its resolved working directory (workspace_root, else the server cwd — MCP roots are unavailable). Kimi auto-loads the resolved workspace's AGENTS.md and discovers skills from its own config (including extra_skill_dirs, which may point outside the workspace).

Your inputs are sent raw and unredacted. Secret redaction is best-effort and covers the gathered diff and Kimi's returned output — not what you type, and not the files Kimi reads for itself.

ParametersJSON Schema
NameRequiredDescriptionDefault
modelNoOverride the Kimi model slug for this call; defaults to the server/Kimi default when unset.
questionYesThe question or prompt to send Kimi (a different model) for a read-only answer. Must be non-blank: empty or whitespace-only is rejected before any model call.
isolationNoWhich skills Kimi loads: 'inherit' (own user/project discovery) or 'ignore-skills' (empty dir). Built-ins load either way; this reduces loading, not isolation. Default: server-configured, per kimi_status. More: kimi://params.
extra_contextNoOptional author intent/background context, added as clearly-labeled UNTRUSTED prompt data. Redaction does NOT cover it — no live secrets. Full caveats and bounds: kimi://params.
workspace_rootNoAbsolute path to the target repo root — pass it to target the intended repo (MCP roots are unavailable); otherwise the call falls back to the server's own cwd and sets meta.workspace_warning.
idempotency_keyNoOptional dedup key scoped to THIS tool + workspace. Same key + same args replays the prior result with no new spend; different args are refused (idempotency_conflict). Sync and _async are separate tools and never share a key. Omit for none; retention is bounded. Lifecycle: kimi://params.
reasoning_effortNoOverride the Kimi reasoning effort for this call (a model_reasoning_effort override); omit or pass null for the server default (MOONBRIDGE_REASONING_EFFORT) or Kimi's own resolution. An open, per-model string the backend validates at run time — commonly minimal|low|medium|high|xhigh; kimi_models lists each model's advertised set (advisory). Rejection and bounds detail: kimi://params.

Output Schema

ParametersJSON Schema
NameRequiredDescription
okYes

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only provide coarse flags (readOnlyHint=false, idempotentHint=false), but the description reveals substantial behavioral context: it is paid and spends quota on every call, has no dry-run, commits to spend once started, has a separate 1800s default deadline, sends raw and unredacted inputs, auto-loads AGENTS.md, and has best-effort secret redaction. The phrase 'read-only' refers to Kimi not editing files, so it does not contradict readOnlyHint=false; the tool still has job and quota side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but appropriately so given the tool's side effects, cost, and lifecycle. It is front-loaded: purpose, paid warning, and sync-vs-async tradeoff appear first, followed by job lifecycle and data egress. Each paragraph adds necessary information and none is filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers purpose, cost, deadline behavior, lifecycle tools, data egress, workspace resolution, redaction limits, and parameter caveats. Since an output schema exists, return-value details are not needed in prose. An agent has everything needed to decide whether to call this tool and how to handle the resulting job.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all parameters and the baseline is 3. The description adds valuable operational semantics beyond the schema, especially for question and extra_context (sent raw and unredacted) and workspace_root (fallback to server cwd when MCP roots are unavailable). This extra context justifies a 4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Ask Kimi for a read-only second opinion in the background; get a job_id back immediately instead of blocking.' It also explicitly differentiates from kimi_consult by noting the same read-only behavior but detached execution. This makes the tool's purpose and distinction from siblings immediately clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit when-to-use guidance: prefer this async variant for high-reasoning_effort or broad repo-grounded consults that may exceed the 300s synchronous deadline. It also prescribes the surrounding workflow: run kimi_status first, poll kimi_job_status, consume via kimi_job_result, and cancel with kimi_job_cancel. This is strong routing and lifecycle guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

kimi_delegateDelegate a coding task (paid)A

Delegate a coding task to Kimi (a different model) in an isolated git worktree, and get back a reviewable diff that is NOT applied to your tree.

PAID — this spends Kimi quota on every new call; use kimi_delegate_dry_run or kimi_status (both free) first if you only need to check scope or readiness.

Kimi edits files with workspace-write, but only inside a throwaway worktree seeded from your current tracked state. The returned diff is Kimi's changes; review it, then apply it yourself if you want it. Requires a git repo with at least one commit. Pass workspace_root (absolute).

NETWORK IS NOT BLOCKED: kimi has no sandbox, so a delegated task CAN reach the network — it may git push/fetch, run gh, curl, publish, or install dependencies, and it runs shell commands with your own user's privileges. Scope tasks accordingly and review the returned diff before applying it; the diff shows what changed in the worktree, not what else the run did. The Kimi model call also sends your task to your configured provider and lets Kimi read tracked files in the worktree and send their content. Kimi auto-loads the resolved workspace's AGENTS.md and discovers skills from its own config (including extra_skill_dirs, which may point outside the workspace). Skill names and descriptions are exposed to the model up front, so that content can be sent even if your prompt never mentions it. The isolation setting does not suppress any of it: kimi's built-in skills always load, and AGENTS.md is read regardless.

Your inputs are sent raw and unredacted. Secret redaction is best-effort and covers the gathered diff and Kimi's returned output — not what you type, and not the files Kimi reads for itself.

Progress & recovery: blocks up to the resolved deadline (timeout_seconds, clamped 10-600s; when omitted, the server-configured value, built-in default 300s). If that deadline expires the run is terminated and its partial output is not recoverable or resumable, so for a substantial or multi-file task that may exceed it, prefer kimi_delegate_async (a background job, built-in default 1800s deadline; poll kimi_job_status). Coarse notifications/progress streams while it blocks when your client requests it; some MCP clients background a long call before the deadline, so timeout_seconds bounds the run, not necessarily the inline wait — either way the detached run (meta.job_id) is recoverable via kimi_job_listkimi_job_statuskimi_job_result.

ParametersJSON Schema
NameRequiredDescriptionDefault
taskYesThe coding task for Kimi to implement inside a throwaway git worktree; the resulting diff is returned for review, not applied to your tree. Must be non-blank: empty or whitespace-only is rejected before any model call.
modelNoOverride the Kimi model slug for this call; defaults to the server/Kimi default when unset.
detailNoResponse verbosity: 'summary' (default) omits the raw model text; 'full' includes it.summary
isolationNoWhich skills Kimi loads: 'inherit' (own user/project discovery) or 'ignore-skills' (empty dir). Built-ins load either way; this reduces loading, not isolation. Default: server-configured, per kimi_status. More: kimi://params.
workspace_rootNoAbsolute path to the target repo root — pass it to target the intended repo (MCP roots are unavailable); otherwise the call falls back to the server's own cwd and sets meta.workspace_warning.
idempotency_keyNoOptional dedup key scoped to THIS tool + workspace. Same key + same args replays the prior result with no new spend; different args are refused (idempotency_conflict). Sync and _async are separate tools and never share a key. Omit for none; retention is bounded. Lifecycle: kimi://params.
timeout_secondsNoPer-call wall-clock timeout in seconds, clamped to 10..600 (out-of-range values are coerced, not rejected). Defaults to the server's configured timeout.
reasoning_effortNoOverride the Kimi reasoning effort for this call (a model_reasoning_effort override); omit or pass null for the server default (MOONBRIDGE_REASONING_EFFORT) or Kimi's own resolution. An open, per-model string the backend validates at run time — commonly minimal|low|medium|high|xhigh; kimi_models lists each model's advertised set (advisory). Rejection and bounds detail: kimi://params.

Output Schema

ParametersJSON Schema
NameRequiredDescription
okYes

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description goes far beyond annotations. It discloses the paid/quota cost, the non-blocked network and lack of sandbox, execution with the user's own privileges, that AGENTS.md and skills are loaded even with isolation settings, raw input exposure, best-effort redaction limits, timeout/deadline behavior, and non-recoverable partial output. Annotations already mark readOnlyHint=false and openWorldHint=true, and the description expands on that meaningfully.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense and information-rich, with critical facts front-loaded: the headline diff-not-applied behavior, the paid cost, and the free alternatives. It is longer than average, but every section covers high-stakes facts an agent needs before invoking a paid, un-sandboxed, potentially network-accessible tool. Slight structural improvement could consolidate the warnings, but overall it is well organized with clear topic shifts.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's genuine complexity, a high-stakes paid model delegation with 8 parameters, no sandbox, and many sibling alternatives, the description covers prerequisites, cost, security boundaries, failure modes, timeouts, recovery paths, and routing to async variants. An output schema exists, so the description need not enumerate return values. This is as complete as an agent could reasonably need.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents each parameter. However, the description adds context beyond the schema, especially for workspace_root (MCP roots unavailable, fallback to server cwd, workspace_warning), isolation (built-ins load either way), idempotency_key (scoped to tool+workspace, replay semantics, conflict refusal), and timeout_seconds (clamping behavior). It also explains how parameters relate to runtime behavior (e.g., timeout_seconds bounds the run, not necessarily the inline wait).

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb (delegate), resource (a coding task to Kimi), and the key behavioral outcome (a reviewable diff that is not applied to the tree). It is clearly distinguished from siblings by naming alternatives like kimi_delegate_dry_run, kimi_status, and kimi_delegate_async.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says when to use the tool (when you want Kimi to implement a coding task and inspect the diff before applying), when to avoid it (for mere scope/readiness checks, use kimi_delegate_dry_run/kimi_status), and when to use an alternative (kimi_delegate_async for substantial tasks likely to exceed the deadline). It also notes the workspace_root requirement and the prerequisite of a git repo with at least one commit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

kimi_delegate_asyncDelegate in background (paid)A

Delegate a coding task to Kimi in the background and get a job_id back immediately (does not block on the run).

PAID — this spends Kimi quota on every new call; use kimi_delegate_dry_run or kimi_status (both free) first if you only need to check scope or readiness.

Same propose-tier behavior as kimi_delegate — Kimi works in a throwaway git worktree and the result carries a reviewable diff that is NOT applied — but detached; prefer it for a substantial or multi-file implementation task that can exceed the synchronous deadline (built-in default 300s), since a sync run whose deadline expires loses its partial work (this job's own deadline is separately configured, built-in default 1800s). Starting a job commits to spend (it runs to completion or its wall-clock deadline even if you never poll). Poll kimi_job_status; read/consume with kimi_job_result/kimi_job_consume_result; stop with kimi_job_cancel. Requires a git repo with at least one commit; pass workspace_root (absolute).

NETWORK IS NOT BLOCKED: like kimi_delegate, this has no sandbox — a delegated task CAN push, fetch, install dependencies, or call out, running with your own user's privileges. Scope tasks accordingly and review the returned diff before applying it. The Kimi model call also sends your task (raw) to your configured provider and lets Kimi read tracked files in the worktree and send their content.

Kimi auto-loads the resolved workspace's AGENTS.md and discovers skills from its own config (including extra_skill_dirs, which may point outside the workspace).

Secret redaction is best-effort and does not cover your task or the files Kimi reads for itself.

ParametersJSON Schema
NameRequiredDescriptionDefault
taskYesThe coding task for Kimi to implement inside a throwaway git worktree; the resulting diff is returned for review, not applied to your tree. Must be non-blank: empty or whitespace-only is rejected before any model call.
modelNoOverride the Kimi model slug for this call; defaults to the server/Kimi default when unset.
isolationNoWhich skills Kimi loads: 'inherit' (own user/project discovery) or 'ignore-skills' (empty dir). Built-ins load either way; this reduces loading, not isolation. Default: server-configured, per kimi_status. More: kimi://params.
workspace_rootNoAbsolute path to the target repo root — pass it to target the intended repo (MCP roots are unavailable); otherwise the call falls back to the server's own cwd and sets meta.workspace_warning.
idempotency_keyNoOptional dedup key scoped to THIS tool + workspace. Same key + same args replays the prior result with no new spend; different args are refused (idempotency_conflict). Sync and _async are separate tools and never share a key. Omit for none; retention is bounded. Lifecycle: kimi://params.
reasoning_effortNoOverride the Kimi reasoning effort for this call (a model_reasoning_effort override); omit or pass null for the server default (MOONBRIDGE_REASONING_EFFORT) or Kimi's own resolution. An open, per-model string the backend validates at run time — commonly minimal|low|medium|high|xhigh; kimi_models lists each model's advertised set (advisory). Rejection and bounds detail: kimi://params.

Output Schema

ParametersJSON Schema
NameRequiredDescription
okYes

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses far more than annotations could: it is paid, spends quota on every new call, runs without a sandbox, can push/fetch/install with user privileges, sends the raw task to the provider, reads tracked files, auto-loads AGENTS.md, and only best-effort redacts secrets. It also explains that the job runs to completion or its deadline even if never polled. No contradiction with annotations exists.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Despite being long, every sentence earns its place: purpose is front-loaded, then cost, sync-vs-async tradeoff, lifecycle, requirements, network risk, data handling, and redaction limits. The paragraph structure uses bold semantic labels and makes the critical operational and safety facts scannable without fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given that this is a paid, asynchronous, side-effectful operation, the description is operationally complete. It covers what is returned (job_id), how the result is delivered (reviewable diff not applied), how to poll/consume/cancel, prerequisites (git repo with at least one commit), deadlines, sandbox absence, and data exposure. An output schema exists, so return-value details are not the description's burden.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and each parameter is already well-documented in the schema. The description reinforces key usage points such as passing an absolute workspace_root and using idempotency_key to replay without new spend, but it does not add substantial new parameter-level meaning beyond the schema's own descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Opens with a specific verb-plus-resource statement: 'Delegate a coding task to Kimi in the background and get a job_id back immediately.' It clearly separates this from kimi_delegate (sync) and explicitly names related sibling tools for follow-up, so an agent can distinguish it without opening schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit when-to-use guidance: prefer this for substantial/multi-file tasks that may exceed the 300s sync deadline, and use free tools (kimi_delegate_dry_run, kimi_status) first for scope/readiness checks. It also names the companion tools for polling, consuming, and canceling, leaving no ambiguity about the operational workflow.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

kimi_delegate_dry_runPreview a delegate (free)A
Read-only

Preview what a kimi_delegate/kimi_delegate_async call would do — the baseline it seeds from (HEAD commit, tracked file count/size, uncommitted and untracked counts), the prompt size that would be sent, and the resolved workspace/isolation. Free — no model call, no spend, no worktree created.

Use it before delegating to confirm scope and repo before committing to cost, exactly as kimi_dry_run previews kimi_review_changes. Mirrors the real delegate's zero-spend validation (workspace, isolation, task size, git repo), so a failure here is a failure the paid call would also hit. The returned tier/sandbox describe the previewed propose run, not this read-only preview; the result echoes the effective model/reasoning_effort overrides the paid call would send (unvalidated). deadline_advisory is non-null when size or reasoning effort risks the synchronous deadline and names kimi_delegate_async verbatim — the async counterpart of the previewed call, not of this dry-run tool. A hint, not a refusal.

ParametersJSON Schema
NameRequiredDescriptionDefault
taskYesThe coding task you want Kimi to implement via a real kimi_delegate call; this dry run only previews the seeded baseline and prompt size — it does NOT call Kimi or return a diff. Must be non-blank: empty or whitespace-only is rejected here too, not previewed.
modelNoThe Kimi model slug the previewed paid call would use; defaults to the server default (MOONBRIDGE_MODEL) when unset, so the preview mirrors the paid call's resolution. This dry run does not call Kimi or validate the model.
isolationNoWhich skills Kimi loads: 'inherit' (own user/project discovery) or 'ignore-skills' (empty dir). Built-ins load either way; this reduces loading, not isolation. Default: server-configured, per kimi_status. More: kimi://params.
workspace_rootNoAbsolute path to the target repo root — pass it to target the intended repo (MCP roots are unavailable); otherwise the call falls back to the server's own cwd and sets meta.workspace_warning.
reasoning_effortNoThe reasoning effort the previewed paid call would send (as a `model_reasoning_effort` config override); defaults to the server default (MOONBRIDGE_REASONING_EFFORT) when unset, so the preview mirrors the paid call's resolution. This dry run does not call Kimi or validate the value beyond the paid params' shape bounds (no control or surrogate characters, ≤128 chars).

Output Schema

ParametersJSON Schema
NameRequiredDescription
okYes

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description goes well beyond the readOnlyHint annotation by detailing exactly what happens and what does not: no model call, no spend, no worktree created. It also transparently explains subtle return semantics — tier/sandbox describe the previewed run, overrides are unvalidated, and deadline_advisory is only a hint — which prevents misinterpreting the tool's output.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long, but it is information-dense and front-loaded with the most critical facts (free, no model call, no spend, no worktree). The caveats about tier/sandbox, overrides, and deadline_advisory are valuable and earn their place, though a slightly tighter structure would improve scannability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a preview tool with an output schema, the description completely covers the behavioral contract: what is previewed, what is not, validation parity with the paid call, and the meaning of special return fields. It even resolves potential confusion about deadline_advisory naming the async counterpart. Nothing critical is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Input schema description coverage is 100%, so the schema already fully documents every parameter. The description adds useful context about the previewed call's resolutions, but it does not need to compensate for schema gaps. Baseline 3 is appropriate here.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description identifies a specific action ('Preview what a kimi_delegate/kimi_delegate_async call would do'), names the exact resources involved (HEAD commit, file counts, prompt size, workspace/isolation), and distinguishes this tool from related siblings like kimi_dry_run. The 'exactly as kimi_dry_run previews kimi_review_changes' analogy makes the purpose immediately recognizable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description says explicitly when to use it: 'Use it before delegating to confirm scope and repo before committing to cost.' It also states that a failure here mirrors a failure the paid call would hit, giving the agent a concrete preflight decision rule. It names the paid counterparts (kimi_delegate/kimi_delegate_async) and the analogous dry-run sibling.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

kimi_dry_runPreview a review (free)A
Read-only

Preview what a kimi_review_changes call would send — scope, diff size, redactions, truncation. Free — no model call, no spend. Use it before a review to inspect the scope and the reported redactions; redaction is best-effort, so treat the preview as a check on scope, not as confirmation that no secret remains. Pass the same extra_context and untracked policy you would give the review so the preview matches it. would_call_model reports whether the paid call would actually run the model (False on an empty diff, where prompt_bytes is 0), and coverage discloses omitted untracked files just as the review would. The result echoes the effective model/reasoning_effort overrides the paid call would send (unvalidated). deadline_advisory is non-null when size or effort risks the synchronous deadline (null whenever would_call_model is False) and names kimi_review_changes_async verbatim — the async counterpart of the previewed call, not of this dry-run tool. A hint, not a refusal.

ParametersJSON Schema
NameRequiredDescriptionDefault
baseNoBase git ref for scope='branch'; the review covers base...HEAD.
modelNoThe Kimi model slug the previewed paid call would use; defaults to the server default (MOONBRIDGE_MODEL) when unset, so the preview mirrors the paid call's resolution. This dry run does not call Kimi or validate the model.
pathsNoRepo-relative paths to narrow the review ('/' separators, no '..'); omit to review all changes in scope.
scopeNoWhich changes to review: 'working_tree' (tracked changes vs HEAD; untracked files follow the `untracked` policy, off by default), 'branch' (needs base), or 'commit' (needs commit).working_tree
commitNoCommit SHA or ref to review for scope='commit'.
isolationNoWhich skills Kimi loads: 'inherit' (own user/project discovery) or 'ignore-skills' (empty dir). Built-ins load either way; this reduces loading, not isolation. Default: server-configured, per kimi_status. More: kimi://params.
untrackedNoHow working_tree scope treats untracked files: 'explicit_only' (default) includes only those named in `paths`; 'include' reviews all non-ignored untracked files (SENDS their contents to your configured provider — opt-in egress); 'exclude' includes none. Omitted ones are disclosed in `coverage`. Inert for branch/commit scopes.explicit_only
extra_contextNoOptional author intent/background context, added as clearly-labeled UNTRUSTED prompt data. Redaction does NOT cover it — no live secrets. Full caveats and bounds: kimi://params.
workspace_rootNoAbsolute path to the target repo root — pass it to target the intended repo (MCP roots are unavailable); otherwise the call falls back to the server's own cwd and sets meta.workspace_warning.
reasoning_effortNoThe reasoning effort the previewed paid call would send (as a `model_reasoning_effort` config override); defaults to the server default (MOONBRIDGE_REASONING_EFFORT) when unset, so the preview mirrors the paid call's resolution. This dry run does not call Kimi or validate the value beyond the paid params' shape bounds (no control or surrogate characters, ≤128 chars).

Output Schema

ParametersJSON Schema
NameRequiredDescription
okYes

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint: true, so the 'Free — no model call, no spend' claim is consistent. The description goes beyond the annotation by detailing effective behavior: would_call_model is False on empty diff, prompt_bytes is 0, coverage discloses omitted untracked files, model/reasoning_effort are echoed unvalidated, and deadline_advisory is non-null only when size/effort risks the synchronous deadline. This meaningfully explains what the call will do and what side effects (none) it has, though some behaviors are described at a high level. No contradiction with the read-only/hint annotations exists.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but informational; it front-loads the core purpose in the first sentence and the free/no-spend trait. Each sentence adds a distinct behavioral fact (would_call_model, coverage, unvalidated overrides, deadline_advisory). It is not tautological or bloated, but it is verbose and could be tightened around the deadline_advisory/async sentence. The structure earns a 4 not a 5 because some sentences are dense enough to require rereading, though all of them earn their place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is complete for an agent to invoke correctly: it names the sibling alternatives, explains the free/read-only behavior, explains the return value semantics (would_call_model, prompt_bytes, coverage, deadline_advisory) even though an output schema exists, and it adheres to the annotation profile. For a 10-parameter tool with 100% schema coverage, the description fills the gaps the schema can't — when to use it, what the preview can't guarantee (redaction), and how parameters should be passed to match the paid call. No missing information for selecting or invoking this tool is apparent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents every parameter. However, the description adds important cross-parameter guidance: 'Pass the same extra_context and untracked policy you would give the review so the preview matches it', and it explains that model/reasoning_effort mirror the paid call's defaults. It also explains the relationship between deadline_advisory and would_call_model, which the schema alone does not convey. Slightly above the baseline 3 because the description explains how parameters interact, though it does not restate individual parameter meanings from the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Preview what a kimi_review_changes call would send') plus a concrete resource (the review call's scope, diff size, redactions, truncation). It names the sibling it is not ('async counterpart of the previewed call, not of this dry-run tool') and distinguishes it from kimi_review_changes. This allows an agent to tell it apart from both the paid review and the dry-run sibling without opening schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says 'Use it before a review to inspect the scope and the reported redactions', provides a concrete precondition, and warns about the redaction limitation. It also says to 'Pass the same extra_context and untracked policy you would give the review so the preview matches it', which is a direct how-to for correct invocation. The 'not a refusal' closing phrase clarifies the advisory hint semantics, further guiding use.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

kimi_job_cancelCancel a job (free)A
Idempotent

Cancel a running background Kimi job.

Asks the worker to shut down gracefully so it tears down its throwaway worktree, then force-kills it if it overstays, and marks the job cancelled (cancelled jobs cannot be resumed). If the worktree could not be removed, cleanup_warnings names the leftover path. Already-terminal jobs are returned unchanged, so cancel is idempotent — a retry after a lost response is safe. Free — no model call.

ParametersJSON Schema
NameRequiredDescriptionDefault
job_idYesThe job_id from an *_async call or a sync call's meta.job_id; recover lost ids with kimi_job_list.
workspace_rootNoAbsolute path to the target repo root — pass it to target the intended repo (MCP roots are unavailable); otherwise the call falls back to the server's own cwd and sets meta.workspace_warning.

Output Schema

ParametersJSON Schema
NameRequiredDescription
okYes

TDQS

A4.3/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses far beyond the annotations: the graceful-shutdown-then-force-kill lifecycle, teardown of a throwaway worktree, non-resumability of cancelled jobs, cleanup_warnings for leftover paths, idempotent retry safety, and the 'free — no model call' cost profile. This aligns with and enriches readOnlyHint=false and idempotentHint=true with no contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The purpose is front-loaded in the first sentence, and each subsequent sentence earns its place by covering a distinct behavioral facet: shutdown process, force-kill fallback, non-resumably, cleanup warnings, idempotency, and cost. It is dense but not bloated; only a small trim would tighten it further.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With a 100%-covered schema, an output schema present, and annotations covering idempotency and destructiveness, the description still adds substantial context: lifecycle, edge cases (terminal jobs, cleanup failure), and retry safety. The only untold edge case is behavior for a genuinely unknown job id, which is a minor gap given how much is already covered.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and the schema itself is unusually rich: job_id explains where to find it and how to recover lost ids via kimi_job_list, and workspace_root explains the MCP-roots fallback and workspace_warning behavior. The description adds no parameter-level meaning beyond the schema, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening sentence states a specific verb (Cancel) and resource (a running background Kimi job), making the tool's function immediately unambiguous. It is plainly distinct from sibling tools like kimi_job_status, kimi_job_result, and kimi_job_list, none of which perform cancellation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear usage context: it applies to running jobs, and the statement that already-terminal jobs are returned unchanged effectively defines when the tool adds no value. It explicitly names kimi_job_list as the recovery path for lost job ids. It stops short of an explicit when-not statement against sibling status/result tools, but cancellation is unique among the siblings, so little exclusion guidance is needed.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

kimi_job_consume_resultFetch and delete job result (free)A

Fetch a finished background Kimi job's result and delete the stored record.

Same envelope as kimi_job_result (matching the job's kind — branch on tool), then removes completed job state — but only once the stored result has been read intact and validated (a success or the job's own error envelope): a stored result this release cannot read (job_result_incompatible or a corruption internal_error) is NOT deleted, so it stays inspectable via kimi_job_result. Deletion precedes the response, so a response lost in transit does not restore the record; a failed removal retains the record until its TTL (kimi_job_status still shows it). Use only when you no longer need to poll or re-read the job. Non-done jobs are not deleted. Free — no model call.

detail works as in kimi_job_result (#56).

ParametersJSON Schema
NameRequiredDescriptionDefault
detailNoResponse verbosity: 'summary' (default) omits the raw model text; 'full' includes it.summary
job_idYesThe job_id from an *_async call or a sync call's meta.job_id; recover lost ids with kimi_job_list.
workspace_rootNoAbsolute path to the target repo root — pass it to target the intended repo (MCP roots are unavailable); otherwise the call falls back to the server's own cwd and sets meta.workspace_warning.

Output Schema

ParametersJSON Schema
NameRequiredDescription
okYestrue = success result, false = error result

TDQS

A3.9/5.0
Behavior1/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The prose is extremely transparent: deletion conditions, ordering relative to the response, TTL retention on failed removal, and non-done behavior are all described. However, the annotations declare destructiveHint=false while the description says the tool 'deletes the stored record' and 'removes completed job state.' This is a direct contradiction, so the dimension must be scored 1 per the rubric.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but information-dense; every sentence contributes a distinct operational fact. It front-loads the core purpose and then uses a tight paragraph for deletion semantics, making the structure appropriate for the behavioral complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the output schema exists and the input schema is fully documented, the description covers all the remaining behavioral context an agent needs: when deletion happens, what is retained on incompatible/corrupt results, what happens if removal fails, and that non-done jobs are untouched. Nothing material is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already documents all three parameters, including the detail enum's summary/full semantics and job_id provenance, so schema coverage is 100%. The description adds minimal parameter-specific meaning beyond a cross-reference to kimi_job_result for detail; it does not need to compensate, so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb-resource pair: 'Fetch a finished background Kimi job's result and delete the stored record.' It also distinguishes itself from the sibling kimi_job_result by emphasizing deletion and one-shot consumption, so an agent can tell them apart immediately.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly states when to use it ('Use only when you no longer need to poll or re-read the job') and what it does not do ('Non-done jobs are not deleted'). It names the analogous envelope of kimi_job_result and clarifies the free/no-model-call behavior, giving clear selection context among siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

kimi_job_listList background jobs (free)A
Read-only

List the background jobs known for this workspace, newest first.

Free — no model call. Use to recover job_ids lost across context compaction or interruption. Returns each job's id, kind, status, start time, result_available, result_ok (a done job's outcome — true/false/null; see kimi_job_status), and expiry, so a stored failure is triageable without fetching each result.

Returns every retained job by default; pass limit (1-1000) or status to narrow. They narrow independently — omitting limit returns every job matching status, not every job. Only an explicit limit truncates: when more jobs match, the response sets truncated: true with a truncation_hint — the extra rows are dropped, not paged, so omit limit to get them all rather than looking for a cursor.

Read a job's result promptly — a finished record can silently drop off. This list is not permanent storage: terminal records expire after the TTL (default 24h), and a per-workspace soft cap (default 50, clamped 1-1000) evicts the oldest terminal records as new jobs start, so a finished job can disappear even before its expires_at. Running jobs are never evicted, so a busy workspace can hold more than the cap — and more than limit's 1000 ceiling. Includes sync-originated records (any sync consult/review/delegate call); the cap/TTL eviction covers both.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum jobs to return, newest first (1-1000). Omit (or pass null) to return every retained job that matches — the default; it caps nothing, and does not override `status`. Only an explicit limit truncates: then the response sets truncated=true and the extra rows are dropped.
statusNoReturn only jobs in this lifecycle state ('running', 'done', 'failed', 'cancelled', 'timeout'); omit for all states.
workspace_rootNoAbsolute path to the target repo root — pass it to target the intended repo (MCP roots are unavailable); otherwise the call falls back to the server's own cwd and sets meta.workspace_warning.

Output Schema

ParametersJSON Schema
NameRequiredDescription
okYes

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes far beyond the readOnlyHint annotation by disclosing TTL/eviction behavior, the soft cap of 50, eviction order, running-job exemption, truncation behavior, filter independence, and inclusion of sync-originated records. This is rich behavioral context that annotations alone do not provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Long but dense and front-loaded with purpose and cost. Each paragraph covers a distinct behavioral concern, and there is no filler or repetition beyond what is needed to prevent common misuse. The structure earns its length.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Provides everything an agent needs to call and interpret this tool correctly: return field overview, defaults, filter interactions, truncation semantics, expiry/eviction caveats, and a pointer to kimi_job_status for result_ok interpretation. With an output schema present, detailed return values are handled elsewhere, so no critical gap remains.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Although schema descriptions already cover all three parameters, the description adds crucial semantics not visible in the schema: limit and status narrow independently, omitted limit returns every matching job, a single explicit limit truncates and drops rows rather than paging, and there is no cursor to follow. This materially improves correct invocation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States exactly what the tool does: lists background jobs for a workspace, newest first, and explicitly notes it is free with no model call. It also names the key returned fields and implies the distinction from sibling job tools by saying stored failures are triageable without fetching each result.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives a concrete use case: recover job_ids lost across context compaction or interruption. It also references kimi_job_status for result_ok semantics and advises reading results promptly, which implies when deeper inspection is needed. It does not explicitly tell the agent to use kimi_job_result for full results, so a small exclusionary detail is missing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

kimi_job_resultFetch job result (free)A
Read-only

Fetch a finished background Kimi job's result WITHOUT deleting the record.

Works for any async job or sync consult/review/delegate (whose meta.job_id names its record) — kimi_delegate_async (a diff), kimi_consult_async (a consult answer), or kimi_review_changes_async (a review with verdict). Use when kimi_job_status reports result_available=true; the envelope matches the job's kind, so branch on tool. meta.job_id is set. A still-running/cancelled/timed- out/failed job returns an error envelope — as does a done job whose stored result this release cannot read (job_result_incompatible). To fetch and delete, use kimi_job_consume_result. Free — no model call.

detail="summary" (default) omits the raw model text; pass detail="full" for the complete raw output and metadata (#56).

ParametersJSON Schema
NameRequiredDescriptionDefault
detailNoResponse verbosity: 'summary' (default) omits the raw model text; 'full' includes it.summary
job_idYesThe job_id from an *_async call or a sync call's meta.job_id; recover lost ids with kimi_job_list.
workspace_rootNoAbsolute path to the target repo root — pass it to target the intended repo (MCP roots are unavailable); otherwise the call falls back to the server's own cwd and sets meta.workspace_warning.

Output Schema

ParametersJSON Schema
NameRequiredDescription
okYestrue = success result, false = error result

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, and the description adds meaningful behavioral context: the call does not delete the record, failure modes include job_result_incompatible for unreadable stored results, the envelope matches the job kind so callers should branch on 'tool', and the operation is free with no model call. These details go well beyond the annotation alone.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core behavior and non-destructive guarantee, then efficiently covers usage conditions, failure modes, and the alternative deletion tool. Every sentence adds distinct value, and the detail parameter behavior is explained compactly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the presence of an output schema, the description need not restate return values. It covers when to call, what kinds of jobs are supported, how to branch on the result, failure scenarios, the deletion alternative, and the detail option, making it fully contextual for an agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and the schema already documents job_id, detail, and workspace_root with equivalent semantics. The description reinforces the 'summary'/'full' detail distinction but does not materially add parameter meaning beyond what the input schema provides, so a baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource: 'Fetch a finished background Kimi job's result WITHOUT deleting the record.' It clearly distinguishes itself from kimi_job_consume_result and enumerates which async/sync job kinds it applies to, making sibling differentiation straightforward.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use this tool ('Use when kimi_job_status reports result_available=true'), when not to use it (running/cancelled/timed-out/failed jobs), and which alternative to prefer when deletion is desired (kimi_job_consume_result). This leaves no ambiguity about tool selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

kimi_job_statusCheck job status (free)A
Read-only

Check a background job's lifecycle state without fetching the full result.

Use after any *_async call (kimi_delegate_async, kimi_consult_async, kimi_review_changes_async) or any sync consult/review/delegate (whose meta.job_id names its record). Returns status, elapsed time, expiry, and result_available; when it is true, call kimi_job_result. result_ok reports a done job's producer-declared outcome — true (success), false (a stored error envelope), or null (running, no stored envelope, an unclassifiable payload, or a record finalized before this field) — so you can spot a stored FAILURE without fetching it. It does not guarantee the payload is still fetchable; a cross-release record may report an outcome yet fail kimi_job_result with job_result_incompatible. Free — no model call.

Honor poll_after_ms between polls — for a running job it GROWS with elapsed runtime (bounded), so following it backs you off instead of tight-looping (a delegate often runs ~20s). expires_at is null while running and is set once the job finishes; results are then retained ttl_seconds past that completion.

ParametersJSON Schema
NameRequiredDescriptionDefault
job_idYesThe job_id from an *_async call or a sync call's meta.job_id; recover lost ids with kimi_job_list.
workspace_rootNoAbsolute path to the target repo root — pass it to target the intended repo (MCP roots are unavailable); otherwise the call falls back to the server's own cwd and sets meta.workspace_warning.

Output Schema

ParametersJSON Schema
NameRequiredDescription
okYes

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Despite readOnlyHint=true, the description adds substantial non-obvious behavior: result_ok's three-state semantics, the possibility of job_result_incompatible on cross-release records, poll_after_ms backing off, expires_at lifecycle, and ttl retention. It also notes it is free/no model call. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Long but dense and front-loaded: purpose, then usage, then state semantics, then polling protocol. Every sentence carries behavioral or routing information; the parentheticals ('a delegate often runs ~20s') are relevant, not filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a polling/status tool with complex lifecycle semantics, the description covers the full call path (when to poll, what fields mean, when to escalate to kimi_job_result, edge cases like incompatible payloads). Output schema exists, so return-value detail is not required here.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Input schema coverage is 100% and both parameter descriptions are already complete; the tool description restates job_id's origin but adds no new meaning for the input parameters. The poll_after_ms discussion is output behavior, not an input parameter, so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The first sentence uses a specific verb and resource ('Check a background job's lifecycle state') and immediately differentiates from kimi_job_result with 'without fetching the full result.' It also names the async/sync origins of job_id, making it unmistakable which call is being described.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says to use after any *_async call or sync consult/review/delegate whose meta.job_id names the record, tells the agent to call kimi_job_result when result_available is true, and instructs honoring poll_after_ms. This is clear when-to-use guidance with named alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

kimi_modelsList Kimi models (free)A
Read-only

List Kimi model slugs you can pass as model, with each model's advertised reasoning-effort set for reasoning_effort. Free — no model call.

Advisory discovery only: read from Kimi's on-disk cache when present, else a bundled fallback (source says which; the fallback carries no effort data). The kimi CLI validates the real slug and the backend validates the real effort, so an unlisted value may still work and a listed one may be unavailable to your account. Same payload as the kimi://models resource. Not fingerprint-stable — do not cache it by the capabilities fingerprint.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
okYes

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnlyHint annotation, it discloses the data source (on-disk cache vs bundled fallback), that the fallback lacks effort data, that the real CLI/backend validate values, and that the payload is identical to kimi://models while not being fingerprint-stable. This is far more behavioral context than the annotation provides.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The core statement is front-loaded and every sentence adds information, but the middle sentences are dense with caveats and parentheticals (cache source, fallback data, validation behavior). It is efficient but slightly more complex than necessary.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no parameters, an output schema present, and a readOnly annotation, the description covers all decision-relevant behavior: free/no call, sources, validation caveats, payload equivalence, and cacheability. Nothing needed for correct invocation is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so there is nothing to document; baseline is 4. The description still adds relevant semantic value by explaining how the returned slugs/effort values are meant to be used as `model` and `reasoning_effort` in other calls.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description starts with a concrete verb and object: 'List Kimi model slugs you can pass as `model`' and specifies the output includes each model's advertised reasoning-effort set for `reasoning_effort`. This makes the tool's function unambiguous and clearly distinct from siblings like kimi_status or kimi_capabilities.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides clear context: 'Free — no model call', 'Advisory discovery only', and warns not to cache by fingerprint. It does not explicitly name alternative tools or state when not to use it, so it stops just short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

kimi_review_changesReview git changes (paid)A

Ask Kimi (a different model) to review your git changes for an independent second opinion.

PAID — this spends Kimi quota on every new call; use kimi_dry_run or kimi_status (both free) first if you only need to check scope or readiness.

scope: working_tree (tracked changes vs HEAD — untracked files follow the untracked policy and are NOT reviewed by default), branch (needs base, reviews base...HEAD), or commit (needs a commit SHA). The diff is gathered, secret- redacted, and bounded by this server; Kimi reviews it read-only and returns structured findings. Pass workspace_root (absolute) for the right repo. Optional extra_context (author intent, bounded like the diff) cuts false positives.

The result's top-level review_status and coverage disclose whether the model actually ran and what it was shown: a pass over partial coverage is surfaced as unknown, and a tree with nothing reviewable returns not_run, never a pass.

STATIC review, not a verify mode: the read-only agent profile gives Kimi no shell and no write tool, so it cannot run the project's checks to confirm its findings — treat them as unvalidated claims you verify yourself before acting.

Data egress: this sends the gathered diff to your configured provider via the kimi CLI. The diff is secret-redacted (best-effort), but your extra_context is sent raw (unredacted), Kimi auto-loads the resolved workspace's AGENTS.md and discovers skills from its own config (including extra_skill_dirs, which may point outside the workspace). Skill names and descriptions are exposed to the model up front, so that content can be sent even if your prompt never mentions it. The isolation setting does not suppress any of it: kimi's built-in skills always load, and AGENTS.md is read regardless.

Your inputs are sent raw and unredacted. Secret redaction is best-effort and covers the gathered diff and Kimi's returned output — not what you type, and not the files Kimi reads for itself.

Progress & recovery: blocks up to the resolved deadline (timeout_seconds, clamped 10-600s; when omitted, the server-configured value, built-in default 300s). If that deadline expires the run is terminated and its partial output is not recoverable or resumable, so for a multi-file or whole-branch review that may exceed it, prefer kimi_review_changes_async (a background job, built-in default 1800s deadline; poll kimi_job_status). Coarse notifications/progress streams while it blocks when your client requests it; some MCP clients background a long call before the deadline, so timeout_seconds bounds the run, not necessarily the inline wait — either way the detached run (meta.job_id) is recoverable via kimi_job_listkimi_job_statuskimi_job_result.

ParametersJSON Schema
NameRequiredDescriptionDefault
baseNoBase git ref for scope='branch'; the review covers base...HEAD.
modelNoOverride the Kimi model slug for this call; defaults to the server/Kimi default when unset.
pathsNoRepo-relative paths to narrow the review ('/' separators, no '..'); omit to review all changes in scope.
scopeNoWhich changes to review: 'working_tree' (tracked changes vs HEAD; untracked files follow the `untracked` policy, off by default), 'branch' (needs base), or 'commit' (needs commit).working_tree
commitNoCommit SHA or ref to review for scope='commit'.
detailNoResponse verbosity: 'summary' (default) omits the raw model text; 'full' includes it.summary
isolationNoWhich skills Kimi loads: 'inherit' (own user/project discovery) or 'ignore-skills' (empty dir). Built-ins load either way; this reduces loading, not isolation. Default: server-configured, per kimi_status. More: kimi://params.
untrackedNoHow working_tree scope treats untracked files: 'explicit_only' (default) includes only those named in `paths`; 'include' reviews all non-ignored untracked files (SENDS their contents to your configured provider — opt-in egress); 'exclude' includes none. Omitted ones are disclosed in `coverage`. Inert for branch/commit scopes.explicit_only
extra_contextNoOptional author intent/background context, added as clearly-labeled UNTRUSTED prompt data. Redaction does NOT cover it — no live secrets. Full caveats and bounds: kimi://params.
workspace_rootNoAbsolute path to the target repo root — pass it to target the intended repo (MCP roots are unavailable); otherwise the call falls back to the server's own cwd and sets meta.workspace_warning.
idempotency_keyNoOptional dedup key scoped to THIS tool + workspace. Same key + same args replays the prior result with no new spend; different args are refused (idempotency_conflict). Sync and _async are separate tools and never share a key. Omit for none; retention is bounded. Lifecycle: kimi://params.
timeout_secondsNoPer-call wall-clock timeout in seconds, clamped to 10..600 (out-of-range values are coerced, not rejected). Defaults to the server's configured timeout.
reasoning_effortNoOverride the Kimi reasoning effort for this call (a model_reasoning_effort override); omit or pass null for the server default (MOONBRIDGE_REASONING_EFFORT) or Kimi's own resolution. An open, per-model string the backend validates at run time — commonly minimal|low|medium|high|xhigh; kimi_models lists each model's advertised set (advisory). Rejection and bounds detail: kimi://params.

Output Schema

ParametersJSON Schema
NameRequiredDescription
okYes

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Despite annotations only giving readOnlyHint=false/openWorldHint=true/idempotentHint=false/destructiveHint=false (no safety assertions), the description discloses extensively: it spends Kimi quota, sends the diff to the provider, secret-redaction is best-effort and does NOT cover extra_context or user inputs, AGENTS.md and skills are auto-loaded regardless of isolation, results can be lost on timeout (not recoverable/resumable), and review_status/coverage disclose partial/not_run states. It even explains that skill names/descriptions are exposed to the model before the prompt. This significantly enriches beyond annotations and surfaces the risk profile clearly. No contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but every paragraph earns its place: pricing/quota, scope, egress/privacy, progress/recovery, and limitations are all substantive and non-redundant. It is structured with bold labels (scope, Data egress, Progress & recovery) and front-loaded with the most decision-critical facts (PAID, free alternatives). It loses one point because the volume of detail, while valuable, is dense enough that a quick-skimming agent might miss the egress warnings embedded in the middle; a brief upfront risk summary would improve scanability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 13 parameters, 0 required, an output schema, and a rich sibling set, the description is exceptionally complete: it covers cost, egress/privacy, timeout behavior, async alternatives, dedup semantics, result disclosure semantics (review_status/coverage, not_run), and the read-only/static limitation. The only minor gap is not describing the output schema's structure, but the presence of an output schema plus the description's statements about top-level review_status/coverage makes that unnecessary. Nothing an agent needs to correctly select or invoke this tool is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so baseline 3. The description adds substantial compensating value on top: it explains scope semantics (working_tree vs branch vs commit), untracked policy behavior, timeout clamping (10-600s), idempotency_key replay/refusal rules, and that workspace_root avoids fallback to server cwd. It also flags that extra_context is sent raw/unredacted and that isolation does not suppress built-in skills/AGENTS.md. This goes well beyond what the schema's individual parameter descriptions provide.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Review git changes') and resource ('git changes'), and immediately contrasts it with siblings: 'PAID — this spends Kimi quota on every new call; use kimi_dry_run or kimi_status...'. It distinguishes from kimi_review_changes_async (prefer for long runs), kimi_consult/kimi_delegate (different Kimi interactions), and explains what it actually does (gathers diff, secret-redacts, bounded, read-only review). This makes the tool's purpose and scope unmistakable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly provides when-to-use guidance: 'use kimi_dry_run or kimi_status (both free) first if you only need to check scope or readiness', 'prefer kimi_review_changes_async ... for a multi-file or whole-branch review that may exceed it', and describes the recovery path via kimi_job_list→kimi_job_status→kimi_job_result. It also explains scope selection semantics, workspace_root necessity, and extra_context usage. This is comprehensive routing guidance with exclusions (e.g., 'STATIC review, not a verify mode: ... cannot run the project's checks').

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

kimi_review_changes_asyncReview git changes in background (paid)A

Review your git changes in the background; get a job_id back immediately.

PAID — this spends Kimi quota on every new call; use kimi_dry_run or kimi_status (both free) first if you only need to check scope or readiness.

Same read-only behavior as kimi_review_changes (the diff is gathered, secret- redacted, and bounded, then reviewed read-only), but detached — prefer it for a multi-file or whole-branch review that can exceed the synchronous deadline (built-in default 300s), since a sync run whose deadline expires loses its partial work; this job's own deadline is separately configured (built-in default 1800s). The diff is gathered inside the job, so a bad base/commit comes back as the same structured error with zero spend (a bad scope is rejected by MCP input validation before the job starts). Starting a job commits to spend. Poll kimi_job_status; read/consume the review envelope with kimi_job_result/kimi_job_consume_result; stop with kimi_job_cancel. Pass workspace_root (absolute).

Data egress: same as kimi_review_changes — sends the secret-redacted diff plus your raw (unredacted) extra_context to your configured provider via the kimi CLI; Kimi may also Kimi auto-loads the resolved workspace's AGENTS.md and discovers skills from its own config (including extra_skill_dirs, which may point outside the workspace).

Your inputs are sent raw and unredacted. Secret redaction is best-effort and covers the gathered diff and Kimi's returned output — not what you type, and not the files Kimi reads for itself.

ParametersJSON Schema
NameRequiredDescriptionDefault
baseNoBase git ref for scope='branch'; the review covers base...HEAD.
modelNoOverride the Kimi model slug for this call; defaults to the server/Kimi default when unset.
pathsNoRepo-relative paths to narrow the review ('/' separators, no '..'); omit to review all changes in scope.
scopeNoWhich changes to review: 'working_tree' (tracked changes vs HEAD; untracked files follow the `untracked` policy, off by default), 'branch' (needs base), or 'commit' (needs commit).working_tree
commitNoCommit SHA or ref to review for scope='commit'.
isolationNoWhich skills Kimi loads: 'inherit' (own user/project discovery) or 'ignore-skills' (empty dir). Built-ins load either way; this reduces loading, not isolation. Default: server-configured, per kimi_status. More: kimi://params.
untrackedNoHow working_tree scope treats untracked files: 'explicit_only' (default) includes only those named in `paths`; 'include' reviews all non-ignored untracked files (SENDS their contents to your configured provider — opt-in egress); 'exclude' includes none. Omitted ones are disclosed in `coverage`. Inert for branch/commit scopes.explicit_only
extra_contextNoOptional author intent/background context, added as clearly-labeled UNTRUSTED prompt data. Redaction does NOT cover it — no live secrets. Full caveats and bounds: kimi://params.
workspace_rootNoAbsolute path to the target repo root — pass it to target the intended repo (MCP roots are unavailable); otherwise the call falls back to the server's own cwd and sets meta.workspace_warning.
idempotency_keyNoOptional dedup key scoped to THIS tool + workspace. Same key + same args replays the prior result with no new spend; different args are refused (idempotency_conflict). Sync and _async are separate tools and never share a key. Omit for none; retention is bounded. Lifecycle: kimi://params.
reasoning_effortNoOverride the Kimi reasoning effort for this call (a model_reasoning_effort override); omit or pass null for the server default (MOONBRIDGE_REASONING_EFFORT) or Kimi's own resolution. An open, per-model string the backend validates at run time — commonly minimal|low|medium|high|xhigh; kimi_models lists each model's advertised set (advisory). Rejection and bounds detail: kimi://params.

Output Schema

ParametersJSON Schema
NameRequiredDescription
okYes

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations, the description discloses spend, zero-spend error cases, the 1800s job deadline, best-effort secret redaction, egress of raw extra_context, AGENTS.md auto-loading, and skill discovery. The 'read-only behavior' clause is consistent with readOnlyHint=false because the tool creates a job and spends quota; the description clarifies that the review itself does not modify the code.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense and front-loaded with the core async behavior, cost, and free alternatives. It is somewhat long and contains a broken sentence ('Kimi may also' followed by 'Kimi auto-loads'), plus minor redundancy around spend, but nearly every sentence carries material guidance.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For an 11-parameter paid async tool, the description covers the full job lifecycle, cost model, failure modes, data-egress boundaries, timeouts, and relationships to all relevant sibling tools. Output shape is delegated to the existing output schema, so nothing critical is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already documents all 11 parameters. The description adds useful runtime semantics: bad base/commit yields a structured error with zero spend, bad scope is rejected before the job starts, workspace_root should be passed, and inputs are sent raw/unredacted.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The first sentence states a specific action ('Review your git changes in the background') and immediate result ('get a job_id back'), and the title/description mark it as the paid async variant. It explicitly distinguishes itself from kimi_review_changes by the detached execution model and from kimi_dry_run/kimi_status by cost and purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear selection criteria: use kimi_dry_run or kimi_status first for free scope/readiness checks, prefer this tool for multi-file or whole-branch reviews likely to exceed the 300s sync deadline, and use the listed kimi_job_* siblings to poll, read, consume, or cancel. It also warns that starting a job commits spend.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

kimi_statusCheck Kimi readiness (free)A
Read-only

Check that the kimi CLI is installed, authenticated, and a supported version, and report the resolved defaults. Free — no model call. Run it before your first paid call in a session to confirm setup, and again whenever a run fails with a setup error. Spend: do not plan spend around rate_limit — it always reports unavailable, and that is not a failure. kimi exposes no quota-read channel and its provider is user-configured, so there is nothing authoritative to report. The only quota signal this server can give you is the kimi_rate_limited error on a call that was actually throttled; it carries retry_after_ms.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
okYes

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate readOnlyHint=true and openWorldHint=false, so the safety profile is covered. The description adds valuable behavioral detail: the tool always reports `rate_limit` as `unavailable`, that this is not a failure, and that the only quota signal is the `kimi_rate_limited` error with `retry_after_ms`. This goes beyond what annotations provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded: first sentence states the purpose and the free/no-model-call nature, second sentence gives when to use it, and the final paragraph gives crucial behavioral caveats. Slightly longer than strictly minimal, but every sentence carries meaningful guidance. A 4 rather than 5 because the last paragraph could be tightened slightly, but it's well-structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter, read-only status check with an output schema, the description is complete. It tells the agent when to call, what to expect, what not to plan around, and how to interpret the only quota signal. There is nothing an agent needs to know to invoke it correctly that is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so schema coverage is trivially 100% and there is no parameter documentation burden. The description appropriately explains the output semantics (rate_limit reports unavailable) even though there is an output schema. A 4 is appropriate because the description compensates for the fact that the output schema likely just lists fields and may not explain the always-`unavailable` behavior.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Check' and the specific scope: installed, authenticated, supported version, and resolved defaults. It also labels it as 'Free — no model call,' which distinguishes it from paid tools. It doesn't explicitly name a sibling that performs an overlapping check, but the title and description together make the purpose clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says when to run it: 'before your first paid call in a session to confirm setup, and again whenever a run fails with a setup error.' It also provides a strong 'do not' guidance about spend planning and `rate_limit`, which prevents incorrect use. This is excellent usage guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

TDQS

A4.4/5.0
Disambiguation5/5

Each tool has a clearly distinct role: setup introspection, model/capability discovery, three separate paid operation modes, their async counterparts, per-mode dry runs, and job lifecycle management. Even the job tools split cleanly into status, result, consume, cancel, and list functions.

Naming Consistency5/5

All tools share the kimi_ prefix and snake_case convention, with predictable suffixes like _async, _dry_run, and kimi_job_*. The naming is uniform and easy to navigate even though discovery tools are noun-style while operation tools are verb-style.

Tool Count4/5

At 16 tools, this is slightly above the typical well-scoped range, but the count is justified by the three natural groups: metadata/status, paid operations with dry-run and async variants, and job lifecycle. No tool feels redundant, though the surface is a bit large.

Completeness5/5

The tool surface covers the full intended workflow: preflight status, capability and model discovery, three operation modes, dry-run previews, and a complete async job lifecycle from start through list, status, fetch, consume, and cancel. Sync calls also expose job IDs for recovery, leaving no obvious dead ends.

Maintenance

ActivityMaintained
ResponsivenessUnresponsive

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    D
    maintenance
    An MCP bridge that enables Claude Code to consult the Kimi AI model in a structured challenge-loop for code review, debugging, and architecture evaluation.
    37
    2
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    Enables users to request a second opinion from a locally authenticated Claude Code model via MCP tools, supporting asynchronous jobs with restricted tools for safety.
    MIT
  • A
    license
    B
    quality
    B
    maintenance
    Bridges Codex Desktop with Kimi Code CLI, enabling direct control of AI coding sessions via MCP tools for prompt, status, cancel, and CLI operations.
    1
    33
    MIT

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/briandconnelly/moonbridge'

If you have feedback or need assistance with the MCP directory API, please join our Discord server