Check that the kimi CLI is installed, authenticated, and a supported version, and report the resolved defaults. Free — no model call. Run it before your first paid call in a session to confirm setup, and again whenever a run fails with a setup error. Also reports a rate_limit block — how much of the Kimi quota windows remains, fetched LIVE from kimi app-server (a read-only call with no model spend). primary is the shorter/rolling window, secondary the longer one; the account reports only the windows that currently bind it, so either may be null. Use it to decide whether to spend: available is deliberately conservative (only when every reported window is healthy); when limited/exhausted, prefer to defer non-urgent Kimi calls (urgent ones may still proceed); unknown means the live read couldn't complete just now (retry) or only a stale cache was available; unavailable means this kimi/account exposes no quota data — none of these means anything is wrong. blocked is different: the backend reports a SPEND control (spend_control_reached: true), so paid calls will fail and waiting for a quota reset will NOT clear it — don't defer, and surface it to the user. spend_control_reached is null when this kimi/backend didn't report that state (then available covers the quota windows only, and note says so). is_stale/as_of show freshness; home_unverified flags a snapshot from a different KIMI_CODE_HOME.

List this server's tools, tiers, and the result fingerprint. Free — no model call. Clients can cache by the fingerprint.

detail="summary" (default) returns each tool's name, cost, stability, and error_codes — the facts tools/list does not already carry — plus async_lifecycle, but only for the *_async tools. detail="full" adds use_when/returns/required_params/key_optional_params, restating what you already hold. detail="contracts" omits tool_details.

Pass include_schemas to also embed the full 'error-envelope', 'result-meta', 'capabilities-result', and/or 'status-result' schema, and/or the 'parameter-contracts' document (a contract doc, not a JSON Schema) — a tool-reachable fallback to the kimi:// resources for resource-blind clients. It works in any detail mode.

List Kimi model slugs you can pass as model, with each model's advertised reasoning-effort set for reasoning_effort. Free — no model call.

Advisory discovery only: read from Kimi's on-disk cache when present, else a bundled fallback (source says which; the fallback carries no effort data). kimi exec validates the real slug and the backend validates the real effort, so an unlisted value may still work and a listed one may be unavailable to your account. Same payload as the kimi://models resource. Not fingerprint-stable — do not cache it by the capabilities fingerprint.

Ask Kimi (a different model) for a read-only second opinion or answer.

PAID — this spends Kimi quota on every new call; there is no dry-run preview for a consult, so run kimi_status (free) first to confirm the CLI is installed and authenticated.

Runs kimi exec in a read-only sandbox — Kimi never edits files. A STATIC review, not a verify mode: the read-only sandbox blocks the writes a test/build/lint run needs, so Kimi can't run your checks to confirm its claims — treat findings as unvalidated claims you verify yourself. Pass workspace_root (absolute) for a repo-grounded question; omit it for pure Q&A. Returns a result envelope.

Data egress: this sends your question and extra_context to your configured Kimi provider via the kimi CLI. Kimi always runs with a resolved working directory (workspace_root, your MCP roots, or the server's cwd as a fallback), so it may read files there and Kimi auto-loads the resolved workspace's AGENTS.md and discovers skills from its own config (including extra_skill_dirs, which may point outside the workspace). Skill names and descriptions are exposed to the model up front, so that content can be sent even if your prompt never mentions it. The isolation setting does not suppress any of it: kimi's built-in skills always load, and AGENTS.md is read regardless.

Your inputs are sent raw and unredacted. Secret redaction is best-effort and covers the gathered diff and Kimi's returned output — not what you type, and not the files Kimi reads for itself.

Progress & recovery: blocks up to the resolved deadline (timeout_seconds, clamped 10-600s; when omitted, the server-configured value, built-in default 300s). If that deadline expires the run is terminated and its partial output is not recoverable or resumable, so for a high-reasoning_effort or broad repo-grounded consult that may exceed it, prefer kimi_consult_async (a background job, built-in default 1800s deadline; poll kimi_job_status). Coarse notifications/progress streams while it blocks when your client requests it; some MCP clients background a long call before the deadline, so timeout_seconds bounds the run, not necessarily the inline wait — either way the detached run (meta.job_id) is recoverable via kimi_job_list→kimi_job_status→kimi_job_result.

Ask Kimi (a different model) to review your git changes for an independent second opinion.

PAID — this spends Kimi quota on every new call; use kimi_dry_run or kimi_status (both free) first if you only need to check scope or readiness.

scope: working_tree (tracked changes vs HEAD — untracked files follow the untracked policy and are NOT reviewed by default), branch (needs base, reviews base...HEAD), or commit (needs a commit SHA). The diff is gathered, secret- redacted, and bounded by this server; Kimi reviews it read-only and returns structured findings. Pass workspace_root (absolute) for the right repo. Optional extra_context (author intent, bounded like the diff) cuts false positives.

The result's top-level review_status and coverage disclose whether the model actually ran and what it was shown: a pass over partial coverage is surfaced as unknown, and a tree with nothing reviewable returns not_run, never a pass.

STATIC review, not a verify mode: the read-only sandbox blocks the writes a test/build/lint run needs, so Kimi can't run the project's checks to confirm its findings — treat them as unvalidated claims you verify yourself before acting.

Data egress: this sends the gathered diff to your configured provider via the kimi CLI. The diff is secret-redacted (best-effort), but your extra_context is sent raw (unredacted), Kimi auto-loads the resolved workspace's AGENTS.md and discovers skills from its own config (including extra_skill_dirs, which may point outside the workspace). Skill names and descriptions are exposed to the model up front, so that content can be sent even if your prompt never mentions it. The isolation setting does not suppress any of it: kimi's built-in skills always load, and AGENTS.md is read regardless.

Your inputs are sent raw and unredacted. Secret redaction is best-effort and covers the gathered diff and Kimi's returned output — not what you type, and not the files Kimi reads for itself.

Progress & recovery: blocks up to the resolved deadline (timeout_seconds, clamped 10-600s; when omitted, the server-configured value, built-in default 300s). If that deadline expires the run is terminated and its partial output is not recoverable or resumable, so for a multi-file or whole-branch review that may exceed it, prefer kimi_review_changes_async (a background job, built-in default 1800s deadline; poll kimi_job_status). Coarse notifications/progress streams while it blocks when your client requests it; some MCP clients background a long call before the deadline, so timeout_seconds bounds the run, not necessarily the inline wait — either way the detached run (meta.job_id) is recoverable via kimi_job_list→kimi_job_status→kimi_job_result.

Delegate a coding task to Kimi (a different model) in an isolated git worktree, and get back a reviewable diff that is NOT applied to your tree.

PAID — this spends Kimi quota on every new call; use kimi_delegate_dry_run or kimi_status (both free) first if you only need to check scope or readiness.

Kimi edits files with workspace-write, but only inside a throwaway worktree seeded from your current tracked state. The returned diff is Kimi's changes; review it, then apply it yourself if you want it. Requires a git repo with at least one commit. Pass workspace_root (absolute).

NETWORK IS NOT BLOCKED: kimi has no sandbox, so a delegated task CAN reach the network — it may git push/fetch, run gh, curl, publish, or install dependencies, and it runs shell commands with your own user's privileges. Scope tasks accordingly and review the returned diff before applying it; the diff shows what changed in the worktree, not what else the run did. The Kimi model call also sends your task to your configured provider and lets Kimi read tracked files in the worktree and send their content. Kimi auto-loads the resolved workspace's AGENTS.md and discovers skills from its own config (including extra_skill_dirs, which may point outside the workspace). Skill names and descriptions are exposed to the model up front, so that content can be sent even if your prompt never mentions it. The isolation setting does not suppress any of it: kimi's built-in skills always load, and AGENTS.md is read regardless.

Your inputs are sent raw and unredacted. Secret redaction is best-effort and covers the gathered diff and Kimi's returned output — not what you type, and not the files Kimi reads for itself.

Progress & recovery: blocks up to the resolved deadline (timeout_seconds, clamped 10-600s; when omitted, the server-configured value, built-in default 300s). If that deadline expires the run is terminated and its partial output is not recoverable or resumable, so for a substantial or multi-file task that may exceed it, prefer kimi_delegate_async (a background job, built-in default 1800s deadline; poll kimi_job_status). Coarse notifications/progress streams while it blocks when your client requests it; some MCP clients background a long call before the deadline, so timeout_seconds bounds the run, not necessarily the inline wait — either way the detached run (meta.job_id) is recoverable via kimi_job_list→kimi_job_status→kimi_job_result.

Delegate a coding task to Kimi in the background and get a job_id back immediately (does not block on the run).

PAID — this spends Kimi quota on every new call; use kimi_delegate_dry_run or kimi_status (both free) first if you only need to check scope or readiness.

Same propose-tier behavior as kimi_delegate — Kimi works in a throwaway git worktree and the result carries a reviewable diff that is NOT applied — but detached; prefer it for a substantial or multi-file implementation task that can exceed the synchronous deadline (built-in default 300s), since a sync run whose deadline expires loses its partial work (this job's own deadline is separately configured, built-in default 1800s). Starting a job commits to spend (it runs to completion or its wall-clock deadline even if you never poll). Poll kimi_job_status; read/consume with kimi_job_result/kimi_job_consume_result; stop with kimi_job_cancel. Requires a git repo with at least one commit; pass workspace_root (absolute).

NETWORK IS NOT BLOCKED: like kimi_delegate, this has no sandbox — a delegated task CAN push, fetch, install dependencies, or call out, running with your own user's privileges. Scope tasks accordingly and review the returned diff before applying it. The Kimi model call also sends your task (raw) to your configured provider and lets Kimi read tracked files in the worktree and send their content.

Kimi auto-loads the resolved workspace's AGENTS.md and discovers skills from its own config (including extra_skill_dirs, which may point outside the workspace).

Secret redaction is best-effort and does not cover your task or the files Kimi reads for itself.

Ask Kimi for a read-only second opinion in the background; get a job_id back immediately instead of blocking.

PAID — this spends Kimi quota on every new call; there is no dry-run preview for a consult, so run kimi_status (free) first to confirm the CLI is installed and authenticated.

Same read-only behavior as kimi_consult (Kimi never edits files), but detached — prefer it for a high-reasoning_effort or broad repo-grounded consult that can exceed the synchronous deadline (built-in default 300s), since a sync run whose deadline expires loses its partial work; this job's own deadline is separately configured (built-in default 1800s). Starting a job commits to spend (it runs to completion or its wall-clock deadline even if you never poll). Poll kimi_job_status; read/consume the consult envelope with kimi_job_result/kimi_job_consume_result; stop with kimi_job_cancel.

Data egress: same as kimi_consult — sends your question and extra_context (raw, unredacted) to your configured provider via the kimi CLI, plus files Kimi reads from its resolved working directory (workspace_root, your MCP roots, or the server cwd). Kimi auto-loads the resolved workspace's AGENTS.md and discovers skills from its own config (including extra_skill_dirs, which may point outside the workspace).

Your inputs are sent raw and unredacted. Secret redaction is best-effort and covers the gathered diff and Kimi's returned output — not what you type, and not the files Kimi reads for itself.

Review your git changes in the background; get a job_id back immediately.

PAID — this spends Kimi quota on every new call; use kimi_dry_run or kimi_status (both free) first if you only need to check scope or readiness.

Same read-only behavior as kimi_review_changes (the diff is gathered, secret- redacted, and bounded, then reviewed read-only), but detached — prefer it for a multi-file or whole-branch review that can exceed the synchronous deadline (built-in default 300s), since a sync run whose deadline expires loses its partial work; this job's own deadline is separately configured (built-in default 1800s). The diff is gathered inside the job, so a bad base/commit comes back as the same structured error with zero spend (a bad scope is rejected by MCP input validation before the job starts). Starting a job commits to spend. Poll kimi_job_status; read/consume the review envelope with kimi_job_result/kimi_job_consume_result; stop with kimi_job_cancel. Pass workspace_root (absolute).

Data egress: same as kimi_review_changes — sends the secret-redacted diff plus your raw (unredacted) extra_context to your configured provider via the kimi CLI; Kimi may also Kimi auto-loads the resolved workspace's AGENTS.md and discovers skills from its own config (including extra_skill_dirs, which may point outside the workspace).

Your inputs are sent raw and unredacted. Secret redaction is best-effort and covers the gathered diff and Kimi's returned output — not what you type, and not the files Kimi reads for itself.

Preview what a kimi_review_changes call would send — scope, diff size, redactions, truncation. Free — no model call, no spend. Use it before a review to inspect the scope and the reported redactions; redaction is best-effort, so treat the preview as a check on scope, not as confirmation that no secret remains. Pass the same extra_context and untracked policy you would give the review so the preview matches it. would_call_model reports whether the paid call would actually run the model (False on an empty diff, where prompt_bytes is 0), and coverage discloses omitted untracked files just as the review would. The result echoes the effective model/reasoning_effort overrides the paid call would send (unvalidated). deadline_advisory is non-null when size or effort risks the synchronous deadline (null whenever would_call_model is False) and names kimi_review_changes_async verbatim — the async counterpart of the previewed call, not of this dry-run tool. A hint, not a refusal.

Preview what a kimi_delegate/kimi_delegate_async call would do — the baseline it seeds from (HEAD commit, tracked file count/size, uncommitted and untracked counts), the prompt size that would be sent, and the resolved workspace/isolation. Free — no model call, no spend, no worktree created.

Use it before delegating to confirm scope and repo before committing to cost, exactly as kimi_dry_run previews kimi_review_changes. Mirrors the real delegate's zero-spend validation (workspace, isolation, task size, git repo), so a failure here is a failure the paid call would also hit. The returned tier/sandbox describe the previewed propose run, not this read-only preview; the result echoes the effective model/reasoning_effort overrides the paid call would send (unvalidated). deadline_advisory is non-null when size or reasoning effort risks the synchronous deadline and names kimi_delegate_async verbatim — the async counterpart of the previewed call, not of this dry-run tool. A hint, not a refusal.

Check a background job's lifecycle state without fetching the full result.

Use after any *_async call (kimi_delegate_async, kimi_consult_async, kimi_review_changes_async) or any sync consult/review/delegate (whose meta.job_id names its record). Returns status, elapsed time, expiry, and result_available; when it is true, call kimi_job_result. result_ok reports a done job's producer-declared outcome — true (success), false (a stored error envelope), or null (running, no stored envelope, an unclassifiable payload, or a record finalized before this field) — so you can spot a stored FAILURE without fetching it. It does not guarantee the payload is still fetchable; a cross-release record may report an outcome yet fail kimi_job_result with job_result_incompatible. Free — no model call.

Honor poll_after_ms between polls — for a running job it GROWS with elapsed runtime (bounded), so following it backs you off instead of tight-looping (a delegate often runs ~20s). expires_at is null while running and is set once the job finishes; results are then retained ttl_seconds past that completion.

Fetch a finished background Kimi job's result WITHOUT deleting the record.

Works for any async job or sync consult/review/delegate (whose meta.job_id names its record) — kimi_delegate_async (a diff), kimi_consult_async (a consult answer), or kimi_review_changes_async (a review with verdict). Use when kimi_job_status reports result_available=true; the envelope matches the job's kind, so branch on tool. meta.job_id is set. A still-running/cancelled/timed- out/failed job returns an error envelope — as does a done job whose stored result this release cannot read (job_result_incompatible). To fetch and delete, use kimi_job_consume_result. Free — no model call.

detail="summary" (default) omits the raw model text; pass detail="full" for the complete raw output and metadata (#56).

Fetch a finished background Kimi job's result and delete the stored record.

Same envelope as kimi_job_result (matching the job's kind — branch on tool), then removes completed job state — but only once the stored result has been read intact and validated (a success or the job's own error envelope): a stored result this release cannot read (job_result_incompatible or a corruption internal_error) is NOT deleted, so it stays inspectable via kimi_job_result. Deletion precedes the response, so a response lost in transit does not restore the record; a failed removal retains the record until its TTL (kimi_job_status still shows it). Use only when you no longer need to poll or re-read the job. Non-done jobs are not deleted. Free — no model call.

detail works as in kimi_job_result (#56).

Cancel a running background Kimi job.

Asks the worker to shut down gracefully so it tears down its throwaway worktree, then force-kills it if it overstays, and marks the job cancelled (cancelled jobs cannot be resumed). If the worktree could not be removed, cleanup_warnings names the leftover path. Already-terminal jobs are returned unchanged, so cancel is idempotent — a retry after a lost response is safe. Free — no model call.

List the background jobs known for this workspace, newest first.

Free — no model call. Use to recover job_ids lost across context compaction or interruption. Returns each job's id, kind, status, start time, result_available, result_ok (a done job's outcome — true/false/null; see kimi_job_status), and expiry, so a stored failure is triageable without fetching each result.

Returns every retained job by default; pass limit (1-1000) or status to narrow. They narrow independently — omitting limit returns every job matching status, not every job. Only an explicit limit truncates: when more jobs match, the response sets truncated: true with a truncation_hint — the extra rows are dropped, not paged, so omit limit to get them all rather than looking for a cursor.

Read a job's result promptly — a finished record can silently drop off. This list is not permanent storage: terminal records expire after the TTL (default 24h), and a per-workspace soft cap (default 50, clamped 1-1000) evicts the oldest terminal records as new jobs start, so a finished job can disappear even before its expires_at. Running jobs are never evicted, so a busy workspace can hold more than the cap — and more than limit's 1000 ceiling. Includes sync-originated records (any sync consult/review/delegate call); the cap/TTL eviction covers both.