The firepass-mcp server turns Kimi K2.6 Turbo into an autonomous coding agent with tool loops for file operations, shell commands, code search, and structured code review — all sandboxed to a working directory you specify.
Tools Available
firepass_worker — Full read/write coding agent: read, write, and edit files; run bash commands; search with ripgrep, ast-grep, jq, and glob; navigate directories. Autonomously iterates on coding, refactoring, and bug fixes (up to 60 iterations by default).
firepass_researcher — Read-only analysis agent: read files, search codebases, perform code/architecture analysis. No writes or shell execution — safe for exploration.
firepass_reviewer — Read-only code review agent: reviews files, diffs, or PR descriptions and returns structured feedback (blocking issues, suggestions, positives).
firepass_trio — Orchestrator that chains researcher → worker → reviewer in a single call, with an optional bounded fix loop based on review feedback.
Key Capabilities
Provide a prompt and cwd to scope the agent's file access; optionally pre-load context (file contents, errors, specs, diffs).
Configurable max_iterations (default 60, up to 200), shell command timeouts, and output/file size limits.
All file operations are sandboxed to cwd; read-only agents strictly block write/execute capabilities.
Results returned as XML envelopes with an executive summary and activity log for structured parsing.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@firepass-mcp Find and fix the failing test in test_api.py"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
MCP server that turns Kimi K2.6 Turbo into an agentic coding assistant. The model gets a tool loop — it can read/write files, run shell commands, and search code with ripgrep, ast-grep, jq, and glob — and iterates autonomously until the task is done.
Four tools exposed over MCP:
Tool | Capabilities | Use case |
| read_file, write_file, edit_file, bash, ripgrep, glob_find, ast_grep, jq, list_dir, tree, done | Coding, refactoring, bug fixes |
| read_file, ripgrep, glob_find, ast_grep, jq, list_dir, tree, done (read-only) | Code analysis, architecture review |
| read_file, ripgrep, glob_find, ast_grep, jq, list_dir, tree, done (read-only) | Code review with structured output |
| researcher → worker → reviewer chain with bounded fix loop-back | Plan-then-implement-then-review in one MCP call |
Python 3.10+
A Fireworks AI API key
rg (ripgrep), sg (ast-grep), jq, tree on PATH for full tool coverage
bash, ls (standard on POSIX systems)
Related MCP server: agentKimi
uvx firepass-mcpSet your API key:
export FIREWORKS_API_KEY="fw-..."Add the server with:
codex mcp add firepass --env FIREWORKS_API_KEY=fw-... -- uv run firepass-mcpThis writes a config like:
[mcp_servers.firepass]
command = "uv"
args = ["run", "firepass-mcp"]
[mcp_servers.firepass.env]
FIREWORKS_API_KEY = "fw-..."Add the server with:
claude mcp add -e FIREWORKS_API_KEY=fw-... firepass -- uv run firepass-mcpThis writes a config like:
{
"mcpServers": {
"firepass": {
"type": "stdio",
"command": "uv",
"args": ["run", "firepass-mcp"],
"env": {
"FIREWORKS_API_KEY": "fw-..."
}
}
}
}If your client reads MCP JSON directly, use:
{
"mcpServers": {
"firepass": {
"command": "uvx",
"args": ["firepass-mcp"],
"env": {
"FIREWORKS_API_KEY": "fw-..."
}
}
}
}Variable | Default | Description |
| (required) | Fireworks AI API key |
|
| Model ID |
|
| Shell command timeout (seconds) |
|
| Max chars per tool result |
|
| Max chars per file read |
You call firepass_worker, firepass_researcher, firepass_reviewer, or firepass_trio with a prompt and a required cwd
The server (server.py) sends the prompt to Kimi K2.6 Turbo with function-calling enabled, using tools.py for the typed ToolSpec registry and executors and messages.py for context budgeting
The model explores the codebase, makes edits, runs tests, and iterates
Every tool has a frozen-dataclass argument contract with additionalProperties: false enforced at runtime — unknown fields are rejected
When done, it calls done() with an executive summary
The summary (plus an activity log) is returned as the tool result
All roles get 60 iterations by default (capped at 200), configurable per call.
firepass_trio chains researcher, worker, and reviewer: the researcher gathers context, the worker implements, and the reviewer audits the result. The reviewer can send the worker back for fixes up to max_review_rounds times (default 2, capped at 5). The response is an XML envelope that contains each sub-result as a separate tag so the calling LLM can address them individually.
For Fireworks rate-limit behavior, worker fan-out guidance, and the recommended path before running many parallel workers, see docs/fireworks-scaling.md.
Every tool result is returned as an XML envelope so the calling LLM can read sub-results structurally.
Single tool (e.g. firepass_worker):
<firepass_worker status="completed" iterations="4" tool_calls="3">
<result>Done: refactored auth logic into helpers.py</result>
<activity>
<call>read_file(path="src/auth.py")</call>
<call>write_file(path="src/helpers.py", content="...")</call>
<call>done(result="Done: refactored auth logic into helpers.py")</call>
</activity>
</firepass_worker>Trio call (firepass_trio):
<firepass_trio status="approved" rounds="1">
<research status="completed" iterations="3" tool_calls="2">...</research>
<rounds>
<round n="1">
<implementation status="completed" iterations="5" tool_calls="4">...</implementation>
<review status="completed" iterations="2" tool_calls="1">...</review>
</round>
</rounds>
</firepass_trio>All file operations (read_file, write_file, edit_file, glob_find, ripgrep, ast_grep, jq, tree, list_dir) are sandboxed to the required cwd you provide. Paths are resolved and validated against the working directory before any I/O.
The researcher and reviewer are read-only — bash, write_file, and edit_file are blocked both at the API schema level (model never sees them) and at runtime (server rejects them even if hallucinated). Dangerous ripgrep flags (--pre, --pre-glob, --search-zip, --replace, -r, -z) are also blocked.
The worker has full access including bash. It is not sandboxed at the command level — treat it like giving shell access to a remote developer scoped to your project directory.
Limits:
File writes capped at 1 MB per operation
File reads capped at 100K characters
Tool output capped at 50K characters
Context budget of 200K characters. Phase 1 truncates oldest tool outputs to [truncated]; phase 2 compacts assistant tool_call arguments to {}. If still over budget, an error is raised rather than silently exceeding.
Configurable iteration limits (default 60 for all roles, capped at 200)
Review rounds capped at 5 in the trio (default 2)
Install dev dependencies and run tests:
uv sync
uv run pytest -q tests/test_server.pyLint and type-check:
uv run ruff check src tests
uv run ty check srcMIT
Run a research task with FirePass researcher (Kimi K2.6 Turbo + read-only tool loop).
The researcher can read files, search with ripgrep/ast-grep/jq/glob, and iterate autonomously. No file writes or shell commands.
Args: prompt: Research question or analysis task. cwd: Working directory to sandbox file access to. context: Optional file contents, docs, or code to pre-load. max_iterations: Max tool-call rounds (default 60).
| Name | Required | Description | Default |
|---|---|---|---|
| prompt | Yes | ||
| cwd | Yes | ||
| context | No | ||
| max_iterations | No |
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses key behaviors: autonomous iteration, read-only file access, specific search tools, and the underlying model. While it could mention timeouts or error handling, the disclosed traits are sufficient for an agent to understand the tool's behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, front-loading the purpose and key constraints, followed by a clear parameter list. Every sentence adds value, with no unnecessary repetition or fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the presence of an output schema (not shown), the description adequately covers input parameters and behavioral constraints. It could mention determinism or caching, but the provided information is sufficient for an agent to select and invoke the tool correctly. Complexity is moderate, and the description meets the need.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0% description coverage, but the description lists all 4 parameters with meaningful explanations (prompt as research question, cwd as sandbox directory, context as optional pre-loaded files, max_iterations as tool-call rounds with default). This compensates well for the lack of schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it runs a research task using the FirePass researcher (Kimi K2.6 Turbo) with a read-only tool loop. It specifies capabilities (read files, search with ripgrep/ast-grep/jq/glob, iterate autonomously) and constraints (no file writes or shell commands), effectively distinguishing it from sibling tools like firepass_reviewer or firepass_worker.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for research/analysis tasks by stating its read-only nature and explicit exclusions ('No file writes or shell commands'). It does not explicitly list when to use vs alternatives, but the constraints provide clear guidance. Sibling tool names further hint at different purposes.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Run a code review with FirePass reviewer (Kimi K2.6 Turbo + read-only tool loop).
The reviewer can read files, search with ripgrep/ast-grep/jq/glob, and iterate autonomously. No file writes or shell commands. Returns structured review: blocking issues, suggestions, and what's done well.
Args: prompt: What to review — files, a diff, a PR description, or a specific concern. cwd: Working directory to sandbox file access to. context: Optional diff, file contents, or PR description to pre-load. max_iterations: Max tool-call rounds (default 60).
| Name | Required | Description | Default |
|---|---|---|---|
| prompt | Yes | ||
| cwd | Yes | ||
| context | No | ||
| max_iterations | No |
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description fully discloses behavior: read-only, autonomous iteration, and structured review output. It mentions the default max_iterations (60) and that no writes or shell commands occur, which is transparent for a review tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and well-structured: a clear one-liner, a paragraph on capabilities, and a bullet list of args. Every sentence adds value, and the purpose is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 4 parameters (2 required), 0% schema coverage, and an existing output schema, the description thoroughly covers all aspects: purpose, behavior, parameter semantics, and return format (blocking issues, suggestions, praise). It is complete for the tool's complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, but the description adds detailed explanations for each parameter: prompt (what to review), cwd (sandbox directory), context (optional pre-loaded content), and max_iterations (tool-call rounds). This adds significant meaning that the schema lacks.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it runs a code review with FirePass reviewer and specifies the model and read-only tool loop. It explicitly lists what it returns (blocking issues, suggestions, and what's done well), distinguishing it from a vague tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains what the tool can do (read files, search, iterate autonomously) and what it cannot do (no file writes or shell commands). This provides clear usage context, though it does not explicitly differentiate from sibling tools like firepass_researcher or firepass_worker.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Run a full FirePass trio: research → implement → review → (fix loop).
Args: prompt: The coding task. cwd: Working directory to sandbox file access to. context: Optional file contents, errors, or specs to pre-load. max_iterations: Max tool-call rounds per sub-agent (default 60). max_review_rounds: Max worker+reviewer fix rounds (default 2).
| Name | Required | Description | Default |
|---|---|---|---|
| prompt | Yes | ||
| cwd | Yes | ||
| context | No | ||
| max_iterations | No | ||
| max_review_rounds | No |
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description bears full burden. It mentions sandboxing and a fix loop but lacks details on side effects, permissions, or potential long runtime. Behavioral traits like file modifications or error handling are not disclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise: one purposeful sentence followed by a well-structured argument list. Every sentence adds value, no fluff, and the purpose is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (5 params, orchestration, output schema present), the description is adequate but not thorough. It omits details on the fix loop, output format, and potential runtime warnings. The output schema reduces burden, but gaps remain.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, but the description explains each parameter's meaning (prompt, cwd, context, max_iterations, max_review_rounds), adding value beyond the schema's titles. This compensates well for the missing schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it runs a full FirePass trio (research → implement → review → fix loop), using a specific verb and resource. It effectively distinguishes from sibling tools (firepass_researcher, firepass_worker, firepass_reviewer) by being the orchestrator.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage: use this tool to run the complete trio workflow. It provides clear context but does not explicitly state when to use this vs. alternatives, such as using individual sub-agents directly.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Run a coding task with FirePass worker (Kimi K2.6 Turbo + tool loop).
The worker can read/write/edit files, run bash, search with ripgrep/ast-grep/jq, and iterate autonomously until done.
Args: prompt: The coding task. cwd: Working directory to sandbox file access to. context: Optional file contents, errors, or specs to pre-load. max_iterations: Max tool-call rounds (default 60).
| Name | Required | Description | Default |
|---|---|---|---|
| prompt | Yes | ||
| cwd | Yes | ||
| context | No | ||
| max_iterations | No |
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description must fully disclose behavioral traits. It mentions the tool can read/write/edit files, run bash, and search with ripgrep/ast-grep/jq, implying destructive potential. It also notes file access is sandboxed to 'cwd'. However, it omits details on permissions, network access, cleanup, or recovery after failures, which are important for an autonomous coding agent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and well-structured: a one-sentence opener stating the purpose, a sentence listing capabilities, and a bullet-style list for parameters. Every sentence adds value without redundancy. It is front-loaded and easy to scan.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (autonomous agent with many capabilities) and the presence of an output schema (unseen), the description is fairly complete. It covers what the tool does, its main capabilities, and parameter usage. However, it lacks guidance on when to use this worker versus sibling tools, and missing behavioral details like expected output format or error handling prevent a perfect score.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description coverage is 0%, so the description must add meaning beyond parameter names. It does provide brief explanations: for 'prompt' it says 'The coding task,' for 'cwd' it says 'Working directory to sandbox file access to,' for 'context' it says 'Optional file contents, errors, or specs to pre-load,' and for 'max_iterations' it says 'Max tool-call rounds (default 60).' While this adds some value, the explanations are minimal and do not fully compensate for the lack of schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Run a coding task with FirePass worker (Kimi K2.6 Turbo + tool loop).' It specifies the verb (run), resource (coding task), and the autonomous agent (Kimi K2.6 Turbo + tool loop). This directly differentiates it from sibling tools like 'firepass_researcher' (likely for research) and 'firepass_reviewer' (likely for review), as the worker focuses on autonomous coding tasks.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use by listing capabilities like reading/writing files, running bash, and iterating autonomously. However, it lacks explicit guidance on when not to use it or alternatives among siblings (researcher, reviewer, trio). No 'when-to-use' or 'when-not-to-use' clauses, leaving room for ambiguity.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v0.2.0firepass_triov0.1.0firepass_researcherfirepass_reviewerfirepass_workerScored across 4 tools
Each tool maps to a distinct agent role: researcher is read-only analysis, reviewer is read-only code review with structured output, worker can write files and run commands, and trio orchestrates the full pipeline. The descriptions make the boundaries clear despite researcher and reviewer sharing a read-only tool loop.
All tools follow the same firepass_<role> naming convention with single-word role identifiers. The pattern is immediately predictable and there are no mixed styles or vague generic verbs.
Four tools is well-scoped for this server: it exposes exactly the three FirePass agent modes plus the combined trio workflow. Each tool earns its place and the count feels neither thin nor bloated.
The tool surface covers the full intended workflow: research, implementation, review, and an orchestrated research→implement→review→fix loop. There are no obvious dead ends or missing core operations for the stated domain.
MCP server for agentverse documentation, generated by doc2mcp.
Nifty's MCP server — exposes tasks, projects, messages, and files as tools for AI agents.
MCP server for building and testing AI agents with multi-model experimentation and insights.
A comprehensive Model Context Protocol (MCP) server that enables AI assistants to interact with yo…
