kimi-cli-mcp
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@kimi-cli-mcpstart a kimi session to fix the failing tests in src/"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
kimi-cli-mcp
MCP server that delegates coding tasks to your locally installed
Kimi Code CLI (kimi).
It wraps the real kimi binary instead of bundling its own copy of the agent, so every call
inherits your kimi auth, models and ~/.kimi-code config. Nothing about your model stack is
duplicated here, and the server does not drift when you upgrade kimi.
Sibling of pi-cli-mcp, qwen-cli-mcp and grok-cli-mcp — same architecture, same principles, kimi behind the wheel.
Use it when your primary agent should hand work to native Kimi as it already does to pi / qwen / grok.
Verified against kimi 0.41.0 (~/.kimi-code/bin/kimi) and native source
kimi-code@aad4a7df2.
Install
Requires Node ≥ 22 and a working kimi on PATH.
This package is not activated automatically. Add it only when you want a
separate MCP named kimi.
Claude Code (example — do not run unless you intend to activate)
Clone and build from source (not yet published to npm):
git clone https://github.com/minmax/kimi-cli-mcp.git
cd kimi-cli-mcp
npm ci
npm run build
claude mcp add-json kimi -s user "{
\"type\": \"stdio\",
\"command\": \"node\",
\"args\": [\"$(pwd)/dist/index.js\"],
\"timeout\": 3600000
}"Or with an explicit binary:
{
"mcpServers": {
"kimi": {
"command": "node",
"args": ["/absolute/path/to/kimi-cli-mcp/dist/index.js"],
"env": { "KIMI_MCP_BIN": "/absolute/path/to/kimi" }
}
}
}Keep the server name short (kimi): it becomes part of the tool names your model sees.
⚠️ Default ACP approval mode is
yolo. Delegation is only useful when the delegate can act. Print mode (transport: "print") already executes tools without confirmation; combining-pwith-yis a CLI error and this adapter never does that.
Related MCP server: Kimi MCP Server
Tools
Tool | Purpose |
| Start a session. Returns |
| Continue a finished or interrupted session — including one killed by a timeout. |
| List models this install has configured ( |
| Deliver into a turn executing right now ( |
| List turns executing right now that |
| List known sessions started through this server, newest first. |
| Read visible user/assistant/tool history from native |
kimi
Argument | Notes |
| Required. Must be self-contained — kimi cannot see your conversation. |
| Absolute path; defaults to this server's cwd. |
|
|
|
|
| ACP-only: |
| Comma-separated extra absolute dirs ( |
|
|
| Wall clock for this run. Off unless you set it. |
Not supported (honest error, not a fake flag): effort, allowed_tools, system_prompt_append.
Kimi has no --effort; pick a model alias such as stepfun-high/step-3.7-flash. Prompt mode
already runs tools; -y with -p is rejected by the CLI.
kimi({
prompt: "Read and execute the prompt: /abs/path/prompt.md",
cwd: "/abs/path/to/repo",
model: "kimi-code/k3"
})
// later:
kimi_reply({
session: "<id from the prefix>",
prompt: "Now check the error paths of those call sites."
})What comes back
Only kimi's final result plus aggregate stats — never the transcript, thinking, tool arguments or raw stdout:
[session: session_0927adc5-a840-4b68-93ca-5ca344c9fafb]
Refactored retry() in src/http.rs; all 12 tests pass.
---
kimi: kimi-code/k3 · 1 turn · 5 tool calls: Read×2, Bash×2, Edit · 12s
kimi wrote: src/http.rsOn acp the text is assembled from agent_message_chunk updates (thought chunks dropped).
On print it is the last role: assistant content from --output-format stream-json
(thinking is not on that stream). Session identity comes from ACP session/new or print
session.resume_hint.
Sessions
kimi returns a session id; kimi_reply resumes it with session/load (acp) or -S (print).
The conversation lives in kimi's own store (~/.kimi-code/sessions/...), so follow-ups keep
working across restarts of this server — the session → directory map is persisted in
~/.local/state/kimi-mcp/sessions.json.
Concurrent replies to one session are serialized per server process.
Transports
|
| |
command |
|
|
process | stays up, speaks ACP JSON-RPC | one process per turn, exits when done |
mid-run delivery |
| impossible |
follow-up |
|
|
deadline / cancel | kimi's | SIGTERM, then SIGKILL |
This server never sends anything into kimi on its own. kimi_send fires only when the caller calls it.
History
kimi_history reads $KIMI_CODE_HOME/sessions/<workspace>/<id>/agents/main/wire.jsonl
without taking the session lock and without talking to a live process. Visible items are
user / assistant / tool / gap. Thought, encrypted blobs and reasoning are omitted. State is
active if this process is running the turn, otherwise unknown — a missing registry row
is not treated as completed. The cursor is always returned, including at EOF, so a later
append can be read; a partial trailing JSONL line is truncated_tail. Paths outside the
session store are rejected.
Environment
Variable | Default | Meaning |
|
| Path to the kimi binary. |
|
| Default ACP mode for every call. |
| unset | Default model for every call. |
|
| Default transport: |
| unset | Server-wide default wall clock; unset means no deadline. |
|
| Ceiling on what |
|
| Concurrent kimi processes. |
| unset | Cap on the answer. Unset means no truncation. |
|
| stderr tail included in the response. |
| unset |
|
|
| Read-buffer guard against a runaway stream. |
|
| Longest single message line from kimi before it is dropped. |
|
| Longest single JSON-RPC frame from the client. |
|
| Remembered sessions before the oldest is dropped. |
|
| SIGTERM → SIGKILL grace period. |
|
| How long |
|
| Initialize-handshake timeout (acp only). |
|
| Whole-run budget for the |
|
| Session → cwd map. |
| unset | Command prefix, e.g. a sandbox wrapper around kimi. |
|
| Native kimi data root (forwarded to the child). |
Development
TypeScript (native tsc), Biome, Vitest. Tests drive the real server binary over stdio against a
fixture that speaks kimi's protocol; live tests against the installed kimi are opt-in.
npm run hooks # once per clone: git hooks from .githooks/
npm run build # tsc -> dist/
npm test # unit + type tests, no API access, no tokens
npm run test:live # live tests against the real kimi binary (spends tokens)
npm run check # format + types + tests
npm run fix # biome --writeVerification: the deterministic suite passes; two opt-in live prompt tests are skipped. The recorded live check covers model discovery only, not a real prompt/reply run.
License
MIT
Available Tools
7 toolskimiADestructive
Start a NEW task in the local Kimi Code agent — a separate CLI coding agent with its own file/shell tools and its own context window. Blocks until kimi settles, then returns only its final result plus stats, prefixed [session: ]; continue that session later with kimi_reply.
Good for: a second opinion from a different model, work kept out of this context, or parallel investigation.
Caution: with approval_mode 'yolo' (the server default, ACP) kimi edits files and runs shell commands as your user inside cwd without asking. Print mode also executes tools without confirmation (and forbids combining -p with -y).
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | Usually omit to use this server's cwd. If set, must be an absolute path (relative is rejected). kimi works and edits here, and reads AGENTS.md / project rules from here. | |
| model | No | Model alias as configured in kimi, e.g. 'kimi-code/k3' or 'stepfun-high/step-3.7-flash'. Defaults to kimi's own default_model. kimi_models lists what this install has configured. | |
| prompt | Yes | The complete task. kimi cannot see this conversation, so include everything it needs: file paths, goal, constraints, expected output format. | |
| add_dirs | No | Comma-separated extra workspace directories passed as kimi --add-dir (print) or ACP additionalDirectories (acp). Each path must be absolute. | |
| thinking | No | ACP thinking config (`session/set_config_option` id=thinking). Print transport has no thinking flag — kimi has no CLI --effort; pick a model alias instead. | |
| transport | No | Usually omit. The default 'acp' keeps kimi up (`kimi acp`) so a running turn can be steered or aborted with kimi_send. 'print' is kimi -p --output-format stream-json: one process per turn that cannot be reached while it works. -p is last (greedy). | |
| timeout_ms | No | Usually omit — the server default is generous. Override only when the task's real size demands it. A run killed at the deadline is not lost: it still returns its session id and is resumable with kimi_reply. | |
| approval_mode | No | ACP session mode: 'yolo' (auto-approve everything), 'auto' (auto-approve safe ops), 'default' (ask — unusable headless), 'plan' (read-only). Server default is yolo. Print transport cannot take -y/--auto/--plan with -p (the CLI rejects that); prompt mode already executes tools without confirmation, and 'plan' is rejected on print. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations (destructiveHint=true), it discloses that with 'yolo' approval mode kimi edits files and runs shell commands as the user, that print mode executes without confirmation, that it blocks until settling, and that interrupted runs preserve a resumable session id. This significantly extends the structured annotations without contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Structured into purpose, usage, and caution paragraphs with no filler—each sentence conveys an important fact or constraint. It is somewhat long, but that length is reasonable given the tool can mutate the local machine and has 8 configurable parameters.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, it sensibly tells the agent what to expect ('only its final result plus stats, prefixed session id') and covers resumability, blocking, cwd scope, and destructive behavior. It does not spell out the exact structure of the result/stats, but the remaining gap is minor for evaluating outcomes.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already covers all 8 parameters with detailed, 100% coverage. The description reinforces certain parameters (e.g., cwd's workspace scope, approval_mode's yolo hazard, timeouts not losing sessions) but adds little meaning beyond the schema's existing text, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource ('Start a NEW task in the local Kimi Code agent') and clearly identifies it as separate from the current conversation, naming kimi_reply for continuation. This makes it easy to distinguish from the six sibling tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly lists when to use it ('Good for: a second opinion, work kept out of this context, parallel investigation') and points to kimi_reply as the continuation path, effectively stating when not to use this tool. It also gives practical guidance on optional parameters ('Usually omit').
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
kimi_historyARead-onlyIdempotent
Read a bounded snapshot of a kimi session's visible conversation from kimi's native agents/main/wire.jsonl. Does not send anything into the run, does not take the session lock, and does not wait for kimi to finish. Returns JSON: session, state (active if this process is running it, otherwise unknown — sessions stay resumable so 'completed' is not claimed), items (user / assistant / tool / gap), an opaque cursor to resume even at the current EOF, has_more, truncated_tail. Thought/reasoning/encrypted content are omitted. User text comes only from context.append_message with role=user — if that stream has none, the page says so rather than inventing prompts from session metadata. Caps: limit (default 50, max 200), max_chars per item (default 4000, max 16000), and 100000 chars on the whole JSON page.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max items to return (default 50, max 200). | |
| cursor | No | Opaque resume token from a previous kimi_history call for this same session and transcript. Omit to read from the start. Always returned, including when the page is empty at EOF, so a later append can be read without missing the partial trailing line. | |
| session | Yes | Session id from [session: <id>] or kimi_sessions / kimi_running. | |
| max_chars | No | Max characters per item text (default 4000, max 16000). | |
| include_tools | No | Include tool calls/results (default true). Filtered tool lines still advance the cursor. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, and the description goes well beyond them: no data is sent, no session lock is taken, it never blocks on kimi, thought/reasoning content is omitted, and it refuses to invent prompts from metadata. It also discloses the 100000-char page cap and cursor durability at EOF. This is model behavior disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Long but dense; the first sentence names the action and source, and every additional clause adds operational detail (omissions, caps, cursor semantics). Slightly run-on in the return-shape sentence, but nothing is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only tool with no output schema, the description fully specifies the return shape (session, state, items, cursor, has_more, truncated_tail), data source, omissions, caps, and cursor behavior. There is no output schema, so this description carries the entire burden and meets it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema already documents all five parameters with defaults and maxes, so the baseline is 3. The description adds meaning beyond the schema: the cursor is always returned even on empty pages, and a trailing partial line is not lost at EOF; the overall 100000-char cap applies per page. These nuances are not in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and object: 'Read a bounded snapshot of a kimi session's visible conversation from kimi's native agents/wire.jsonl'. It clearly states what the tool does, where data comes from, and what it does not do (no sending, no waiting). The purpose is immediately distinguishable from sibling tools even without naming them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description makes the read-only, non-interfering nature explicit ('does not send anything into the run, does not take the session lock, does not wait'), which tells an agent when to pick this over mutations like kimi_resume. It doesn't explicitly name sibling tools, but the behavioral contrast is clear enough. Not a 5 because it never states direct conditions like 'use this when you need history without resuming'.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
kimi_modelsARead-onlyIdempotent
List the models this kimi installation has configured right now — read live from kimi provider list --json. Use it to pick a model value for kimi / kimi_reply. Starts no task. This is the configured catalog, not a paid probe of every endpoint.
| Name | Required | Description | Default |
|---|---|---|---|
| search | No | Optional substring filter on model id, e.g. 'k3', 'stepfun'. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and destructiveHint=false. The description adds valuable context: it reads live from `kimi provider list --json`, 'Starts no task' (quick operation), and clarifies it is a cheap lookup rather than a full endpoint probe. This goes beyond the annotations without contradicting them.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four short sentences, each carrying distinct value: purpose, data source, use case, and economic warning. Front-loaded with the verb and resource, no filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple list tool with one optional parameter and no output schema, the description covers the main needs: what it returns (list of models), when to call it, that it is read-only and cheap. It could mention result formatting or that the search filters by model id, but the schema handles that parameter, so nothing critical is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description for the single `search` parameter is fully self-explanatory (100% coverage), specifying it as an optional substring filter with examples. The description adds no parameter-specific information, which is acceptable given the schema already covers it fully — baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description starts with a specific verb ('List') and resource ('models this kimi installation has configured'), making the operation unambiguous. It explicitly states it is for picking a `model` value for `kimi`/`kimi_reply`, which distinguishes it from sibling tools that perform replies.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It directs the agent to use this tool to select a model for kimi/kimi_reply, which is a clear use case. It also implies when not to use it by noting it is the 'configured catalog, not a paid probe,' though it doesn't explicitly list exclusions or alternative conditions beyond naming the reply tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
kimi_replyADestructive
Send a new turn to an existing kimi session that is not executing right now — including one that timed out or was cancelled: the session survives in kimi's own store, so resume it here instead of restarting with kimi. kimi still has its prior turns (but never this conversation), so the follow-up can be short. Survives restarts of this server. For a turn still running under 'acp', use kimi_send instead.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | Absolute path override. Defaults to the directory where the session started. | |
| model | No | Model alias as configured in kimi, e.g. 'kimi-code/k3' or 'stepfun-high/step-3.7-flash'. Defaults to kimi's own default_model. kimi_models lists what this install has configured. | |
| prompt | Yes | Follow-up message for this session. | |
| session | Yes | Session id from a [session: <id>] prefix, or from kimi_sessions. | |
| add_dirs | No | Comma-separated extra workspace directories passed as kimi --add-dir (print) or ACP additionalDirectories (acp). Each path must be absolute. | |
| thinking | No | ACP thinking config (`session/set_config_option` id=thinking). Print transport has no thinking flag — kimi has no CLI --effort; pick a model alias instead. | |
| transport | No | Usually omit. The default 'acp' keeps kimi up (`kimi acp`) so a running turn can be steered or aborted with kimi_send. 'print' is kimi -p --output-format stream-json: one process per turn that cannot be reached while it works. -p is last (greedy). | |
| timeout_ms | No | Usually omit — the server default is generous. Override only when the task's real size demands it. A run killed at the deadline is not lost: it still returns its session id and is resumable with kimi_reply. | |
| approval_mode | No | ACP session mode: 'yolo' (auto-approve everything), 'auto' (auto-approve safe ops), 'default' (ask — unusable headless), 'plan' (read-only). Server default is yolo. Print transport cannot take -y/--auto/--plan with -p (the CLI rejects that); prompt mode already executes tools without confirmation, and 'plan' is rejected on print. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark destructiveHint=true and readOnlyHint=false, and the description adds substantial context beyond that: session survival in kimi's store, persistence across server restarts, that kimi retains prior turns but never this conversation, and that a timeout-killed run is resumable. It also explains the difference in reachability between transport modes. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is four tightly packed sentences. The core purpose is front-loaded, then it adds session persistence, follow-up brevity, and sibling routing. No filler; every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 9-parameter tool with no output schema, the description covers the essential behavioral dimensions: when to use, what happens on timeout, session longevity, transport trade-offs, and routing. It even hints at the return (session id) and missing conversation context. Nothing an agent needs to decide correctly is omitted.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, yet the description enriches several parameters: it explains session ID sources, why transport should usually be omitted and the reachability difference, timeout override guidance including resumability, and approval_mode headless implications. This goes well beyond the schema's own descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Send a new turn') and names the exact resource ('existing kimi session that is not executing right now'). It explicitly distinguishes itself from kimi_send and kimi, and even includes edge cases like timed-out or cancelled sessions. This fully separates it from all six siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It states precisely when to use this tool versus alternatives: 'For a turn still running under acp, use kimi_send instead' and 'resume it here instead of restarting with kimi'. This is explicit routing with a clear condition, leaving nothing to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
kimi_runningARead-onlyIdempotent
List kimi turns executing at this moment — the ones kimi_send can reach — with session id, working directory, elapsed time, and messages already sent in. Only acp-transport runs appear; 'print' runs are unreachable mid-run. For past sessions use kimi_sessions.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is known. The description adds the behavioral constraint that only acp-transport runs are reachable and that 'print' runs cannot be accessed mid-run, which is useful context. However, it doesn't describe the return format or potential pagination, though with annotations covering safety, a 3 is appropriate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, with four sentences that each add value. The first sentence states the core purpose and key information fields, the second clarifies scope and exclusions, and the third routes to the appropriate sibling. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Though the tool has no output schema, the description lists what information the results contain (session id, working directory, elapsed time, messages). Combined with annotations clarifying read-only and idempotent behavior, and the clear use case and exclusions, the description is complete for an agent to invoke correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameterschen and schema description coverage is 100% (the schema is empty). With no parameters to document, the description naturally carries no parameter burden. The tool's output is well described, so this dimension is not applicable and a high score is given.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists currently running kimi turns, with specific details (session id, working directory, elapsed time, messages). It distinguishes from siblings by noting only acp-transport runs appear and that 'print' runs are unreachable mid-run, and points to kimi_sessions for past sessions. This is a specific verb+resource with clear scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly states when to use this tool (for current, reachable runs) and when not to ('print' runs are unreachable; for past sessions use kimi_sessions). The alternative (kimi_sessions) is named, providing clear routing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
kimi_sendADestructive
Deliver a message into a kimi turn that is executing right now. The default transport 'acp' keeps the turn reachable; 'print' runs cannot be reached, and a session that already finished takes kimi_reply, not kimi_send. Returns immediately; kimi's reaction appears in the answer of the kimi/kimi_reply call still waiting on that turn. kimi_running lists reachable sessions.
Note: the adapter reports the first result envelope; a follow_up queued behind the current turn is delivered but its answer is not awaited by the original call.
| Name | Required | Description | Default |
|---|---|---|---|
| command | No | 'abort' (default) cancels the current turn via ACP session/cancel; 'steer' cancels and immediately submits the message as a new user turn; 'follow_up' queues the message without interrupting. | |
| message | No | Text to deliver. Required for 'steer' and 'follow_up', ignored by 'abort'. | |
| session | Yes | Session id of the running turn (see kimi_running). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark it readOnly=false, idempotent=false, and destructiveHint=truehare, and the description adds crucial behavioral details: it returns immediately, the reaction surfaces in a separate pending reply call, and a follow_up is queued without awaiting its result. The note about the first result envelope further clarifies the async interaction model.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and information-dense: each sentence adds distinct value—reachability, command semantics, delivery timing, and caveats about result envelopes. There is no wasted wording.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the 100% schema coverage and annotations, the description still supplies essential contextual details: immediate return behavior, relationship to the waiting kimi_reply call, and the caveat about follow_up results not being awaited. This is sufficient for an agent to decide when and how to use the tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with each parameter already described in detail, including the command enum and the message requirement rules. The description reinforces the relationship between commands and turn behavior but doesn't substantially extend the parameter-level semantics already provided.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb ('Deliver') and resource ('a kimi turn that is executing right now'), clearly distinguishing this from kimi_reply, which is for finished sessions. It also clarifies transport constraints ('acp' vs 'print') that prevent misuse.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit when-to-use and when-not-to-use guidance: only for currently executing turns, not for 'print' transport or finished sessions. It names kimi_reply as the correct alternative for completed turns and points to kimi_running for finding reachable sessions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
kimi_sessionsARead-onlyIdempotent
List all kimi sessions started through this server, newest first, with their working directory — running or finished, including runs that timed out. Use it to recover an id for kimi_reply. For turns still executing (kimi_send targets), use kimi_running.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is covered. The description adds useful behavioral context by stating the ordering (newest first), the inclusion of timed-out runs, and the fact that it returns working directories. It doesn't describe pagination or output format, but for a read-only list tool with no output schema, the added context is meaningful.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loads the core behavior (list all sessions, newest first, with working directory), and then immediately provides the use case and the sibling alternative. Every sentence earns its place with no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, read-only list tool with strong annotations, the description is nearly complete. It covers scope, ordering, inclusion of timed-out runs, and how to use the result. The only minor gap is the lack of an explicit output format, but since there is no output schema and the tool is simple, this is a small omission.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the schema is trivially complete. The description adds no parameter-specific semantics because there are none to add. A baseline of 4 is appropriate for a zero-parameter tool.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists all kimi sessions with their working directory, newest first, and explicitly includes running, finished, and timed-out runs. It also distinguishes itself from kimi_running by noting that kimi_running is for turns still executing, which helps an agent understand the exact scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says to use this tool to recover an id for kimi_reply, and it names kimi_running as the alternative for turns still executing. This gives clear when-to-use and when-not-to-use guidance, which is strong for a list tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
7 tool updates
v0.1.0- First observed
kimi - First observed
kimi_history - First observed
kimi_models - First observed
kimi_reply - First observed
kimi_running - First observed
kimi_send - First observed
kimi_sessions
TDQS
Scored across 7 tools
Each tool targets a distinct phase of the Kimi session lifecycle: start (kimi), resume (kimi_reply), message a running turn (kimi_send), list running (kimi_running), list all (kimi_sessions), read history (kimi_history), and list models (kimi_models). The overlapping pairs (reply/send, running/sessions) are explicitly differentiated by execution state.
All tools share the kimi_ prefix with lowercase snake_case names. The only deviation is the root verb `kimi` itself for starting a new session, which is a natural base command; the pattern is otherwise uniform (kimi_ + verb/noun).
Seven tools cover the full lifecycle of orchestrating a Kimi CLI agent: start, resume, send, list running/all, history, and models. This is well-scoped for the server's stated purpose without redundancy.
Core session lifecycle is well covered: start, reply, send while running, list running/all, read history, and list models. Missing an explicit cancel/stop operation for running turns, which is a minor gap but likely handled outside the tool surface.
Maintenance
Related MCP Connectors
Source-checked CLI guides and model-aware planning for Claude Code, Codex, and Grok Build.
Develop, manage, and debug Railway projects, services, and deployments from within agents.
Shared memory and actions for Claude, Kiro, OpenAI, Cursor, and other MCP-compatible AI clients.
Real-time chat for AI agents. Claude Code, Cursor, Cline and Codex join channels over MCP.
Related MCP Servers
- AlicenseBqualityDmaintenanceMCP server wrapping Kimi Code CLI (kimi-k2.5) to provide tools for filesystem, shell, web, and agent operations.1414 npm7MIT
- AlicenseAqualityDmaintenanceBridges MCP clients to Moonshot AI's Kimi Code CLI, enabling file analysis, brainstorming, batch tasks, code reviews, and session management within editors like Claude Desktop and Cursor.14316 npm1MIT
- AlicenseNot gradedqualityBmaintenanceBridges Kimi Code CLI to OpenAI Computer Use, enabling Kimi to control local macOS applications via MCP.5 npm6MIT
- FlicenseAqualityBmaintenanceProvides Claude Code with an asynchronous expert advisory service via kimi CLI, maintaining conversation-level memory and automatically binding to kimi sessions for cost-effective guidance at key checkpoints.5-