Kiro MCP Server

Kiro memories

kiro_memory

Destructive

List, read, create, update, or delete Kiro memories under _kiro/memory and check memory sync status. Pass confirm:true to delete; writes fail in untrusted workspaces or below access level.

Instructions

List, read, create, update, or delete Kiro memories (_kiro/memory/*), like /memories, and read the memory sync status. Delete needs confirm: true. Kiro refuses writes in untrusted workspaces or below the configured memory access level (KIRO_REFUSED with Kiro's message).

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "action": "<action>",
      "session_id": "<session_id>"
    },
    "name": "kiro_memory"
  }
}

Input Schema

Name	Required	Description
`action`	Yes
`confirm`	No
`content`	No
`memory_id`	No
`session_id`	Yes	Kiro session id (sess_<uuid>).

Output Schema

Name	Required	Description	Default
`action`	Yes
`result`	Yes

Schema Changelog

Changes observed during successful MCP inspections.

First observedv0.1.1Nov 5, 2026

TDQS

A3.6/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already flag destructiveHint=true and openWorldHint=true, but the description adds real context beyond them: the confirm gate on delete and the fact that Kiro refuses writes in untrusted workspaces or below the configured memory access level, with the KIRO_REFUSED error code and Kiro's message surfaced. That is exactly the failure-mode information an agent needs before committing to a write. It does not say what gets destroyed on delete (whole file vs entry), which keeps it off a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tight sentences, front-loaded with the full action list so the agent sees scope immediately, followed by the confirm gate and the refusal conditions in priority order. No filler. Slightly dense packing of five concerns into one paragraph keeps it from a 5.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return formatting need not be described, and annotations cover the safety profile. What remains missing is material for a 5-parameter mutation tool: whether create requires content and whether memory_id is caller-chosen or generated, what sync_status reports, and any listing behavior. Reasonably complete on risk, incomplete on mechanics.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is only 20%, so the description must compensate. It partially does: it maps actions to the enum values and explains that confirm must be true for delete, and the '_kiro/memory/*' reference implies what memory_id addresses. However, content and the format/scope of memory_id go unexplained, and the description says 'read' where the enum value is 'get', which adds avoidable friction. Partial compensation for a documented-gap schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description enumerates concrete verbs (list, read, create, update, delete) against a specific resource (Kiro memories under _kiro/memory/*) plus sync status, and anchors the concept by comparing it to /memories. An agent can tell what this tool manipulates, though it does not distinguish itself from adjacent siblings such as kiro_knowledge or kiro_specs, so it stops short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by the action verb list rather than stated as when-to-use guidance; there is no explicit statement about when to prefer memory over knowledge or specs, or when sync_status is appropriate. The one operational rule given — 'Delete needs confirm: true' — is a call requirement, not alternative selection. Adequate but with clear gaps in routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.