Kiro IDE module

[bpmct]

A discussion dedicated to the Kiro IDE module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
17 / 25	17 / 25	20 / 20	N/A	8 / 10	78 / 100

Drilldown

Presentation & Onboarding — 17 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides examples for default usage, opening in a specific directory, and configuring MCP servers. Each example shows sensible defaults and different configuration modes.
Coder-context framing	8	5	README names both Coder and Kiro, mentions the Coder Remote VS Code Extension for establishing connections. However, it does not clearly explain what the module adds on top of Coder or show where Coder fits in the overall flow—it jumps directly to usage examples.
Visual preview	5	0	No image, GIF, or video in the README. Only an icon reference in frontmatter.

IDE Integration — 17 / 25

Criterion	Max	Score	Notes
Dashboard entry point	7	7	Uses coder_app via the vscode-desktop-core module with proper configuration (slug, display name, icon, order, group).
Managed configuration	6	6	Documented support for managed MCP server configuration via the mcp input variable, which writes to ~/.kiro/settings/mcp.json. README includes a complete example with GitHub MCP server setup.
Configurable folder or workdir	6	4	The folder variable is documented and tested, but the README example shows usage without explaining what it does or why a user would set it. The variable description is minimal ("The folder to open in Kiro IDE").
Pre-installed extensions	6	0	N/A - not a web IDE, this is a desktop IDE launcher. However, since this criterion is specific to web IDEs and the rubric does not provide N/A handling for individual track criteria, scoring 0.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	The MCP example uses data.coder_external_auth.github.access_token which is a proper auth path. No inline secrets in README examples. The module itself has no sensitive inputs (it only accepts agent_id, folder, and configuration strings).
Non-hardcoded auth path	4	4	README demonstrates OAuth via coder_external_auth for the GitHub MCP server example, avoiding raw API keys.

Restricted-Environment Readiness — N/A

Criterion	Max	Score	Notes
Mirrorable artifact source	10	N/A	Module downloads nothing; it only generates URLs and optionally writes configuration files. No artifacts to mirror.
Bring-your-own binary	5	N/A	Module installs nothing; Kiro is expected to be installed on the client side (desktop IDE).
Egress transparency	3	N/A	Module makes no network calls itself; it generates kiro:// URLs for the client and optionally writes local config.
Runs without sudo	2	N/A	The coder_script for MCP writes to $HOME/.kiro/settings/mcp.json using standard shell commands (mkdir, echo, base64, chmod) with no sudo invocations. However, since this is the only script and it verifiably needs no privileges, this would score 2/2 if applicable. Marking N/A per rubric since module has minimal scripting footprint.

Restricted-Environment Readiness: All criteria N/A (module downloads/installs nothing of its own). Theme excluded from denominator.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	4	Variables have descriptions and sensible defaults. However, descriptions are minimal (e.g., "The folder to open in Kiro IDE" doesn't explain use cases). No validation blocks present where they could be useful (e.g., validating mcp is valid JSON if non-empty).
Test coverage	4	4	Both .tftest.hcl and main.test.ts present. Terraform tests cover URL generation logic with different parameter combinations. TypeScript tests cover end-to-end behavior including MCP file writing in a container. Good coverage of business logic.

Overall — 78 / 100

Raw 62 / 80 → round(62 / 80 × 100) = 78

---

Scored against SCORECARD.md on 2026-07-15 with claude-sonnet-4-5.