v0.10.7 — why this one, answered on npm too

The comparison against the tools that came before Kiro-Kit was only on the repository README. Someone deciding on npm never sees that page, so the package page now carries it too: what starter templates, settings managers, config generators, and steering collections each do, where each stops, and where Kiro-Kit is the wrong choice.

First release cut by CI

This version was published by the workflow, not by a person. Authentication is an OIDC identity GitHub mints for the publish job and npm accepts as a trusted publisher — there is no token in the repository to leak, and none to rotate when it expires.

The release path is now: bump the version, merge, push a tag. The workflow refuses to publish if the tag disagrees with package.json, and skips instead of failing if the version is already on npm.

Published with provenance — the package is cryptographically linked to the commit and workflow that built it.

npx kiro-kit@0.10.7 init

v0.10.6 — demo on the package page

Cosmetic release. 0.10.5 went out an hour before the demo GIF landed in the package README, and an npm page only refreshes when a version is published — so the GIF ships here.

Package content is otherwise identical to 0.10.5.

Since 0.10.4, for anyone catching up

• The npm page was serving a README from the v0.3.x era: it advertised six presets when there are nine, carried per-preset counts that had drifted, and described the MCP _disabled_ behaviour that 0.10.3 had already fixed. Rewritten against what actually ships, with per-preset catalogs now pointing at the generated reference so the page cannot drift again.
• Documented flags corrected against the source: -v is --version, not --verbose, and --quiet has no -q shorthand. --preset and kiro-kit spec new were missing entirely.

npx kiro-kit@0.10.6 init

v0.10.4 — MCP servers that start, and a publish that can't ship a stale build

MCP servers no longer open red in a fresh workspace

init used to write server definitions Kiro could not start. Five separate causes, all fixed:

• ${WORKSPACE_ROOT} was written verbatim into args — Kiro does not interpolate it, so the filesystem server got a literal path. It is now resolved at write time.
• Credentialed servers were "disabled" by renaming the key to _disabled_<name>, which is not a Kiro convention — Kiro saw a server literally named _disabled_github and tried to launch it. They now use Kiro's own "disabled": true field with a _comment naming the variable to set. Existing _disabled_* keys migrate on the next init.
• uvx servers (git, fetch) shipped enabled but need the uv Python toolchain. They now ship disabled with install instructions.
• An unresolved ${VAR} in a server's env disables that server instead of letting it fail at launch.
• MCP setup was nested inside the "Configuring Powers" task, so --powers none silently skipped it. It is its own task now, and both .mcp.json and .kiro/settings/mcp.json come from one normalised config.

A server you enabled by hand is never switched back off, and user-defined servers are still never overwritten.

A stale dist/ can no longer be published

npm publish packs whatever sits in dist/, and nothing rebuilt it first — so kiro-kit@0.10.3 on npm shipped a build from 20 May: 7 presets instead of 10 (no sa, kiro-kit-dev, ai-engineer), none of the MCP fixes above, plus 41 stray .coverage files. That version is now deprecated on npm — use 0.10.4.

packages/cli now runs prepublishOnly: clean && build, so publishing always rebuilds from source.

Also fixed

• A backup/restore property test generated . as a filename, so the write failed with EISDIR on some seeds — read as CI flake rather than a generator bug.
• Documents named after an Object.prototype key (toString, constructor, …) no longer break the parity-sync rebrander: gray-matter's cache is a plain object, so those names hit the prototype and parsed to body: undefined.

Verified in the published package

10 preset directories, the MCP normaliser present in the bundle, zero stray files, and npx kiro-kit init --preset sa produces a workspace whose mcp.json has no _disabled_ keys and no unresolved ${WORKSPACE_ROOT}.

npx kiro-kit@0.10.4 init

v0.10.0 — ai-engineer preset + green CI

v0.10.0 — ai-engineer preset + green CI

For building production chatbots and AI agents on AWS. Based on data-ai:
20 agents, 35 skills, 70 commands, 7 native hooks, 4 workflows.

• Skills: bedrock-agentcore (Runtime deployment, Harness vs Runtime vs
  Lambda, Memory tiers, the 0.0.0.0:8000/mcp streamable-HTTP contract),
  agentcore-gateway-mcp (Lambda/OpenAPI/Smithy to MCP tools, the four
  outbound auth modes, the IAM SigV4 compatibility matrix, semantic tool
  discovery, the DYNAMIC-mode gotcha), mcp-server-hosting (remote MCP on
  Lambda/Fargate/Runtime, OAuth via Cognito/Okta/Auth0, the RFC 7235 401 +
  WWW-Authenticate handshake), strands-agents, bedrock-rag,
  agent-evaluation.
• Steering: aws-native-agents, mcp-architecture,
  agent-design-patterns, agent-evaluation, responsible-ai.
• Native hooks: Prompt Change Eval, Tool Contract Check, Agent Card Update.
• 4 example specs: AgentCore Support Chatbot, MCP Server on Lambda,
  RAG Knowledge Assistant, Multi-Agent Orchestrator.
• Powers: AWS IaC + Terraform (essential), Context7/Exa/Hugging Face
  (recommended), Langfuse/LangSmith/Datadog/Pinecone/Snyk (optional).

AWS claims are grounded in an adversarially verified research pass. Compute
pricing and blanket component-GA claims are deliberately excluded in favour
of links to the live AWS release-notes and pricing pages.

CI had never been green: 40 consecutive failed runs going back to 18 May.

• pnpm/action-setup aborted on a duplicate version declaration, so every run
  died at setup before reaching install.
• packages/cli had no vitest.config.ts, so pnpm run test matched no files
  and exited 1.
• lint invoked eslint, which was neither installed nor configured. Added
  eslint 9 + typescript-eslint with a flat config.
• Real bug: ThemedPrompt gated all four prompts on
  process.stdin.readable instead of the injected capability.isTTY,
  contradicting its own interface docs. stdin.readable is true for a pipe, so
  non-interactive runs (CI, pipes, tests) blocked forever waiting on input.
• The p11 emoji/PII checks sampled 100 of ~450 files at random, so real
  violations surfaced only intermittently and read as flake; both now iterate
  every file. Exemption matching also compared forward-slash patterns against
  path.relative() output, silently missing on Windows only.
• Removed a decorative emoji prefix from the deep-security-scan command
  description in four presets; it violated the repo's own no-emoji test and
  slipped in while CI was red.
• Removed dead code surfaced by the first working lint run.
• Corrected stale "6 presets" counts in README and docs (now 9).

Verified: lint, typecheck, test (586 passing), build and structural all green
across 9 CI jobs (ubuntu/macos/windows on Node 18/20/22).

v0.8.0 — sa (Solutions Architect) preset

New sa (Solutions Architect) preset — the 8th

For designing and documenting cloud architectures: diagrams, documents, decks, and IaC.

• draw.io skills drawio-aws / drawio-azure / drawio-gcp from sparklabx/drawio-ai-kit (MIT, attributed). Prerequisite: npm i -g github:sparklabx/drawio-ai-kit for the drawio-ai CLI (real-stencil search + diagram validation)
• Document skills: architecture-deck (.pptx presentations), architecture-doc (.docx Solution Architecture Documents), mermaid-diagrams (C4 context/container/component, sequence, deployment, state)
• Steering: AWS Well-Architected (6 pillars), C4 model, ADRs, diagramming conventions (draw.io vs Mermaid, stencil discipline), IaC conventions (CloudFormation vs Terraform, least privilege, state, drift)
• Commands iac/: cloudformation, terraform-module, well-architected-review
• 4 worked example architecture specs: Three-Tier Web (CloudFormation), Event-Driven Microservices (Terraform), Data Lake (Glue/Athena/Lake Formation), Multi-Region DR (RTO/RPO, Route 53 failover)
• Powers: Terraform + AWS CDK (essential), Context7 + Figma (recommended), Datadog + Snyk (optional)

Install:

npx kiro-kit init --preset sa

Full changelog: CHANGELOG.md

v0.7.0 — kiro-kit-dev preset (7th)

New kiro-kit-dev preset for developing Kiro-Kit itself: specialized steering, 3 meta example specs, wired through schema/MCP/tests.

v0.6.0 — 12 research-grounded example specs

12 new example specs (frontend/backend/devops/data-ai): landing/CWV, queue/webhooks/caching, AWS serverless/CDK/CI-CD, ML/LLM eval + RAG. Enhanced template (Out of Scope, Files & Interfaces, E2E + docs task).

v0.5.0 — kiro-kit powers install

New kiro-kit powers install command (auto-install real Kiro Powers). Example specs show in Kiro Specs panel (.config.kiro), MCP → .kiro/settings/mcp.json, broken links pruned.

v0.4.1 — Security: remove @mcp/docs-seeker RCE

Removed unclaimed @mcp/docs-seeker scope (dependency-confusion RCE) from preset manifests; corrected MCP package names (git/fetch → uvx, playwright → @playwright/mcp).

v0.4.0 — Native Agent Hooks, example specs, enriched Powers

Native Kiro Agent Hooks (7/preset, opt-in), worked example specs per preset, enriched Powers catalog + credential-free MCP auto-wire. See CHANGELOG.md.