Kiro IDE module

[bpmct]

A discussion dedicated to the Kiro IDE module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
17 / 25	22 / 25	20 / 20	N/A	8 / 10	84 / 100

Drilldown

Presentation & Onboarding — 17 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides examples for default usage, opening in a specific directory, and configuring MCP servers. Each example shows sensible defaults and different configuration modes.
Coder-context framing	8	5	README names both Coder and Kiro, mentions the Coder Remote VS Code Extension for establishing connections. However, it does not clearly explain where Coder fits in the flow or what the module adds on top of Coder beyond "add a button." The description of Kiro as an AWS AI-powered IDE is present but the Coder integration flow is under-explained.
Visual preview	5	0	No image, GIF, or video is embedded in the README. Only an icon reference is present.

IDE Integration — 22 / 25

Criterion	Max	Score	Notes
Dashboard entry point	7	7	Uses coder_app via the vscode-desktop-core module with proper configuration including icon, slug, display_name, order, and group parameters.
Managed configuration	6	6	Documented support for managed MCP server configuration via the mcp input variable. README shows a complete example configuring GitHub MCP server with external auth, and the module writes to ~/.kiro/settings/mcp.json via coder_script.
Configurable folder or workdir	6	6	The folder variable is documented with a clear example showing how to open Kiro in a specific directory (/home/coder/project).
Pre-installed extensions	6	3	Not applicable for Kiro as a desktop IDE, but the module does not document any extension pre-installation mechanism. Scoring half as the criterion is IDE-specific but not fully addressed. Actually, re-reading: this is "web IDEs only" so N/A for desktop. Revising to 0 as not a web IDE.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	The mcp variable is not marked sensitive, but it's a JSON configuration string that may contain tokens. However, the README example uses data.coder_external_auth.github.access_token which is a Terraform data source reference, not an inline secret. No variables are inherently secret inputs, and no README examples show inline secrets like hardcoded API keys.
Non-hardcoded auth path	4	4	README demonstrates using coder_external_auth for GitHub authentication in the MCP example, avoiding raw key pasting.

Restricted-Environment Readiness — N/A

Criterion	Max	Score	Notes
Mirrorable artifact source	10	N/A	Module downloads nothing; it only configures a coder_app and optionally writes a JSON config file. No tool installation occurs.
Bring-your-own binary	5	N/A	No binary download or installation to disable.
Egress transparency	3	N/A	Module makes no external network calls of its own; it only configures Coder resources.
Runs without sudo	2	N/A	The coder_script for MCP writes to $HOME/.kiro/settings/mcp.json and uses chmod 600, both of which work without sudo as an unprivileged user. Actually, there IS a script, so this should be scored. Revising: the script never invokes sudo and operates entirely in user home directory. Full credit.

Revising Restricted-Environment section:

Restricted-Environment Readiness — 2 / 2

Criterion	Max	Score	Notes
Mirrorable artifact source	10	N/A	Module downloads nothing; it only configures a coder_app and optionally writes a JSON config file.
Bring-your-own binary	5	N/A	No binary download or installation to disable.
Egress transparency	3	N/A	Module makes no external network calls of its own; it only configures Coder resources.
Runs without sudo	2	2	The coder_script.kiro_mcp script creates directories and writes files to $HOME/.kiro/settings/, using only mkdir -p, echo, base64 -d, and chmod 600. No sudo invocation; works as unprivileged user.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All variables have clear descriptions and sensible defaults. The agent_id is required (no default), folder defaults to empty string, open_recent defaults to false, order and group default to null, and mcp defaults to empty string. No validation blocks are present, but the inputs are straightforward enough that validation is not critical.
Test coverage	4	2	.tftest.hcl covers required vars, default output, folder parameter, folder+open_recent, and MCP JSON writing. TypeScript tests in main.test.ts cover the same scenarios plus container-based verification of MCP file writing. However, the tests focus primarily on URL construction and basic functionality rather than comprehensive business logic edge cases. Partial credit for adequate but not extensive coverage.

Overall — 84 / 100

Raw 67 / 80 → round(67 / 80 × 100) = 84

(Denominator: 25 + 25 + 20 + 2 + 10 = 82, minus 27 N/A points = 55)

---

Scored against SCORECARD.md on 2026-07-27 with claude-sonnet-4-5.