Kiro

Kiro

Kiro, the agentic IDE from AWS, loads MCP servers, steering files and agent hooks from your workspace's .kiro folder. Vorim uses all three. The MCP server lets the agent check its own permissions, the steering file tells it what to do when Vorim says no, and a PreToolUse hook checks every file write, shell command and MCP call against the agent's Vorim scopes before it runs. A call the agent isn't granted never runs.

Install

From your project root, run the installer. It writes four files into .kiro and merges Vorim into an existing mcp.json rather than replacing it.

curl -fsSL https://vorim.ai/hooks/kiro/install.sh | bash

Then set two variables in the environment Kiro starts from, add VORIM_API_KEY to the Mcp Approved Env Vars setting so the MCP config can read it, and restart Kiro.

# key scopes: permissions:read, audit:write
export VORIM_API_KEY=agid_sk_live_...
export VORIM_AGENT_ID=agid_...

What gets installed

• .kiro/settings/mcp.json adds the vorim MCP server.
• .kiro/hooks/vorim.json a PreToolUse hook on write, shell and MCP tools that runs the Vorim check and blocks the call with exit code 2 when the agent lacks the scope, and a PostToolUse hook that records each completed call in the agent's audit trail.
• .kiro/steering/vorim.md tells the agent not to retry or work around a Vorim denial, and to check permission itself before actions the hooks can't see.
• .kiro/vorim/vorim-hook.mjs the hook itself, a single Node script with no dependencies.

{
  "version": "v1",
  "hooks": [
    {
      "name": "vorim-permission-gate",
      "trigger": "PreToolUse",
      "matcher": "write|shell|@mcp",
      "action": { "type": "command", "command": "node .kiro/vorim/vorim-hook.mjs pre" },
      "enabled": true
    },
    {
      "name": "vorim-audit",
      "trigger": "PostToolUse",
      "matcher": "write|shell|@mcp",
      "action": { "type": "command", "command": "node .kiro/vorim/vorim-hook.mjs post" },
      "enabled": true
    }
  ]
}

How tools map to scopes

The hook picks the scope from the tool name. Reads and searches need agent:read, file writes need agent:write, shell commands need agent:execute, sending a message needs agent:communicate, and payments or refunds need agent:transact. Anything it can't classify needs agent:execute, and VORIM_SCOPE_MAP (a JSON object of tool-name patterns to scopes) overrides the mapping.

The hook fails closed, so if Vorim can't be reached the gated call is blocked; set VORIM_FAIL_OPEN=1 to let it through instead. Tool inputs are never sent whole. The audit event carries the tool name, the scope and a short summary such as a file path or a command, never file contents. Kiro runs hooks in the IDE and the CLI.

Book a demo for a walkthrough, or contact us for support. For enterprise needs, reach out at sales@vorim.ai.