Kiro
Kiro MCP Setup: .kiro/settings/mcp.json, autoApprove and OAuth
How do I add an MCP server to Kiro?
Add the server under mcpServers in .kiro/settings/mcp.json for one workspace or ~/.kiro/settings/mcp.json for all workspaces. Use command and args for local servers, or url and headers for remote ones. In the CLI you can also run kiro-cli mcp add.
Config file locations
- Workspace: .kiro/settings/mcp.json
- User: ~/.kiro/settings/mcp.json
- If both exist they merge, and the workspace wins. An agent's own mcpServers field ranks above both.
In the IDE, open the command palette and run Kiro: Open workspace MCP config (JSON) or Kiro: Open user MCP config (JSON). Changes apply when you save.
Local and remote servers
.kiro/settings/mcp.json
{
"mcpServers": {
"web-search": {
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-bravesearch"],
"env": { "BRAVE_API_KEY": "${BRAVE_API_KEY}" }
},
"api-server": {
"url": "https://api.example.com/mcp",
"headers": { "Authorization": "Bearer ${API_TOKEN}" }
}
}
}In the IDE, Kiro only expands environment variables you approve. Add them under the Mcp Approved Env Vars setting. The CLI does not load project .env files, so export variables before you start it.
Auto-approve and disable tools
- autoApprove: tool names to run without prompting. Use "*" for all tools.
- disabledTools: tool names the agent should not get.
- disabled: set to true to turn a server off without deleting it.
.kiro/settings/mcp.json
{
"mcpServers": {
"server-name": {
"command": "uvx",
"args": ["mcp-server-fetch"],
"autoApprove": ["fetch"],
"disabledTools": ["delete_file", "execute_command"]
}
}
}Add servers from the CLI
Terminal
kiro-cli mcp add \ --name "awslabs.aws-documentation-mcp-server" \ --scope global \ --command "uvx" \ --args "awslabs.aws-documentation-mcp-server@latest" \ --env "FASTMCP_LOG_LEVEL=ERROR"
Inside a chat session, run /mcp to see loaded servers, their status and tools.
OAuth servers
Most servers use dynamic client registration and need no extra config. For others, add an oauth object. clientSecret works in the CLI only. The IDE supports public clients without a secret.
.kiro/settings/mcp.json
{
"mcpServers": {
"remote-server-with-oauth": {
"url": "https://api.example.com/mcp",
"oauth": {
"clientId": "your-client-id",
"redirectUri": "http://127.0.0.1:8080/oauth/callback",
"oauthScopes": ["read", "write"]
}
}
}
}Get Kiro settings changes by email
When a setting, flag or permission rule in this guide changes, it goes in the weekly AgentAtlas update, checked against the vendor docs. One email a week.
Sources
More on Kiro
More Kiro guides
Other guides
Reviewed Oct 13, 2026. Settings change often; the linked vendor docs are the source of truth.