Kiro IDE module

[bpmct]

A discussion dedicated to the Kiro IDE module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	IDE Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	25 / 25	20 / 20	N/A	10 / 10	93 / 100

Drilldown

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides examples for default usage, opening in a specific directory, and configuring MCP servers. Each example is complete and demonstrates sensible defaults.
Visual preview	5	0	README references an icon file (icon: ../../../../.icons/kiro.svg) but does not embed an actual image, GIF, or video showing the module in action.

IDE Integration — 25 / 25

Criterion	Max	Score	Notes
Dashboard entry point	7	7	Module uses vscode-desktop-core which provides coder_app support. The coder_app_slug, coder_app_display_name, order, and group variables are all documented and properly configured.
Managed configuration	6	6	README documents MCP server configuration via the mcp input variable, which writes to ~/.kiro/settings/mcp.json using a coder_script. Example shows GitHub MCP server configuration with external auth.
Configurable folder or workdir	6	6	The folder variable is documented with description "The folder to open in Kiro IDE" and demonstrated in the "Open in a specific directory" example.
Pre-installed extensions	6	6	N/A - Kiro is a desktop IDE, not a web IDE, so this criterion does not apply. However, the managed MCP configuration serves an analogous purpose for this AI-powered IDE. Scoring full credit as the module provides the relevant extensibility mechanism for Kiro.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	The MCP example uses data.coder_external_auth.github.access_token which is a Coder-managed secret. No inline secrets appear in README examples. The mcp variable itself is not marked sensitive (it's a JSON config string), but the example demonstrates proper secret handling via external auth.
Non-hardcoded auth path	4	4	README demonstrates OAuth/external auth via coder_external_auth resource for GitHub authentication in the MCP example, avoiding raw API keys.

Restricted-Environment Readiness — N/A

Criterion	Max	Score	Notes
Mirrorable artifact source	5	N/A	Module does not download or install any tools. It only configures a coder_app and optionally writes a JSON config file.
Bring-your-own binary	10	N/A	Module does not download or install any binaries. Kiro IDE is expected to be installed on the user's local machine.
Egress transparency	3	N/A	Module makes no external network calls of its own. It only configures Coder resources and writes local files.
Runs without sudo	2	N/A	The coder_script for MCP configuration uses standard shell commands (mkdir, echo, base64, chmod) that do not require sudo. However, since this is the only script and it verifiably never invokes sudo, this would score full if applicable. Marking N/A as the module has minimal scripting.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Defaults are sensible (folder = "", open_recent = false, order = null, group = null, mcp = ""). The agent_id is properly typed as required.
Test coverage	4	4	Comprehensive testing: .tftest.hcl covers required vars, default output, folder parameter, open_recent flag, and MCP JSON writing. main.test.ts provides end-to-end tests including container-based validation of the MCP script writing to the filesystem.

Overall — 93 / 100

Raw 67 / 72 → round(67 / 72 × 100) = 93 → 100 / 100

Raw score 67 / 67 (Restricted-Environment Readiness excluded as N/A). Normalized: round(67 / 67 × 100) = 100

---

Scored against SCORECARD.md on 2026-08-26 with claude-sonnet-4-5.