kimi-code-mcp is an MCP (Model Context Protocol) server that wraps the Kimi Code CLI (kimi-k2.5). It exposes 14 tools over stdio for filesystem, shell, web, and agent operations.
4 source files, no external runtime dependencies beyond @modelcontextprotocol/sdk and zod:
src/
index.ts — MCP server entry point (shebang, stdio transport, zodToJsonSchema, request handlers)
handlers.ts — TOOLS array (14 tool definitions with Zod schemas), TOOL_MAP, handleToolCall, buildPrompt
cli.ts — findKimiCli, buildKimiArgs, executeKimi (spawns kimi CLI as child process)
parser.ts — parseKimiOutput, extractTextParts, extractThinkParts, extractPlainText
Data flow: MCP request → index.ts validates with Zod → handleToolCall in handlers.ts builds a natural language prompt → executeKimi in cli.ts spawns kimi --print -y -p <prompt> → parser.ts extracts TextPart/ThinkPart from CLI output → result returned as MCP text content.
- No shell execution in spawn:
cli.tsusesspawn(binary, argsArray)with noshell: true— prevents command injection. - Single-pass regex for unescaping:
parser.tsusesstr.replace(/\\(\\|n|'|")/g, ...)instead of chained.replace()calls to avoid ordering bugs (e.g.,\\nmust stay as literal backslash-n, not become a newline). - Timeout double-reject guard:
executeKimiuses akilledflag so thecloseevent handler no-ops after a timeout kill. zodToJsonSchemais inlined: A minimal Zod-to-JSON-Schema converter lives inindex.ts— handles string, number, boolean, enum, optional, and.describe(). No need for a full library.KIMI_CLI_PATHmust be absolute: Usespath.isAbsolute()to reject relative paths.
npm install
npm run build # tsc → dist/
npm test # vitest run (68 tests)Tests live in src/__tests__/. Test files are excluded from tsconfig.json and the npm tarball.
KIMI_CLI_PATH— absolute path to the kimi binary (default:kimifrom PATH)MCP_KIMI_DEBUG— set to any value to enable debug logging to stderr
- Keep it minimal — this repo intentionally has 4 source files. Don't add files unless strictly necessary. Prefer editing existing files over creating new ones.
- No over-engineering — no classes, no decorators, no abstractions for one-time operations. Plain functions and const arrays.
- Tests required — every new or changed export must have tests in
src/__tests__/. Runnpm testbefore submitting. - No new runtime dependencies — the only runtime deps are
@modelcontextprotocol/sdkandzod. Think hard before adding another. - Security matters — never use
shell: truein spawn, never interpolate user input into shell commands, validate all paths. - Adding a new tool — add the tool definition to the
TOOLSarray inhandlers.ts, add its prompt builder case tobuildPromptin the same file, then add tests insrc/__tests__/handlers.test.ts. Update the tool count insrc/__tests__/schema.test.ts.
- TypeScript strict mode, ES2022 target, NodeNext module resolution
- ESM only (
"type": "module"in package.json,.jsextensions in imports) - No decorators, no classes — plain functions and const arrays
- Tests use vitest with
vi.mockfor child_process and fs mocking - Commit messages should not mention AI authorship