Recipes · Chapter 35 of 63
Add an MCP Server
Add an MCP server to .kiro/settings/mcp.json or the global file, understand agent, project, and global precedence, and keep autoApprove empty.
All levels 2 min read last reviewed 2026-09-04
◎ Learning objective
Configure a local or remote MCP server for one workspace, approve its tools deliberately, and make it fail fast in automation.
MCP is the protocol Kiro uses to reach external tools and data. You add a server by describing how to start it, or where to reach it, in a small JSON file.
When to use this
Add an MCP server when the agent needs something outside your repository: a documentation search, an issue tracker, a database, a design tool. If a Power already bundles the server you want, install the Power instead. It carries the same MCP configuration plus instructions on when to use it.
Steps
-
Decide the scope. Team-wide servers belong in the workspace file so everybody gets them. Personal servers belong in your global file.
-
Create the file for that scope. Workspace:
.kiro/settings/mcp.json. Global:~/.kiro/settings/mcp.json. -
Add a local server under
mcpServers. Usecommand,args, andenv. Environment variables expand with${VAR}syntax, so no secret is written into the file..kiro/settings/mcp.json{ "mcpServers": { "docs-search": { "command": "npx", "args": ["-y", "example-docs-mcp-server"], "env": { "DOCS_TOKEN": "${DOCS_TOKEN}" }, "autoApprove": [], "disabled": false } } } -
Add a remote server with
urlinstead ofcommand, plusheadersoroauthfor authentication. In the CLI,/mcp authstarts the sign-in,/mcp cancel-authcancels a pending one, and/mcp logoutclears saved credentials. -
Leave
autoApproveas an empty list. Work for a week, watch which tools the server actually uses, then add those specific names."autoApprove": "*"exists and approves everything, including tools the server adds later. -
Mask anything you do not want available with
disabledTools, or turn the whole server off with"disabled": true. -
Save the file. The CLI hot-reloads agent and MCP settings on save since v2.10.0, so you keep your session and its history.
-
For headless or CI runs, add
--require-mcp-startupto the command so the job fails immediately when a server cannot connect.
Check it worked
In the IDE, open the MCP servers panel and confirm the server shows as connected. In the CLI (v2.21.0 and later), the configuration panel lists MCP servers next to agents, Powers, steering, skills, and hooks. Then ask the agent to do something only that server can do, and watch for the approval prompt on the first call.
Common problems
- The server never connects. Run the
commandandargsyourself in a terminal. Most failures are a missing runtime or a package name typo. - An environment variable is empty.
${VAR}expands from your environment, not from the repository. Export it in your shell profile or your CI secret store. - Approval prompts on every call. That is the default and it is correct. Add the read-only tool names to
autoApproveonce you know them. - Two servers with the same name. The closest scope wins: agent, then project, then global. Rename one if you meant to run both.
- A pipeline hangs. Add
--require-mcp-startup. Without it a headless run can wait on a server that will never answer. - You need logs. The IDE writes to the “Kiro - MCP Logs” output channel.
Related
- MCP explains the protocol and the configuration keys.
- Add a Power bundles MCP config with instructions.
- Set up permissions.yaml controls the
mcpcapability.
Frequently asked questions
Where is the Kiro MCP config file?
Workspace configuration is .kiro/settings/mcp.json inside the repository. Personal configuration is ~/.kiro/settings/mcp.json. An agent can also carry its own MCP configuration, and the closest scope wins: agent, then project, then global.
How do I stop Kiro asking to approve every MCP tool?
Add the specific tool names you trust to that server's autoApprove list. Avoid the wildcard value, which approves everything the server offers now and in future. MCP calls are also checked against the mcp permission capability.
Why does my MCP server not start?
Check the command runs on its own in a terminal, check any ${VAR} environment variables are actually set, and read the Kiro MCP Logs output channel. In headless runs, add --require-mcp-startup so the job fails fast instead of hanging.
☰ Chapter summary
- Workspace MCP config lives in .kiro/settings/mcp.json; personal config lives in ~/.kiro/settings/mcp.json.
- Precedence runs agent over project over global, so the closest scope wins.
- Local servers use command, args, and env; remote servers use url with headers or oauth.
- Start every server with autoApprove set to an empty list, then approve read-only tools you actually use.
- MCP calls are permission-checked under the mcp capability, and --require-mcp-startup fails a headless run fast.
All chapter summaries are collected on the revision page.
Related chapters
- ConceptsMCPMCP connects Kiro to external tools and data. Where mcp.json lives, the config keys that matter, precedence rules, and how to approve tools safely.
- RecipesAdd a PowerWhat a Kiro Power bundles, where Powers live, how to install one from the marketplace, a folder, or GitHub, and why cloud Powers appear read-only.
- RecipesSet Up permissions.yamlControl what Kiro's agent may do with permissions.yaml: the capability list, the deny over ask over allow order, match and exclude globs, and the six scopes.
- RecipesRun Kiro CLI Headless in CIRun kiro-cli chat --no-interactive in a pipeline: authenticate with KIRO_API_KEY, trust the smallest tool set, and fail fast when MCP servers are missing.
- Hands-onAdvanced TutorialA production-shaped workflow that combines specs, steering, hooks, MCP, custom agents, and skills, written for engineers who already know the basics.