mirror of
https://github.com/Kilo-Org/kilocode.git
synced 2026-09-21 14:07:20 +08:00
dcf9c5a0be
* fix(config): expand MCP header env refs without wiping MCP set
Project kilo.jsonc with {env:…} in MCP headers caused the whole config
load to fail since 7.4.5, silently removing every MCP. Leave {env:} literal
during untrusted text substitution, expand only remote MCP headers after
parse, and drop individual MCPs with blocked env refs instead of the full set.
Fixes #12319
* fix(config): ban {file:} during MCP header env expansion
Post-parse header expand used trusted substitute without fileScope, so a
decoy in-repo {file:} plus any {env:} could read arbitrary paths into
remote MCP headers. Expand only {env:} and reject residual {file:}.
* fix(config): ban env secret expansion in project MCP headers
Untrusted project MCP headers must not read process.env or authEnv.
Reject {env:} and {file:} per entry with a warning so sibling MCPs still load.
* fix(config): drop global MCP headers on project URL retarget
When a project config overrides a same-named global remote MCP with a
new URL and does not restate headers, do not inherit expanded secret
headers from the global entry. Also fix MCP union narrowing in tests
and stop saying "header env expansion failed" when only validating.
* fix(config): do not mutate caller's patch in mergeConfig
Shallow-copy patch before delete p.mcp so probe-then-write
updateProjectConfig paths keep mcp on the original object.
* fix(config): secure project MCP header loading
* Update packages/opencode/src/config/config.ts
Co-authored-by: kilo-code-bot[bot] <240665456+kilo-code-bot[bot]@users.noreply.github.com>
* fix(config): secure layered MCP transitions
---------
Co-authored-by: arimu1 <19286898+arimu1@users.noreply.github.com>
Co-authored-by: Johnny Eric Amancio <johnnyeric@gmail.com>
Co-authored-by: kilo-code-bot[bot] <240665456+kilo-code-bot[bot]@users.noreply.github.com>
Kilo Code CLI
The AI coding agent built for the terminal. Generate code from natural language, automate tasks, and run terminal commands -- powered by 500+ AI models.
Kilo is the all-in-one agentic engineering platform. Build, ship, and iterate faster with the most popular open source coding agent.
Website · Install · IDE · CLI · Docs · Models · Gateway · Pricing · Kilo Pass
500+ models. One open source agent in VS Code, JetBrains, CLI, Slack, and Cloud.
Install
npm install -g @kilocode/cli
Or run directly with npx:
npx --package @kilocode/cli kilo
Getting Started
Run kilo in any project directory to launch the interactive TUI:
kilo
Run a one-off task:
kilo run "add input validation to the signup form"
Features
- Code generation -- describe what you want in natural language
- Terminal commands -- the agent can run shell commands on your behalf
- 500+ AI models -- use models from OpenAI, Anthropic, Google, and more
- MCP servers -- extend agent capabilities with the Model Context Protocol
- Multiple modes -- Plan with Architect, code with Coder, debug with Debugger, or create your own
- Sessions -- resume previous conversations and export transcripts
- API keys optional -- bring your own keys or use Kilo credits
Commands
| Command | Description |
|---|---|
kilo |
Launch interactive TUI |
kilo run "<task>" |
Run a one-off task |
kilo auth |
Manage authentication |
kilo models |
List available models |
kilo mcp |
Manage MCP servers |
kilo session list |
List sessions |
kilo session delete |
Delete a session |
kilo export |
Export session transcripts |
Run kilo --help for the full list.
Alternative Installation
Homebrew (macOS/Linux)
brew install Kilo-Org/tap/kilo
GitHub Releases
Download pre-built binaries from the Releases page.
Documentation
Links
License
MIT