sbx/kiro-kit:20260827-2d26f13b91e884116ff94ea5f1819adbb33b4ec0

schemaVersion: "2"
kind: sandbox
name: kiro
version: 1.0.0
displayName: Kiro
description: Kiro CLI by AWS, with interactive device-flow authentication.
sandbox:
    image: docker.io/sbx/kiro-image:latest
    entrypoint:
        - kiro
    command:
        default:
            - chat
            - --trust-all-tools
        interactive:
            - chat
            - --trust-all-tools
agentInstructions:
    filename: KIRO.md
permissions:
    network:
        allow:
            - cli.kiro.dev
            - prod.download.cli.kiro.dev
            - kiro.dev
            - archive.ubuntu.com
            - security.ubuntu.com
            - ports.ubuntu.com
            - download.docker.com
            - client-telemetry.us-east-1.amazonaws.com
            - cognito-identity.us-east-1.amazonaws.com
            - desktop-release.q.us-east-1.amazonaws.com
            - management.us-east-1.kiro.dev
            - prod.us-east-1.auth.desktop.kiro.dev
            - prod.us-east-1.telemetry-v2.kiro.dev
            - runtime.us-east-1.kiro.dev
environment:
    variables:
        IS_SANDBOX: "1"
setup:
    install:
        - command: kiro-cli setup --no-confirm
          user: agent
          description: Run Kiro CLI setup
    startup:
        - command:
            - sh
            - -c
            - command -v apt-get > /dev/null 2>&1 && (apt-get update -qq -y > /dev/null 2>&1 || true) &
          user: root
          description: Update apt package cache in background
        - command:
            - sh
            - -c
            - |
              set -e
              [ -n "$MCP_GATEWAY_URL" ] || exit 0
              mkdir -p "$HOME/.kiro/settings"
              cat > "$HOME/.kiro/settings/mcp.json" <<EOF
              {
                "mcpServers": {
                  "mcp-gateway": {
                    "url": "$MCP_GATEWAY_URL",
                    "headers": {
                      "Authorization": "Bearer $MCP_SENTINEL_TOKEN_NAME"
                    }
                  }
                }
              }
              EOF
          user: agent
          description: Register the sandbox MCP gateway in ~/.kiro/settings/mcp.json