Extensibility

Model Context Protocol (MCP) & Connectors

Kyro is a full client for the open Model Context Protocol (MCP). Connect local command-line tools or remote servers to expand Kyro's autonomous reasoning with external data and actions.

Schema Validation & Tool Namespacing

To prevent collision attacks and malicious tool execution, Kyro's MCP manager enforces strict rules:

• Namespaced Identifiers: Tools are prefixed with their server ID (mcp__{server_id}__{tool_name}).
• Strict Schema Checks: Arguments are validated against the server's declared inputSchema before dispatch.
• Untrusted External Classification: External MCP tools cannot be auto-approved by default; modifying actions require human authorization.

Native GitHub Connector with OAuth PKCE

The built-in GitHub connector uses OAuth 2.0 with Proof Key for Code Exchange (PKCE). Tokens are managed by the Vault service:

libkyro/src/connector/github.rs

// PKCE state verification & single-flight token refresh
// Bearer tokens are stored in the OS Keyring Vault
// Plaintext secrets are never returned in IPC responses

Per-Action Governance Policies

Inside Kyro's Connections Modal, users can configure granular permissions per tool:

• Allow (Auto): Permits read-only inspection queries without prompting.
• Ask Always: Requires explicit human confirmation before the tool runs.
• Deny: Unconditionally blocks the tool from being called by the agent.