Hook Types and Triggers#

Configuration#

Hooks go in .kiro/hooks.yaml at your project root:

1
hooks:
2
  # On save: regenerate unit tests for changed components
3
  - trigger: on_save
4
    pattern: "src/components/**/*.tsx"
5
    action: "Regenerate unit tests for this component in tests/components/"
6

7
  # On save: type-check changed TypeScript files
8
  - trigger: on_save
9
    pattern: "src/**/*.ts"
10
    action: "Run TypeScript type checker on the changed file and fix any type errors"
11

12
  # On commit: scan for hardcoded secrets
13
  - trigger: on_commit
14
    action: "Scan all staged files for hardcoded API keys, passwords, tokens, and connection strings. Flag any found with the exact file and line number."
15

16
  # On commit: enforce commit message convention
17
  - trigger: on_commit
18
    action: "Validate the commit message follows conventional commits format (type(scope): description). If not, suggest the correct format."
19

20
  # On API change: update documentation
21
  - trigger: on_api_change
22
    pattern: "src/routes/**/*.ts"
23
    action: "Update API documentation in docs/api/ to reflect changed routes"
24

25
  # On build: security audit
26
  - trigger: on_build
27
    action: "Run npm audit on package.json. If vulnerabilities found, categorize by severity and suggest fixes."
28

29
  # On PR open: generate description
30
  - trigger: on_pr_open
31
    action: "Analyze the diff between this branch and main. Generate a PR description with: summary of changes, affected files, breaking changes, and testing instructions."

How Hooks Execute#

When a trigger fires (e.g., you save a file), Kiro:

1. Matches the trigger — checks if the changed file matches the pattern glob
2. Reads the context — loads the current file, recent changes, and project structure
3. Executes the action — interprets your natural language instruction and performs the work
4. Reports results — shows a notification in the IDE (success, warnings, or flags)

The hook execution is asynchronous and runs alongside your work. You’ll see a subtle indicator that an agent hook is running, but it won’t block your editing.

The Pattern Parameter#

The pattern field is a glob that limits which files trigger the hook:

1
# Only fire when TypeScript source files change
2
pattern: "src/**/*.ts"
3

4
# Only fire when API route files change
5
pattern: "src/routes/**/*.ts"
6

7
# Only fire when test files change
8
pattern: "**/*.test.ts"
9

10
# Fire on any JavaScript/TypeScript file
11
pattern: "src/**/*.{js,ts,jsx,tsx}"

Without a pattern, the hook fires for any file change matching the trigger.

Safety: Why Natural Language > Scripts#

Traditional Git hooks are shell scripts — a pre-commit hook that runs npm test either passes or fails. Kiro’s natural language hooks are smarter:

1
# Instead of: "run eslint on src/"
2
# You write:
3
- trigger: on_save
4
  pattern: "src/**/*.ts"
5
  action: "Check the saved file for common coding issues: unused imports, missing error handling, hardcoded values that should be config. Fix any issues directly."

The agent understands what you want to check, not just which command to run. It can:

• Distinguish between a real secret and a test placeholder
• Understand that a missing import might be intentional in a WIP file
• Apply project-specific conventions from your steering file

This makes hooks significantly less brittle than shell scripts.

How Powers Work#

Each Power bundles:

• An MCP server (the actual tool implementation)
• Kiro-specific configuration (steering file snippets, hook templates, spec patterns)
• Auth setup (OAuth flow, API key management)
• Usage examples (prompt templates optimized for this tool)

The Powers Catalog#

Kiro ships with 100+ Powers. Here are the most impactful categories:

Spotlight: Figma Power#

The Figma Power is one of Kiro’s most impressive — it connects Figma design files to code generation:

1
# How it works:
2
# 1. Drop a Figma URL into your Kiro spec
3
# 2. Kiro fetches the design via Figma MCP
4
# 3. It understands: component hierarchy, design tokens, layout, interactions
5
# 4. Generates code matching your tech stack (React/Tailwind/TypeScript)
6
# 5. Uses Code Connect to map Figma components to existing components

This is fundamentally different from “screenshot to code” tools. The Figma Power understands your design system, not just pixel positions.

Enabling a Power#

From Kiro IDE:

1. Open the Powers tab (left sidebar)
2. Browse or search — try “PostgreSQL” to see database Powers
3. Click the Power card → review permissions and auth requirements
4. Click Add
5. Complete any auth flow (OAuth, API key entry)

The Power is now active. Kiro will use its tools during spec generation and task execution automatically.

Configuration#

Edit .kiro/kiro.json in your project root:

1
{
2
  "mcpServers": {
3
    "internal-api-docs": {
4
      "command": "node",
5
      "args": ["/path/to/mcp-server/index.js"],
6
      "env": {
7
        "API_DOCS_URL": "${INTERNAL_API_URL}"
8
      }
9
    },
10
    "pagerduty": {
11
      "command": "npx",
12
      "args": ["-y", "@pagerduty/mcp-server"],
13
      "env": {
14
        "PAGERDUTY_API_KEY": "${PAGERDUTY_TOKEN}"
15
      }
16
    }
17
  }
18
}

Security Rules for MCP#

1. Never hardcode tokens — use environment variables or Kiro’s secret store
2. Read-only tokens first — start with read-only API keys; upgrade when needed
3. Limit scope — Kiro can connect up to 5 MCP servers simultaneously; more = more token consumption + slower planning
4. Audit token permissions — check what each MCP server token can access

MCP in the Autonomous Agent#

When you run the autonomous agent (Web interface), MCP integrations are available during task execution. The agent can query external APIs, check documentation, and call services — all within the isolated sandbox.

The key difference from IDE MCP: the autonomous agent can use MCP tools across multiple repos in a single task, maintaining context throughout.