Skip to content

comment-hq/comment-io

v0.1.0

Work directly with people on shared files, documents, and structured data in Comment.io.

GitHubOpen Website

Comment.io for Kiro — preparation only

This Agent Plugins package points to the current public remote MCP endpoint https://comment.io/mcp, documented as exposing one run tool. It has not been authenticated in Kiro and is not ready for Powers submission. Agent Plugins v1 mcp.json has no portable OAuth configuration field; Kiro must discover and manage client registration or use its host-local OAuth settings. The repository's existing production publication remains pinned to alpha; endpoint reachability does not establish release status.

Before testing with a Client ID Metadata Document (CIMD), the owner must provide a reachable HTTPS document listing the exact fixed local callback Kiro will serve. Configure oauth.clientMetadataUrl and a matching oauth.redirectUri in Kiro's own MCP settings for this server; do not set clientId alongside clientMetadataUrl. Comment.io's authentication contract now also offers dynamic client registration (DCR) for public clients with no secret or scopes. Kiro documents an automatic DCR attempt when neither client ID nor metadata URL is set, but that flow has not been tested with Comment.io. Agent Plugins v1 mcp.json cannot carry host-specific OAuth settings. A human workspace member chooses and approves the agent in the browser. The connected host can receive workspace content; disconnecting ends future access, not content already received.

Kiro's submission requirements require a complete, tested, working package and an MCP service not in beta/preview. On October 8, 2026, the public Comment.io homepage said “Join the waitlist” and “We’re opening access gradually”; this does not establish eligibility under Kiro's no-beta/preview rule. Current repository artifacts are pinned to alpha. Max must confirm general availability and eligibility before submission. Kiro's creation and installation guides allow multiple powers in one repository, each with plugin.json at its package root; this directory is a valid package layout and may be imported from https://github.com/comment-hq/comment-io-plugins/tree/prep/gemini-kiro-packages/plugins/comment-kiro for local testing after the branch is updated. The required submission license field is omitted: the unified repository has no declared GitHub license or root LICENSE, so Max must approve the applicable license and rights before adding it. Publisher terms require Max's explicit approval before acceptance or submission; they include publisher support, at least 90 days of support for existing users after removal, distribution/marketing rights, and indemnification. No terms have been accepted.

Evidence and compatibility gate

Observed on October 9, 2026: an unauthenticated MCP initialize POST returned HTTP 401 with resource metadata, and authorization-server metadata advertised CIMD and registration_endpoint: https://comment.io/oauth/register. These checks do not demonstrate an authenticated connection. The following host checks have not run:

  1. Revalidate the final package against the Agent Plugins 1.0.0 schemas. With approval for a disposable registration and fixture, add this directory via Kiro's local plugin/power install surface. Verify keyword activation loads working-with-comment-io and the MCP connection targets https://comment.io/mcp. Test Kiro's DCR default; if choosing CIMD instead, configure the hosted URL and exact pinned callback in Kiro's host settings, never in portable mcp.json. Test IDE and CLI separately if both are intended distribution targets; record settings persistence.
  2. Complete browser consent with human approval. Check exactly run appears; invoke it with help and check You are AGENT in workspace WORKSPACE. Test reconnect, token refresh and revoked access without creating a new production grant. Record outputs with tokens removed and clean up the disposable fixture.
  3. Resolve the public waitlist/alpha evidence against Kiro's no-beta/preview criterion; confirm the approved license and rights, privacy/support links, and a complete working package. Only after eligibility is established should Max consider express approval of the publisher terms; do not submit based only on schema validity.

See MCP setup, authentication, and privacy. Support: support@comment.io.