XMemo for Kiro

imageValidate Power imageAgent Plugins 1.0 imageLicense: MIT

imageXMemo

Give Kiro durable, user-owned project memory and access to your curated XMemo Knowledge Base. Recall decisions from earlier sessions, resume unfinished work, preserve useful outcomes, and consult trusted reference material without placing credentials or private data in the Power package.

The Power connects only to the production XMemo service at https://xmemo.dev/mcp.

What you can do

• Recall prior decisions, conventions, TODOs, and project context.
• Resume interrupted work from a bounded checkpoint.
• Save concise outcomes that should survive the current conversation.
• Search authorized Knowledge Bases for runbooks and reference material.
• Create and maintain Knowledge items through the bundled REST adapter when an explicitly supplied credential has Knowledge write access.
• Keep current repository and runtime evidence authoritative when stored context is stale.

Install in Kiro

Requirements

• A current Kiro IDE installation.
• An XMemo account for OAuth, or an XMemo API key supplied through your local environment.
• Node.js 20 or newer only when using the optional Knowledge authoring adapter or local validation commands.

Install from GitHub

1. Open Kiro's Powers panel.
2. Select Add Custom Power > Import power from GitHub.
3. Enter https://github.com/yonro/xmemo-kiro-power.
4. Install the Power and start a new Kiro conversation.
5. Ask: "Use XMemo to recall the decisions for this project."
6. Complete the XMemo authorization flow when Kiro requests it.

After authorization, ask Kiro to check the XMemo identity and scopes. A visible connection alone does not prove that the account granted the operation you want.

How it works

Memory and Knowledge have separate purposes and permissions:

The Power never substitutes a Memory write for a Knowledge operation.

Authentication

OAuth is the default. The root mcp.json contains only the HTTPS production endpoint, allowing Kiro to manage OAuth without shipping client secrets or user credentials.

API key authentication is also supported. Keep the key in your environment or secret manager, then use the maintained XMemo CLI setup flow:

# Set XMEMO_KEY outside the repository before running this command.
xmemo mcp add kiro --auth key
xmemo doctor --client kiro

The Power supports both modes, but one Kiro connection should use only one mode. Disable duplicate XMemo MCP registrations to avoid repeated authorization prompts and duplicate tools. API key permissions are fixed when the key is issued; a key with only Memory scopes cannot access Knowledge.

See AUTHENTICATION.md for OAuth scopes, API key setup, credential handling, diagnostics, and failure recovery.

Knowledge authoring

Knowledge retrieval uses the hosted MCP. Explicit create, update, revision, and delete operations use the dependency-free adapter in skills/xmemo/scripts/knowledge-api.mjs. The launching environment must provide exactly one authorized XMEMO_ACCESS_TOKEN or XMEMO_KEY value.

node skills/xmemo/scripts/knowledge-api.mjs list-bases
node skills/xmemo/scripts/knowledge-api.mjs create-base --name "Project Runbooks"
node skills/xmemo/scripts/knowledge-api.mjs create-item BASE_ID --title "Deploy service" --content-file .\runbook.md
node skills/xmemo/scripts/knowledge-api.mjs update-content ITEM_ID --expected-current-revision-id REVISION_ID --content-file .\runbook-v2.md
node skills/xmemo/scripts/knowledge-api.mjs delete-item ITEM_ID --confirm

The adapter requires exact IDs, returned version or revision values, explicit delete confirmation, and post-mutation verification. It never accepts a token as a command-line argument. When Kiro runs an installed copy, it resolves the adapter from the installed Skill directory while content paths remain relative to the user's project.

Skill design

This Power contains one discoverable Skill: skills/xmemo/SKILL.md. It gives Kiro one compact model for the full XMemo workflow:

1. recall only the context useful for the current task;
2. act against current workspace evidence;
3. save concise, durable outcomes with provenance;
4. checkpoint the next action when work remains.

Four supporting references load only when Kiro needs authentication guidance, Knowledge authoring, unfamiliar tool routing, or advanced lifecycle operations. This keeps routine activation small while preserving complete task guidance. MCP tool definitions remain authoritative for live names and parameters.

Example prompts

• "What do you remember about this project?"
• "Pick up where we left off."
• "Recall the decision about the MCP transport."
• "Search my Knowledge Base for the deployment runbook."
• "Record this architecture decision for the next session."
• "Create a draft Knowledge item from this runbook."
• "Update this Knowledge item only if its revision is still current."

More synthetic, data-safe checks are available in examples/smoke-prompts.md.

Package contents

The package contains no credentials, customer data, telemetry, local database, or XMemo deployment code.

Development and validation

npm ci --ignore-scripts
npm run check

GitHub Actions validates the package on Ubuntu, Windows, and macOS with Node.js 20 and 22. Validation covers the Agent Plugins and MCP schemas, Skill frontmatter, package containment, required documentation, credential exclusion, logo integrity, and the Knowledge adapter's safety contracts.

Live authorization and account isolation require the synthetic acceptance flow described in SUBMISSION.md; static tests do not make a production authentication claim.

Privacy, security, and support

• Privacy policy: PRIVACY.md
• Security policy: SECURITY.md
• Authentication guide: AUTHENTICATION.md
• Product: xmemo.dev
• Support: support@xmemo.dev
• Security reports: security@xmemo.dev

Do not put passwords, tokens, private keys, customer data, or authentication cookies in prompts, issue reports, or this repository.

License

Licensed under the MIT License.