MseeP.ai Security Assessment Badge

Kilo-Kit: Autonomous Cognitive Flow & Quality Engine for AI Coding Agents

Version: 1.8.0
Author: Kilo-Kit Team
License: Apache 2.0

Kilo-Kit is an agentic MCP runtime and curated 177-skill catalog designed to enforce grounded diagnosis, Tree-of-Thoughts architectural planning, adversarial red-teaming, 4D quality verification, and continuous SQLite self-improvement for AI coding assistants.

🧠 Core Architectural Pillars:

  1. Division of Labor (Cortex vs Limbs): Kilo-Kit acts as the high-level cognitive brain (Tree of Thoughts, 5-Whys root cause analysis, adversarial stress-testing, context compaction) while host clients handle surgical I/O.
  2. Kilo-Sentinel Supervisor & Circuit Breaker: Real-time middleware enforcing Pre-flight Grounding Locks (no editing unread files), loop tripwires (identical call and edit-thrashing detection), and SQLite trajectory logging (katl_trajectories).
  3. Closed-Loop Industry Benchmarking: Subagent-driven audit of session trajectory against open-source GitHub standards (kilo_benchmark_solution), triggering autonomous re-planning when architectural divergence occurs.
  4. Fuzzy Skill & Alias Resolver: Instant, resilient skill loading with support for aliases (brainstorming, diagnose, playwright, clean-code, tdd).
  5. 4D Quality Assurance & Playwright E2E Gate: Validates Given-When-Then acceptance criteria, clean code interfaces, UI/UX aesthetics, and automated Playwright browser/DOM verification before work is marked complete.

🚀 Installation & Team Rollout

1. Install Global Tooling (All Developers):

npm install -g @vodailoc/kilo-kit-mcp
kilo-kit-init global

2. Configure Project Rules (Tech Leads):

kilo-kit-init init --client all

Commit the generated CLAUDE.md & AGENTS.md to your Git repository.

Developers cloning the repository will automatically inherit the Kilo-Kit cognitive rules.


🛡️ Why Kilo-Kit: Protocol-Level Server-Side Hard-Gate

Traditional agent systems rely entirely on passive text prompts (.cursorrules or CLAUDE.md). When LLMs experience prompt drift, they frequently skip planning, jump straight into rewriting code, introduce breaking changes, or hallucinate completion.

Kilo-Kit solves this at the I/O Protocol layer:

sequenceDiagram
    autonumber
    actor User
    participant Agent as Host AI Agent
    participant MCP as Kilo-Kit MCP Server (v1.8.0)
    participant Disk as File System & Execution

    User->>Agent: "Add JWT rate-limiting middleware"
    Note over Agent,MCP: 1. Gating Enforcement
    Agent->>MCP: kilo_write_file("auth.ts") [Unauthorized]
    MCP-->>Agent: 🛑 [KILO-KIT HARD-GATE VIOLATION] (Blocked at Server Level!)
    
    Note over Agent,MCP: 2. C4 Planning & Brainstorming
    Agent->>MCP: kilo_orchestrate_task("Add JWT rate-limiting")
    MCP-->>Agent: State: brainstorming_required (Workflow + Skills released)
    Agent->>MCP: kilo_grill_plan(plan="...") [Adversarial Red-Teaming]
    MCP-->>Agent: Risk Score: 20/100, Invariants Locked ✅
    
    User->>Agent: Approve Brainstorming Plan
    Agent->>MCP: kilo_orchestrate_task(sessionId, brainstormingApproved=true)
    MCP-->>Agent: State: READY (I/O permissions unlocked)

    Note over Agent,Disk: 3. Execution & Verification
    Agent->>MCP: kilo_write_file, kilo_edit_file, kilo_run_command
    MCP->>Disk: Safe Defense-in-Depth Execution
    Agent->>MCP: kilo_synthesize_skill("jwt-rate-limit")
    MCP-->>Agent: Synthesized into Library 🧬
    Agent-->>User: Completed with Verified Evidence ✅

🧰 The 19 All-in-One MCP Tools Suite

Kilo-Kit provides a complete, self-contained execution and reasoning runtime:

Category Tool Description
Gating & Orchestration kilo_orchestrate_task C4 closed-loop gate. Enforces brainstorming and cognitive steps before code mutation.
kilo_route_intent Routes intent to best workflow chains, task modes, and rules.
kilo_get_skill Loads curated SKILL.md workflows with token-safe truncation and session tracking.
kilo_search_skills High-precision semantic and keyword search across 177 skills.
kilo_memory_report Inspects persistent SQLite decisions, facts, and sessions.
kilo_record_reflection Self-Improvement: Persists reflections, correct/wrong paths, and lessons to SQLite.
kilo_route_report Reports route telemetry, top skills, workflows, scores, and conflict penalties.
kilo_validate_skills Validates entire skill catalog against the quality gate.
Safe Execution Suite kilo_read_file Line slicing, size capping, and repository boundary enforcement.
kilo_search_files Glob pattern search across directory trees.
kilo_grep_code Line-by-line regex and substring search.
kilo_write_file Atomic write with Protocol Hard-Gate, clean-code smell audit, and secret detection.
kilo_edit_file Targeted search-and-replace with JSON syntax & bracket balancing audit.
kilo_run_command Defense-in-depth terminal execution with security guardrails & command injection filtering.
Cognitive Reasoning kilo_think_step Tree of Thoughts DAG: Step-by-step reasoning, 3-option trade-off matrix & hypothesis branching.
kilo_grill_plan Adversarial Red-Teaming: Inversion, simplification, mobile touch & concurrency stress testing.
kilo_trace_root_cause 5-Whys Diagnostic Engine: Recursive causal back-propagation with regression test scaffolding.
kilo_compact_context Cognitive Compactor: 40-70% token savings while locking invariants.
kilo_synthesize_skill Self-Evolution: Distills solved patterns into reusable skills.
Sentinel & Supervision kilo_sentinel_status Supervisor Telemetry: Inspects circuit breaker state, step budget, and grounded files list.
kilo_reset_circuit_breaker Supervised Reset: Resets tripped circuit breaker with root-cause justification.
kilo_benchmark_solution Industry Benchmark: Audits trajectory against GitHub standards and triggers re-planning.

🧠 Cognitive Thinking & Reasoning Engines

1. kilo_think_step (Tree of Thoughts)

Allows agents to record iterative hypotheses, branch into alternative solutions (branchId), and backtrack when initial assumptions fail.

2. kilo_grill_plan (Adversarial Red-Teaming)

Stress-tests architectures against 3 critical lenses:

  • Inversion Analysis: Where will this fail first under 100x traffic or network timeouts?
  • Simplification Cascade: Can 50% of this complexity be deleted?
  • Blast Radius: Will mutating this state cause regressions in unrelated modules?

3. kilo_trace_root_cause (5-Whys Root Cause Tracer)

Bypasses superficial patches by propagating backward from crash stack traces to the true systemic trigger:

Stack Trace ──[Why?]──> Null Pointer ──[Why?]──> Un-awaited Promise ──[Root Cause]──> Bootstrap Lifecycle Race!

4. kilo_compact_context (Token Economy)

Slashes context bloat by compressing repetitive terminal logs while anchoring architectural invariants ([INVARIANT]) into active working memory.

5. kilo_synthesize_skill (Self-Evolving Agent)

Transforms solved production bugs and clean designs into standardized SKILL.md entries that persist across future coding sessions.


📚 177 Curated Skills Catalog

Kilo-Kit bundles 177 production-ready skills categorized into:

  • Engineering & Architecture: codebase-design, backend-development, api-patterns, database-design, nextjs-best-practices, react-patterns, tailwind-patterns, aspnet-core, better-auth.
  • Problem-Solving & Reasoning: sequential-thinking, root-cause-tracing, systematic-debugging, collision-zone-thinking, scale-game, simplification-cascades, inversion-exercise.
  • Productivity & Review: brainstorming, spec-driven-development, tdd-workflow, code-review, verification-before-completion, grill-me, subagent-driven-development.
  • Agent Frameworks: workflow-state-machines, agent-memory, agentic-rag, multi-agent-orchestration, mcp-agent-patterns.
  • Security & Defense: ai-guardrails, red-team-tactics, security-best-practices, vulnerability-scanner.
  • Operations & Cloud: docker-devops, server-management, chrome-devtools, performance-profiling.

🧪 Verification & Development

# Clone and install dependencies
git clone https://github.com/VoDaiLocz/KILO-KIT.git
cd KILO-KIT
npm install

# Run unit tests (50/50 test suites across 12 files)
npm test

# Run skill catalog validation (177/177 skills)
node src/tools/validate-skill.js --all skills

# Full prepublish test & smoke verification
npm run prepublishOnly

📄 License

Distributed under the Apache 2.0 License. See LICENSE for more details.