Kiro Crew Open-Source Agent Workspace Guide
On this page
Quick answer
Kiro Crew is an open-source, persistent agent workspace for development work. It runs on hardware you control, exposes one runtime through desktop, web, CLI, and messaging surfaces, and can preserve sessions, memory, schedules, heartbeats, and task checkpoints beyond a single chat.
That persistence is also the main risk boundary. Crew can receive file, command, web, CI, MCP, and integration access. Treat it as an operated service with explicit data and action authority, not as a chat window that becomes safe because its code is visible.
The product model
| Layer | Role |
|---|---|
| Gateway | Hosts runtime state and connects user surfaces and channels |
| Sessions | Isolate conversations while allowing configured tool access |
| Memory and lessons | Carry preferences, project context, and corrections forward |
| Task Runner | Decomposes longer work, tests, retries, and checkpoints progress |
| Schedules, webhooks, heartbeats | Start or monitor work without an active chat |
| Subagents | Run independent work and return results to a parent session |
| Apps and integrations | Provide purpose-built interfaces and external data or actions |
Crew’s launch describes the runtime as built on the Kiro CLI and compatible with existing .kiro steering files, skills, and custom agents. That reduces setup for current Kiro users, but inherited configuration also inherits authority and stale assumptions.
Local and remote are deployment choices
Kiro documentation says Crew can run on a Mac, local container, or remote machine you control. The dashboard binds locally by default, and the Mac app can connect to a remote Gateway through an SSH tunnel.
“Runs locally” does not mean all data stays on one device. Model calls, configured MCP tools, web access, messaging channels, repositories, CI systems, and external APIs can move data outside the host. Map every connection and its credentials.
Use the installation and Gateway guide to choose a topology.
Persistent work changes the approval model
A one-time prompt can create continuing work through a schedule, webhook, heartbeat, lesson, skill, or App. Approval should cover:
- the data and tools available now;
- the actions and destinations allowed;
- the schedule, trigger, and stop condition;
- how retries and duplicate effects are prevented;
- what persists into later sessions;
- who reviews results and disables the workflow.
Review the memory, schedule, and heartbeat guide before enabling unattended work.
Inspectability versus assurance
Kiro describes OS sandboxing, denied-by-default commands, suspicious-pattern and sensitive-path controls, credential redaction, approvals, and signed activity logs. These are useful documented controls. They are not independent proof that a specific installation, plugin, integration, or task is secure.
Verify the exact release and configuration. Test bypass, prompt injection, secret exposure, approval changes, log completeness, restart behavior, integration compromise, and recovery under your threat model.
Use the Kiro Crew security readiness check before granting code, CI, cloud, messaging, or production access.
Frequently asked questions
What is Kiro Crew?
Kiro Crew is an open-source personal AI agent workspace that runs on user-controlled local or remote hardware and preserves sessions, memory, schedules, and task checkpoints.
Does Kiro Crew keep working across sessions?
Its documentation says sessions, memory, schedules, and task checkpoints persist across chats and Gateway restarts, while recurring jobs and heartbeats can continue on configured schedules.
Does open source make Kiro Crew automatically safe?
No. Source access and activity visibility support inspection, but security depends on the deployed version, configuration, runtime, credentials, tools, approvals, network, data, monitoring, and operator response.
Official sources
Source check: August 19, 2026. Recheck releases, installation, runtime, channels, memory, schedules, tools, security controls, model usage, licensing, and support before deployment.