Kiro Crew

Personal agent (open source) · AWS · 6/7 verified · Listed on agentsafetyscore 2026-10-22 · Last checked 2026-10-22

Denied commands and protected paths that hold even in Autopilot, an admin policy ceiling the agent can’t loosen, an encrypted secrets vault and a signed audit log. Tool calls run without a prompt by default.

Overall: B (2.00 avg, 6/7 controls verified)

Lock this down first

Switch tool approval to Interactive, set agent.sandbox to strict, and set mcp.honour_auto_approve to false so MCP autoApprove lists go back through the gate.

Scorecard

Criterion	Rating	Notes
Permission granularity	3/3	Built-in and custom denied commands plus protected paths, checked before approval and never bypassed, even in Autopilot. A policy file sets a tightest-wins ceiling that admins can publish fleet-wide. Owner-written MCP autoApprove lists skip the gate by default. Not the same product as the Kiro IDE and CLI row.
Human approval gates	1/3	Automatic by default: calls that pass the deny and sandbox checks run without a prompt. Interactive mode asks for each call; approvals are checked again against deny rules before they run. With no default prompt for risky actions, this is capped at 1.
Sandboxing	2/3	OS sandbox (Linux namespaces or macOS Seatbelt) on by default, and Crew refuses to run unsandboxed unless you opt out. The default auto mode still leaves .aws, .ssh and .kube visible; strict hides them.
Secrets handling	3/3	Secrets live in an encrypted vault, MCP servers can reference them as secret://NAME, sensitive env vars are stripped from subprocesses, and 15+ credential patterns are redacted from every output.
Audit logs	2/3	Every tool call, approval and denial goes into an HMAC-signed log you can verify with kirocrew security verify. With the Claude Code harness, calls pre-approved in Claude’s settings skip Crew’s audit log.
Kill switch / interrupt	1/3	Turn, subagent and plan timeouts cap a run. No manual stop found in the docs we checked.
Network egress control	Unverified	Not confirmed in the docs we checked.

Unverified: Network egress control. That means we could not confirm it in public docs, not that it is missing.

Public reports

Independent reporting, not used for scoring.

2026-10-20 · NVD: CVE-2026-112380: WhatsApp group members could drive another session’s subagent, logged as the operator (fixed in 0.7.2; default config not affected)

Sources

Vendor? Request a correction. We review every correction request. How corrections work.