Apps

The App Kit is what turns Crew into a platform. An app is a package that contributes any combination of agents, skills, MCP servers, cron jobs, dashboard UI pages, or backend processes to Crew. Users install apps from the built-in App Store; developers publish apps by adding an entry to the app registry.

This section covers the app landing here, plus four subpages:

• Build your first app — get an app running in 5 minutes
• Manifest reference — every field in app.json
• SDK / API reference — TypeScript and Python client APIs
• Publishing & guidelines — from development to App Store listing

An app can contribute any subset of these:

A Skill-only app can be one file. A full app can combine an agent, backend, UI, schedules, and chat integrations.

An app can start, steer, and stop sessions only after you grant that capability in its trust dialog. The grant is off by default for each app. An app with scheduled work also shows running, finished, or failed job state on its rail icon.

A button or form inside a rendered MCP App can send text into that app's bound chat. The row is labeled Sent by the name app, using the app's name, rather than appearing as words you typed. It starts a model turn or waits behind the turn already running.

This path works only from the dashboard owner's session and requires the app's callback key and original session binding. Each message is text-only, limited to 16,384 characters, one message per three seconds, and 20 messages from one rendered app. Disable or uninstall an app you no longer trust.

Dashboard routes that install or enable apps require the dashboard owner. An app token can manage only the scheduled jobs created by that app.

Open Apps → Library to see installed apps. Each tile can open, pin, update, disable, or uninstall the app. Create Folders From Project can also turn selected project packages into nested sidebar folders.

From Apps → Discover:

1. Browse or search for an app.
2. Review its source and trust tier.
3. Select Install to copy the pinned source into the Crew home.
4. Select Enable to register its resources and start its lifecycle.

Local development can install through the API or use live-reload mode:

curl -X POST http://localhost:5476/api/apps/install \
  -H 'Content-Type: application/json' \
  -d '{"source": "/path/to/my-app"}'
kirocrew app dev my-app

The Gateway-managed mode is the simplest: declare resources in app.json and let Crew reconcile them. Self-managed apps use the runtime registration API when a native or external process owns its lifecycle.

The Apps page can filter the catalog by source and by review tier. A pinned external registry shows its label and tier in the catalog, so the origin and level of scrutiny are visible before you install anything.

The built-in registry remains curated through pull requests to the KiroCrew repository. Teams can opt into an external registry for their own catalog; adding one is an explicit trust decision, and its apps remain subject to the install dialog and local policy.

Convert a manifest-based plugin from another agent harness into a Crew app. The converter reads the package manifest and copies recognized resources into a new app directory without executing any code from the source package:

kirocrew app import /path/to/plugin
kirocrew app import /path/to/plugin --install

The converter copies recognized resources into a new app directory and reports declarations it cannot map. It does not import or execute source-package code, skips symlinks while copying, and refuses a declared path that escapes the package root. Without --install, it prints the local install command for the generated app.

Apps with backend processes are accessible through the gateway's reverse proxy at /apps/{name}/api/*. The gateway signs each proxied request with X-Crew-Proxy: <timestamp>:<hmac-sha256> — backends verify this to authenticate the caller as the gateway itself.

This avoids CORS issues for dashboard UI pages and gives apps a stable, gateway-authenticated way to talk to their own backend without minting tokens.

Turn on dev mode for an installed app and the gateway:

• Serves the app's UI files with Cache-Control: no-store
• Watches the app's ui/ directory
• Broadcasts an app_reload WebSocket event on any file change
• The dashboard reloads the app immediately

Recommended local workflow:

# 1. Symlink your source tree into Crew's app directory
ln -sfn /path/to/my-app-src/ui ~/.kiro/crew/apps/my-app/ui

# 2. Turn on dev mode
kirocrew app dev my-app

# 3. Edit → save → dashboard hot-reloads

Turn it off when you're done — dev mode adds file-watching overhead.

Apps declare what they can access in app.json:

{
  "permissions": {
    "api": ["/api/crons", "/api/status"],
    "events": ["notification", "slots"],
    "mcpTools": ["cron_add", "cron_list"],
    "storage": true,
    "cron": true,
    "network": false
  }
}

Apps live in separate git repos. On install, Crew clones the repo (shallow, specific branch) into ~/.kiro/crew/app-sources/{name}/, runs the build step (npm install && npm run build for JS/TS packages, pip install . for Python), then copies the app to ~/.kiro/crew/apps/{name}/.

Symlinks are never followed on copy — a symlink to inside the app source is preserved as a symlink; a symlink to outside is dropped. Build-input and VCS directories (node_modules, .git, __pycache__, .venv) are excluded from the installed copy — commit build artifacts to ui/dist/ if the app needs them at runtime.

Contributes agents and skills. No UI, no backend. Example: an oncall triage agent.

{
  "name": "oncall-triage",
  "agents": ["agents/triage.json"],
  "skills": ["skills/ticket-analysis"]
}

Agents + skills + backend + dashboard UI page. Example: a monitoring dashboard.

{
  "name": "service-monitor",
  "agents": ["agents/monitor.json"],
  "backend": { "entryPoint": "backend/app.py" },
  "ui": {
    "entry": "dist/index.mjs",
    "pages": [{ "route": "/apps/service-monitor", "label": "Monitor", "icon": "Activity" }]
  }
}

External app (Electron, CLI tool, native binary) that registers with Crew at runtime. Example: Mochi desktop pet.

{
  "name": "mochi",
  "resources": "app",
  "lifecycle": "app",
  "platform": { "os": ["macos"], "installMode": "client" }
}

The app calls POST /api/apps/register on startup and manages its own resources.

Apps declare minKiroCrewVersion in app.json. Install and update check this — if the current version is too old, the operation is rejected with a clear error message.