Kiro Crew Setup: Your First Automated AI Crew

This Kiro Crew setup tutorial walks you from a clean machine to a working automated crew that can triage a real backlog item unattended. Kiro Crew is the multi-agent orchestration platform AWS open-sourced on August 4, 2026, built for engineering work that spans repos, tools, and days rather than a single chat session — see the official announcement for the full backstory. By the end of this walkthrough you’ll have the gateway running, a subagent doing real work against a repo, and a scheduled job that runs without you.

Kiro Crew setup prerequisites

• macOS, Linux, or Windows machine with Python 3.10+ and pipx installed (or Docker, if you’d rather containerize — see the installation docs for the Docker path)
• A GitHub (or other Git host) repo you have write access to, ideally a non-production one for this first run
• An API key or credentials for the model provider you plan to use with Kiro (Kiro supports Bedrock-backed models among others)
• 15–20 minutes and a terminal

A quick note before you start: don’t run this walkthrough against a repo tied to production infrastructure. The point of a first pass is to get comfortable with how Kiro Crew’s gateway, sandbox, and scheduling actually behave before you trust it with anything that matters. Pick a low-stakes repo, work through the whole sequence once, then repeat it deliberately against something real once you know what “normal” looks like.

What you’ll build

A running Kiro Crew gateway, one configured subagent capable of reviewing pull requests against a repo, a recorded “lesson” so it respects a rule about your codebase, and a snapshot backup of that configuration — the same pattern you’d extend into full incident-response or dependency-management automation later.

1. Install Kiro Crew via the prebuilt wheel. The wheel is SHA-256-verified and this is the fastest path on a dev machine:

   pipx install kirocrew
   kirocrew --version

2. Run the setup wizard. This walks you through selecting a model provider, setting your workspace root, and storing credentials securely:

   kirocrew setup

   Follow the prompts. When asked for a workspace root, point it at a parent directory containing (or where you’ll clone) the repo you want it working against — not your entire home directory.

3. Verify the install. doctor checks your Python version, PATH configuration, sandbox availability, and network reachability:

   kirocrew doctor

   Fix anything flagged red before moving on — a broken sandbox check especially, since that’s what keeps subagents from touching files or commands they shouldn’t.

4. Start the gateway. This is the local orchestration server that schedules and supervises every subagent:

   kirocrew gateway
   # → gateway listening on http://localhost:5476

   Leave this running in its own terminal tab, or install it as a background service so it survives a reboot:

   kirocrew service install

5. Generate an auth token so the CLI (and any external tooling you wire in later, like a webhook receiver) can talk to the gateway:

   kirocrew token

   Store this the way you’d store any API credential — not in a repo, not in Slack.

6. Clone the target repo into your configured workspace and point a subagent at it. From the workspace root:

   git clone git@github.com:your-org/your-repo.git
   cd your-repo
   kirocrew run "review the open pull requests in this repo for missing test \
   coverage on any changed Lambda handler, and summarize findings"

   Kiro Crew spins up a subagent with context isolated to this repo. You can watch its reasoning and tool calls live in the Activity view, or list what’s active from the CLI:

   kirocrew subagents list

7. Record a lesson so it respects a real rule about your codebase. This gets injected automatically into future sessions instead of you re-explaining it every time:

   kirocrew learn add \
     --note "Never suggest changes to files under infra/networking/ without \
   flagging that they require #net-review sign-off first."



8. Turn the one-off task into a scheduled job. Kiro Crew supports cron-style recurring jobs and webhook triggers so the crew works without you prompting it each time — for example, running the same PR review every morning:

   kirocrew schedule add \
     --name "daily-pr-review" \
     --cron "0 13 * * 1-5" \
     --task "review open pull requests for missing Lambda test coverage \
   and post a summary comment"

   Check the CLI reference for the full set of scheduling and webhook options, including tying triggers to external events like a CloudWatch alarm forwarded through Amazon EventBridge.

9. Back up your configuration. Before you walk away and let this run unattended, snapshot the gateway state:

   kirocrew snapshot

   This tars up your crew’s configuration, learned lessons, and scheduled jobs so you can restore it on another machine or after a reset.

10. Confirm the loop closes. Wait for the next scheduled run (or trigger it manually with kirocrew run --job daily-pr-review), and check that the summary shows up where you expect — a PR comment, a Slack message, wherever you routed the output. If it doesn’t, run kirocrew doctor again and check the troubleshooting guide before assuming the model itself is at fault; most first-run failures are gateway connectivity or token scope issues, not agent reasoning problems.

What you built

You now have a running Kiro Crew gateway, a subagent that reviews real pull requests against an isolated context, an institutional-memory rule it won’t forget, a scheduled recurring job, and a backup of the whole configuration. That’s the entire pattern — install, delegate, teach, schedule, snapshot — that scales up to incident investigation, dependency management, or full ticket triage once you trust it with more. Don’t skip the sandbox and token hygiene steps when you extend this to production repos; the mechanics are identical, but the blast radius isn’t.

From here, the natural next steps are tightening the sandbox allowlist before you point this at anything with write access, wiring a real webhook trigger — a CloudWatch alarm through EventBridge is the most common starting point — instead of relying purely on cron, and getting a second set of eyes on your approval-gate configuration before the crew runs unattended overnight. None of that requires re-learning the tool; it’s the same five-step pattern you just walked through, applied with a narrower, more deliberate scope.

At Enkompass (enkompass.net), this is our home turf. We’ve walked teams through exactly this setup on production AWS accounts without the 2 AM surprise. If you’d rather have seasoned cloud people handle it instead of learning the hard way at 2 AM, let’s talk. Reach out through our contact page or call us directly at +1-828-436-5667 — we’ll help you turn this from a someday-project into a done-deal.