backend

Comprehensive kit for Node.js/Python/Go API development with 25 agents, 23 skills, 67 commands, and whole-repo deep security scanning

npx kiro-kit add backend

Comprehensive kit for Node.js/Python/Go API development with 25 agents, 23 skills, 67 commands, and whole-repo deep security scanning

At a glance

Artifact	Count
Commands	67
Agents	25
Skills	23
Workflows	4
Hook scripts	9
Native Kiro hooks	8
Files written in total	403

Category: backend · Version: 1.0.0

Tags: nodejs, python, go, api, rest, graphql, backend, database, docker

Commands

Command	Description
`ask`	⚡ Answer technical and architectural questions.
`backend/middleware`	Generate a new middleware function for request processing pipeline
`backend/migration`	Generate a new database migration file with up and down operations
`backend/route`	Generate a new API route handler with validation, error handling, and tests
`bootstrap`	Bootstrap the project from scratch with dependencies and configuration
`bootstrap/auto`	⚡⚡⚡⚡ Bootstrap a new project automatically
`bootstrap/auto/fast`	⚡⚡⚡ Quickly bootstrap a new project automatically
`brainstorm`	⚡⚡ Brainstorm a feature
`clean`	Clean build artifacts, caches, and temporary files
`code`	⚡ Start coding & testing an existing plan
`content/cro`	Analyze the current content and optimize for conversion
`content/enhance`	Analyze the current copy issues and enhance it
`content/fast`	Write creative & smart copy [FAST]
`content/good`	Write good creative & smart copy [GOOD]
`cook`	⚡⚡⚡ Implement a feature [step by step]
`cook/auto`	⚡⚡ Implement a feature automatically ("trust me bro")
`cook/auto/fast`	⚡ No research. Only scout, plan & implement ["trust me bro"]
`debug`	⚡⚡ Debugging technical issues and providing solutions.
`design/figma`	Extract design specifications from Figma for implementation
`design/system`	Design system architecture for a feature or service
`design/wireframe`	Create wireframe specifications for a feature
`docs/architecture`	Generate or update system architecture documentation
`docs/init`	⚡⚡⚡⚡ Analyze the codebase and create initial documentation
`docs/summarize`	Analyze the codebase and generate documentation summary
`docs/update`	Update project documentation to reflect recent code changes
`fix`	⚡⚡ Analyze and fix small issues [AUTO DETECT COMPLEXITY]
`fix/build`	Investigate and fix build or compilation errors
`fix/ci`	⚡ Analyze Github Actions logs and fix issues
`fix/fast`	⚡ Analyze and fix small issues [FAST]
`fix/hard`	⚡⚡⚡ Use subagents to plan and fix hard issues
`fix/lint`	Auto-fix linting errors across the project
`fix/logs`	⚡ Analyze logs and fix issues
`fix/test`	⚡⚡ Run test suite and fix issues
`fix/tests`	Investigate and fix failing tests
`fix/types`	⚡ Fix type errors
`fix/ui`	⚡⚡ Analyze and fix UI issues
`git/branch`	Create a new feature or fix branch with proper naming
`git/cm`	Stage all files and create a commit.
`git/commit`	Stage and commit changes with conventional commit message
`git/cp`	Stage, commit and push all code in the current branch
`git/pr`	Create a pull request with proper description
`integrate/polar`	⚡⚡ Implement payment integration with Polar.sh
`integrate/sepay`	⚡⚡ Implement payment integration with SePay.vn
`journal`	⚡ Write some journal entries.
`lint`	Run linting and formatting checks across the project
`plan`	⚡⚡⚡ Intelligent plan creation with prompt enhancement
`plan/ci`	Analyze Github Actions logs and provide a plan to fix the issues
`plan/cro`	Create a CRO plan for the given content
`plan/fast`	⚡⚡ No research. Only analyze and create an implementation plan
`plan/feature`	Create an implementation plan for a new feature
`plan/hard`	⚡⚡⚡ Research, analyze, and create an implementation plan
`plan/refactor`	Plan a refactoring effort with risk assessment
`plan/two`	⚡⚡⚡⚡ Research & create an implementation plan with 2 approaches
`release`	Prepare and execute a release with version bump and changelog
`review/code`	Perform a code review on recent changes
`review/codebase`	⚡⚡⚡ Scan & analyze the codebase.
`review/security`	Perform a security-focused review of the codebase
`scout`	Scout the codebase for files relevant to a task
`scout/ext`	Scout codebase using external agentic tools for faster parallel search
`security/deep-scan`	Whole-repository deep security scan (multi-agent pipeline, findings workspace)
`skill/add`	Add new reference files or scripts to a skill
`skill/create`	Create a new skill from scratch
`skill/fix-logs`	Fix the agent skill based on `logs.txt` file.
`skill/optimize`	Optimize an existing skill for token efficiency and effectiveness
`test`	Run the test suite with coverage reporting
`use-mcp`	Utilize tools of Model Context Protocol (MCP) servers
`watzup`	⚡ Review recent changes and wrap up the work

Agents

Agent	Description
`api-developer`	Use when you need to implement API endpoints, design route handlers, build middleware, create request/response schemas, or integrate with external services in Node.js, Python, or Go backends.
`brainstormer`	Use when you need to brainstorm software solutions, evaluate architectural approaches, or debate technical decisions before implementation begins.
`code-reviewer`	Use when you need code review, quality analysis, security audit, or feedback on implementations before merging or deploying.
`copywriter`	Use when you need high-converting copy for marketing materials, social media posts, landing pages, email campaigns, or any content that must capture attention and drive action.
`database-admin`	Use when you need database diagnostics, query optimization, schema design, index strategy, backup planning, replication setup, or performance troubleshooting.
`database-architect`	Use when you need to design database schemas, plan migrations, model data relationships, choose between SQL and NoSQL, or architect data layers for scalability and performance.
`debugger`	Use when you need to investigate issues, diagnose errors, analyze logs, trace execution flows, identify performance bottlenecks, or troubleshoot failing tests and deployments.
`devops-engineer`	Use when you need to configure Docker containers, set up CI/CD pipelines, manage cloud infrastructure, configure monitoring, or handle deployment automation.
`docs-manager`	Use when you need to create, update, or organize technical documentation, synchronize docs with code changes, write product requirements, or maintain documentation standards.
`git-manager`	Use when you need to stage, commit, push code changes, create pull requests, or manage git operations with conventional commit messages.
`journal-writer`	Use when significant technical difficulties occur -- repeated test failures, critical bugs, failed refactoring, security vulnerabilities, or architectural decisions that prove problematic in practice.
`mcp-manager`	Use when you need to manage MCP (Model Context Protocol) server integrations, discover available tools and resources, execute MCP capabilities, or troubleshoot MCP connectivity issues.
`planner`	Use when you need to research, analyze, and create comprehensive implementation plans for features, system architectures, or complex technical solutions before starting implementation.
`project-manager`	Use when you need project oversight, progress tracking against implementation plans, status reporting, milestone management, or coordination across multiple workstreams.
`researcher`	Use when you need to research technologies, find documentation, explore best practices, evaluate libraries, or gather technical information from multiple sources before making decisions.
`scout`	Use when you need to quickly locate relevant files across a large codebase for a specific task, before starting implementation or debugging that spans multiple directories.
`scout-external`	Use when you need to locate files across a large codebase using external agentic tools (Gemini, OpenCode) for faster parallel searching with large context windows.
`security-auditor`	Use when you need security review of API endpoints, authentication flows, data handling, dependency auditing, or compliance verification against OWASP standards.
`security-finder`	Use during a deep security scan to hunt vulnerabilities inside one assigned partition of the attack surface. Traces data flow from user inputs to sensitive sinks and writes candidate findings incrementally to a partition file.
`security-judge`	Use during a deep security scan, after validation, as the single SERIAL dedup pass over surviving findings. Classifies each as new / better-example-of-known / duplicate, fixes final severity, assigns slugs.
`security-recon`	Use at the start of a deep security scan to map the attack surface of a repository and partition it into non-overlapping segments for parallel vulnerability finders. Produces scan-manifest.json.
`security-reporter`	Use at the end of a deep security scan to write the findings workspace — report.md, per-finding reports, hardening recommendations, and the three JSON automation files (scan-manifest, findings, coverage).
`security-triage`	Use in a deep security scan's optional Semgrep hybrid mode to classify a batch of SAST results as true positive, false positive, or hard-excluded, reading the flagged code with real context.
`security-validator`	Use during a deep security scan to adversarially validate ONE candidate finding. Attempts to refute it, assigns confidence 1-10; findings below 8 are dropped. The false-positive filter of the pipeline.
`tester`	Use when you need to validate code through testing -- running test suites, analyzing coverage, checking for regressions, validating error handling, or verifying build processes after implementation changes.

Skills

Skill	Description
`ai-multimodal`	Process and generate multimedia content using AI APIs. Use when working with images, audio, video, or document analysis.
`backend-development`	Build robust backend systems with Node.js, Python, or Go. Use when implementing APIs, services, middleware, or server-side logic following production-grade patterns.
`better-auth`	Implement authentication and authorization with modern patterns including OAuth 2.1, JWT, sessions, RBAC, and multi-factor authentication. Use when building auth systems.
`chrome-devtools`	Browser automation and debugging using Puppeteer for API testing, screenshot capture, and web scraping. Use when you need to interact with web interfaces programmatically.
`code-review`	Structured code review practices for receiving feedback, requesting reviews, and verification gates. Use when reviewing or receiving review feedback on code changes.
`databases`	Work with PostgreSQL, MongoDB, and Redis for schema design, query optimization, migrations, and data modeling. Use when designing or optimizing data layers.
`debugging`	Systematic debugging framework for investigating root causes before applying fixes. Use when encountering bugs, test failures, or unexpected behavior.
`deep-security-scan`	Methodology, severity taxonomy, templates, and CI contract for a whole-repository deep security scan. Activate when running /security:deep-scan or when orchestrating the recon → find → validate → judge → report pipeline.
`devops`	Deploy and manage infrastructure with Docker, Kubernetes, CI/CD pipelines, and cloud services. Use when containerizing, deploying, or managing production infrastructure.
`docs-seeker`	Search and retrieve technical documentation from official sources. Use when you need current documentation for libraries, frameworks, or APIs.
`frontend-design`	Create production-grade frontend interfaces when backend services need admin panels, dashboards, or API documentation UIs. Use when building web interfaces for backend services.
`mcp-builder`	Guide for creating MCP (Model Context Protocol) servers that enable LLMs to interact with external services. Use when building MCP server integrations.
`mcp-management`	Manage MCP servers -- discover, analyze, and execute tools from configured servers. Use when working with MCP integrations or discovering available capabilities.
`media-processing`	Process multimedia files with FFmpeg and ImageMagick for encoding, conversion, and manipulation. Use when working with video, audio, or image processing pipelines.
`payment-integration`	Implement payment integrations with SePay (Vietnamese payment gateway with VietQR, bank transfers, cards) and Polar (global SaaS monetization platform with subscriptions, usage-based billing, automated benefits). Use when integrating payment processing, implementing checkout flows, managing subscriptions, handling webhooks, processing bank transfers, generating QR codes, automating benefit delivery, or building billing systems. Supports authentication (API keys, OAuth2), product management, customer portals, tax compliance (Polar as MoR), and comprehensive SDK integrations (Node.js, PHP, Python, Go, Laravel, Next.js).
`planning`	Plan technical solutions that are scalable, secure, and maintainable. Use when you need to decompose features, evaluate approaches, or create implementation plans.
`problem-solving`	Apply systematic problem-solving techniques for complexity spirals, innovation blocks, recurring patterns, and scale uncertainty. Use when stuck or facing novel challenges.
`repomix`	Package code repositories into single AI-friendly files for analysis. Use when you need to understand unfamiliar codebases or prepare context for AI consumption.
`research`	Research and evaluate technical solutions, libraries, and patterns. Use when you need to investigate options before making architectural or technology decisions.
`sequential-thinking`	Apply structured, reflective problem-solving for complex tasks requiring multi-step analysis and revision. Use for complex decomposition or when you need to think step by step.
`shopify`	Build Shopify applications, extensions, and themes using GraphQL/REST APIs, Shopify CLI, Polaris UI components, and Liquid templating. Capabilities include app development with OAuth authentication, checkout UI extensions for customizing checkout flow, admin UI extensions for dashboard integration, POS extensions for retail, theme development with Liquid, webhook management, billing API integration, product/order/customer management. Use when building Shopify apps, implementing checkout customizations, creating admin interfaces, developing themes, integrating payment processing, managing store data via APIs, or extending Shopify functionality.
`skill-creator`	Guide for creating effective skills that extend agent capabilities with specialized knowledge and workflows. Use when building new skills.
`template-skill`	Template for creating new skills. Copy this directory and customize for your specific use case.

Workflows

Workflow
`development-rules`
`documentation-management`
`orchestration-protocol`
`primary-workflow`

Hooks

Registered in settings.json:

Event	Hook
`PreToolUse`	`scout-block`
`PostToolUse`	`modularization-hook`
`agentStop`	`discord-notify`
`agentStop`	`telegram-notify`

Hook scripts shipped with this preset:

Script
`api-schema-validate`
`discord-notify`
`endpoint-test-coverage`
`git-status-tracker`
`migration-safety-check`
`modularization-hook`
`pre-commit-lint`
`scout-block`
`telegram-notify`

Native Kiro Agent Hooks (ship disabled; enable them in Kiro's Agent Hooks panel):

Native hook
`api-contract-sync`
`deep-scan-stale`
`docs-drift-guard`
`endpoint-test-coverage`
`migration-safety-review`
`run-tests-on-save`
`secret-scan-on-save`
`spec-task-sync`

MCP servers

Server
`fetch`
`filesystem`
`git`
`postgres`

Kiro Powers

Recommended Kiro Powers for this preset. init auto-wires the credential-free MCP-backed ones and scaffolds the credentialed ones disabled.

Tier	Power	Description	Auth	MCP-backed
`essential`	Supabase	Backend-as-a-service: Postgres, auth, storage, and realtime	`apiKey`	yes
`recommended`	Context7	Up-to-date library and framework documentation lookup	`none`	yes
`recommended`	Neon	Serverless Postgres with branching and autoscaling	`apiKey`	no
`recommended`	Postman	API testing, collections, and mock servers	`apiKey`	no
`recommended`	Upstash	Serverless Redis and Kafka with per-request pricing	`apiKey`	no
`optional`	Sentry	Error tracking and performance monitoring	`apiKey`	yes
`optional`	Snyk	Dependency and container vulnerability scanning	`apiKey`	no
`optional`	Stripe	Payments, subscriptions, and billing	`apiKey`	yes

Example specs

Fully-written requirements.md / design.md / tasks.md trios you can read as worked examples.

Spec
API Key Authentication
Background Job Queue
Caching Strategy
Webhook Delivery System

On this page