
Research
/Security News
Trivy Under Attack Again: Widespread GitHub Actions Tag Compromise Exposes CI/CD Secrets
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.
pi-provider-kiro
Advanced tools
pi extension for Kiro API (AWS CodeWhisperer/Q) — 17 models across 7 families with OAuth authentication
A pi provider extension that connects pi to the Kiro API (AWS CodeWhisperer/Q), giving you access to 17 models through a single provider.
| Family | Models | Context | Reasoning |
|---|---|---|---|
| Claude Opus 4.6 | opus-4-6, opus-4-6-1m | 200K / 1M | ✓ |
| Claude Sonnet 4.6 | sonnet-4-6, sonnet-4-6-1m | 200K / 1M | ✓ |
| Claude Opus 4.5 | opus-4-5 | 200K | ✓ |
| Claude Sonnet 4.5 | sonnet-4-5, sonnet-4-5-1m | 200K / 1M | ✓ |
| Claude Sonnet 4 | sonnet-4 | 200K | ✓ |
| Claude Haiku 4.5 | haiku-4-5 | 200K | ✗ |
| DeepSeek 3.2 | deepseek-3-2 | 128K | ✓ |
| Kimi K2.5 | kimi-k2-5 | 200K | ✓ |
| MiniMax M2.1 | minimax-m2-1 | 128K | ✗ |
| GLM 4.7 | glm-4-7, glm-4-7-flash | 128K | ✓ / ✗ |
| Qwen3 Coder | qwen3-coder-next, qwen3-coder-480b | 128K | ✓ |
| AGI Nova | agi-nova-beta-1m | 1M | ✓ |
All models are free to use through Kiro.
Install the provider:
pi install npm:pi-provider-kiro
Or install via npm directly:
npm install -g pi-provider-kiro
Then log in:
/login kiro
This opens a browser for authentication. You can choose from:
If you have kiro-cli installed and already logged in, credentials are picked up automatically — no second login needed.
Once logged in, select any Kiro model in pi:
/model claude-sonnet-4-6
Reasoning is automatically enabled for supported models. Use /reasoning to adjust the thinking budget.
Generic transient retries such as HTTP 429 and 5xx are handled by pi-coding-agent at the session layer.
This provider only keeps local recovery for Kiro-specific cases:
403 auth races, where it can refresh credentials from kiro-cliMONTHLY_REQUEST_COUNT and INSUFFICIENT_MODEL_CAPACITYnpm run build # Compile TypeScript
npm run check # Type check (no emit)
npm test # Run all 248 tests
npm run test:watch # Watch mode
The extension is organized as one feature per file:
src/
├── index.ts # Extension registration
├── models.ts # 17 model definitions + ID resolution
├── oauth.ts # Multi-provider auth (Builder ID / Google / GitHub)
├── kiro-cli.ts # kiro-cli credential sharing
├── transform.ts # Message format conversion
├── history.ts # Conversation history management
├── thinking-parser.ts # Streaming <thinking> tag parser
├── event-parser.ts # Kiro stream event parser
└── stream.ts # Main streaming orchestrator
See AGENTS.md for detailed development guidance and .agents/summary/ for full architecture documentation.
MIT
FAQs
pi extension for Kiro API (AWS CodeWhisperer/Q) — 17 models across 7 families with OAuth authentication
We found that pi-provider-kiro demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.

Security News
ENISA’s new package manager advisory outlines the dependency security practices companies will need to demonstrate as the EU’s Cyber Resilience Act begins enforcing software supply chain requirements.

Research
/Security News
We identified over 20 additional malicious extensions, along with over 20 related sleeper extensions, some of which have already been weaponized.