Kiro + xCloud

Deploy from Git with Kiro on xCloud

Deploying from Git with Kiro means asking the agent in Amazon's agentic IDE to ship the project you have open, and letting xCloud detect the app, preview the site, create it after your approval and verify the live URL.

Skill: xcloud:deploy
Toolsets: sites, servers, integrations
Free with every xCloud account

Set up Kiro All Kiro guides

YouDeploy this project to Frankfurt on a staging hostname. Dry run first.

git_detectread-only

AgentLaravel app on main with the web root at public. xCloud suggests its Laravel defaults. Staging address: portal-staging.acme.xcloud.site. Create it?

YouYes.

servers_sites_git_autoneeds approval

AgentDeployed. https://portal-staging.acme.xcloud.site answers 200 and failed_steps is empty.

Last updated: October 2026. Keep a human in the loop: xCloud stops and asks before anything that creates, deploys, updates, reboots, deletes or buys.

Setup

How Do You Set Up Kiro to Deploy from Git on xCloud?

Connect Kiro once; every job on this account uses the same connection. Then ask in plain words.

1
Add xCloud to your Kiro MCP config
Open the Command Palette (Cmd+Shift+P on Mac, Ctrl+Shift+P on Windows and Linux), search for MCP and choose Kiro: Open workspace MCP config (JSON) for .kiro/settings/mcp.json, or Kiro: Open user MCP config (JSON) for ~/.kiro/settings/mcp.json. Paste this, save, and Kiro reconnects on its own. The first connection opens the xCloud approval screen in your browser, where you tick the teams and choose Read-only or Full access.
JSON
```
{
  "mcpServers": {
    "xcloud": {
      "url": "https://app.xcloud.host/mcp"
    }
  }
}
```
2
Choose which xCloud tools Kiro may run
Optional. autoApprove lists tools Kiro runs without asking, and disabledTools hides tools from the agent altogether. The two names here are real xCloud tools; swap in your own. Avoid the "*" wildcard in autoApprove, so Kiro's own prompt stays as a second check beside xCloud's confirmation.
JSON
```
{
  "mcpServers": {
    "xcloud": {
      "url": "https://app.xcloud.host/mcp",
      "autoApprove": ["xcloud_docs_search", "xcloud_agent_search"],
      "disabledTools": ["sites_destroy"]
    }
  }
}
```
3
No browser sign-in? Use an API key
Create a token with the mcp:invoke scope plus the read abilities for the areas it will use (read:servers and read:sites, with read:billing and read:addons for billing and add-on tools) and the matching write: abilities if it should change things in Settings, Developers, API Tokens, export it as XCLOUD_API_TOKEN, and pass it in headers. Kiro only expands environment variables you have approved, so add XCLOUD_API_TOKEN under the Mcp Approved Env Vars setting. Never paste the token into the file or into chat.
JSON
```
{
  "mcpServers": {
    "xcloud": {
      "url": "https://app.xcloud.host/mcp",
      "headers": {
        "Authorization": "Bearer ${XCLOUD_API_TOKEN}"
      }
    }
  }
}
```

Check it worked

Then ask Kiro for the job itself, for example:

Prompt

Use xCloud to deploy this project to my Frankfurt server on a staging hostname. Show me the dry run first.

In practice

How Does Deploy from Git Work from Kiro?

Kiro puts the agent in a chat panel beside the editor with your project loaded, so you can ask for a deploy in the same place you wrote the change. The repository is open, which gives the agent the remote, the branch and the scripts to compare with what xCloud detects. You type the request, name the server, and Kiro calls git_detect through the xcloud MCP server and reports the app type, branch, commands and warnings in the panel. If you did not name a domain, it asks xCloud for a free staging hostname and shows it, so you know the address before any site exists.

What sets Kiro apart for this job is where the permission settings live. The xcloud entry sits in .kiro/settings/mcp.json for one workspace or ~/.kiro/settings/mcp.json for all of them, and it takes an autoApprove list. A sensible setup lists the read tools this job begins with, git_detect and sites_status, and leaves the create tool, servers_sites_git_auto, off the list. Kiro then asks you before it calls the create tool, and xCloud asks for its own explicit confirmation as well, so the dry run is reviewed twice before a site exists. Because OAuth keeps the token out of the file, a workspace file carries no secret, and a teammate who opens the project can use the same connection.

After you approve, Kiro sends the confirmed create call, polls sites_status and reports one line per real step change, then fetches the URL and reads failed_steps before it says the site is live. When a build fails it reads the deployment diagnosis, proposes a change to the build command or web root, and retries on the same site after you say yes. Since Kiro edits files, a correction that belongs in the repository, such as a missing build script, can be made and committed in the same panel before the retry.

Kiro specific: Kiro's MCP support has to be switched on in Settings before the xcloud entry does anything, so if the tools are missing, check that first. If the same server name appears in a workspace file and a user file, the workspace entry wins, which can leave you with a stale URL after you edit the other one. And keep servers_sites_git_auto out of autoApprove and never use the star wildcard there: a deploy is the one call in this job that creates a billable site, so you want Kiro's prompt standing next to xCloud's confirmation.

What xCloud does for deploy from git

xCloud detects the app in the repository, previews the site it would create with a dry run, creates it once you approve, polls the deployment to a terminal state and checks the live URL. A failed deploy gets a diagnosis and a corrected retry on the same site, never a delete and recreate.

Pick the team and server. The agent uses the server you name. If you name none it lists provisioned servers and asks; it never picks one silently. Node.js, PHP and static builds need an Nginx or OpenLiteSpeed server; anything else needs a Docker server.
Detect the repository. git_detect reads the default branch, the app type (WordPress, Laravel, custom PHP, Node.js or Lovable), the web root, suggested install, build and start commands, repository access and server compatibility. Detection creates nothing.
Choose the address. With no domain the agent asks xCloud for a free staging hostname. With a live domain it checks whether the zone is on a connected Cloudflare account, in which case xCloud writes the DNS record and certificate itself.
Dry run, then one approval. The agent sends the create request with dry_run set to true and shows you the resolved configuration: app type, URL, branch, commands, runtime version and every warning. Then it asks once, naming the server and the URL, before sending the same body with confirm set to true and an idempotency key.
Poll and verify. A 202 means queued, not deployed. The agent polls the site status until it is terminal, reports each real step change, reads failed_steps and the SSL block, and fetches the URL before it calls the site live.
Recover if it fails. On a failed deploy the agent reads the deployment diagnosis, proposes a fix from the correctable fields, and retries on the same site with your approval. Two failed retries with the same classification stop the loop and hand you the dashboard link.

Reference

Deploy from Git Settings and Limits on xCloud

The facts Kiro works within when it deploys from Git. Where a row names the dashboard, that step stays yours to take there.

Setting or limit	What applies
Supported app types	WordPress, Laravel, custom PHP, Node.js and Lovable on native servers; Dockerfile and Compose apps, including Python, Go and Rust, on Docker servers
Repository sources	Public HTTPS URLs, repositories on a connected GitHub, GitLab or Bitbucket provider, and private SSH repositories with a read-only deploy key
Private repositories	The agent prepares a deploy key on the server, you add the public key to the repository, xCloud verifies it. A private key or personal token never goes in the request
Preview	dry_run: true returns the would_create block and consumes no idempotency key
Idempotency	The create call carries an Idempotency-Key, so a retried request cannot create a duplicate site. A new deployment needs a new key
Deployment states	deployed, failed or cancelled once terminal is true; failed_steps can be non-empty on a deployed site and must be read
Node.js versions	The Node version is server-wide, not per site; changing it can affect other apps on the server
Redeploys	A redeploy runs git reset --hard and git clean -df in the site directory, so uncommitted server-side changes are lost. Supply environment values through env_file_content, not files in the checkout
Staging environments	Available for Git sites on paid plans through the API; WordPress staging stays a dashboard step
Agentic servers	An OpenClaw, Hermes, Paperclip or DeepSeek Harness server hosts only the site created at provisioning; a second site is refused

Rules Kiro has to follow

Creating a site is billable and stops for your approval; detection and the dry run never create anything.
The agent explains every detection warning before asking, and a repository access problem is never worked around by naming an app type by hand.
A deployed state is not proof the application works: the agent fetches the URL and reads failed_steps first.
A failed site is retried in place with corrections; it is never deleted and recreated to retry.
Changing a live site's domain after creation, databases and server resizing are dashboard steps; the agent gives you the path and the dashboard link xCloud returned.

Example prompts

What Can You Ask Kiro to Do for Deploy from Git?

Type these as written and swap in your own repository, site and server names. Reads and routine actions such as backups, cache purges, PageSpeed scans and vulnerability scans run straight away; creating, deploying, updating, rebooting, deleting, buying or starting a broken-link scan stops and asks first.

Prompt

Use xCloud to deploy this project to my Frankfurt server on a staging hostname. Show me the dry run first.

Prompt

Run xCloud detection on this workspace and list the build command, start command and any warning. Do not create anything.

Prompt

The xCloud deploy for this project failed. Read the diagnosis, fix the repository if that is where the problem is and ask before you retry.

Prompt

Deploy https://github.com/acme/shop to my Frankfurt server and show me the dry run before creating anything.

Prompt

Deploy the private GitLab repository connected to my team on a staging hostname.

Prompt

Scan the docker-compose.yml in github.com/acme/api and tell me which services and ports xCloud would use.

Prompt

Create a staging environment from the feature/checkout branch of the API site.

Prompt

Deploy the latest commit of the shop site after showing me what will change.

Prompt

The last deploy of the API site failed. Diagnose it, fix the build command and retry on the same site.

Kiro and Deploy from Git: Frequently Asked Questions

What people ask before they let Kiro deploy from Git through xCloud.

Which xCloud tools should I put in Kiro's autoApprove for a deploy?

The read tools only, such as git_detect and sites_status. Leave servers_sites_git_auto, the create call, off the list so Kiro still asks you before a billable site is created. xCloud then asks for its own confirmation as a second check.

Can my team share the xCloud connection for a Kiro project?

Yes. Put the xcloud entry in .kiro/settings/mcp.json in the workspace. With OAuth the file holds only the URL and no token, and each person signs in with OAuth and approves the access level for their own account.

Does the agent create the site as soon as I give it a repository URL?

No. It detects the repository and runs a dry run first, shows you the resolved configuration, and asks once. Only after you approve does it send the create call with an explicit confirmation and an idempotency key.

Can an agent deploy a private repository through xCloud?

Yes. Either the repository is on a Git provider connected to your xCloud team, or the agent prepares an SSH deploy key on the server for you to add to the repository. A private key or a personal access token is never sent in the request.

What does a 202 response mean during a deploy?

That xCloud queued the deployment. The agent polls the site status until it is terminal and reports deployed, failed or cancelled, then checks failed_steps and fetches the URL before calling the site live.

What happens when a deploy fails?

The agent reads the deployment diagnosis, which classifies the failing step and quotes the relevant log lines, proposes a fix from the fields xCloud lets it correct, and retries on the same site after your approval. It never deletes and recreates the site to retry.

Which servers can take a Git deploy?

Node.js, PHP and static builds deploy to Nginx or OpenLiteSpeed servers. Dockerfile and Compose apps, and other language stacks, need a Docker server. Agentic servers running OpenClaw, Hermes, Paperclip or DeepSeek Harness take no additional sites.

Other agents