Latest release: v2026.10.6Download zip
Compatibility
Security Scan
OpenClaw
Benign
high confidenceCredentials
Kimi credentials and conversation requests are expected for this integration. The default endpoint is https://api.kimi.com/coding/, with explicit provider configuration allowed to override it.
Install Mechanism
Installation uses OpenClaw's plugin installer and a bundled JavaScript runtime entry; the package declares no installation scripts.
Instruction Scope
Setup configures the Kimi provider through OpenClaw APIs; no unrelated agent instructions or permission changes were found.
Persistence & Privilege
The plugin remains installed as a provider, but startup activation is disabled. Inspected code contains no background workers, direct credential-store harvesting, or privilege escalation.
Purpose & Capability
Model registration, request formatting, response conversion, and quota handling support the disclosed Kimi provider integration.
Assessment
Using this provider sends conversation content to Kimi and authenticates with your Kimi API key. Check any custom endpoint and applicable usage costs. SkillSpector reported no findings because bundled skills were absent; this verdict also reflects inspection of the plugin runtime.Verification
Tags
OpenClaw Kimi Coding Provider
Official OpenClaw provider plugin for Kimi Coding.
Install from OpenClaw:
openclaw plugins install @openclaw/kimi-provider
openclaw gateway restart
See https://docs.openclaw.ai/providers/moonshot for setup and configuration.
Quota errors
Kimi can return HTTP 403 when a weekly usage limit is exhausted. OpenClaw treats explicit weekly, seven-day, or quota-reset errors as rate limits. Wait for the provider's quota window to reset or use another configured provider; replacing a valid API key does not restore quota. Invalid keys and access restrictions keep their authentication error handling.
Catalog notes
Model rows live in openclaw.plugin.json under modelCatalog.providers.kimi.
k3serves up to 1M context, tier-gated server-side;k3-256kis the cheaper 256K variant of the same weights. Both point atmoonshot/kimi-k3throughupstreamModel, which keeps theircompatcapability tiers aligned with themoonshotcatalog for the same model.- Legacy
k3[1m]was retired upstream and normalizes tok3for shipped configurations. KIMI_K3_MODEL_IDSinprovider-policy-api.tsmust cover exactly the catalog rows that carry a K3thinkingLevelMap;provider-catalog.test.tsasserts it.
