Kimi CLI

Moonshot AI terminal agent with a universal Guard key.

Model protocol

Claude, Kimi, Composer and Grok

Kimi CLI in this section is Moonshot AI's new Kimi Code terminal agent: package @moonshot-ai/kimi-code, command kimi. It takes a third-party address from its own config file, where the provider is declared explicitly. These steps were verified on Kimi Code 2.1.0 on macOS. The Codex steps above are written for the old Python Kimi CLI 1.x: Moonshot has archived it, it keeps its settings in ~/.kimi and does not read the file from this section. The new client's kimi migrate command moves the old client's data.

bash

curl -fsSL https://code.kimi.com/kimi-code/install.sh | bash

On Windows: irm https://code.kimi.com/kimi-code/install.ps1 | iex, and Git for Windows is required before the first launch. Through npm: npm install -g @moonshot-ai/kimi-code, Node.js 22.19.0 or later.

Settings live in ~/.kimi-code/config.toml. A provider is one [providers.<name>] entry: the required type field, then api_key or api_key_env, base_url and optionally custom_headers. The type value selects the protocol: openai for Chat Completions, openai_responses for Responses. The Grok example uses openai_responses, the others use openai; on Kimi Code 2.1.0 both work for Grok.

toml

# ~/.kimi-code/config.toml
[providers.guard]
type = "openai"
base_url = "https://api.guardrelay.ai/v1"
api_key = "gd-your-key-from-bot"

[models."guard/claude"]
provider = "guard"
model = "claude-sonnet-5-5"
max_context_size = 1000000

toml

# ~/.kimi-code/config.toml
[providers.guard]
type = "openai"
base_url = "https://api.guardrelay.ai/v1"
api_key = "gd-your-key-from-bot"

[models."guard/k3"]
provider = "guard"
model = "k3"
max_context_size = 1048576

toml

# ~/.kimi-code/config.toml
[providers.guard]
type = "openai_responses"
base_url = "https://api.guardrelay.ai/v1"
api_key = "gd-your-key-from-bot"

[models."guard/grok"]
provider = "guard"
model = "cursor-grok-4.7-high"
max_context_size = 256000

toml

# ~/.kimi-code/config.toml
[providers.guard]
type = "openai"
base_url = "https://api.guardrelay.ai/v1"
api_key = "gd-your-key-from-bot"

[models."guard/composer"]
provider = "guard"
model = "composer-2.5"
max_context_size = 200000
max_output_size = 32000

A model entry needs three fields: provider, model and max_context_size. The first points at the provider name, the second is the exact id sent to the server, the third is the context window the client budgets against. The per-family numbers are on the Models page.

Put default_model = "guard/..." with the alias from the file at the top of config.toml and run plain kimi; kimi -m "guard/..." picks another model for one run. For a one-off kimi -p "…" request Kimi Code 2.1.0 needs default_model: with only -m it answers no default model configured. If the file already has a default_model line, for example after /login, change its value: a second such line breaks the file.

GLM 5.3 in Kimi CLI

Install Kimi Code

This is Moonshot's current Node/TypeScript client. Use the official Kimi Code guide. Run the first block on macOS/Linux or the second on Windows PowerShell, then check kimi --version.

bash

curl -fsSL https://code.kimi.com/kimi-code/install.sh | bash
kimi --version

powershell

irm https://code.kimi.com/kimi-code/install.ps1 | iex
kimi --version

Get a Guard key

Get a universal gd-… key from the direct API link in @guardapi and choose an API package. Do not put the key in a project, repository, task prompt, or screenshot. Balance and usage are available in your Guard account.

Create a separate GLM profile

Create ~/.kimi-code-guard-glm/config.toml (Windows: %USERPROFILE%\.kimi-code-guard-glm\config.toml) and save the example below there. KIMI_CODE_HOME attaches this profile without changing the normal .kimi-code. max_context_size = 131072 is the verified Kimi Code history budget, not a published GLM maximum; max_output_size = 4096 bounds one example response.

toml

default_model = "guard/glm-5.3"

[providers.guard]
type = "openai_responses"
base_url = "https://api.guardrelay.ai/glm/v1"
api_key_env = "GUARD_API_KEY"

[models."guard/glm-5.3"]
provider = "guard"
model = "glm-5.3"
display_name = "GUARD API · GLM 5.3"
max_context_size = 131072
max_output_size = 4096
capabilities = ["tool_use"]

[models."guard/glm-5.3-flash"]
provider = "guard"
model = "glm-5.3-flash"
display_name = "GUARD API · GLM 5.3 Flash"
max_context_size = 131072
max_output_size = 4096
capabilities = ["tool_use"]

macOS / Linux: enter the key at the hidden prompt. The variable applies only to this terminal and the client started from it.

{
unset GUARD_API_KEY
until [ -n "${GUARD_API_KEY-}" ]; do printf "Guard API key: "; read -r -s GUARD_API_KEY || break; printf "\n"; done
export GUARD_API_KEY
export KIMI_CODE_HOME="$HOME/.kimi-code-guard-glm"
kimi -m guard/glm-5.3
}

Windows PowerShell: run these commands in the same window that starts the client. Set the key again after opening a new PowerShell window.

powershell

$guardKey = Read-Host "Guard API key" -AsSecureString
$env:GUARD_API_KEY = [System.Net.NetworkCredential]::new("", $guardKey).Password
$env:KIMI_CODE_HOME = "$HOME/.kimi-code-guard-glm"
kimi -m guard/glm-5.3

Quick check and continuation

Run kimi -m guard/glm-5.3 in a test folder. The full name includes provider prefix guard/.
Send: Read README.md and reply with exactly GUARD_GLM_OK. Change nothing.
In the same window, ask for the line without rereading. After exit, kimi -c continues the previous session for the current folder.
For one task without the interactive UI, use kimi -m guard/glm-5.3 -p "Reply with exactly GLM_OK". Do not add --auto: Kimi Code 2.1.0 does not allow it together with -p.

Legacy Python client boundary

Models and confirmed capabilities

Model ID	When to use it
`glm-5.3`	Default model; text and coding tasks.
`glm-5.3-flash`	Fast model; at API level it accepts PNG and PDF through all three protocols, and MP4 through Chat Completions only.

For glm-5.3, Responses, capability tool_use, and session continuation are confirmed. Flash is added through the same provider, but its attachments through Kimi Code were not checked.
The client itself executes file, edit, and terminal tools. This profile does not connect Z.AI tools or MCP automatically.
This version was checked with text tasks; its attachment button was not checked. Flash capability at API level does not prove that this particular UI can send a file.
The profile uses OpenAI Responses (openai_responses). The GLM server prompt is off by default for ordinary API access; client setup does not enable it.
Native TXT, DOCX, and XLSX are outside the confirmed GLM contract. Use PDF for documents, or PNG with glm-5.3-flash for images.

If the connection fails

Symptom	What to check
`401 invalid_api_key`	The client received the complete active `gd-…` key; the variable is set in the same process that starts the client.
`404 model_not_found`	The model ID is exactly `glm-5.3` or `glm-5.3-flash`; old GLM IDs, aliases, Turbo, and FlashX are unsupported.
`404` or incorrect path	Base URL is `https://api.guardrelay.ai/glm/v1`. The client appends `/responses`; do not add it twice.
`400 invalid_request`	The documented API format is selected; reasoning, temperature, MCP, or other unconfirmed fields were not copied from an older profile.
`402 insufficient_balance`	Check available balance and unfinished reservations in your Guard account.
`no default model configured`	The file must contain one top-level `default_model = "guard/glm-5.3"` line; do not duplicate it.
The key was not loaded	The field is `api_key_env = "GUARD_API_KEY"`, and the variable is set before starting `kimi`.
Error combining `--prompt` and `--auto`	Remove `--auto`. For interactive work, start without `-p`; for one task, keep `-p` without `--auto`.

Gemini in Kimi CLI

Install Kimi Code

This is Moonshot's current Node/TypeScript client. Use the official Kimi Code guide. Run the first block on macOS/Linux or the second on Windows PowerShell, then check kimi --version.

bash

curl -fsSL https://code.kimi.com/kimi-code/install.sh | bash
kimi --version

powershell

irm https://code.kimi.com/kimi-code/install.ps1 | iex
kimi --version

Get a Guard key

Create a separate Gemini profile

Create ~/.kimi-code-guard-gemini/config.toml (Windows: %USERPROFILE%\.kimi-code-guard-gemini\config.toml) and save the example below there. KIMI_CODE_HOME attaches this profile without changing the normal .kimi-code. max_context_size = 1048576 is the model window from the table below and is the history budget of Kimi Code itself; max_output_size = 4096 bounds one example response.

toml

default_model = "guard/gemini-4-argon"

[providers.guard]
type = "openai_responses"
base_url = "https://api.guardrelay.ai/v1"
api_key_env = "GUARD_API_KEY"

[models."guard/gemini-4-argon"]
provider = "guard"
model = "gemini-4-argon"
display_name = "GUARD API · Gemini 4 Argon"
max_context_size = 1048576
max_output_size = 4096
capabilities = ["tool_use"]

[models."guard/gemini-3.8-flash"]
provider = "guard"
model = "gemini-3.8-flash"
display_name = "GUARD API · Gemini 3.8 Flash"
max_context_size = 1048576
max_output_size = 4096
capabilities = ["tool_use"]

macOS / Linux: enter the key at the hidden prompt. The variable applies only to this terminal and the client started from it.

{
unset GUARD_API_KEY
until [ -n "${GUARD_API_KEY-}" ]; do printf "Guard API key: "; read -r -s GUARD_API_KEY || break; printf "\n"; done
export GUARD_API_KEY
export KIMI_CODE_HOME="$HOME/.kimi-code-guard-gemini"
kimi -m guard/gemini-4-argon
}

Windows PowerShell: run these commands in the same window that starts the client. Set the key again after opening a new PowerShell window.

powershell

$guardKey = Read-Host "Guard API key" -AsSecureString
$env:GUARD_API_KEY = [System.Net.NetworkCredential]::new("", $guardKey).Password
$env:KIMI_CODE_HOME = "$HOME/.kimi-code-guard-gemini"
kimi -m guard/gemini-4-argon

Quick check and continuation

Run kimi -m guard/gemini-4-argon in a test folder. The full name includes provider prefix guard/.
Send: Read README.md and reply with exactly GUARD_GEMINI_OK. Change nothing.
In the same window, ask for the line without rereading. After exit, kimi -c continues the previous session for the current folder.
For one task without the interactive UI, use kimi -m guard/gemini-4-argon -p "Reply with exactly GEMINI_OK". Do not add --auto: Kimi Code does not allow it together with -p.

Gemini models and capabilities

Model ID	Input and window
`gemini-4-argon`	Text, images, PDF; 1,048,576-token window, shared by input and answer.
`gemini-3.8-flash`	Text, images, PDF; 1,048,576-token window for input.

Kimi Code itself executes the client-side read, edit, and terminal tools; kimi -c continues the session.
The Guard catalog takes text, images, and PDF as input and returns text. How to send a file or an image depends on the client's interface; this guide does not describe attachments.
The profile uses OpenAI Responses (openai_responses). The server prompt is a separate setting of the Gemini family: it applies only when the key has the entitlement and the option is on; client setup does not enable it.

If the connection fails

Symptom	What to check
`401 invalid_api_key`	The client received the complete active `gd-…` key; the variable is set in the same process that starts the client.
`404 model_not_found`	The model ID is an exact ID from the table above or the short name `gemini`; other spellings are unsupported.
`404` or incorrect path	Base URL is `https://api.guardrelay.ai/v1`. The client appends `/responses`; do not add it twice.
`400 invalid_request`	The documented API format is selected; extra settings from an older profile were not copied: reasoning, temperature, MCP, and others.
`402 insufficient_credit`	Check available balance and unfinished reservations in your Guard account.
`no default model configured`	The file must contain one top-level `default_model = "guard/gemini-4-argon"` line; do not duplicate it.
The key was not loaded	The field is `api_key_env = "GUARD_API_KEY"`, and the variable is set before starting `kimi`.
Error combining `--prompt` and `--auto`	Remove `--auto`. For interactive work, start without `-p`; for one task, keep `-p` without `--auto`.

Muse in Kimi CLI

Install Kimi Code

This is Moonshot's current Node/TypeScript client. Use the official Kimi Code guide. Run the first block on macOS/Linux or the second on Windows PowerShell, then check kimi --version.

bash

curl -fsSL https://code.kimi.com/kimi-code/install.sh | bash
kimi --version

powershell

irm https://code.kimi.com/kimi-code/install.ps1 | iex
kimi --version

Get a Guard key

Create a separate Muse profile

Create ~/.kimi-code-guard-muse/config.toml (Windows: %USERPROFILE%\.kimi-code-guard-muse\config.toml) and save the example below there. KIMI_CODE_HOME attaches this profile without changing the normal .kimi-code. max_context_size = 1048576 is the model window from the table below and is the history budget of Kimi Code itself; max_output_size = 4096 bounds one example response.

toml

default_model = "guard/muse-wonder-1.0"

[providers.guard]
type = "openai_responses"
base_url = "https://api.guardrelay.ai/v1"
api_key_env = "GUARD_API_KEY"

[models."guard/muse-wonder-1.0"]
provider = "guard"
model = "muse-wonder-1.0"
display_name = "GUARD API · Muse Wonder 1.0"
max_context_size = 1048576
max_output_size = 4096
capabilities = ["tool_use"]

[models."guard/muse-spark-1.3"]
provider = "guard"
model = "muse-spark-1.3"
display_name = "GUARD API · Muse Spark 1.3"
max_context_size = 1048576
max_output_size = 4096
capabilities = ["tool_use"]

[models."guard/muse-spark-1.2"]
provider = "guard"
model = "muse-spark-1.2"
display_name = "GUARD API · Muse Spark 1.2"
max_context_size = 1048576
max_output_size = 4096
capabilities = ["tool_use"]

macOS / Linux: enter the key at the hidden prompt. The variable applies only to this terminal and the client started from it.

{
unset GUARD_API_KEY
until [ -n "${GUARD_API_KEY-}" ]; do printf "Guard API key: "; read -r -s GUARD_API_KEY || break; printf "\n"; done
export GUARD_API_KEY
export KIMI_CODE_HOME="$HOME/.kimi-code-guard-muse"
kimi -m guard/muse-wonder-1.0
}

Windows PowerShell: run these commands in the same window that starts the client. Set the key again after opening a new PowerShell window.

powershell

$guardKey = Read-Host "Guard API key" -AsSecureString
$env:GUARD_API_KEY = [System.Net.NetworkCredential]::new("", $guardKey).Password
$env:KIMI_CODE_HOME = "$HOME/.kimi-code-guard-muse"
kimi -m guard/muse-wonder-1.0

Quick check and continuation

Run kimi -m guard/muse-wonder-1.0 in a test folder. The full name includes provider prefix guard/.
Send: Read README.md and reply with exactly GUARD_MUSE_OK. Change nothing.
In the same window, ask for the line without rereading. After exit, kimi -c continues the previous session for the current folder.
For one task without the interactive UI, use kimi -m guard/muse-wonder-1.0 -p "Reply with exactly MUSE_OK". Do not add --auto: Kimi Code does not allow it together with -p.

Muse models and capabilities

Model ID	Input and window
`muse-wonder-1.0`	Text, images, PDF; 1,048,576-token window.
`muse-spark-1.3`	Text, images, PDF; 1,048,576-token window.
`muse-spark-1.2`	Text, images, PDF; 1,048,576-token window.

Kimi Code itself executes the client-side read, edit, and terminal tools; kimi -c continues the session.
The Guard catalog takes text, images, and PDF as input and returns text. How to send a file or an image depends on the client's interface; this guide does not describe attachments.
The profile uses OpenAI Responses (openai_responses). The server prompt is a separate setting of the Muse family: it applies only when the key has the entitlement and the option is on; client setup does not enable it.

If the connection fails

Symptom	What to check
`401 invalid_api_key`	The client received the complete active `gd-…` key; the variable is set in the same process that starts the client.
`404 model_not_found`	The model ID is an exact ID from the table above or the short name `muse`; other spellings are unsupported.
`404` or incorrect path	Base URL is `https://api.guardrelay.ai/v1`. The client appends `/responses`; do not add it twice.
`400 invalid_request`	The documented API format is selected; extra settings from an older profile were not copied: reasoning, temperature, MCP, and others.
`402 insufficient_credit`	Check available balance and unfinished reservations in your Guard account.
`no default model configured`	The file must contain one top-level `default_model = "guard/muse-wonder-1.0"` line; do not duplicate it.
The key was not loaded	The field is `api_key_env = "GUARD_API_KEY"`, and the variable is set before starting `kimi`.
Error combining `--prompt` and `--auto`	Remove `--auto`. For interactive work, start without `-p`; for one task, keep `-p` without `--auto`.

Install Kimi CLI

Install Kimi CLI using Moonshot's official instructions. Run the first command on macOS/Linux or the second in Windows PowerShell. Then check kimi --version.

bash

curl -LsSf https://code.kimi.com/install.sh | bash
kimi --version

powershell

Invoke-RestMethod https://code.kimi.com/install.ps1 | Invoke-Expression
kimi --version

Get a Guard key

Open @guardapi → Categories → API, choose a package, and save the gd-… key. Kimi CLI reaches Codex with the same universal key.

Add a provider and model

Open ~/.kimi/config.toml (Windows: %USERPROFILE%\.kimi\config.toml). If it does not exist, run kimi once and exit so the client creates it. /login does not configure a third-party URL; it configures Moonshot platforms.
Add [providers.guard-codex]. Keep existing [providers.*] entries and every other section. type = "openai_responses" selects /responses; openai_legacy would select Chat Completions.
Add a separate [models."guard-codex/astra"] table. This is a local Kimi CLI name; model = "gpt-6-astra" is the exact ID sent to Guard.
max_context_size is required by Kimi CLI. Use 872000 for Astra, Sol, and Luna; this is a client history budget, not a strict server cap. A check dated September 23, 2026 shows Kimi CLI 1.48.0 completing Astra read/edit/test and a same-session follow-up; Sol and Luna answered separate short requests.

toml

# Add to ~/.kimi/config.toml; replace only gd-your-key
[providers.guard-codex]
type = "openai_responses"
base_url = "https://api.guardrelay.ai/codex/v1"
api_key = "gd-your-key"

[models."guard-codex/astra"]
provider = "guard-codex"
model = "gpt-6-astra"
display_name = "GUARD API · GPT-6 Astra"
max_context_size = 872000
capabilities = ["thinking", "image_in"]

[models."guard-codex/sol"]
provider = "guard-codex"
model = "gpt-6-sol"
display_name = "GUARD API · GPT-6 Sol"
max_context_size = 872000
capabilities = ["thinking", "image_in"]

[models."guard-codex/luna"]
provider = "guard-codex"
model = "gpt-6-luna"
display_name = "GUARD API · GPT-6 Luna"
max_context_size = 872000
capabilities = ["thinking"]

Kimi CLI stores api_key in config.toml. Keep that file accessible only to your user account and out of repositories. On macOS/Linux you can run chmod 600 ~/.kimi/config.toml. If OPENAI_API_KEY or OPENAI_BASE_URL is set in the environment, it overrides this provider type's config value; check those variables if the URL is unexpected or you receive 401.

The latest saved Guard native catalog declares these maximum-window values for client-side budgeting. They are not verified hard input caps; the client may compact history sooner. In the Guard connection, all seven models accept and preserve max_output_tokens (Responses), max_completion_tokens (Chat), and max_tokens (Messages) as advisory, without guaranteeing a hard managed Codex output limit; billing follows actual tokens and the key's money rules.

Model ID	Context value for client setup
`gpt-6-astra`	`872000`
`gpt-6.1-sol`	`872000`
`gpt-6-sol`	`872000`
`gpt-6-luna`	`872000`
`gpt-5.6-sol`	`872000`
`gpt-5.6-terra`	`872000`
`gpt-5.6-luna`	`872000`

Start, ask, and continue

Run kimi --model "guard-codex/astra" in your project folder.
In the open session, type Reply with exactly OK and wait for the answer. For a one-off check, use the command below with --prompt and --print.
Your next message in the same window continues the chat. After exiting, run kimi --continue from the same folder to restore the latest session. /sessions lets you choose another one.
For deeper reasoning, Kimi CLI offers --thinking for a model with the thinking capability. That switch asks for high; it does not expose every API effort value.

bash

kimi --model "guard-codex/astra"

# One-off request:
kimi --model "guard-codex/astra" --prompt "Reply with exactly OK" --print

# Return to the latest conversation in this folder:
kimi --continue

If connection fails

Symptom	Check
Config load error	There is no second table with the same name, and `max_context_size` is present as a number.
`401`	`api_key` is your active `gd-…` key; an unrelated `OPENAI_API_KEY` did not override it.
`404`	`base_url` ends in `/codex/v1`, type is `openai_responses`, and the exact model ID is `gpt-6-astra`.
`402`	Check the key balance and limits in your Guard account.

Kimi CLI

Claude, Kimi, Composer and Grok

GLM 5.3 in Kimi CLI

Install Kimi Code

Get a Guard key

Create a separate GLM profile

Quick check and continuation

Legacy Python client boundary

Models and confirmed capabilities

If the connection fails

Gemini in Kimi CLI

Install Kimi Code

Get a Guard key

Create a separate Gemini profile

Quick check and continuation

Gemini models and capabilities

If the connection fails

Muse in Kimi CLI

Install Kimi Code

Get a Guard key

Create a separate Muse profile

Quick check and continuation

Muse models and capabilities

If the connection fails

Install Kimi CLI

Get a Guard key

Add a provider and model

Start, ask, and continue

If connection fails

Sections

On this page