Best Kimi Plugins in 2026

The best Kimi plugins in 2026 are NPMScan, HTML/CSS to Image, Mobbin, You.com Agent Skills, uCoz, the Azure Cosmos DB Agent Kit, Morning Star Harness, superlite, Embedded Workbench and NeatContext. All ten ship a Kimi Code manifest that passes HOL's manifest checks, carry no high or critical finding in the HOL Plugins catalog, and give a Kimi install command in their own README. For each one we read the manifest to see what Kimi actually loads, and we note what you need before it works: an account, a paid plan, Node.js, or nothing at all.

The Best Kimi plugins page on hol.org ranks all 33 Kimi listings by Trust Score. This list is sorted by setup instead. Plugins that bring their own hosted tools come first, then plugins that start a server on your machine, then plugins made of skills only.

TL;DR: best Kimi plugins

Scores, labels and findings were read from the HOL catalog API on Nov 4, 2026. Star counts come from HOL's GitHub fetch the same day. Skill counts are HOL's.

How we picked these

HOL lists 33 plugins that name Kimi as a supported runtime, and only 3 of them name Kimi first. The rest list Codex (14), Claude Code (9), MCP (6) or the Agent Skills format (1) as their main runtime. HOL's scanner found a Kimi manifest in 24 of the 33 and runs a separate set of Kimi checks on each: the manifest parses, declared paths stay inside the plugin, field shapes are valid, and MCP server entries are well formed. Those checks raised 7 Kimi-specific findings across 6 plugins, mostly a malformed interface block, which only affects how the plugin is shown in Kimi's plugin manager.

To make this list, a plugin had to ship a Kimi manifest, have no high or critical finding, and give a Kimi install command in its own repository. We took one plugin per job and skipped plugins already picked in our Codex, Claude Code and Cursor roundups.

One caveat applies to all ten. HOL's per-skill content scanner failed or timed out on every pick, so the scans are partial. HOL checked manifests, MCP settings, provenance and the supply chain, but it did not read each SKILL.md in depth. Treat the label as evidence about packaging, not a code review. The Trust Score page explains how labels are set.

What are Kimi plugins?

A Kimi plugin is a folder or zip file with a manifest at kimi.plugin.json or .kimi-plugin/plugin.json. If both exist, kimi.plugin.json wins. According to the Kimi Code plugin docs, a plugin can carry:

• Skills: folders with a SKILL.md, called as /skill:plugin-id:skill-name or loaded by the model when a task matches.
• Agents: markdown files the main agent can hand work to. Kimi looks in agents/ even if the manifest doesn't mention it.
• Commands: saved prompts that run as /plugin-id:command.
• MCP servers: tool connections, local or remote, declared inside the manifest.
• Hooks, a session-start skill, and extra system-prompt text.

Installing a plugin never runs its hooks or starts its MCP servers. Servers start after /reload or in a new session, and you can switch each one off from /plugins. Kimi's older Python CLI used a different format, a root plugin.json with a list of tools. That project is archived, and Kimi Code ignores those fields.

The Kimi help center says the same plugin definition is used across Kimi's products, with one limit: the Kimi web app supports only the skills and MCP parts of a plugin, while Kimi Work and Kimi Code support all of it.

How to install Kimi plugins

In Kimi Code (the CLI)

Run /plugins to open the plugin manager. It has four tabs: Installed, Official (Kimi's own plugins, currently Kimi Datasource, Kimi Browser Extension and Kimi Computer Use), Curated (partner plugins) and Custom. To install from GitHub, pass the repository URL:

/plugins install https://github.com/owner/repo
/reload

A bare repository URL installs the latest release, or the default branch if there are no releases. Add /tree/<ref>, /releases/tag/<tag> or /commit/<sha> to pin a version. Changes apply after /reload or /new, not in the session you are in. Plugins install per user and apply to every project. /plugins info <id> shows a plugin's diagnostics, and /plugins mcp disable <id> <server> turns off one of its servers.

If you don't have Kimi Code yet, the getting started guide installs it from npm (Node.js 22.19.0 or newer) and you sign in with /login:

npm install -g @moonshot-ai/kimi-code

In the Kimi app

On the web and in the mobile app, open the plugin marketplace from the + button or by typing /, open a plugin and click install. Some ask you to sign in to the third-party service first. After that, pick the plugin with / or describe the task and let Kimi choose. To bring in a plugin from GitHub, use the Kimi Work desktop app: type /, choose Plugin Builder and give it the repository link. Kimi's guide to personal plugins says the result lands under Plugins, then Personal, where you click + to install it. NPMScan's README documents this route for its own repo.

Kimi skills vs plugins

A skill can only tell Kimi how to do something. A plugin can also hand it the tool to do it with. Kimi's skills page says skills use the open SKILL.md format, so a skill you already use with another agent can usually be dropped into ~/.agents/skills/. One naming rule trips up several READMEs below: a skill that arrives inside a plugin is never reached by its bare name. If a README says /skill:pm, the Kimi Code form is /skill:plugin-id:pm.

The 10 best Kimi plugins

1. NPMScan: ask about an npm package before you install it

NPMScan connects Kimi to npmscan.com's public MCP server, which its README says has 23 read-only tools and needs no API key. The five skills turn those tools into jobs: a dependency audit for a pasted package.json or GitHub repo, a deep trust check on one package, a side-by-side for picking a new dependency, incident response, and a pass, warn or fail verdict for a pull request. Malware findings are reported as packages to remove, not as ordinary bugs.

• Trust Score 84, security 97 (Safe), 0 high findings
• Finding behind the score: a low one, the Kimi interface block is malformed. HOL also takes 10 percent off the Trust Score because the repo doesn't run security checks in CI.
• 520 GitHub stars; owner verified on HOL; Scanner Clean and Marketplace Ready badges

Install, from the README:

/plugins install https://github.com/salemalem/npmscan-mcp-plugin

The README also gives the Kimi Work route: Custom plugin, then ask Plugin Builder to import the same URL. Example prompts from the README:

Is chalk 5.6.1 safe? I heard there was a supply-chain incident.
Should we use axios, got, or node-fetch for our new HTTP client?

Pros: works the moment it is installed, with no account. It checks things a vulnerability list misses, such as maintainer changes and install scripts.

Cons: the server is rate-limited to 30 requests a minute per IP, and package names you ask about go to npmscan.com. The malformed interface block concerns the name and description Kimi shows in /plugins, not what the plugin can do.

HOL listing · GitHub

2. HTML/CSS to Image: screenshots and social cards without running a browser

The official HCTI plugin points Kimi at the hosted server at mcp.hcti.io. Kimi can then render HTML and CSS to an image, capture part of a live page, fill a saved template, or set up dynamic Open Graph images for a site. Sign-in happens in your browser, and the repo stores no API key.

• Trust Score 95, security 97 (Safe), no findings above info
• Passes all 45 points of HOL's Kimi checks
• 7 GitHub stars; owner verified on HOL; Scanner Clean badge

Install, then sign in to the server, from the README:

/plugins install https://github.com/htmlcsstoimage/agent-plugins
/reload
/mcp-config login hcti

Example requests from the README:

Create a 1200×630 Open Graph image with this title and color palette.
Capture the pricing table on https://example.com/pricing.

Pros: the second-highest Trust Score in the Kimi catalog and a clean Kimi manifest. You don't have to run a browser yourself to get a picture of a page.

Cons: you need an HCTI account. Some tools change your account, and the README warns that update_og_config replaces the whole configuration. Seven stars is a small user base.

HOL listing · GitHub

3. Mobbin: design from screens real apps shipped

Mobbin's plugin adds its hosted MCP server and four skills. The search skill teaches Kimi to write searches the way Mobbin indexes them: by meaning, with at most three constraints. redesign-screen takes a screenshot, code or design file and reworks it against how real apps handle the same screen, naming each product it drew from. Per its HOL listing, the library covers more than 600,000 iOS and web screens, flows and website sections.

• Trust Score 80, security 97 (Safe), no findings above info
• Passes all 45 points of HOL's Kimi checks; Trust Score lowered 10 percent for no security checks in CI
• 62 GitHub stars; Scanner Clean badge

Install from the README, then run /reload:

/plugins install https://github.com/mobbin/skills

The README has no sample prompts. These are example searches from the plugin's own search skill:

paywall with a free trial button
expense tracker home with no transactions

Pros: answers cite real products and link to the screens, and the redesign skill is strict about not inventing evidence.

Cons: it needs a Pro, Team or Enterprise Mobbin plan. The tools have no Android, so the skill searches iOS for Android work. Not owner verified on HOL.

HOL listing · GitHub

4. You.com Agent Skills: current web answers with sources

You.com's Kimi manifest declares four remote servers, for search and page reading, research, finance, and a discovery profile, plus the skills folder. you-web searches and reads the pages before answering, you-research pulls from many sources into a cited report, and you-finance handles stock and earnings questions. Every answer cites the pages it read, and the README says web results are treated as data, never as instructions.

• Trust Score 80, security 87 (Review), 0 high findings
• Findings behind the label: no lockfile for package.json, no SECURITY.md, no Dependabot config
• 98 GitHub stars, 16 forks; owner verified on HOL

The README's Kimi row reads /plugins install <repo url>. With the repository filled in:

/plugins install https://github.com/youdotcom-oss/agent-skills

Example prompts from the README:

What changed in the latest Next.js release, and does it break my middleware?
Research NVIDIA's latest earnings and cite the numbers.

Pros: four services behind one install, and the plugin starts no local scripts.

Cons: the README says the free, keyless profile covers basic search only, and the Kimi manifest points at the full endpoints, so expect to sign in or set an API key. HOL counts 7 skills, including general ones such as tdd and grill-me that load alongside the search skills.

HOL listing · GitHub

5. uCoz: build and run a uCoz site from Kimi

uCoz's official plugin lists nine skill folders in its Kimi manifest, each for one job: landing pages, ad-campaign landings, shop audits, translation, redesign, new site templates, server scripts, content publishing and popup styling. All of them work through the remote ucoz-mcp server, which the manifest turns on by default.

• Trust Score 80, security 97 (Safe), no findings above info
• Passes all 45 points of HOL's Kimi checks; Trust Score lowered 10 percent for no security checks in CI
• 24 GitHub stars; Scanner Clean badge

Install from the README, then run /reload or start a new session. On first connection, sign in to uCoz and click Allow:

/plugins install https://github.com/ucoz-skills/agent-skills

The README has no sample prompts. Its first step after sign-in is to pick a site with list_sites and select_site, or make one with create_site.

Pros: one install gives both the instructions and the tools, and each skill is versioned on its own.

Cons: it only helps if your site runs on uCoz. The ad-campaign skill is built around Yandex Direct, with Google Ads on request. Not owner verified on HOL.

HOL listing · GitHub

6. Azure Cosmos DB Agent Kit: 139 rules for Cosmos DB code

The Azure Cosmos DB team packs 139 rules in 13 categories into one skill, ranked by impact, with data modeling and partition key design at the top. The Kimi manifest also starts Microsoft's Azure MCP server on your machine through npx. The README is unusually frank about delivery: in its tests, forcing the whole skill set into every prompt overflowed the context window and scored 0 on models with about 130K tokens or less. Loading the skill only when needed avoided that. Kimi Code's docs describe skills the same way: loaded by slash command, or when the model decides a task needs one.

• Trust Score 77, security 87 (Review), 0 high findings
• Findings behind the label: no SECURITY.md, no Dependabot config, a malformed Kimi interface block
• 62 GitHub stars, 38 forks

Install from the README, then run /reload:

/plugins install https://github.com/AzureCosmosDB/cosmosdb-agent-kit

Example prompts from the README:

Help me choose a partition key for my orders collection
Optimize this Cosmos DB query

Pros: vendor-written rules with a published benchmark, and the README says which models did well with them and which didn't.

Cons: the Azure MCP server is pulled as @azure/mcp@latest, so the version can change under you, and it needs Node.js. Not owner verified on HOL.

HOL listing · GitHub

7. Morning Star Harness: a project manager that takes a task to a pull request

Morning Star uses more of Kimi's plugin format than any other pick. Its manifest declares 29 skills, a commands folder with 7 commands, an MCP server started with npx, and a session-start skill that loads the project manager role in every new session. Kimi also picks up the 13 agent files in its agents/ folder, from architect and QA engineer to code reviewer. You describe the work once; the PM writes a plan, sends the work to the matching role, and drives it through review and acceptance to a pull request. Plans and review reports are saved in your repo, not just the chat.

• Trust Score 92, security 91 (Safe), 0 high findings
• Findings behind the score: no lockfile for package.json, no Dependabot config
• Passes all 45 points of HOL's Kimi checks; 68 GitHub stars; owner verified on HOL

Install from the README:

/plugins install https://github.com/btspoony/mstar-harness
/plugins reload

An example request from the README, and its read-only audit command in Kimi's plugin-prefixed form:

Add rate limiting to the public API and cover it with tests.
/morning-star-harness:codebase-audit security

Pros: merges follow a policy you set when an iteration starts, and the audit commands read and report without editing your code.

Cons: it is a heavy install for small jobs. The README tells Kimi users to call /skill:pm, but the Kimi docs say a plugin's skills need the prefix, so use /skill:morning-star-harness:pm if it doesn't load on its own. /amazing-pr-review posts a comment review to GitHub when you give it a PR number.

HOL listing · GitHub

8. superlite: approve one plan, then it builds

superlite was written for Claude Code, and its Kimi manifest shows how a port can be done cleanly. It points Kimi at the same 11 skills, loads using-superlite at session start, and adds instructions that map each Claude Code tool name to Kimi's own, such as plan lists to TodoList and subagent calls to Kimi's Agent tool. Its Kimi guide says there are no copied skills, symlinks, hooks or extra runtime dependencies. Work stays on its own branch, and superlite never commits during a run or pushes without asking.

• Trust Score 89, security 93 (Safe), 0 findings above low
• Findings behind the score: no Dependabot config, a malformed Kimi interface block
• 247 GitHub stars, 19 forks; Scanner Clean and Marketplace Ready badges

Install from the README, then start a fresh session with /new:

/plugins install https://github.com/iha2/superlite

Example prompts from the README:

Add CSV export with column widths to the existing app
This test fails on leap days: find the root cause and fix it

Pros: no extra runtime to install, and the Kimi guide includes a quick check: ask for a React todo list and the inventing skill should load before any code is written.

Cons: the Kimi manifest declares no commands, so the README's /superlite: commands are not Kimi slash commands; describe the task instead. The README's model tiers name Claude models, and its Kimi guide notes Kimi has no per-call model choice. Not owner verified on HOL.

HOL listing · GitHub

9. Embedded Workbench: firmware help that knows Keil and FreeRTOS

Amethyst Luna's toolbox covers embedded C and C++: FreeRTOS, interrupts, NVM storage, Keil MDK with ARM Compiler 5 and 6, HardFault triage from fault registers and stack frames, state machines and LVGL traps. The Kimi manifest declares the 8 skills, and Kimi finds its 4 agents (architecture steward, design reviewer, execution worker and quality coordinator) in agents/. The README says most of the content comes from the author's own firmware work.

• Trust Score 92, security 89 (Review), 0 high findings
• Findings behind the label: two medium findings about its DeepSeek Harness packaging, which Kimi doesn't use, and no Dependabot config
• Passes all 40 points of HOL's Kimi checks; 30 GitHub stars; owner verified on HOL

Install, from the README:

/plugins install https://github.com/AmethystLuna/embedded-workbench.git

The README has no sample prompts. It calls skills as /skill:debug-methodology; under Kimi's plugin naming rule the installed forms are:

/skill:embedded-workbench:hardfault-triage
/skill:embedded-workbench:keil-mdk-build

Pros: a niche few agent plugins cover, with a 7-round debugging case study and embedded C specifics such as volatile MMIO and ISR wrappers.

Cons: the main README is in Chinese; the English one is README.en-US.md. Its manual install clones into ~/.kimi/plugins, the folder the old Kimi CLI used, so stick with /plugins install.

HOL listing · GitHub

10. NeatContext: keep what a session taught you

NeatContext is one of the three listings that name Kimi as their primary runtime, and it has a separate Kimi build in the repo. It saves the useful parts of a conversation, such as decisions, system details and terms, as a named context you reconnect in a later session or export for a teammate. The Kimi manifest adds a session-start skill, ten /neatcontext: commands and a local MCP bridge run with Node. Contexts stay on your machine.

• Trust Score 82, security 80 (Review), 0 high findings
• Findings behind the label: no lockfile for package.json, and a medium Kimi finding that the MCP bridge script must exist inside the plugin and not be a symlink
• 14 GitHub stars, 5 forks

We checked that finding against the commit HOL scanned: plugins/kimi-code/neatcontext/src/kimi/mcp-bridge.mjs is there as a regular file. After installing, run /plugins info neatcontext to see whether Kimi reports the same problem. Install, from the plugin's Kimi README, then run /reload:

/plugins install https://github.com/XTSoftwareLabs/neatcontext-plugins/tree/main

Commands from the README, to save the current session and to reconnect later:

/neatcontext:save [name]
/neatcontext:use [name or number]

Pros: its command names already follow Kimi's plugin-id:command rule, and each Kimi session keeps its own selected context.

Cons: the lowest security score of the ten, the last push was Aug 23, 2026, and it is not owner verified on HOL.

HOL listing · GitHub

Popular Kimi plugins we left out

i-have-adhd has the most stars of any Kimi listing, at 60,036, and it ships a Kimi manifest, but its README has no Kimi install and HOL gives it a Trust Score of 70 with medium findings about its marketplace file. Aegis (1,416 stars) has a Kimi manifest and a Kimi guide, but it carries medium lockfile and DeepSeek Harness findings. Better Harness and lattice were in our Codex list, and deja and claude-council name Kimi without shipping a Kimi manifest. Mnemoverse Memory tops the hub at 96, but its README gives no Kimi install command. Two of the three Kimi-first listings missed the cut: GoodMemory has a high finding for possible secret material in its README, and mcp-music-studio declares only an MCP server with no skills. If you want the catalog by Trust Score instead, the Best Kimi plugins page does that.

Build your own Kimi plugin

A Kimi manifest needs only a name. Put kimi.plugin.json at the root, or .kimi-plugin/plugin.json if your repo already has folders for other agents, which is what most picks here do. Point skills at your skills folder with a ./ path, declare MCP servers inline under mcpServers in the manifest, and add commands if you want slash commands. Keep every path inside the plugin root: Kimi ignores a stdio server whose command or working folder points outside it. Test with /plugins install ./ from the checkout, then check /plugins info <id> for diagnostics. If you are porting from Claude Code, superlite's skillInstructions block is a good model for mapping tool names.

Before you publish, run the HOL Plugin Scanner on the repo. It checks the Kimi manifest along with the others and can run in GitHub Actions, which also avoids the 10 percent Trust Score cut several picks took. Then submit the plugin to HOL Plugins for a public listing. To review what installed plugins do on your machine as they run, HOL Guard checks agent actions before they happen.

What do people ask about Kimi plugins?

What is the best Kimi plugin in 2026?

It depends on the job. NPMScan is the easiest to start with because it needs no account. HTML/CSS to Image has the highest Trust Score of the ten at 95. Morning Star Harness uses the most of Kimi's plugin format, with skills, commands, agents, an MCP server and a session-start skill. For the full catalog ranked by Trust Score, see the Best Kimi plugins page on hol.org.

How do I install a plugin in Kimi Code?

Run /plugins install followed by the plugin's GitHub URL, a zip URL or a local folder, then run /reload or start a new session with /new. You can also open /plugins and install from the Official, Curated or Custom tabs.

Can I use Kimi plugins in the Kimi app?

Yes, with limits. Kimi's help center says the web app supports the skills and MCP parts of a plugin, while Kimi Work and Kimi Code support the full format. In Kimi Work you can bring in a plugin from a GitHub link with Plugin Builder, then install it from Plugins, Personal.

What is the difference between a Kimi skill and a Kimi plugin?

A skill is a SKILL.md file with instructions for one kind of task. A plugin is a package that can bundle skills with agents, commands, hooks and MCP servers, so it can give Kimi live tools as well as instructions.

Why doesn't a plugin skill load by its short name?

Kimi Code lists plugin skills under the plugin's id. A skill named pm inside a plugin called morning-star-harness is called with /skill:morning-star-harness:pm, and a bare /skill:pm never reaches it.

Do old Kimi CLI plugins still work?

No. The Python Kimi CLI is archived, and its plugin.json format with a list of tools is ignored by Kimi Code. Current plugins use kimi.plugin.json or .kimi-plugin/plugin.json.

Are Kimi plugins safe to install?

Not automatically. Installing a plugin doesn't run its hooks or start its servers, but once enabled its MCP servers run on your machine or send data to a hosted service, and hooks run on events. Read the manifest, check the HOL listing for its label and findings, and remember that HOL's scan was partial for all ten picks.