Post to social media from Kilo Code

Put the entry in your main Kilo config file, not in a separate MCP file. The global file is ~/.config/kilo/kilo.jsonc and applies to all projects; on Windows that file is C:\Users\<username>\.config\kilo\kilo.jsonc, a .config folder in your home folder rather than AppData. A project can use kilo.jsonc in its root or .kilo/kilo.jsonc, and Kilo's docs say project-level configuration takes precedence over global configuration. Kilo's Settings page says all clients — the CLI, VS Code and JetBrains — read the same files, so you add it once. The extension's Settings, Agent Behaviour tab, MCP Servers sub-tab writes to those same files.

The root key is mcp and the kind is type: remote. Kilo's docs still show a second shape, mcpServers with alwaysAllow and disabled, under their SSE example. Kilo marks the SSE transport deprecated as of MCP specification version 2025-03-26, and the current shape is the mcp key with type: remote, so use that one. Kilo tries Streamable HTTP first and falls back to SSE, and our server is Streamable HTTP, so the first attempt is the one that connects.

Kilo caches project config when it first loads a workspace and does not re-read it on every prompt, so reload the VS Code window or start a fresh CLI session after editing one. Kilo documents this for a project permission rule, in kilo.jsonc or kilo.json in .kilo/. In VS Code, Kilo reloads global config in ~/.config/kilo/ on its own. In the CLI, restart after editing — Kilo's CLI page says to restart the CLI after editing provider, model, permission and MCP settings in that file. The CLI also has /reload, which re-reads the project from disk including config, and Kilo refuses it while any session in the project is running, so finish or abort that session first. Inside the CLI, /mcps toggles servers on or off.

To keep your key out of the file, write "Authorization": "Bearer {env:IHATEPOSTING_API_KEY}" and set that variable in your environment. Kilo's placeholder is {env:VARIABLE_NAME} — curly braces, no dollar sign. There is a command route as well: kilo mcp add ihateposting --url https://ihateposting.com/mcp --header "Authorization=Bearer YOUR_API_KEY" — the header is written as KEY=VALUE, with an equals sign rather than a colon.

MCP tools go through Kilo's ordinary permission system, which takes allow, ask or deny. Each tool's permission key is its namespaced name, {server}_{tool}, so with the server named ihateposting the keys are ihateposting_create_post, ihateposting_whoami and the rest, and ihateposting_* covers them all. Kilo's Agent Permissions page says rules are evaluated in config order and the last matching rule wins, so write the broad rule first: "ihateposting_*": "allow" and then "ihateposting_create_post": "ask" keeps approval on publishing. Kilo's own MCP example lists the specific key before the wildcard; in that order the wildcard wins and posts go out without asking.

A wrong key does not stop the server connecting. Our endpoint forwards your key to the API rather than checking it, so Kilo starts the server and kilo mcp list reports no error, and then every tool answers with the API's 401 as text. Ask Kilo to run whoami: it returns the iHatePosting login and account name your key belongs to, which is the check that proves the key rather than the address.