Here is a sentence you will not hear at many tech conferences this year: "We are not open sourcing the harness." That is exactly what Deepak Singh, AWS's VP of Agentic AI, told reporters last week about Kiro Crew, the company's new open-source agent orchestrator. And honestly? I think he is right. I also think he is telling us something uncomfortable about where agentic coding is headed.
Let me back up. On August 4, AWS open-sourced Kiro Crew under the Apache 2.0 license. If you have not followed the noise, Crew is the persistent, always-on workspace that turns AWS's Kiro coding assistant into something closer to an autonomous engineering team. You start a task, walk away, and come back when there is something worth your attention. It triages ticket queues, investigates incidents, monitors pull requests, and keeps working while you sleep. It was born inside Amazon as a project called MeshClaw, and AWS says more than 39,000 internal developers adopted it within six months, with nearly 500 contributors shipping 597 changes.
That alone would be a decent story. The release is more interesting for what AWS chose to give away, and what it chose to keep.
The Open Part Is Real, and It Is the Boring Half
What AWS open-sourced is the orchestration layer. That is the unglamorous machinery that makes long-running agents survivable: scheduling recurring jobs, heartbeat monitoring that waits for a pull request before resuming, persistent memory that carries project context and corrections across sessions, multi-agent coordination through the Agent Client Protocol (ACP), approval workflows, and a web and desktop dashboard that shows every tool call as it happens.
It is also the governance half. Kiro Crew ships with OS-level sandboxing, denied-by-default commands, sensitive-path blocking, credential redaction, and signed audit logs. The dashboard binds to localhost unless you explicitly expose it. For the first time in a mainstream product, an enterprise can deploy an agent orchestrator entirely inside its own perimeter, no AWS account required, and show security teams exactly what ran, what it touched, and who authorized it.
That matters more than any benchmark. Right now, agent use inside most companies is shadow IT. Developers wire up their own agents against their own credentials and nobody tracks it. Crew's approval gates and logging give platform teams a single place to see the whole swarm. Analysts at Moor Strategy and IDC have been unusually blunt about why this is the actual selling point: it is a low-risk entry point for demonstrating agentic ROI before extending trust to unattended workflows.
But AWS Kept the Brain, and That Is the Point
Here is the catch, and it is a big one. Kiro Crew runs on the proprietary Kiro CLI, which is metered by credits. The harness underneath, the code that actually plans, reasons, executes the agent loop, and enforces Cedar-based permissions, stays closed. AWS's stated strategy is to standardize on open protocols rather than open implementations. Open the plumbing, keep the engine.
You can see the commercial logic immediately. Open orchestration drives adoption of the Kiro ecosystem, while the proprietary reasoning engine and credit consumption remain the monetization. It is a clean, defensible trade. It is also, I would argue, the shape of everything to come in agentic coding: protocols open, runtimes closed, and interoperability defined by what competitors can agree to standardize.
I have three questions every platform team should ask before adopting Kiro Crew:
- Audit integrity. AWS advertises signed audit logs but has not explained what exactly is signed, where the signing keys live, or whether administrators can independently detect deleted or reordered events. A log you cannot verify is a marketing slide, not a control.
- Policy precedence. Crew stacks its own runtime policies on top of the harness's Cedar authorization policies. When the two conflict, which layer wins? Enterprises cannot answer that today, and they will not be able to answer it by reading the open-source code alone.
- Portability. Crew speaks ACP, and ACP version 1.0 is genuinely open, with support across JetBrains IDEs, Zed, and Xcode. But AWS also ships Kiro-ACP, extending the protocol with more than twenty proprietary agent methods. Any ACP client can talk to Kiro. Only Kiro-aware clients understand what makes Kiro different. That is the classic platform strategy, and it means the open protocol alone does not guarantee you can swap in another runtime.
None of this makes Kiro Crew a bad product. It is arguably the most honest agentic-coding release of the year: an unusually transparent look at how orchestration works, wrapped around a proprietary core that AWS openly admits it will not share.
The debate is bigger than AWS. As agent platforms mature, the competitive question stops being whether vendors embrace open source and becomes where they choose to stop. Kiro Crew is a bright line drawn in exactly the place that protects AWS's business. I think that line is reasonable, and I think pretending otherwise is how enterprises end up surprised when the open part stops being open.
Comments