# Install and connect Kam AI developer tools

Prepare the approved local toolkit and private SDK for an AgentCore project. Local installation does not configure a runtime, grant cloud access or qualify a deployment.

Status: Merged · local only. Prelaunch; not a live service guarantee.
Native toolkit 0.1.0 is merged into the backend (PR #176) and qualified in CI as a network-disabled Linux x64 artifact. No public binary release, macOS/Windows distribution, or live AWS connection is offered here. SDK 0.40.0 is source-implemented but not published to npm; an authorized service endpoint and tenant binding are separate prerequisites.

Reviewed: 2026-10-14.
Backend source: e16b81b4a637acec91f3aed8a71cf5b0f42f0c19.
Native toolkit: merged in PR #176, reviewed at e16b81b4a637acec91f3aed8a71cf5b0f42f0c19.
HTML: /docs/install

## In short

Prepare local tools for the State layer of an AgentCore application. Verify the supplied Linux x64 artifact, add the approved private SDK to an authorized backend, and give a coding agent read-only MCP access. Those steps do not attach Kam to a running agent.

**Available today:** The CLI and MCP are qualified locally for Linux x64. Private SDK 0.40.0 is unpublished; service authority and live runtime integration are separate.

> Prepare the State tools for an AgentCore project; qualify the connection separately.

## Prepare an AgentCore State project

- **Verify the local artifact** — Use the approved Linux x64 candidate and its recorded provenance.
- **Add authorized SDK access** — Local installation does not supply a service endpoint or tenant authority.
- **Keep runtime setup separate** — CLI and read-only MCP do not attach tools to AgentCore.

## Before you install

You need a Linux x64 development environment, an existing application directory, and the separately supplied Kam 0.1.0 artifact from the qualified backend CI run. Record its version, checksum, and provenance before use.

SDK use additionally requires an authorized backend source checkout, the exact approved SDK 0.40.0 package, a Kam service endpoint, and a server-authorized tenant binding. The CLI and MCP do not require AWS credentials or connect your account to the managed service.

There is no public CLI registry package, public SDK npm package, Homebrew formula, macOS build, or Windows distribution. Do not substitute similarly named packages from a public registry.

[Request candidate access](/support)

## Step 1: place the CLI on your PATH

Use the filename and checksum supplied with the approved artifact. The example keeps the binary in a user-owned directory; adapt the path to your organization’s software policy.

### Install and verify the approved candidate

```bash
mkdir -p "$HOME/.local/bin"
install -m 0755 ./kam "$HOME/.local/bin/kam"
export PATH="$HOME/.local/bin:$PATH"

kam --version
kam capabilities --json
```

> **Verify before use**
> Do not substitute an artifact from an unreviewed source. A successful version command establishes local execution only—not service access, deployed IAM, or production qualification.

## Step 2: initialize one project

Run from the application directory you want Kam to inspect. The first command prints the proposed changes. Nothing is written until you repeat it with --write.

### Plan, write, and check local setup

```bash
cd /path/to/your-application
kam init --template deployment-agent
kam init --template deployment-agent --write
kam doctor --json
kam generate --check
```

> **Local diagnostic boundary**
> kam doctor checks local configuration, declarations, and generated-file drift. It is separate from the authenticated kam-history doctor command and does not prove cloud permissions.

## Step 3: add the SDK to an authorized backend

Use the exact approved SDK source supplied for your evaluation and preserve its version with the backend that calls it. The current import is repository-local; there is no supported npm install command.

Configure endpoint, tenant, and access-token inputs through your backend’s existing secret and deployment controls. Never embed credentials in browser code, generated agent guidance, MCP configuration, or this static website.

### Create a scoped client and preserve exact references

```javascript
// Save as a .mjs file in an authorized backend source checkout. SDK candidate 0.40.0.
// This is a read-only example, not code executed by the website.
import { createKamClient } from './server/trajectory/sdk/index.mjs';
const kam = createKamClient({
  baseUrl: process.env.KAM_API_URL,
  tenantId: process.env.KAM_TENANT_ID,
  accessToken: () => process.env.KAM_ACCESS_TOKEN,
});
const deployments = kam.scope({ subjectId: 'checkout', type: 'deployment' });
const page = await deployments.allIds({ day: '2026-10-06', limit: 16 });
if (page.status === 'ready' && page.items.length > 0) {
  const exact = await deployments.byIds({
    day: page.day,
    generation: page.generation,
    refs: page.items,
  });
  console.log(exact.records); // Keep every position and result status.
}
// A short page is not the end when nextCursor is present.
// Continue with the SAME generation and returned cursor.
```

> **Service access is separate**
> Possessing the SDK does not authorize a tenant or AWS account. Validate the approved endpoint, principal, server-side tenant binding, lifecycle status, and supported scope before sending outcomes.

[Read the full SDK integration guide](/docs/integrate)

## Step 4: connect the read-only MCP server

Add the server to a coding agent that supports local stdio MCP processes. Client configuration locations differ, but the server command and arguments follow this shape. Use the absolute path returned by command -v kam.

The client starts kam mcp and communicates over stdio. Do not wrap it in a TCP listener or add shell, credential, arbitrary-path, or write capabilities.

### Generic MCP client configuration

```json
{
  "mcpServers": {
    "kam": {
      "command": "/home/you/.local/bin/kam",
      "args": ["mcp"]
    }
  }
}
```

## Step 5: verify the connection

1. **Restart or reload the MCP client** — The client should start the local stdio process itself; a separate hosted Kam endpoint is not involved.

2. **List the Kam tools** — Confirm the client exposes only the documented read-only tools, including project status, View manifest, fixture replay, reference Atlas, and bundled docs.

3. **Read project status** — Call kam_project_status in the application directory and review configuration or drift findings. This is a local filesystem assessment, not an AWS account check.

4. **Keep effects explicit** — Use the CLI with --write for reviewed generation changes. MCP remains read-only and cannot install packages, edit files, run a shell, or deploy infrastructure.

[Understand every MCP tool](/docs/agent-tooling)

[Continue with the CLI workflow](/docs/toolkit)

## Durable local State is a separate package

The private local-host source runs the existing HTTP service and real Rust worker over SQLite. Explicit open, initialize and process calls preserve accepted records and pending projection work across a restart. Your application supplies authentication; local identities do not grant cloud permissions.

This host requires Node 24.19 or later and a checksum-pinned worker for the target platform. It is separate from the Linux x64 native CLI artifact and the transport SDK. Hosted Context, account/provider delivery and offline-to-cloud write synchronization are unavailable in this local host.

> **Source and platform qualification are separate**
> The local-host package is unpublished. Source conformance and a native CLI round trip do not establish a public installer, every platform build or live AWS qualification.

## Update or remove the candidate

There is no public self-update channel for the local CLI artifact. Replace it only with a separately supplied artifact from an approved qualification run, verify the new version and checksum, then rerun kam doctor and kam generate --check.

Update the SDK only from an approved source revision and review its API and service compatibility before changing the pinned package in your backend. Do not replace the repository-local package with an unverified registry package.

To disconnect MCP, remove the kam server entry from your client and reload it. Remove the local binary or SDK package only after confirming no project, backend, or client configuration still references it.