Kiro CLI 2.0 vs Codex CLI: Spec-Driven Development Meets Terminal-First Autonomy

The terminal agent landscape shifted again this week. AWS released Kiro CLI 2.0 with headless mode, Windows support, and a refreshed terminal UI¹ — the same week Amazon Q Developer began blocking new signups ahead of its April 2027 end-of-support². For AWS-oriented teams choosing their next coding agent, the decision increasingly comes down to two philosophies: Kiro’s spec-driven, structured approach versus Codex CLI’s lightweight, terminal-first autonomy.

This article provides a practitioner-level comparison as both tools stand in the first week of May 2026.

Architectural Philosophies

The two tools occupy overlapping territory but start from fundamentally different premises.

Codex CLI is a Rust-native binary that treats the terminal as its natural habitat³. It authenticates through your existing ChatGPT subscription, runs in a kernel-level sandbox (Seatbelt on macOS, Landlock/Bubblewrap on Linux, DACL on Windows), and talks to OpenAI’s Responses API. It is intentionally minimal — no IDE, no project scaffolding, no structured specification workflow. You prompt, it executes.

Kiro CLI is a TypeScript-based agent that extends a broader platform encompassing an IDE (Code OSS fork) and cloud services⁴. Its philosophical core is spec-driven development — translating natural language into structured requirements before generating code. The CLI surface launched in 2025 and graduated to a full terminal UI in v2.0.

graph LR
    subgraph Codex["Codex CLI"]
        A[Prompt] --> B[Agent Loop]
        B --> C[apply_patch / shell]
        C --> D[Sandbox Enforcement]
        D --> E[Responses API]
    end

    subgraph Kiro["Kiro CLI"]
        F[Prompt] --> G[Spec Generation]
        G --> H[Task Decomposition]
        H --> I[Agent Execution]
        I --> J[Hook Triggers]
    end

Feature Comparison Matrix

Capability	Codex CLI (v0.128)	Kiro CLI (v2.0)
Language	Rust	TypeScript
Open source	Yes (Apache 2.0)³	No
Sandbox	Kernel-level (Seatbelt/Landlock/DACL)⁵	Process isolation, no kernel sandbox⁶
Primary models	GPT-5.5, GPT-5.4, GPT-5.3-Codex-Spark⁷	Claude Opus 4.7, Claude Sonnet 4.6⁸
Spec-driven workflows	Manual (PLANS.md pattern)	First-class (Feature Specs, Bugfix Specs)⁹
Headless / CI mode	`codex exec` (since v0.100)¹⁰	`--no-interactive` + API key (v2.0)¹
MCP support	Full (stdio + HTTP)¹¹	Full (stdio + HTTP, prompts + resource templates)¹²
Subagents	MultiAgentV2 with custom TOML roles¹³	Subagent crew with task dependencies¹
Hooks	Six lifecycle events (stable since v0.124)¹⁴	Pre/Post Task Execution + five lifecycle hooks¹²
Plan mode	/plan toggle (Shift+Tab)¹⁵	Design-First and Requirements-First spec workflows⁹
Windows	Native (DACL sandbox)⁵	Native (v2.0)¹
Self-update	`codex update`¹⁶	Background auto-update¹
Pricing	Included in ChatGPT Plus ($20/mo)¹⁷	Free (50 credits) / Pro ($20/mo, 1000 credits)¹⁸

Headless Mode: CI/CD Integration

Both tools now support non-interactive execution for CI/CD pipelines, but the mechanics differ.

Codex CLI

# Codex exec has existed since early versions
codex exec "Fix the failing test in src/auth.ts" \
  --model gpt-5.4-mini \
  --output-schema '{"type":"object","properties":{"fix_applied":{"type":"boolean"}}}' \
  --approval-mode full-auto

Codex’s headless mode operates through the exec subcommand. It supports --output-schema for structured JSON output, --ephemeral for disposable sessions, and --ignore-user-config for hermetic CI runs¹⁰. Session resumption via codex resume allows multi-stage pipelines.

Kiro CLI

# Kiro 2.0 headless mode
export KIRO_API_KEY="$YOUR_KIRO_KEY"
kiro-cli --no-interactive \
  --trust-all-tools \
  "Fix the failing test in src/auth.ts"

Kiro’s headless mode requires a generated API key and the --no-interactive flag¹. Tool permissions are granted upfront via --trust-all-tools or selectively with --trust-tools. Enterprise administrators control API key generation through governance settings.

Key Differences

The philosophical split shows here. Codex treats headless execution as a Unix-style pipe — stdin prompt, stdout results, exit code for success/failure. Kiro treats it as an authenticated service call — API key implies identity, governance policies apply remotely.

For CI/CD pipelines, Codex’s --output-schema is a significant advantage when you need structured data extraction. Kiro’s approach is simpler to set up (no OAuth dance) but offers less output control.

Spec-Driven Development vs Terminal-First Autonomy

This is the fundamental philosophical divide.

Kiro’s Spec-Driven Approach

Kiro’s Feature Specs generate structured documents in three stages⁹:

Requirements — EARS notation (Easy Approach to Requirements Syntax) formal requirement statements
Design — Architecture decisions, data models, API contracts
Tasks — Ordered implementation steps with dependencies

# Feature Spec: User Authentication

## Requirements
- WHEN a user submits valid credentials, THE system SHALL issue a JWT
- IF the token has expired, THEN the system SHALL return 401

## Design
- OAuth2 PKCE flow with refresh token rotation
- Redis session store with 15-minute TTL

## Tasks
- [x] 1. Create auth middleware
- [ ] 2. Implement token refresh endpoint (depends: 1)
- [ ] 3. Add rate limiting (depends: 1)

Bugfix Specs follow a different structure: Current Behaviour, Expected Behaviour, and Unchanged Behaviour⁹. This explicit framing of what must not change addresses the specification drift problem that plagues long agent sessions.

Codex CLI’s Equivalent Patterns

Codex CLI achieves similar structured planning through composition rather than built-in spec workflows:

# Plan mode for structured thinking
codex --model gpt-5.5
# Then within the session:
# /plan  (or Shift+Tab to toggle)

For reproducible structured development, Codex relies on:

PLANS.md — The ExecPlan pattern for multi-hour sessions¹⁹
AGENTS.md — Repository-level conventions and constraints²⁰
Plan Mode — Agent reads and analyses without writing until you approve¹⁵
/goal — Persistent objectives with token budgets²¹

The Codex approach is more flexible but less prescriptive. You can build spec-driven workflows, but the tool does not enforce them.

Sandbox and Security Model

This is where Codex CLI has a clear architectural advantage.

graph TD
    subgraph Codex_Security["Codex CLI Security Stack"]
        S1[Kernel Sandbox] --> S2[Filesystem deny-read policies]
        S2 --> S3[Network domain allowlists]
        S3 --> S4[Approval policies]
        S4 --> S5[Shell environment policy]
    end

    subgraph Kiro_Security["Kiro CLI Security Stack"]
        K1[Process isolation] --> K2[Tool permission prompts]
        K2 --> K3[Path-scoped write permissions]
        K3 --> K4[Command allowlists/blocklists]
    end

Codex CLI enforces isolation at the operating system kernel level⁵. The Seatbelt (macOS), Landlock + Bubblewrap (Linux), and DACL (Windows) mechanisms prevent even a compromised agent from escaping its sandbox. Network access is mediated through a managed proxy with domain allowlists.

Kiro CLI uses process-level isolation with a permission prompt system⁶. Users grant shell execution approval per-command, per-session, or comprehensively. Path-scoped write permissions and command allowlists provide additional guardrails, but without kernel enforcement.

For enterprise environments handling sensitive codebases, Codex’s kernel sandbox is materially stronger. For standard development work, Kiro’s permission system is arguably more ergonomic — you choose your trust level once and work uninterrupted.

Model Access and Cost Economics

Codex CLI

Bundled with ChatGPT subscriptions¹⁷:

Plan	Monthly Cost	Codex Allowance
Plus	$20	Standard usage
Pro	$200	20x Plus usage
Team	$30/user	Shared team limits
Enterprise	Custom	Unlimited

API key access charges per-token at standard OpenAI rates. The Pro plan’s 2x promotional bonus (10x total usage) runs through 31 May 2026¹⁷.

Kiro CLI

Credit-based pricing¹⁸:

Plan	Monthly Cost	Credits
Free	$0	50
Pro	$20	1,000
Pro+	$40	2,000
Power	$200	10,000

Overage at $0.04/credit on paid plans. Enterprise pricing via AWS IAM Identity Centre integration.

Practical Cost Comparison

A typical heavy development day might consume 200-400 Kiro credits or the equivalent of $15-30 in Codex token usage. For teams already on ChatGPT Pro, Codex CLI represents zero incremental cost. For AWS-native teams without OpenAI subscriptions, Kiro’s $20/month Pro tier is competitive.

When to Choose Each

Choose Codex CLI When

Your team already has ChatGPT Pro or Enterprise subscriptions
Kernel-level sandboxing is a compliance requirement
You need Unix-pipe composability (codex exec | jq | gh pr create)
Open-source tooling matters for audit or extensibility
You prefer flexibility over prescription in workflows
Multi-provider model access (Bedrock, custom providers) is needed²²

Choose Kiro CLI When

Your infrastructure is AWS-native and you want integrated governance
Spec-driven development resonates with your team’s process
You value structured requirements-before-code workflows
The team includes less experienced developers who benefit from guardrails
You are migrating from Amazon Q Developer and want minimal disruption²
Subagent task dependency graphs match your workflow patterns

Use Both

There is no exclusivity requirement. A practical pattern for AWS-oriented teams:

# ~/.codex/config.toml — use Codex for quick terminal tasks
[profiles.quick]
model = "gpt-5.4-mini"
model_reasoning_effort = "low"

# Kiro for structured feature development
# (configured separately via kiro-cli settings)

The Convergence Pattern

Despite their differences, both tools are converging on shared primitives:

Structured planning — Codex’s /plan and /goal; Kiro’s Feature/Bugfix Specs
Lifecycle hooks — Both offer pre/post execution hooks for automation
MCP integration — Both support stdio and HTTP MCP servers
Subagent orchestration — Both support parallel agent execution
Headless CI/CD — Both now have non-interactive modes

The competitive pressure is pushing each tool to adopt the other’s strengths. Kiro added headless mode (Codex’s territory); Codex added Goal Mode (closer to Kiro’s persistent objectives). Expect further convergence through 2026.

Migration Considerations for Q Developer Teams

With Amazon Q Developer blocking new signups from 15 May 2026 and removing Opus 4.6 from 29 May², teams need to act now. The decision framework:

flowchart TD
    A[Q Developer team] --> B{AWS-native governance required?}
    B -->|Yes| C{Spec-driven workflow preferred?}
    B -->|No| D[Codex CLI]
    C -->|Yes| E[Kiro CLI]
    C -->|No| F{Model preference?}
    F -->|Claude models| E
    F -->|GPT models| G[Codex CLI on Bedrock]
    G --> H[config.toml with Bedrock provider]

For teams wanting GPT models within AWS infrastructure, Codex CLI now supports first-class Amazon Bedrock provider configuration with AWS SigV4 signing²². This gives you Codex’s terminal-first workflow with AWS credential management.

Citations

Kiro CLI 2.0 release announcement, kiro.dev/blog/cli-2-0 ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶
Amazon Q Developer end-of-support announcement, AWS DevOps Blog ↩ ↩² ↩³
OpenAI Codex CLI GitHub repository, github.com/openai/codex ↩ ↩²
Kiro general availability announcement, kiro.dev/blog/general-availability ↩
Codex CLI sandboxing documentation, developers.openai.com/codex/sandboxing ↩ ↩² ↩³
Kiro CLI vs Codex CLI comparison, vibecoding.app/compare/kiro-vs-openai-codex-cli ↩ ↩²
Codex CLI models documentation, developers.openai.com/codex/models ↩
Kiro changelog — CLI 2.0, kiro.dev/changelog/cli/2-0 ↩
Kiro Specs documentation, kiro.dev/docs/specs ↩ ↩² ↩³ ↩⁴
Codex CLI non-interactive mode documentation, developers.openai.com/codex/noninteractive ↩ ↩²
Codex CLI MCP documentation, developers.openai.com/codex/mcp ↩
Kiro CLI changelog — new spec workflows and MCP prompts, kiro.dev/changelog/ide/0-10 ↩ ↩²
Codex CLI subagents documentation, developers.openai.com/codex/subagents ↩
Codex CLI hooks documentation, developers.openai.com/codex/hooks ↩
Codex CLI features documentation, developers.openai.com/codex/cli/features ↩ ↩²
Codex CLI v0.128 changelog, developers.openai.com/codex/changelog ↩
Codex pricing, developers.openai.com/codex/pricing ↩ ↩² ↩³
Kiro pricing, kiro.dev/pricing ↩ ↩²
OpenAI Cookbook — PLANS.md for multi-hour sessions, cookbook.openai.com ↩
Codex CLI AGENTS.md documentation, developers.openai.com/codex/agents-md ↩
Codex CLI Goal Mode (v0.128), developers.openai.com/codex/changelog ↩
Codex CLI advanced configuration — Amazon Bedrock provider, developers.openai.com/codex/config-advanced ↩ ↩²