How to Add Web Search to Kimi Code With the You.com MCP Server

TLDR: To add web search to Kimi Code, put the You.com MCP server in ~/.kimi-code/mcp.json with the URL https://api.you.com/mcp and your key in an environment variable named by bearerTokenEnvVar, or use https://api.you.com/mcp?profile=free for 100 keyless queries a day. Kimi Code also has a built-in WebSearch tool, but it appears only when a search service is available. Check the result with /mcp.

Kimi Code CLI is Moonshot AI's MIT-licensed terminal coding agent. Its README says it can read and edit code, run shell commands, search files, and fetch web pages, and that it adds MCP servers conversationally with /mcp-config. This guide was checked against the Kimi Code documentation, whose changelog lists 2.1.1 (September 24, 2026) as the latest release, against the project source, and against the live You.com MCP server on October 3, 2026.

What web search does Kimi Code already have?

Kimi Code's built-in tools reference lists two web tools, both auto-allowed by default. FetchURL takes a URL and returns the page content, extracting body text from HTML. WebSearch takes a single query parameter. Both need a host-provided implementation, and the docs say that when no search implementation is available, WebSearch does not appear in the tool list.

Where that implementation comes from is configurable. The services section of config.toml defines moonshot_search and moonshot_fetch endpoints, and the environment variable reference lists KIMI_WEB_SEARCH_BASE_URL and KIMI_WEB_SEARCH_API_KEY for the search service. The changelog describes these as a way to configure search and fetch without an OAuth login. In the project source, the search provider comes from that services config or, failing that, from the managed Kimi Code OAuth credential.

So Kimi Code can search the web when you are signed in through Kimi Code OAuth or have configured a search service, and cannot when you have done neither. If its built-in tool covers your questions, you do not need another one. Our Claude Code web search tool guide asks the same question about another agent's built-in search. For Kimi Code, the case for adding You.com is narrower:

• Search you can tune. The you-search tool takes count, freshness, offset, extraction, and exclude_domains alongside the query, and maps inline site: filters automatically, per the tool listing the server returned on October 3, 2026. Kimi's WebSearch documents only a query.
• Settings the model cannot override. The host can set country, language, include domains, and boost domains through request headers, per the MCP server reference, and Kimi Code's headers field sends static headers with every request.
• A connection that does not depend on your model login. The MCP entry works the same whether or not WebSearch is available.

Which You.com setup fits Kimi Code?

There are four ways to connect. The table follows the You.com Kimi Code page and the MCP server reference, as checked in October 2026.

Setup	What you change	Sign-in	Tools you get
Plugin	Install from the agent-skills repository, then run /reload	OAuth through /mcp-config login for the you, you-research, and you-finance servers; none for you-discover	Four skills and four MCP servers
Keyless	Add an mcp.json entry with ?profile=free	None	you-search and you-discover, 100 queries a day
API key	Add an mcp.json entry with bearerTokenEnvVar	Bearer key from an environment variable	you-search, you-contents, you-balance, and you-discover
OAuth	Add an mcp.json entry with only the URL, then run /mcp-config login you-com	OAuth 2.1	The same four tools as the keyed setup

Use the keyless profile to prove the wiring, a key or OAuth for daily work, and the plugin if you also want its four skills, which tell the model when to use each tool and how to cite what it finds. The rest of this guide uses a direct mcp.json entry, because it is the smallest change and the easiest to review.

How do you add the You.com MCP server to mcp.json?

Kimi Code reads MCP servers from ~/.kimi-code/mcp.json (or $KIMI_CODE_HOME/mcp.json), shared across projects, and from .kimi-code/mcp.json in the working directory for one repository. When both define the same name, the project entry wins. Running /mcp-config inside a session adds, edits, or deletes servers interactively, so you do not have to touch the JSON. The keyless version first:

{
  "mcpServers": {
    "you-com": {
      "url": "https://api.you.com/mcp?profile=free"
    }
  }
}

That profile exposes you-search and you-discover at 100 queries a day. When you are ready for a key, name the environment variable that holds it:

{
  "mcpServers": {
    "you-com": {
      "url": "https://api.you.com/mcp",
      "bearerTokenEnvVar": "YDC_API_KEY"
    }
  }
}

This is the safer pattern because the file holds a variable name, not a secret. Per the Kimi Code MCP docs, bearerTokenEnvVar names an environment variable that contains a bearer token. In the project source, Kimi Code builds the Authorization: Bearer header from that variable when it connects, replaces any Authorization header you set under headers, and raises a config error that names the variable if it is unset or empty. That is easier to diagnose than a silent 401.

Two Kimi-specific rules apply after you save. A server added to mcp.json mid-session does not register in sessions that are already open, so start a new one with /new. And when Kimi Code finds project-level MCP servers in a folder you have not trusted, it lists each server's transport and URL in the workspace trust prompt, so review it before confirming.

If you also want the four skills, install the plugin from inside a session, reload, and sign in per server:

/plugins install https://github.com/youdotcom-oss/agent-skills
/reload
/mcp-config login you
/mcp

How do you confirm Kimi Code is calling You.com?

1. Export the key in the shell that starts Kimi Code, then start a new session so the server registers.
2. Run /mcp. It lists the MCP servers in the current session with their connection status. A server that needs sign-in shows up as needing authorization, and /mcp-config login <server-name> completes the browser flow.
3. Ask something training data cannot answer, such as what changed in a library release this month, and read the transcript, not just the answer. Kimi Code names MCP tools mcp__<server>__<tool>, so a working setup shows a call to mcp__you-com__you-search followed by results with URLs.
4. If the transcript shows a WebSearch call instead, the built-in tool answered. The next section covers how to steer the model.

To separate key problems from config problems, call the server directly, outside Kimi Code. With a valid key the response lists the default tools. A missing or empty key returns the 401 described in the failure table below.

curl -sS https://api.you.com/mcp \
  -H "Authorization: Bearer $YDC_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}'

How do you make Kimi Code use You.com, and what does it ask first?

Two defaults favor the built-in tool. WebSearch is auto-allowed, while an MCP call that matches no permission rule triggers an approval request in the default Always Ask mode. And with no instruction, the model chooses between two search tools on their descriptions alone. Kimi Code reads workspace instruction files such as AGENTS.md, a global ~/.kimi-code/AGENTS.md, and generic instructions under ~/.agents/AGENTS.md, so a short rule can name the tool:

When you need current information from the web, call the mcp__you-com__you-search tool.
Prefer official documentation and release notes over blog posts.
If a search returns nothing useful, reformulate once. Do not repeat the same query.

Permission rules in ~/.kimi-code/config.toml level the approvals. Rules match in order and the first match wins, and MCP tools can be matched by tool name only, because argument patterns are not supported for them:

[[permission.rules]]
decision = "allow"
pattern = "mcp__you-com__you-search"

[[permission.rules]]
decision = "ask"
pattern = "mcp__you-com__*"

[[permission.rules]]
decision = "deny"
pattern = "WebSearch"

The first two rules let you-search run without a prompt and make every other You.com tool ask. The third is optional: it removes the built-in WebSearch so the model has a single search tool. Sub-agents inherit the main agent's approved permission rules, and the built-in coder sub-agent shares most of its tool set. One warning from the Kimi Code docs applies here: in Ask When Needed mode, enabled with /yolo, MCP tool calls are approved automatically, so use that mode only for servers you trust and avoid mcp__* wildcards that allow every tool at once.

How do you control which tools load and how many results come back?

Kimi Code can narrow a server to named tools. enabledTools keeps only the listed tools from that server and disabledTools removes some, which trims the tool definitions the model carries in context for the whole session. The docs also describe an experimental deferred flag that lets the model load a server's tools on demand. And headers is where the You.com host-side settings go:

{
  "mcpServers": {
    "you-com": {
      "url": "https://api.you.com/mcp",
      "bearerTokenEnvVar": "YDC_API_KEY",
      "enabledTools": ["you-search", "you-contents"],
      "headers": {
        "X-Search-Count": "8"
      }
    }
  }
}

The tool listing the server returned on October 3, 2026 defaults count, the maximum number of results per section, to 30. We checked the X-Search-Count header against the keyless profile that day: a query that returned 19 results by default returned exactly 3 with X-Search-Count: 3, and X-Search-Include-Domains: opencode.ai,github.com limited the results to those two hosts. A count cap limits how many results come back, not necessarily how many characters, so measure one real tool result before you assume a cap saves context. Our site restriction guide covers the include-domain pattern for the API.

What goes wrong, and how do you detect it?

Most failures show up as a quiet absence: no tool, no tool call, or a sign-in prompt you did not expect. The table pairs each symptom with what we reproduced or what the Kimi Code and You.com docs state.

Symptom	Cause	Fix
A config error names YDC_API_KEY	bearerTokenEnvVar points at a variable that is unset or empty in the shell that started Kimi Code.	Export the variable, then start a new session.
/mcp shows the server as needing authorization	No key and no OAuth sign-in. Without credentials the You.com endpoint answers 401 with an OAuth challenge.	Run /mcp-config login you-com, or add bearerTokenEnvVar.
The server connects but no tools appear	The profile and the path exclude every tool. https://api.you.com/mcp/research?profile=free returns a 200 with an empty tool list.	Remove ?profile=free from research and finance paths, or use /mcp.
you-contents is missing	The keyless profile exposes only you-search and you-discover.	Use a key or OAuth on /mcp.
Edits to mcp.json do not appear	Servers added mid-session do not register in open sessions.	Start a new session with /new.
A repository overrides your setup	A project-level .kimi-code/mcp.json entry with the same name wins over the user-level one.	Rename or remove the project entry.
A custom agent cannot call the search tool	The agent file's tools allowlist does not include it.	Add mcp__you-com__* to the agent's tools.
Searches run without any prompt	Ask When Needed mode approves MCP calls automatically.	Switch modes with /permission, or keep explicit rules.
WebSearch is missing from the tool list	No search implementation is available: no OAuth sign-in and no configured search service.	Expected, and the You.com tool is unaffected. Sign in or set the KIMI_WEB_SEARCH_* variables if you want both.

Two habits catch most of these. Run /mcp after every config change, and keep one canary prompt about something recent so you notice when search quietly stops working.

What does search cost in a coding agent?

The keyless profile is free for 100 queries a day. Beyond that, the You.com billing page prices the Web Search API at $5.00 per 1,000 calls and the Contents API at $1.00 per 1,000 pages, as of October 2026. An agent that runs 30 searches on each of 22 working days makes 660 calls, which is $3.30 a month at that rate. Full-page extraction adds $1.00 per 1,000 pages crawled live, and pages served from cache are free under the default source. Limits, errors, and the rest of the pricing detail are in the Web Search API reference.

What should you check before rolling it out to a team?

Search results are untrusted text placed in the model's context, so prompt injection applies here as it does to any agent with a search tool. Our guide to prompt injection and intent hijacking covers the threat model, and the ask rule above gives you a human checkpoint for the tools beyond search.

Kimi Code also surfaces each plugin install's trust level up front, per its README, and the docs warn that stdio entries in a project-level .kimi-code/mcp.json run local commands when a session starts. The You.com entry is a plain URL, so it adds no local process, but the same review habit applies to every other entry in the file.

Before you standardize, run the same five version-sensitive prompts through the built-in tool and through You.com, and compare which sources each cites and how many tool calls each needs. Do it on your own repositories. If you would rather call the API from your own tool-calling code than run an MCP server, this coding-agent guide covers that route.

Related Guides

• How to Set Up the You.com MCP Server for Web Search in Any Client
• How to Add a Web Search Tool to Claude Code With the You.com Web Search API
• How to Add Web Search to Cursor With the You.com MCP Server
• How to Add Web Search to OpenClaw With the You.com MCP Server
• How to Give a Coding Agent Web Search With the You.com Web Search API