Kuroco roadmap

Currently, we are focusing on improving the UI/UX of Kuroco's admin panel and developing external integrations.

2026

Oct. Next releases

New Features

External Integration

• A "Trusted client" setting is added to the OAuth Authorization Server client editor. It records administrator-provided consent for a client managed by the same organization: signed-in users skip the consent screen, and an authorization code is issued within the configured scope and resource limits. prompt=none is also supported, so a client can check whether authorization completes without displaying any screen. It can be enabled only for clients using authorization_code, and for public clients only when every redirect URI is an https URI on a host other than a loopback address. Existing clients are unaffected because the setting is disabled by default.

Others

• The admin panel plugin slot parameters topics_group_id and inquiry_id will accept multiple IDs (array or comma-separated), in the same way as group_id. The plugin will be shown for any of the specified topic groups / inquiries.
• The FileManager::list endpoint and the Admin MCP file_manager-list tool will return size (in bytes) and update_ymdhi (last modification time in ISO 8601 format, in the site time zone) for each file, which can be used to detect differences from local files. Both are null for a symbolic link whose target is missing, and update_ymdhi is also null when the cloud storage reports no modification time. Existing response fields are unchanged.
• The content structure management API and Admin MCP will accept publication settings (open_type / open_sta_date / open_sta_time / open_end_date / open_end_time) when creating a content structure.
• Each row in the content structure list response and the Admin MCP response will include open_type / open_sta_date / open_sta_time / open_end_date / open_end_time (dates as YYYY/MM/DD, times as HH:MM, empty string when not set).

Specification Changes

• The FileManager::upload, FileManager::list, and FileManager::delete endpoints will also apply the per-folder settings of the File Manager in the admin panel. When the target folder for the upload, listing, or deletion has "Groups allowed to edit" configured, the request fails with an error (403) unless the member executing the API belongs to one of those groups. On upload, in addition to the checks against the extensions allowed for the site and the folder ACL's "Allowed extensions" / "Denied extensions", a file with an image extension whose content is not an image fails with an error (400). The "Groups allowed to edit" restriction does not apply to super users. If a request that previously succeeded starts failing, review the permission settings of the target folder and the file being uploaded.
• On the Backup screen, getting a download URL, changing the expiry date, and deleting backups will be limited to super users. Creating a backup and configuring auto backup will continue to require only the update permission for Environment settings. In addition, the expiry date in the list will show "No Expiry Date" when not set, and changing it will require selecting [Change] on each row and entering a date.
• The response returned by the Files::upload endpoint when an upload fails will change. When the file size exceeds the endpoint's max_size (or size) setting, the endpoint returns HTTP status 413 (the error code is payload_too_large); when the file extension is not allowed, it returns HTTP status 422 (unprocessable_entity). Both cases previously returned HTTP status 200 with the details in errors, so a frontend that detects errors based on a 200 response must be changed to check the HTTP status and the error code.
• For the Files::create_temp_upload_url and Files::create_temp_upload_post endpoints, the HTTP status returned when the declared file_size exceeds the endpoint's max_size setting changes from 422 to 413 (the error code is payload_too_large). A missing file_size or an extension that is not allowed still returns 422.
• The values that can be written to extended fields whose field setting is "Date picker" will be unified across the endpoints that add or update content (Topics::insert, Topics::update, Topics::bulk_upsert, etc.), the management APIs, and the Admin MCP topics-create / topics-update tools. A string that can be interpreted as a date (2026-12-25, 2026-12-25T09:15:00+09:00, etc.) is saved as that date and time, and an empty string or null clears the field (null returns a required-field error for required fields). A string that cannot be interpreted as a date (unknown, 2026年12月25日, etc.) results in an input error and the record is not saved. In the public REST API, such strings previously resulted in a successful request that saved an empty value, so this behavior changes. Frontends that send such strings must be changed to send a string that can be interpreted as a date, an empty string, or null. See What values can I send to date fields when adding/updating content via API? for details.
• Admin MCP is being improved in short cycles based on user feedback, and for the time being its specifications, such as tool names, arguments, and responses, will change frequently. Kuroco Skills are updated along with these changes. Admin MCP is intended to be used from AI agents with Kuroco Skills installed, so calling its tools directly from your own programs based on an analysis of the tool specifications may stop working with each change. Please refrain from such programmatic use.

2027

Jan. Later releases

The schedule for Later Releases will be announced when the details are finalized.