Kuroco roadmap

Currently, we are focusing on improving the UI/UX of Kuroco's admin panel and developing external integrations.

2026

Oct. Next releases

New Features

External Integration

• A "Trusted client" setting is added to the OAuth Authorization Server client editor. It records administrator-provided consent for a client managed by the same organization: signed-in users skip the consent screen, and an authorization code is issued within the configured scope and resource limits. prompt=none is also supported, so a client can check whether authorization completes without displaying any screen. It can be enabled only for clients using authorization_code, and for public clients only when every redirect URI is an https URI on a host other than a loopback address. Existing clients are unaffected because the setting is disabled by default.

Others

• The admin panel plugin slot parameters topics_group_id and inquiry_id will accept multiple IDs (array or comma-separated), in the same way as group_id. The plugin will be shown for any of the specified topic groups / inquiries.
• The FileManager::list endpoint and the Admin MCP file_manager-list tool will return size (in bytes) and update_ymdhi (last modification time in ISO 8601 format, in the site time zone) for each file, which can be used to detect differences from local files. Both are null for a symbolic link whose target is missing, and update_ymdhi is also null when the cloud storage reports no modification time. Existing response fields are unchanged.
• The content structure management API and Admin MCP will accept publication settings (open_type / open_sta_date / open_sta_time / open_end_date / open_end_time) when creating a content structure.
• Each row in the content structure list response and the Admin MCP response will include open_type / open_sta_date / open_sta_time / open_end_date / open_end_time (dates as YYYY/MM/DD, times as HH:MM, empty string when not set).
• In the responses of content retrieval endpoints (Topics::list, Topics::details, etc.), extension items with the "Relational data selection" field setting will include label, the name of the referenced item: subject for content, inquiry_name for forms, and name1 + name2 for members. label is not included when the caller does not have permission to view member information (member reference), when the referenced member has been deleted, or when a content reference points to the record itself (the reference itself is still returned as before). See List of extension items available in the content structure for details.
• Admin MCP will be able to save content as a draft and issue a preview token (preview URL) for a draft. A preview URL, which until now could only be issued from the [Preview] button on the content editing screen of the admin panel, can be issued and shared during a conversation with an AI agent. An error is returned if "Preview page URL" is not set in the content structure. Anyone with the issued URL can view the draft without authentication until it expires, so take care whom you share it with.

Specification Changes

File upload

• The FileManager::upload, FileManager::list, and FileManager::delete endpoints will also apply the per-folder settings of the File Manager in the admin panel. When the target folder for the upload, listing, or deletion has "Groups allowed to edit" configured, the request fails with an error (403) unless the member executing the API belongs to one of those groups. On upload, in addition to the checks against the extensions allowed for the site and the folder ACL's "Allowed extensions" / "Denied extensions", a file with an image extension whose content is not an image fails with an error (400). The "Groups allowed to edit" restriction does not apply to super users. If a request that previously succeeded starts failing, review the permission settings of the target folder and the file being uploaded.
• The response returned by the Files::upload endpoint when an upload fails will change. When the file size exceeds the endpoint's max_size (or size) setting, the endpoint returns HTTP status 413 (the error code is payload_too_large); when the file extension is not allowed, it returns HTTP status 422 (unprocessable_entity). Both cases previously returned HTTP status 200 with the details in errors, so a frontend that detects errors based on a 200 response must be changed to check the HTTP status and the error code.
• For the Files::create_temp_upload_url and Files::create_temp_upload_post endpoints, the HTTP status returned when the declared file_size exceeds the endpoint's max_size setting changes from 422 to 413 (the error code is payload_too_large). A missing file_size or an extension that is not allowed still returns 422.

Adding and updating content

• The values that can be written to extended fields whose field setting is "Date picker" will be unified across the endpoints that add or update content (Topics::insert, Topics::update, Topics::bulk_upsert, etc.) and the management APIs. A string that can be interpreted as a date (2026-12-25, 2026-12-25T09:15:00+09:00, etc.) is saved as that date and time, and an empty string or null clears the field (null returns a required-field error for required fields). A string that cannot be interpreted as a date (unknown, 2026年12月25日, etc.) results in an input error and the record is not saved. In the public REST API, such strings previously resulted in a successful request that saved an empty value, so this behavior changes. Frontends that send such strings must be changed to send a string that can be interpreted as a date, an empty string, or null. See What values can I send to date fields when adding/updating content via API? for details.
• In the responses of the content insert/update endpoints (Topics::insert, Topics::update) and the management APIs, notices meaning "the write succeeded but part of it was not applied" move from messages to a new warnings key. This covers notices such as fields that were not updated because of the "Edit restriction" field setting in a content structure, and rows skipped during CSV / JSON import. warnings is an array of strings that is included only when there is such a notice; the HTTP status and errors do not change. If you have a program that reads these notices from messages, change it to read warnings. See API Error Response for details.

Other

• On the Backup screen, getting a download URL, changing the expiry date, and deleting backups will be limited to super users. Creating a backup and configuring auto backup will continue to require only the update permission for Environment settings. In addition, the expiry date in the list will show "No Expiry Date" when not set, and changing it will require selecting [Change] on each row and entering a date.
• Admin MCP is being improved in short cycles based on user feedback, and for the time being its specifications, such as tool names, arguments, and responses, will change frequently. Kuroco Skills are updated along with these changes. Admin MCP is intended to be used from AI agents with Kuroco Skills installed, so calling its tools directly from your own programs based on an analysis of the tool specifications may stop working with each change. Please refrain from such programmatic use.

2027

Jan. Later releases

The schedule for Later Releases will be announced when the details are finalized.