Roll Kimi Code out by measured quota and ignore the plan name. Measure a week of each developer's real tasks, pick plans from that, cap Extra Usage, keep approvals on, and confirm data terms with Moonshot in writing. This checklist covers plans, quota, Extra Usage, approvals, editors and keys, and data.
When you need this
- Developers ask for Kimi Code to run beside another coding agent or to replace one.
- A pilot has hit the 5-hour window and you need to decide on plans.
- Security asks where company code goes and what Moonshot keeps.
Evaluation criteria
Measure the quota
How many 5-hour windows does a real task take?
Look forRun a week of each developer's tasks on Plus or Pro with Extra Usage off and record windows used with /usage. Practitioners report a whole window used by one long K3 task and a legacy-plan window measured at about 4.5% of the monthly quota, so the answer depends on the task and its cache hits.
Pick plans per developer
Which plan does each developer need?
Look forPlus costs $19 a month (Kimi's plan page shows $ without naming a currency), Pro $39, Max $99, and Ultra $199, less on annual billing. Pro adds the 1M-context and Highspeed models. Every device and API key on an account shares one quota, so give each developer their own plan.
Cap Extra Usage
What happens when the quota runs out?
Look forExtra Usage continues the session, charged by actual usage from an RMB balance at rates close to Kimi Open Platform API pricing. Set a monthly spending cap before enabling it; without one there is no cap. Extra Usage is not yet available for Enterprise.
Keep approvals on
What can the agent do without asking?
Look forRead-only tools run without confirmation, and file changes and shell commands ask first. A user reported in July 2026 that the agent deleted two directories with rm -rf without a prompt, so review every permission rule, avoid wildcards over all MCP tools, and keep Ask When Needed mode for trusted servers only.
Set up editors and keys
Where will developers use it?
Look forInstall the CLI, VS Code extension, or desktop app, and connect Zed or JetBrains through kimi acp. Create API keys in the Kimi Code Console only for tools that need them, such as Claude Code or OpenCode, since they draw on the same quota.
Confirm data terms
What does Moonshot keep, and where?
Look forThe CLI keeps sessions, credentials, and logs under ~/.kimi-code, and model calls go to Moonshot's China or overseas endpoint. The English docs state no retention, training, SSO, or audit log terms for Kimi Code, so get them in writing before company code goes in.
Questions to ask vendors
- How many 5-hour windows did each developer's pilot tasks use?
- Which developers need Pro for the 1M-context and Highspeed models?
- What is the monthly Extra Usage cap, and who reviews it?
- Which permission rules have we allowed, and who reviewed them?
- What has Moonshot confirmed in writing about retention and training on our code?
Red flags
- One account shared by several developers, so one person's session freezes everyone's quota.
- Extra Usage enabled with no monthly spending cap.
- Wildcard permission rules that allow every MCP tool.
- Company code sent before data terms are confirmed.
- A plan chosen from its name with no measured week of use.
Products in this piece
Sources
- Official documentation
- 9
- Public source
- 4
- Kimi Code plans and pricing
- Kimi Code docs: Membership Benefits (quota and Extra Usage)
- Kimi Code docs: Model Configuration
- Kimi Code CLI docs: Getting started
- Kimi Code CLI docs: Model Context Protocol
- Kimi Code CLI docs: Using Kimi Code CLI in IDEs
- Kimi Code CLI docs: Data locations
- Kimi Code docs: FAQ (endpoints and billing by platform)
- Kimi Code docs: Use in third-party tools, Claude Code
- Hacker News comment by SwellJoe on a 5-hour window used in one K3 task (Jul 18, 2026)
- MoonshotAI/kimi-code issue #2327: unauthorized deletion of template files by the agent (Jul 28, 2026)
- r/kimi: I just measured Kimi Quota for Coding on Allegretto (Sep 26, 2026)
- X post by Om Londhe on Kimi Code CLI 2.3.2 and 2.3.3 subagent defaults (Oct 26, 2026)