Gemini CLI MCP security workflow for AI apps

For a local stdio setup, configure the server in Gemini CLI settings and authenticate through the local LyraShield CLI. lyrashield doctor checks the local setup, but a Gemini tool call is needed to prove client discovery. A remote HTTP connection has a separate authentication path.

Secure AI generated apps from your terminal by connecting Gemini CLI to LyraShield AI through MCP, running bounded checks without leaving the CLI and enforcing the same policy in a diff aware GitHub Action. The server loads from settings.json under mcpServers and supports local stdio via npx -y @lyrashield/mcp@0.2.12 plus remote HTTP with a bearer key.

Gemini CLI brings agent assisted development to the command line, but terminal velocity can miss injection, auth and supply chain risks introduced by scaffolding. The vibe coding security guide calls this unverified generation at scale. LyraShield AI is agent native AppSec for AI built software that follows Target to Scan to Evidence State to Fix Proposal to Retest to Assurance Report. This post shows the exact Gemini CLI config using npx -y @lyrashield/mcp@0.2.12 and https://app.lyrashieldai.com/api/mcp, plus verification and CI wiring. Findings retain their recorded evidence states. Current LyraShield tools record fix proposals and queue retests but do not edit code, create branches or open pull requests.

1. Prerequisites and setup

Use a current Gemini CLI release, Node 24 or newer, a LyraShield key prefixed lsk_ for remote mode and a GitHub repo for workflow setup. Gemini CLI stores MCP under ~/.gemini/settings.json with key mcpServers, including trust, includeTools and env expansion. The pattern is documented in the official Gemini CLI MCP guide and summarized in the Gemini CLI integration guide. Restart Gemini CLI, then use its MCP tool list to confirm discovery. Review risk baselines via OWASP Top 10 and advisory data via OSV. For protocol context, see Model Context Protocol intro. Validate the JSON with a linter after each edit, since a trailing comma or missing bracket will block all servers from loading.

2. Configure Gemini CLI MCP servers

Add entries to ~/.gemini/settings.json. Use trust to control auto execution and includeTools to filter. The canonical reference is the Gemini CLI integration guide. Always link it as a markdown link, never a bare /docs/integrations/gemini-cli path.

The includeTools array is your blast radius control. Without it, the model sees every tool the server exposes, including write tools you may not intend to expose during a read only scan. By listing only scan, lyrashield_list_targets, lyrashield_get_findings and lyrashield_get_scan_status, you prevent the agent from calling a write tool that could mutate your repo or push a branch. The mcp.allowed policy list works as a second gate at the CLI level. When present, only server names in that array load at all. If you add a server entry but forget its name in mcp.allowed, the CLI silently skips it, which is a common debugging trap.

Local stdio:

{
  "mcpServers": {
    "lyrashield": {
      "command": "npx",
      "args": ["-y", "@lyrashield/mcp@0.2.12"],
      "env": {
        "LYRASHIELD_API_KEY": "${LYRASHIELD_API_KEY}"
      },
      "trust": false,
      "includeTools": [
        "scan",
        "lyrashield_list_targets",
        "lyrashield_get_findings",
        "lyrashield_get_scan_status"
      ],
      "timeout": 120000
    }
  }
}

Remote HTTP:

{
  "mcpServers": {
    "lyrashield-remote": {
      "httpUrl": "https://app.lyrashieldai.com/api/mcp",
      "headers": {
        "Authorization": "Bearer $LYRASHIELD_API_KEY"
      },
      "trust": false,
      "includeTools": ["lyrashield_list_targets", "lyrashield_get_findings"],
      "timeout": 120000
    }
  },
  "mcp": {
    "allowed": ["lyrashield", "lyrashield-remote"]
  }
}

Remote URL is https://app.lyrashieldai.com/api/mcp with Bearer lsk_. $VAR expansion keeps the key out of the file and Streamable HTTP uses httpUrl rather than the SSE-only url field. $VAR expansion and the mcp.allowed policy list are Gemini CLI specifics that control which servers run without prompting. For sibling editors, see the Gemini CLI AI app security checklist which uses the same gate shape.

Gemini CLI expands $VAR_NAME and ${VAR_NAME} references in MCP environment values and headers. Export LYRASHIELD_API_KEY in the shell that starts Gemini CLI, keep trust: false and use includeTools to restrict the server surface. A raw key does not belong in settings.json.

3. Verify the connection in Gemini CLI

Restart Gemini CLI and run gemini mcp list, then ask Gemini to call lyrashield_list_targets. Confirm the returned workspace before starting a scan. If local authentication fails, check the credential source inherited by the server; if tools do not appear, check mcp.allowed and includeTools. Gemini reads project guidance from GEMINI.md by default. Use a different filename only when context.fileName in settings explicitly includes it, as documented in the Gemini CLI context guide.

4. Run an inline check from the CLI

From Gemini CLI, ask it to scan the authorized target and return findings with their recorded evidence states, file locations, supporting evidence and limitations. Use lyrashield_scan_target, then inspect results with lyrashield_get_findings; do not filter to “verified,” because retest-confirmed requires a fresh applicable retest.

The distinction between a finding with a recorded evidence state and raw lint noise matters for blocking merges. A finding with a recorded evidence state includes a concrete file path, a line number and a proof snippet that demonstrates exploitability, such as a stored XSS finding that points to an unsanitized input rendered into the DOM along with a payload that executes in the browser. Raw lint noise flags a pattern without proof, such as a generic usage warning with no reachable input source. You block on the former and triage the latter.

Sample instruction for your Gemini CLI prompt library:

Use lyrashield MCP:

- Scope diff vs main
- Return findings with recorded evidence states only with evidence and fix guidance
- Group as auth, injection, secrets, supply chain
- Record the intended remediation with `lyrashield_record_fix_proposal`; let the developer apply the code change.

lyrashield_record_fix_proposal records a remediation summary for review; it does not generate or apply a patch. After a developer makes the change, lyrashield_verify_fix queues a retest and returns a reference to poll. Keep scan IDs and SARIF artifacts explicit in the audit trail.

5. Wire the GitHub Action diff aware gate

Add .github/workflows/lyrashield.yml with SARIF upload so PRs are blocked consistently, as described in GitHub docs for SARIF upload.

name: lyrashield diff gate
on:
  pull_request:
    branches: [main]
permissions:
  contents: read
  security-events: write
  pull-requests: write
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: ecryptoguru/lyrashield-ai@v2
        with:
          fail_on_severity: HIGH

The workflow mirrors your Gemini CLI transport: same endpoint https://app.lyrashieldai.com/api/mcp and same key shape. Diff mode keeps scans fast for agent driven branches by only scanning changed files rather than the full tree.

The SARIF file is uploaded to GitHub code scanning, where advisory results appear alongside other tools with file, line and severity metadata. These local results do not carry hosted LyraShield finding IDs or evidence states; use a recorded scan for retained assurance evidence.

6. Add agent rules snippet

Save as .gemini/rules/security.md or your rules path.

# Security rules for Gemini CLI

- Identify Target before scan: app root, routes, data class.
- Run LyraShield via MCP for changed files vs main.
- Apply the configured severity gate while preserving every finding’s evidence state and limitations.
- Record a fix proposal, apply the change outside LyraShield, then queue and poll the retest.
- Report scan ID and SARIF link in PR or CLI summary.

This keeps Target to Scan to Evidence State to Fix Proposal to Retest to Assurance Report consistent across local CLI and CI. Point teammates to the Gemini CLI integration guide and the pillar vibe coding security guide as markdown links in onboarding. Keeping the rules file short and declarative helps the agent follow it consistently.

Setting	Meaning	Recommended
command, args	How to launch MCP	npx -y @lyrashield/mcp@0.2.12
trust	Auto run without prompt	false for security
includeTools	Filter tools exposed	scan, lyrashield_list_targets, lyrashield_get_findings
env, $VAR	Secret expansion	LYRASHIELD_API_KEY, LYRASHIELD_API_URL
mcp.allowed	Policy allow list	[“lyrashield”, “lyrashield-remote”]

7. Why pair Gemini CLI with LyraShield

Gemini CLI gives you terminal native agent workflows, LyraShield adds recorded security evidence that is designed to travel from CLI to CI without custom scripts. The vibe coding security guide explains how AI built apps accumulate risks across injection, auth and supply chain when verification is deferred. Pairing provides one loop from Target to Report with SARIF that GitHub code scanning understands per docs.github.com on code scanning. v1 is agentic pentest plus SCA plus secrets plus GitHub Action plus SARIF, Bounded scans, evidence states, fix-proposal recording, retest queueing and SARIF are available now.

The value of a single transport across local and CI is consistency. The same MCP endpoint, the same lsk_ key and the same tool surface mean a finding you reproduce in your terminal is the same finding that blocks a PR in GitHub. SARIF output standardizes severity and location data so reviewers see results in the security tab they already use for CodeQL.

Start with local stdio MCP, verify tool listing, run a bounded scan on your next AI-scaffolded branch, record a reviewed fix proposal for one finding, apply the change yourself and poll the queued retest. Deepen coverage with the AI app security checklist and create an account at LyraShield AI.