JetBrains MCP Security Workflow for AI IDEs

Follow the current jetbrains integration guide and manually merge the server entry, preserving existing settings. Authenticate local stdio separately with npx -y lyrashield@0.2.14 login --oauth and use @lyrashield/mcp@0.2.12. Use pinned CLI commands for documented config or skill installs; marketplace plugins remain separately gated. Restart the client, confirm discovery, then call lyrashield_list_workspaces for authenticated read-only access. CLI doctor does not establish client authentication or scan completion.

JetBrains IDEs with AI Assistant can run LyraShield by adding the local MCP package through Settings to AI Assistant to MCP to Add As JSON, then verifying the connection and scanning inline for OWASP risks. The documented JSON needs no embedded key.

JetBrains with AI Assistant changes many files, propagating OWASP Top 10 issues like SSRF and injection. This guide integrates LyraShield via vibe coding security guide pattern. LyraShield AI is agent native AppSec at LyraShield site, following Target to Scan to Evidence State to Fix Proposal to Retest to Report. See JetBrains integration guide and Replit security checklist. Contract aligns with Model Context Protocol and GitHub Actions.

1. Prerequisites and api key setup

Run npx -y lyrashield@0.2.14 login --oauth and keep credentials in the user-only LyraShield credential store. Never commit a key to source control or chat logs. The runner-local GitHub Action does not require that hosted credential.

You need Node 24 or newer for the LyraShield package, a current JetBrains build with MCP support and a testable target such as a repo root. LyraShield MCP supports stdio via npx -y @lyrashield/mcp@0.2.12 and remote HTTP at remote MCP endpoint using Bearer lsk_ key. Stdio keeps traffic local, remote enables central policy.

Review CWE Top 25 and OWASP Top 10 to map checks to weaknesses your team tracks and NIST SSDF for secure build. LyraShield v1 is designed to cover agentic pentest plus SCA and secrets with SARIF output. Fix proposals are proposals requiring review, not hands off merges, after Sprints 0 to 2 shipped MCP contract.

2. Configure MCP server in jetbrains config file

jetbrains reads MCP from Settings to AI Assistant to MCP to Add As JSON. Top level key is mcpServers. Include stdio and remote to switch without code edits. Use pinned npx -y @lyrashield/mcp@0.2.12 for stdio.

{
  "mcpServers": {
    "lyrashield": {
      "command": "npx",
      "args": ["-y", "@lyrashield/mcp@0.2.12"]
    }
  }
}

JetBrains’ current MCP page documents command, args and remote url; it does not document environment interpolation or remote header fields. The local credential-store path avoids inventing either behavior. See the JetBrains integration guide.

3. Verify the connection inside jetbrains

Restart jetbrains after saving config and open MCP servers view to confirm lyrashield shows connected with tools. In chat ask to list MCP tools to see scan tool. This confirms handshake completed.

If disconnected, open log panel. For 401 from remote MCP endpoint reissue key. For npx not found or EACCES fix Node PATH or install via nvm user space. Run npx -y @lyrashield/mcp@0.2.12 manually in terminal with LYRASHIELD_API_KEY set to confirm handshake JSON prints. This isolates IDE versus Node issues.

Verification prevents silent failure where agent assumes scan succeeded but server was unreachable. That leaves OWASP Top 10 risks undetected and breaks verification loop. Allow egress to remote MCP endpoint if org blocks external.

4. Run a security check inline while you code

With MCP connected, prompt agent to scan current target before committing. Example prompt is scan target http://localhost:3000 for injection and secrets using LyraShield and return findings with evidence states only with file paths and CWE.

Agent calls MCP tool and returns file, line, evidence snippet or reproduction notes and remediation pointers that reference OWASP Top 10. For injection it shows untrusted input flowing into query without validation. For secrets it shows detected key pattern in source. For supply chain it maps lock entries against OSV database.

LyraShield preserves each finding’s evidence state and supports a server-owned retest after the developer applies a fix. The MCP workflow can generate and record a fix proposal, but it does not create a branch or pull request. Poll the retest to a terminal state and include its outcome and scan reference in the PR. See NIST SSDF for verifiable remediation and CWE Top 25 for classification.

Check type	What to scan	How to fix
Injection	API routes concatenating user input into queries	Parameterize queries, validate with schema, enforce allow lists at boundary
Secrets	Env example containing real keys, tokens in source	Remove secret, rotate credential, add precommit scan, use secret manager
Auth	Missing role check on sensitive routes, permissive CORS	Add auth middleware, test unauthenticated request, set secure cookie flags
Supply chain	Vulnerable npm packages with CVE in lockfile	Update lockfile, pin safe version, check OSV database advisory, limit scripts

Use table as prompt template for consistent scans. Reference Replit security checklist for deeper checklist.

5. Wire the GitHub Action diff aware gate

Local checks improve speed, but team assurance needs CI gate scanning changed files on pull requests and publishing SARIF for triage. LyraShield provides GitHub Action that runs diff aware scan and uploads SARIF. Uses GitHub Actions and aligns with OWASP Top 10 pipeline guidance.

name: LyraShield Security Gate
on:
  pull_request:
    branches: [main]
jobs:
  security:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
      pull-requests: write
    steps:
      - name: Run LyraShield diff scan
        uses: ecryptoguru/lyrashield-ai@v2
        with:
          fail_on_severity: HIGH

The runner-local Action needs no LyraShield API key. It emits and uploads SARIF but does not comment, open a branch or create a recorded hosted finding. Use JetBrains integration guide for authenticated MCP setup and NIST SSDF for build-integrity context.

6. Add agent rules for continuous guardrails

jetbrains supports project rules that agent reads each task, baking security into definition of done without relying on memory. Add rule forcing LyraShield scan before marking feature complete, covering user input, auth, file upload, secrets or external fetch and include retest.

Location varies. Cursor uses .cursor/rules/security.mdc with globs, Claude Code uses CLAUDE.md, Windsurf uses .windsurf/rules/security.md, VS Code uses .github/copilot-instructions.md, JetBrains uses .jetbrains/ai-assistant/rules/security.md. Choose location traveling with repo so new clones get same expectation.

# Security guardrail

For any task involving user input, auth, file upload or secrets:

1. Call LyraShield MCP scan on target .
2. List findings with evidence states with file and CWE
3. Propose remediation with code edit
4. Ensure .env.example has placeholders only
5. Retest via LyraShield after fix

Test rule by scaffolding endpoint accepting query param and confirming scan triggers without reminder. If agent skips, make rule more directive and place file where agent reads on startup. Keep rule short and committed. Pair with Replit security checklist and CWE Top 25 for taxonomy.

Why pair jetbrains with LyraShield

Jetbrains speeds AI development but can repeat patterns OWASP Top 10 warns about such as trusting generated SQL or leaving debug endpoints enabled. LyraShield adds verification without changing UX, exposing scan and findings as native tools agent knows how to call.

The current product ships MCP, bounded scans, findings and evidence, approval-gated fix proposals, retests, reports, SCA, secrets and the runner-local SARIF gate. The local Action is advisory and does not create hosted evidence states; use a recorded scan and retest when assurance evidence is required. Advisory dependency matches use OSV data and still require resolved-version review.

Local feedback plus CI gate creates defense in depth matching how AI apps evolve, many small edits per hour. For policy framing revisit vibe coding security guide and NIST SSDF. External refs such as CWE Top 25 and OSV database provide standardized ids for prioritization, making triage consistent.

Close loop by tracking findings as tasks, rerunning scans after fixes to confirm resolution and ensuring SARIF appears in GitHub code scanning with file and line mapping. Run AI app security checklist before launch to cover injection, auth, secrets, headers and supply chain in one pass.

When ready to centralize results across jetbrains sessions and pull requests with dashboards and retention, create an account at LyraShield AI to centralize findings with dashboards and retention. LyraShield is designed to grow with your jetbrains workflow, bringing findings with evidence states, proposals requiring review and retest evidence into existing loop without claiming hands off merges.