Skip to content

Updated

Agent authorization

A connected OAuth client is the authorization. When a client connects to LyraShield over OAuth, its grant carries the workspace, scopes, allowed operations, target scope, profiles and expiry. Mutating calls that match the grant execute automatically with a caller-supplied idempotencyKey; identical retries replay the stored result instead of running twice.

Callers without a connection

An API key or a legacy OAuth bearer calling a mutating tool on the hosted endpoint receives one structured response and nothing else:

{
  "code": "connect_required",
  "message": "This action requires a connected LyraShield client. Connect over OAuth to authorize mutating tools inside a bounded grant.",
  "connectUrl": "https://app.lyrashieldai.com/dashboard/connections",
  "docsUrl": "https://lyrashieldai.com/docs/approvals"
}

No approval is queued and nothing executes. Connect a client over OAuth, then re-run the action inside the grant. Read-only credentials are denied on scope before this check.

Retired PENDING flow

The earlier remote flow — a PENDING result with an approvalId that a human approved in a review queue before the agent retried the same call — is retired on the remote path. A call that carries a legacy approvalId now receives connect_required like any other connectionless call.

Historical agent-action approval records stay readable for audit. Browser Fix PR requests still use an exact-patch approval. A Fix PR opens only after a human approves, with a server-generated patch. The REST approval routes below do not reactivate the retired remote MCP PENDING flow:

  • GET /api/v1/agent-approvals?workspaceId=<id> — list approvals
  • POST /api/v1/agent-approvals/<id>/approve — approve an action (requires input for hash verification)
  • POST /api/v1/agent-approvals/<id>/deny — deny an action

Local stdio server

The local @lyrashield/mcp stdio server uses a workspace API key and calls the REST API directly. Scope, role, target authorization and budget are enforced on each request; no second LyraShield prompt applies there.