Updated
Integrations
Connect LyraShield to your AI coding environment to run security checks inline while you build. Choose the setup that matches your editor or workflow.
Choose your client setup
Follow the client-specific guide. Where CLI 0.2.14 provides a matching installer, preview the planned changes and run its pinned command; otherwise merge the LyraShield entry manually using command: "npx" and args: ["-y", "@lyrashield/mcp@0.2.12"] for local stdio. Preserve existing settings and symlinks. Authenticate in the same OS account, restart the client, confirm tool discovery and make a read-only authenticated call. Hosted OAuth uses the client’s own sign-in flow.
npx -y lyrashield@0.2.14 login --oauthThe CLI also installs shared skills where a client has one documented LyraShield skill path. Each client guide shows whether that command is available. A completed install does not prove client discovery, authentication, marketplace listing or runtime acceptance.
Public Agent Plugin listings pending
The portable Agent Plugin package @lyrashield/agent-plugin@0.1.31 is published and passes offline schema validation. Public listings and authenticated client acceptance remain pending. The marketplace default branch contains preparation artifacts. Use the current direct MCP guides with @lyrashield/mcp@0.2.12, authenticate local stdio separately with npx -y lyrashield@0.2.14 login --oauth, then confirm client discovery and an authenticated read-only workspace call.
Do not install from the mutable preparation branch. Cursor also uses the pinned direct MCP fallback; Kiro's Power remains in preparation with a direct MCP fallback. The Agent Plugins guide describes these distribution boundaries. CLI config writing and shared-skill installation remain separately available where their exact client contracts and skill paths are recorded.
npx --yes lyrashield@0.2.14 login --oauth, the MCP server reads the selected workspace credential from ~/.lyrashield/credentials.json. Hosted OAuth does not need that local file. API keys remain a CI and non-OAuth-client fallback; do not commit either credential.Local MCP server (stdio)
For editors that can run local processes, install the LyraShield MCP server via npx -y @lyrashield/mcp@0.2.12. The server uses stdio transport and exposes LyraShield tools directly inside your AI assistant.
Remote MCP endpoint
Cloud editors that cannot run local processes connect to the remote Streamable-HTTP endpoint at https://app.lyrashieldai.com/api/mcp. OAuth-capable clients discover the OAuth authorization server automatically, select exactly one workspace and start with read access. The Remote MCP guide covers Lovable, Bolt.new, Replit and v0. The GitHub Action is the recommended complement for automated PR checks.
Hosted OAuth connection
OAuth clients use authorization code + PKCE (S256), refresh and revocation and a consent screen that names the client, workspace and requested scopes. A connection is bound to one active workspace; changing workspaces requires disconnecting and reconnecting. Matching delegated actions run without repeated approval after consent. Use the API-key guide below only for CI or clients that cannot complete OAuth.
Cross-cutting setup
Frequently asked questions
What is the LyraShield MCP server?
LyraShield ships a Model Context Protocol (MCP) server that exposes security-check tools to AI coding assistants. You can run it locally via npx (stdio transport) or connect to the hosted remote endpoint for cloud editors that cannot run local processes.
Do I need an API key to use the MCP server?
Local stdio uses npx -y lyrashield@0.2.14 login --oauth in the same OS account; the server reads the selected workspace credential store. Hosted OAuth-capable clients authenticate inside the client. Copilot Cloud Agent uses a private read-only Agents secret. Never commit credentials.
Which editors use the remote MCP endpoint instead of the local stdio server?
Cloud-hosted editors that cannot run local processes — such as Lovable, Bolt.new, Replit and v0 — use protected-resource discovery at https://app.lyrashieldai.com/api/mcp. During OAuth, users choose one workspace and the requested access. Matching delegated actions run without repeated LyraShield approval.
Is the @lyrashield/mcp package available on npm now?
Yes — @lyrashield/mcp is published on npm. Run npx -y @lyrashield/mcp@0.2.12 (Node.js 24+) with your LYRASHIELD_API_KEY set or add it to your editor's MCP config as shown in each guide.
Can I use LyraShield in a CI pipeline without an AI editor?
Yes. The GitHub Action integration runs LyraShield checks directly in your workflow without any AI assistant. It is the recommended path for cloud-only editors and for teams that want automated checks on every pull request.
How does CLI login work without pasting a secret?
Run npx --yes lyrashield@0.2.14 login --oauth. The CLI opens hosted OAuth consent with PKCE, lets you choose one workspace and stores the short-lived bearer locally. API-key login remains available for CI and non-interactive environments.
Is there a CLI or do I have to hand-edit config files?
CLI 0.2.14 includes config writers for exact client contracts recorded by the installer and shared-skill installation for documented client skill paths. Each guide shows a preview and install command where supported; otherwise it provides a manual setup. Authenticate local stdio with CLI OAuth, confirm client discovery, then verify a read-only call.
What is the Agent Plugin?
The portable package bundles an MCP descriptor and security guidance. Client marketplace listings are still awaiting review and readback, so follow each client guide for its direct MCP fallback. CLI config installation and shared skills are separate features available only where an exact client contract or skill path is recorded. See /docs/integrations/agent-plugins.