Updated
Integrations
Connect LyraShield to your AI coding environment to run security checks inline while you build. Choose the setup that matches your editor or workflow.
Local MCP server (stdio)
For editors that can run local processes, install the LyraShield MCP server via npx -y @lyrashield/mcp. The server uses stdio transport and exposes LyraShield tools directly inside your AI assistant.
Remote MCP endpoint
Cloud editors that cannot run local processes connect to the remote Streamable-HTTP endpoint athttps://app.lyrashieldai.com/api/mcp with a Bearer API key. TheGitHub Action is the recommended complement for automated PR checks.
Cross-cutting setup
Frequently asked questions
What is the LyraShield MCP server?
LyraShield ships a Model Context Protocol (MCP) server that exposes security-check tools to AI coding assistants. You can run it locally via npx (stdio transport) or connect to the hosted remote endpoint for cloud editors that cannot run local processes.
Do I need an API key to use the MCP server?
Yes. Set the LYRASHIELD_API_KEY environment variable to a workspace key created in LyraShield under Settings → API keys. Keys are prefixed lsk_ and carry either read-only or read-and-write scopes.
Which editors use the remote MCP endpoint instead of the local stdio server?
Cloud-hosted editors that cannot run local processes — such as Lovable, Bolt.new, Replit, and v0 — use the remote Streamable-HTTP endpoint at https://app.lyrashieldai.com/api/mcp with a Bearer API key. Read-only MCP tools work everywhere; remote mutating tools require an explicit opt-in.
Is the @lyrashield/mcp package available on npm now?
Yes — @lyrashield/mcp is published on npm. Run npx -y @lyrashield/mcp (Node.js 20+) with your LYRASHIELD_API_KEY set, or add it to your editor's MCP config as shown in each guide.
Can I use LyraShield in a CI pipeline without an AI editor?
Yes. The GitHub Action integration runs LyraShield checks directly in your workflow without any AI assistant. It is the recommended path for cloud-only editors and for teams that want automated checks on every pull request.