Updated 2026-10-02

Codebuff

Codebuff is an open-source terminal agent (installed via npm i -g codebuff) that reads project MCP configuration from .agents/mcp.json and global configuration from ~/.agents/mcp.json. Its mcpServers object supports local stdio and remote HTTP entries.

Install with the pinned CLI

CLI 0.2.14 has a matching installer for this client. Sign in first with npx -y lyrashield@0.2.14 login --oauth for local stdio. Review the planned changes before writing:

npx -y lyrashield@0.2.14 install codebuff --dry-run

When the preview is correct, run the installer:

npx -y lyrashield@0.2.14 install codebuff

The installer updates LyraShield's entry and preserves unrelated configuration. You can also use the manual snippet below. Restart or reload the client and complete a read-only authenticated call; an installed config entry alone does not prove client discovery.

Prefer to see exactly what gets written or set it up without Node.js? Configure it by hand below.

Local stdio setup

Add the following to .agents/mcp.json. Create the file if it does not exist.

Manual fallback: merge the following into .agents/mcp.json. Recommended: run npx -y lyrashield@0.2.14 login --oauth once; the local MCP server reads the selected workspace credential from ~/.lyrashield/credentials.json. If you use an API key instead, set it in your private process environment before starting the client.

{
  "mcpServers": {
    "lyrashield": {
      "command": "npx",
      "args": [
        "-y",
        "@lyrashield/mcp@0.2.12"
      ],
      "env": {
        "LYRASHIELD_API_URL": "https://app.lyrashieldai.com"
      }
    }
  }
}

npx -y lyrashield@0.2.14 install codebuff

Important gotchas

• Codebuff searches project `.agents/mcp.json`, then a parent `.agents/mcp.json`, then global `~/.agents/mcp.json`; later locations override earlier ones.
• Codebuff resolves `$VAR_NAME` references from the launching shell. Never put a literal key in a shared `.agents/mcp.json`.

Remote HTTP setup

Codebuff also documents HTTP servers with type: "http", url and optional headers. Use its $VAR_NAME syntax instead of storing a token literally.

Manual fallback: merge the following into .agents/mcp.json. Enter the workspace API key only in the client's private, untracked server settings or its documented secret-backed header interpolation. The snippet contains a placeholder; never put a real key in a shared project file or shell command.

{
  "mcpServers": {
    "lyrashield": {
      "url": "https://app.lyrashieldai.com/api/mcp",
      "headers": {
        "Authorization": "Bearer $LYRASHIELD_API_KEY"
      },
      "type": "http"
    }
  }
}

npx -y lyrashield@0.2.14 install codebuff

Important gotchas

• Codebuff searches project `.agents/mcp.json`, then a parent `.agents/mcp.json`, then global `~/.agents/mcp.json`; later locations override earlier ones.
• Codebuff resolves `$VAR_NAME` references from the launching shell. Never put a literal key in a shared `.agents/mcp.json`.

Verify the connection

Start Codebuff and ask: "What LyraShield tools do you have access to?" to confirm the server is connected. Codebuff also supports /init and /publish commands and an agent store.