Updated 2026-10-02

Devin CLI

Devin CLI (by Cognition, separate from Devin's web application) reads MCP server configuration from .devin/mcp_config.local.json in your project root for v3000.3 and later. This file is gitignored and uses a mcpServers object. Devin CLI also supports remote HTTP and OAuth.

Install with the pinned CLI

CLI 0.2.14 has a matching installer for this client. Sign in first with npx -y lyrashield@0.2.14 login --oauth for local stdio. Review the planned changes before writing:

npx -y lyrashield@0.2.14 install devin-cli --dry-run

When the preview is correct, run the installer:

npx -y lyrashield@0.2.14 install devin-cli

The installer updates LyraShield's entry and preserves unrelated configuration. You can also use the manual snippet below. Restart or reload the client and complete a read-only authenticated call; an installed config entry alone does not prove client discovery.

Prefer to see exactly what gets written or set it up without Node.js? Configure it by hand below.

Local stdio setup

Add the following to .devin/mcp_config.local.json. Create the file if it does not exist. You can also manage servers with devin mcp add.

Manual fallback: merge the following into .devin/mcp_config.json. Recommended: run npx -y lyrashield@0.2.14 login --oauth once; the local MCP server reads the selected workspace credential from ~/.lyrashield/credentials.json. If you use an API key instead, set it in your private process environment before starting the client.

{
  "mcpServers": {
    "lyrashield": {
      "command": "npx",
      "args": [
        "-y",
        "@lyrashield/mcp@0.2.12"
      ],
      "env": {
        "LYRASHIELD_API_URL": "https://app.lyrashieldai.com"
      }
    }
  }
}

npx -y lyrashield@0.2.14 install devin-cli

Important gotchas

• Devin CLI v3000.3+ uses dedicated mcp_config files; older main-config mcpServers entries migrate on startup. Inspect and migrate an existing legacy entry before adding a duplicate.
• Remote HTTP uses a bare url and `devin mcp login lyrashield` for OAuth; stdio remains available. MCP tools are namespaced mcp__<server>__<tool>.

Devin CLI versions before v3000.3 stored mcpServers in .devin/config.local.json or another main config file. Current Devin migrates those entries on startup. Inspect the migrated entry before adding a second server. Project-shared and user-level alternatives are .devin/mcp_config.json and ~/.config/devin/mcp_config.json.

Remote HTTP alternative

Devin CLI supports Streamable HTTP and OAuth. Use devin mcp login lyrashield after adding the URL.

Manual fallback: merge the following into .devin/mcp_config.json. Complete OAuth in the client after adding the server. No API key belongs in this config.

{
  "mcpServers": {
    "lyrashield": {
      "url": "https://app.lyrashieldai.com/api/mcp"
    }
  }
}

Verify the connection

Run devin mcp list to confirm the lyrashield server is registered. Ask Devin: "What LyraShield tools do you have access to?" to confirm the server is connected.

Review the app before release

After confirming the connection, use the Devin CLI app security checklist to review secrets, permissions, dependencies and application tests. The Devin CLI MCP workflow explains how scan results and retests fit that review. Connection success alone is not release evidence.