Updated 2026-10-02

Gemini CLI

Gemini CLI reads MCP servers from ~/.gemini/settings.json under the mcpServers key.

Install with the pinned CLI

CLI 0.2.14 has a matching installer for this client. Sign in first with npx -y lyrashield@0.2.14 login --oauth for local stdio. Review the planned changes before writing:

npx -y lyrashield@0.2.14 install gemini-cli --dry-run

When the preview is correct, run the installer:

npx -y lyrashield@0.2.14 install gemini-cli

The installer updates LyraShield's entry and preserves unrelated configuration. You can also use the manual snippet below. Restart or reload the client and complete a read-only authenticated call; an installed config entry alone does not prove client discovery.

Prefer to see exactly what gets written or set it up without Node.js? Configure it by hand below.

Configuration

Open or create ~/.gemini/settings.json and add the following local entry.

Manual fallback: merge the following into ~/.gemini/settings.json. Recommended: run npx -y lyrashield@0.2.14 login --oauth once; the local MCP server reads the selected workspace credential from ~/.lyrashield/credentials.json. If you use an API key instead, set it in your private process environment before starting the client.

{
  "mcpServers": {
    "lyrashield": {
      "command": "npx",
      "args": [
        "-y",
        "@lyrashield/mcp@0.2.12"
      ],
      "env": {
        "LYRASHIELD_API_URL": "https://app.lyrashieldai.com"
      }
    }
  }
}

npx -y lyrashield@0.2.14 install gemini-cli

Important gotchas

• GEMINI.md is the default context file. If context.fileName is customized in settings.json, use one of those configured filenames instead.
• Gemini CLI expands `$VAR_NAME` and `${VAR_NAME}` references in MCP `env` and `headers`; use a reference instead of a literal secret.
• Streamable HTTP servers use `httpUrl`; the `url` field is for SSE endpoints.
• Server name must not contain underscores; use `lyrashield`, never `lyra_shield`.

Gemini CLI loads GEMINI.md by default. If your settings.json sets context.fileName, place LyraShield guidance in one of those configured files instead. The CLI rules command respects that setting.

Remote HTTP setup

Gemini CLI uses httpUrl for Streamable HTTP. The separate url field is for SSE endpoints.

Manual fallback: merge the following into ~/.gemini/settings.json. Enter the workspace API key only in the client's private, untracked server settings or its documented secret-backed header interpolation. The snippet contains a placeholder; never put a real key in a shared project file or shell command.

{
  "mcpServers": {
    "lyrashield": {
      "httpUrl": "https://app.lyrashieldai.com/api/mcp",
      "headers": {
        "Authorization": "Bearer $LYRASHIELD_API_KEY"
      }
    }
  }
}

Verify the connection

Start Gemini CLI and run gemini --list-tools or ask: "What LyraShield tools do you have?" to confirm the server is connected.