Skip to content

Updated

GitHub Copilot

Use the currently published local stdio MCP server with GitHub Copilot CLI. This guide is for the CLI; Copilot in VS Code and Copilot Cloud Agent have separate configuration and authentication contracts.

Public Agent Plugin listing pending

The portable Agent Plugin package @lyrashield/agent-plugin@0.1.31 is published; the Copilot listing and authenticated runtime acceptance are still pending. Do not install from the marketplace's mutable preparation branch or enable an unreviewed plugin in shared settings. Follow this direct MCP fallback until those checks pass.

Authenticate local stdio

Use Node.js 24 or newer. Run this command in the same OS account that runs Copilot CLI, then select the intended LyraShield workspace in the browser:

npx -y lyrashield@0.2.14 login --oauth

The local MCP server reads the CLI credential store. Keep credentials out of committed files; authentication is separate from adding or discovering the server.

Configure the pinned MCP server

Merge this entry into ~/.copilot/mcp-config.json, preserving other servers. Use mcpServers and type: "local" for Copilot CLI. CLI 0.2.14 includes a matching installer; preview the change above, then run the install command after reviewing it. The code block remains a manual fallback.

Manual fallback: merge the following into .mcp.json. Recommended: run npx -y lyrashield@0.2.14 login --oauth once; the local MCP server reads the selected workspace credential from ~/.lyrashield/credentials.json. If you use an API key instead, set it in your private process environment before starting the client.

{
  "mcpServers": {
    "lyrashield": {
      "command": "npx",
      "args": [
        "-y",
        "@lyrashield/mcp@0.2.12"
      ],
      "env": {
        "LYRASHIELD_API_URL": "https://app.lyrashieldai.com"
      },
      "type": "local"
    }
  }
}
CLI installer for this client: Run this pinned command to add LyraShield's entry. The client-specific writer preserves unrelated configuration where supported.
npx -y lyrashield@0.2.14 install copilot-cli

Important gotchas

  • Copilot CLI stdio entries use `type: "local"` (or `"stdio"`); remote uses `type: "http"`.
  • Each entry may carry a `tools` array (e.g. ["*"]) to allowlist server tools.
  • GitHub's own MCP server is built in — you don't add it manually.

Confirm client discovery

Restart Copilot CLI, then enter /mcp show lyrashield in the interactive session to inspect the server status and available tools. A listed server proves discovery; it does not prove authenticated access to a workspace.

Verify an authenticated read

Ask Copilot to call lyrashield_list_workspaces and confirm the expected workspace, then list its authorized targets. If consent expires, repeat CLI OAuth login and restart the client. This read-only check does not start a scan or prove approval-bound write behavior.

See Copilot CLI MCP configuration for project scope and the separate remote HTTP alternative. Client-runtime acceptance remains a separate gate.