Skip to content
LyraShield AIOpen beta

Updated

Goose

Goose (by Block) configures MCP servers as extensions in ~/.config/goose/config.yaml. The format is YAML with a nested map — not a mcpServers JSON dict. Goose has no MCP rules file; project hints live in .goosehints.

Get the exact values with the CLI

Goose uses a YAML config format that LyraShield's CLI cannot safely write automatically. Run npx lyrashield install goose to print the exact values generated from the current registry, then paste them into your config by hand.

npx lyrashield install goose

Local stdio setup

Add the following to ~/.config/goose/config.yaml under the extensions key. Goose's stdio entry uses type: stdio with cmd and args fields.

Install type: Goose: requires manual configuration.

Use this command in a terminal, or enter the same values in the agent's MCP settings UI. Replace <LYRASHIELD_API_KEY> with your workspace API key.

LYRASHIELD_API_KEY=<LYRASHIELD_API_KEY> LYRASHIELD_API_URL=https://app.lyrashieldai.com npx -y @lyrashield/mcp
One-line install: the CLI prints these connection values; add them in the agent's own settings UI.
npx lyrashield install goose

Important gotchas

  • Goose configures MCP servers as `extensions` in ~/.config/goose/config.yaml (YAML, nested map) — not a `mcpServers` JSON dict. Stdio entry: {type: stdio, cmd, args}; remote: {type: streamable_http, uri, headers}.
  • Goose has no MCP rules file; project hints live in .goosehints.

Remote Streamable-HTTP setup

For environments where you prefer not to run a local process, connect to the remote endpoint. Goose uses type: streamable_http with uri and headers.

Install type: Goose: requires manual configuration.

Use this command in a terminal, or enter the same values in the agent's MCP settings UI. Replace <LYRASHIELD_API_KEY> with your workspace API key.

LYRASHIELD_API_KEY=<LYRASHIELD_API_KEY> LYRASHIELD_API_URL=https://app.lyrashieldai.com npx -y @lyrashield/mcp
Read-only vs. read-and-write: Remote mutating tools (scan triggers, finding submissions, report creation) require an explicit OAuth write scope or write-capable API key, plus a human out-of-band approval. Read-only inspection tools work with any key.

Verify the connection

Start Goose and ask: "What LyraShield tools do you have access to?" to confirm the server is connected.

Requirements: Node.js 20+ and a LyraShield workspace API key. The@lyrashield/mcp package is published on npm, sonpx -y @lyrashield/mcp resolves directly.