Skip to content

Updated

Goose

Goose (by Block) configures MCP servers as extensions in ~/.config/goose/config.yaml. The format is YAML with a nested map — not a mcpServers JSON dict. Goose has no MCP rules file; project hints live in .goosehints.

Get the exact values with the CLI

Goose uses a YAML config format that LyraShield's CLI cannot safely write automatically. Run npx lyrashield install goose to print the exact values generated from the current registry, then paste them into your config by hand.

npx lyrashield install goose

Local stdio setup

Add the following to ~/.config/goose/config.yaml under the extensions key. Goose's stdio entry uses type: stdio with cmd and args fields.

Install type: Goose: requires manual configuration.

Use this command in a terminal or enter the same values in the agent's MCP settings UI. Recommended: run npx -y lyrashield@0.2.14 login --oauth once; the local MCP server reads the selected workspace credential from ~/.lyrashield/credentials.json. If you use an API key instead, set it in your private process environment before starting the client.

LYRASHIELD_API_URL=https://app.lyrashieldai.com npx -y @lyrashield/mcp@0.2.12
CLI installer for this client: Run this pinned command to add LyraShield's entry. The client-specific writer preserves unrelated configuration where supported.
npx -y lyrashield@0.2.14 install goose

Important gotchas

  • Goose configures MCP servers as `extensions` in ~/.config/goose/config.yaml (YAML, nested map) — not a `mcpServers` JSON dict. Stdio entry: {type: stdio, cmd, args}; remote: {type: streamable_http, uri, headers}.
  • Goose has no MCP rules file; project hints live in .goosehints.

Remote Streamable-HTTP setup

For environments where you prefer not to run a local process, connect to the remote endpoint. Goose uses type: streamable_http with uri and headers.

Install type: Goose: requires manual configuration.

Use this command in a terminal or enter the same values in the agent's MCP settings UI. Enter the workspace API key only in the client's private, untracked server settings or its documented secret-backed header interpolation. The snippet contains a placeholder; never put a real key in a shared project file or shell command.

LYRASHIELD_API_URL=https://app.lyrashieldai.com npx -y @lyrashield/mcp@0.2.12
Remote authorization: Browser-confirmed OAuth delegations run matching actions without repeated approval. Mutating calls authenticated with an API key receive a connect_required response pointing at OAuth connect and out-of-grant delegated calls are denied. Local stdio approval is separate from hosted delegation.

Verify the connection

Start Goose and ask: "What LyraShield tools do you have access to?" to confirm the server is connected.

Requirements: For local stdio, Node.js 24+ and a local OAuth login or workspace API key. Remote OAuth needs no local key. The @lyrashield/mcp package is published on npm, so npx -y @lyrashield/mcp@0.2.12 resolves directly.

Review the app before release

After confirming the connection, use the Goose app security checklist to review secrets, permissions, dependencies and application tests. The Goose MCP workflow explains how scan results and retests fit that review. Connection success alone is not release evidence.