Updated 2026-10-02

Kilo Code

Kilo Code reads project MCP servers from kilo.jsonc (JSONC — JSON with comments). The root key is mcp. It also recognizes .kilo/kilo.jsonc when a team prefers the hidden project directory.

Install with the pinned CLI

CLI 0.2.14 has a matching installer for this client. Sign in first with npx -y lyrashield@0.2.14 login --oauth for local stdio. Review the planned changes before writing:

npx -y lyrashield@0.2.14 install kilo-code --dry-run

When the preview is correct, run the installer:

npx -y lyrashield@0.2.14 install kilo-code

The installer updates LyraShield's entry and preserves unrelated configuration. You can also use the manual snippet below. Restart or reload the client and complete a read-only authenticated call; an installed config entry alone does not prove client discovery.

Prefer to see exactly what gets written or set it up without Node.js? Configure it by hand below.

Local stdio setup

Manual fallback: merge the following into kilo.jsonc. Recommended: run npx -y lyrashield@0.2.14 login --oauth once; the local MCP server reads the selected workspace credential from ~/.lyrashield/credentials.json. If you use an API key instead, set it in your private process environment before starting the client.

{
  "mcp": {
    "lyrashield": {
      "command": [
        "npx",
        "-y",
        "@lyrashield/mcp@0.2.12"
      ],
      "environment": {
        "LYRASHIELD_API_URL": "https://app.lyrashieldai.com"
      },
      "enabled": true,
      "type": "local"
    }
  }
}

npx -y lyrashield@0.2.14 install kilo-code

Important gotchas

• Kilo Code uses single-brace `{env:VAR}` syntax, not `${VAR}`; wrong syntax passes the literal string through.
• Kilo Code's file is JSONC; a JSON.parse/stringify round-trip destroys the user's comments.
• Kilo Code local entries use `type: "local"`, a command array and `environment`; remote entries use `type: "remote"`.

Remote endpoint

Manual fallback: merge the following into kilo.jsonc. Enter the workspace API key only in the client's private, untracked server settings or its documented secret-backed header interpolation. The snippet contains a placeholder; never put a real key in a shared project file or shell command.

{
  "mcp": {
    "lyrashield": {
      "url": "https://app.lyrashieldai.com/api/mcp",
      "headers": {
        "Authorization": "Bearer {env:LYRASHIELD_API_KEY}"
      },
      "type": "remote"
    }
  }
}

Verify the connection

Reload the Kilo Code window and open the MCP servers panel. Confirm that the lyrashield server shows a connected status.