Skip to content
LyraShield AIOpen beta

Updated

MiMo Code

MiMo Code (by Xiaomi) reads MCP server configuration from .mimocode/mimocode.jsonc (project) or ~/.config/mimocode/mimocode.jsonc (global). The root key is mcp, not mcpServers.

Install with the CLI (fastest)

Run npx lyrashield install mimo-code from your project root. It detects MiMo Code, writes the correct config automatically, and never inlines your API key into a file you might commit. Add --dry-run first to preview the change with no write, or run npx lyrashield doctor afterward to confirm it's configured correctly.

npx lyrashield install mimo-code

Prefer to see exactly what gets written, or set it up without Node.js? Configure it by hand below.

Gotcha — root key is mcp, not mcpServers: Using mcpServers silently fails. MiMo Code uses a different root key than most editors.

Local stdio setup

Add the following to .mimocode/mimocode.jsonc or ~/.config/mimocode/mimocode.jsonc. MiMo Code uses type: "local" with command as an array (e.g. ["npx","-y","@lyrashield/mcp"]) and an environment object, plus an enabled boolean.

Add the following to .mimicode/mimocode.jsonc. Recommended: run npx lyrashield login --oauth once; the local MCP server reads the selected workspace credential from ~/.lyrashield/credentials.json.

{
  "mcp": {
    "lyrashield": {
      "command": [
        "npx",
        "-y",
        "@lyrashield/mcp"
      ],
      "environment": {
        "LYRASHIELD_API_URL": "https://app.lyrashieldai.com"
      },
      "enabled": true,
      "type": "local"
    }
  }
}
One-line install: the CLI writes exactly the configuration above.
npx lyrashield install mimo-code

Important gotchas

  • Root key is `mcp`, not `mcpServers` — using `mcpServers` silently fails.
  • Local uses `type: "local"` with `command` as an ARRAY (["npx","-y","<cmd>"]) and `environment` (not `command`+`args`+`env`), plus an `enabled` boolean.
  • Remote uses `type: "remote"` with `url` + `headers` and `enabled`; OAuth is handled automatically.

Remote HTTP setup

For environments where you prefer not to run a local process, connect to the remote endpoint. MiMo Code uses type: "remote" with url + headers and enabled. OAuth is handled automatically.

Add the following to .mimicode/mimocode.jsonc. Replace <LYRASHIELD_API_KEY> with your workspace API key.

{
  "mcp": {
    "lyrashield": {
      "url": "https://app.lyrashieldai.com/api/mcp",
      "headers": {
        "Authorization": "Bearer <LYRASHIELD_API_KEY>"
      },
      "type": "remote"
    }
  }
}
Read-only vs. read-and-write: Remote mutating tools (scan triggers, finding submissions, report creation) require an explicit OAuth write scope or write-capable API key, plus a human out-of-band approval. Read-only inspection tools work with any key.

Verify the connection

Restart MiMo Code and ask: "What LyraShield tools do you have access to?" to confirm the server is connected.

Requirements: Node.js 20+ and a LyraShield workspace API key. The@lyrashield/mcp package is published on npm, sonpx -y @lyrashield/mcp resolves directly.