Skip to content

Updated

OpenCode

OpenCode reads MCP servers from opencode.json in your project root. The root key is mcp (not mcpServers). Local entries use a command array and environment; remote entries use type: "remote".

Install with the pinned CLI

CLI 0.2.14 has a matching installer for this client. Sign in first with npx -y lyrashield@0.2.14 login --oauth for local stdio. Review the planned changes before writing:

npx -y lyrashield@0.2.14 install opencode --dry-run

When the preview is correct, run the installer:

npx -y lyrashield@0.2.14 install opencode

The installer updates LyraShield's entry and preserves unrelated configuration. You can also use the manual snippet below. Restart or reload the client and complete a read-only authenticated call; an installed config entry alone does not prove client discovery.

Prefer to see exactly what gets written or set it up without Node.js? Configure it by hand below.

Env interpolation gotcha: OpenCode uses single-brace syntax {env:VAR} for environment variable interpolation — not ${VAR}. Using the wrong syntax will result in the literal string being passed instead of the variable value.
Version binding: OpenCode's current documentation uses a top-level mcp object and per-server enabled flag. Record the client version with runtime evidence and revalidate this schema after upgrades.

Remote OAuth setup (recommended)

Manual fallback: merge the following into opencode.json. Complete OAuth in the client after adding the server. No API key belongs in this config.

{
  "mcp": {
    "lyrashield": {
      "url": "https://app.lyrashieldai.com/api/mcp",
      "type": "remote"
    }
  }
}
CLI installer for this client: Run this pinned command to add LyraShield's entry. The client-specific writer preserves unrelated configuration where supported.
npx -y lyrashield@0.2.14 install opencode

Important gotchas

  • OpenCode's global config is `~/.config/opencode/opencode.json`; project `opencode.json` overrides it.
  • OpenCode uses single-brace `{env:VAR}` syntax, not `${VAR}`; wrong syntax passes the literal string through.
  • OpenCode local entries use `type: "local"`, a command array and `environment`; remote entries use `type: "remote"`.
  • OpenCode stores servers under the top-level `mcp` object and uses `enabled: false` to disable an entry.

Run opencode mcp auth lyrashield to complete OAuth. OpenCode stores tokens outside the project configuration and refreshes them for later sessions.

Local stdio alternative

Manual fallback: merge the following into opencode.json. Recommended: run npx -y lyrashield@0.2.14 login --oauth once; the local MCP server reads the selected workspace credential from ~/.lyrashield/credentials.json. If you use an API key instead, set it in your private process environment before starting the client.

{
  "mcp": {
    "lyrashield": {
      "command": [
        "npx",
        "-y",
        "@lyrashield/mcp@0.2.12"
      ],
      "environment": {
        "LYRASHIELD_API_URL": "https://app.lyrashieldai.com"
      },
      "enabled": true,
      "type": "local"
    }
  }
}
CLI installer for this client: Run this pinned command to add LyraShield's entry. The client-specific writer preserves unrelated configuration where supported.
npx -y lyrashield@0.2.14 install opencode

Important gotchas

  • OpenCode's global config is `~/.config/opencode/opencode.json`; project `opencode.json` overrides it.
  • OpenCode uses single-brace `{env:VAR}` syntax, not `${VAR}`; wrong syntax passes the literal string through.
  • OpenCode local entries use `type: "local"`, a command array and `environment`; remote entries use `type: "remote"`.
  • OpenCode stores servers under the top-level `mcp` object and uses `enabled: false` to disable an entry.

Export LYRASHIELD_API_KEY in your shell or add it to a .env file that OpenCode loads.

Verify the connection

Start OpenCode and confirm the lyrashield server appears in the MCP server list. Ask the assistant to list available tools to verify the connection is live.

Local stdio requirements: For local stdio, Node.js 24+ and a local OAuth login or workspace API key. Remote OAuth needs no local key. The @lyrashield/mcp package is published on npm, so npx -y @lyrashield/mcp@0.2.12 resolves directly.