Skip to content

Updated

Pi

Pi includes built-in MCP support over stdio and Streamable HTTP, including OAuth and can load Agent Skills. This guide uses the hosted OAuth endpoint. It documents setup, not a recorded LyraShield-authenticated Pi runtime acceptance.

Connect Pi to hosted MCP

Add the personal connection at user scope, then sign in. Pi stores OAuth credentials in its own user credential store; do not add a static token to the configuration.

pi mcp add lyrashield --url https://app.lyrashieldai.com/api/mcp
pi mcp list
pi mcp login lyrashield

In an interactive Pi session, /mcp shows connection state and tools. After the browser OAuth flow completes, make a read-only call such as workspace discovery before asking for any scan. A successful setup command alone does not prove an authenticated tool call.

Choose the right scope

Pi stores user-level servers in ~/.pi/agent/mcp.json. For a project-shared endpoint, use pi mcp add --local; Pi reads .pi/mcp.json only after project trust is granted. Keep personal credentials at user scope. A project server entry replaces a user entry with the same name. A third-party extension that replaces Pi's built-in MCP support can change which configuration is loaded.

Pi skills discovery

Pi discovers Agent Skills from ~/.agents/skills/ and .agents/skills/. Use reviewed, versioned skill directories and inspect their instructions and scripts before granting project trust. Install LyraShield's shared skills into Pi's native paths with the pinned CLI:

npx -y lyrashield@0.2.14 skills install pi --dry-run
npx -y lyrashield@0.2.14 skills install pi

The CLI records files it owns and preserves unowned or customized files. Reload Pi and confirm the skills appear. LyraShield's Pi package/catalog route remains in preparation; this guide does not imply a public Pi listing or authenticated Pi runtime acceptance.

Use local CLI and CI when preferred

npx -y lyrashield@0.2.14 login --oauth
npx -y lyrashield@0.2.14 check-diff
npx -y lyrashield@0.2.14 gate --verdict --commit "$(git rev-parse HEAD)"

This standalone path remains available whether or not Pi MCP is configured. Oh My Pi is a separate client with its own configuration paths; do not reuse Pi paths for it.

Pi MCP documentation ·Pi skills documentation ·Pi packages documentation