Updated 2026-08-12

Roo Code

Roo Code reads MCP servers from .roo/mcp.json (project-level). This file overrides the global mcp_settings.json in VS Code globalStorage. Entries may carry alwaysAllow: string[] and disabled: boolean fields.

Install with the CLI (fastest)

Run npx lyrashield install roo-code from your project root. It detects Roo Code, writes the correct config automatically, and never inlines your API key into a file you might commit. Add --dry-run first to preview the change with no write, or run npx lyrashield doctor afterward to confirm it's configured correctly.

npx lyrashield install roo-code

Prefer to see exactly what gets written, or set it up without Node.js? Configure it by hand below.

Local stdio setup

Add the following to .roo/mcp.json. Create the file if it does not exist.

Add the following to .roo/mcp.json. Recommended: run npx lyrashield login --oauth once; the local MCP server reads the selected workspace credential from ~/.lyrashield/credentials.json.

{
  "mcpServers": {
    "lyrashield": {
      "command": "npx",
      "args": [
        "-y",
        "@lyrashield/mcp"
      ],
      "env": {
        "LYRASHIELD_API_URL": "https://app.lyrashieldai.com"
      }
    }
  }
}

npx lyrashield install roo-code

Important gotchas

• Remote entries MUST use `type: "streamable-http"` (hyphenated); `type: "http"` or `streamableHttp` fails — Roo validates the literal string.
• Project `.roo/mcp.json` overrides the global `mcp_settings.json` in VS Code globalStorage. Entries may carry `alwaysAllow: string[]` and `disabled: boolean`.

Remote Streamable-HTTP setup

For environments where you prefer not to run a local process, connect to the remote endpoint.

Add the following to .roo/mcp.json. Replace <LYRASHIELD_API_KEY> with your workspace API key.

{
  "mcpServers": {
    "lyrashield": {
      "url": "https://app.lyrashieldai.com/api/mcp",
      "headers": {
        "Authorization": "Bearer <LYRASHIELD_API_KEY>"
      },
      "type": "streamable-http"
    }
  }
}

Verify the connection

Open the Roo Code panel in VS Code and check the MCP server status. Ask Roo: "What LyraShield tools are available?" to confirm the server is connected.