Skip to content

Updated

Roo Code

Roo Code reads MCP servers from .roo/mcp.json (project-level). This file overrides the global mcp_settings.json in VS Code globalStorage. Entries may carry alwaysAllow: string[] and disabled: boolean fields.

Install with the pinned CLI

CLI 0.2.14 has a matching installer for this client. Sign in first with npx -y lyrashield@0.2.14 login --oauth for local stdio. Review the planned changes before writing:

npx -y lyrashield@0.2.14 install roo-code --dry-run

When the preview is correct, run the installer:

npx -y lyrashield@0.2.14 install roo-code

The installer updates LyraShield's entry and preserves unrelated configuration. You can also use the manual snippet below. Restart or reload the client and complete a read-only authenticated call; an installed config entry alone does not prove client discovery.

Prefer to see exactly what gets written or set it up without Node.js? Configure it by hand below.

Local stdio setup

Add the following to .roo/mcp.json. Create the file if it does not exist.

Manual fallback: merge the following into .roo/mcp.json. Recommended: run npx -y lyrashield@0.2.14 login --oauth once; the local MCP server reads the selected workspace credential from ~/.lyrashield/credentials.json. If you use an API key instead, set it in your private process environment before starting the client.

{
  "mcpServers": {
    "lyrashield": {
      "command": "npx",
      "args": [
        "-y",
        "@lyrashield/mcp@0.2.12"
      ],
      "env": {
        "LYRASHIELD_API_URL": "https://app.lyrashieldai.com"
      }
    }
  }
}
CLI installer for this client: Run this pinned command to add LyraShield's entry. The client-specific writer preserves unrelated configuration where supported.
npx -y lyrashield@0.2.14 install roo-code

Important gotchas

  • Remote entries MUST use `type: "streamable-http"` (hyphenated); `type: "http"` or `streamableHttp` fails — Roo validates the literal string.
  • Project `.roo/mcp.json` overrides the global `mcp_settings.json` in VS Code globalStorage. Entries may carry `alwaysAllow: string[]` and `disabled: boolean`.

Remote Streamable-HTTP setup

For environments where you prefer not to run a local process, connect to the remote endpoint.

Gotcha — use type: "streamable-http" exactly: Roo Code validates the literal string. type: "http" or streamableHttp fails. Use the hyphenated form.

Manual fallback: merge the following into .roo/mcp.json. Enter the workspace API key only in the client's private, untracked server settings or its documented secret-backed header interpolation. The snippet contains a placeholder; never put a real key in a shared project file or shell command.

{
  "mcpServers": {
    "lyrashield": {
      "url": "https://app.lyrashieldai.com/api/mcp",
      "headers": {
        "Authorization": "Bearer <LYRASHIELD_API_KEY>"
      },
      "type": "streamable-http"
    }
  }
}
Remote authorization: Browser-confirmed OAuth delegations run matching actions without repeated approval. Mutating calls authenticated with an API key receive a connect_required response pointing at OAuth connect and out-of-grant delegated calls are denied. Local stdio approval is separate from hosted delegation.

Verify the connection

Open the Roo Code panel in VS Code and check the MCP server status. Ask Roo: "What LyraShield tools are available?" to confirm the server is connected.

Requirements: For local stdio, Node.js 24+ and a local OAuth login or workspace API key. Remote OAuth needs no local key. The @lyrashield/mcp package is published on npm, so npx -y @lyrashield/mcp@0.2.12 resolves directly.