Updated
Gemini CLI
Gemini CLI reads MCP servers from ~/.gemini/settings.json under the mcpServers key.
Two critical gotchas for Gemini CLI:
- Env var stripping: Gemini CLI strips environment variables whose names contain
KEY,TOKEN, orSECRETfrom subprocess environments as a security measure. You must declareLYRASHIELD_API_KEYexplicitly in theenvblock inside the server entry — inheriting it from the shell is not sufficient. - No underscores in server name: Use a name without underscores (e.g.
lyrashield, notlyra_shield) to avoid Gemini CLI parsing issues.
Configuration
Open or create ~/.gemini/settings.json and add the following. Note the LYRASHIELD_API_KEY is declared in the env block, not inherited from the environment.
{
"mcpServers": {
"lyrashield": {
"command": "npx",
"args": ["-y", "@lyrashield/mcp"],
"env": {
"LYRASHIELD_API_KEY": "lsk_your_key_here",
"LYRASHIELD_API_URL": "https://app.lyrashieldai.com"
}
}
}
}Verify the connection
Start Gemini CLI and run gemini --list-tools or ask: "What LyraShield tools do you have?" to confirm the server is connected.
Requirements: Node.js 20+ and a LyraShield workspace API key. The
@lyrashield/mcp package is published on npm, sonpx -y @lyrashield/mcp resolves directly.