dsh-mcp-admin

Exposes DeepSeek Harness's skill and Agent preset management as a two-sided MCP server plugin: remote agents modify skill/preset configuration on the server directly via the MCP protocol, no SSH needed; the host half records audit logs, and the browser half provides an "MCP Admin" dashboard on the Settings page showing recent modification records.

Typical use: run dsh web on a remote server, connect a local agent to http://<server>:3080/mcp, forming a closed loop of "produce → review → modify → reproduce".

Architecture

本地 Agent (MCP client)
   │  POST /mcp  (Authorization: Bearer <token>)
   ▼
dsh web (host 半区)
   ├── Streamable HTTP MCP server（stateless，每请求一个实例）
   │     ├── skill_list / skill_read / skill_upsert / skill_delete
   │     └── preset_list / preset_read / preset_upsert / preset_delete
   ├── 审计 JSONL：$DSH_HOME/mcp-admin/audit.jsonl
   └── RPC 通道 /mcp-admin（audit.list，trusted-host 围栏）
        ▲
浏览器 Settings「MCP 管理」看板（client 半区，5s 轮询）

• skill writes: write directly to $DSH_HOME/skills/<name>/SKILL.md (directory bundle; if a flat <name>.md already exists, overwrite in place to preserve its form). The harness's skill-filesystem provider watches that directory, so the change takes effect on the next agent step after writing.

• preset writes: write $DSH_HOME/.agent-presets/<id>/agent.cordis.yml. To override a system-trusted preset, you must pass base to copy it into the user root first (to prevent accidentally shadowing a built-in preset from scratch). The standing mount's file-timestamp mechanism makes changes take effect automatically for new sessions without a restart; in-progress sessions are unaffected.

• audit: each write/delete appends one JSONL line (time, tool, target, action, byte count, first 200 characters of content as a summary), truncated per auditLimit.

Related MCP server: dsh-harness-mcp-server

Installation

dsh plugin --profile web add /path/to/dsh-mcp-admin

Then configure the token in ~/.dsh/profiles/web/cordis.patch.yml in the profile (required, otherwise the plugin refuses to start):

- id: mcp-admin
  config:
    token: <openssl rand -hex 32 的输出>
    auditLimit: 200

Configuration

MCP client configuration

Easiest way: open the "MCP Admin" page in Settings, first fill in this deployment's public/LAN address in "Public access URL" (e.g. http://1.2.3.4:3080, required on NAT machines; leave empty to follow the address you used to open this page), save, then click "Copy MCP config instructions" — it copies a complete config guide (including URL and token) that you can paste directly to the agent you want to configure; it can configure itself by following the guide. Note that on http:// pages browsers block automatic copying, so the button degrades to showing a text box for manual copying.

Manual configuration format (Streamable HTTP type):

{
  "mcpServers": {
    "dsh-admin": {
      "type": "http",
      "url": "http://<服务器>:3080/mcp",
      "headers": { "Authorization": "Bearer <token>" }
    }
  }
}

Tool overview

Security notes

• The harness webserver itself has no TLS, no authentication; /mcp sits outside the /api trust fence, and token is the only line of defense. Leaking the token means someone can rewrite your skills and presets (indirect remote code execution).

• Recommended to expose only behind a reverse proxy that terminates TLS, or combine with the harness's trusted-host mechanism to restrict sources.

• All write operations are confined to the user root (~/.dsh/skills, ~/.dsh/.agent-presets); built-in presets and project directories are never touched.

• The dashboard RPC channel (/mcp-admin) goes through the connection's trusted-host fence; audit records contain no secrets.

• The "Copy MCP config instructions" button returns the token to the page via the setup-info endpoint: anyone who can open the Web UI can obtain the token. This is consistent with the harness's existing security model (being able to open the Web UI already lets you run agents on the server via session.prompt), but it means the Web UI's exposure surface equals the token's exposure surface.

Development

pnpm install
pnpm run build        # host: tsc → lib/；client: tsdown → lib/client.js
pnpm run typecheck

The client half's type resolution depends on the local harness source tree (dsh-client-* is not fully published to npm); the paths in tsconfig*.json hardcode the harness checkout location; you'll need to change these paths when migrating machines.