dsh-mcp-server

Exposes DeepSeek Harness's Agent (dsh, a coding agent with a full toolset: files, terminal, web search, subagents, workflows) as a locally usable model backend via Model Context Protocol, while also exposing "read me / modify me" interfaces.

┌────────────────────────────┐        stdio / HTTP         ┌──────────────────────────────┐
│  其他 Agent / MCP 客户端     │  ────────────────────────▶  │        dsh-mcp-server         │
│  (Claude Desktop, Cursor,  │                            │  方向A：驱动我（消耗我的额度）  │
│   Claude Code, 自定义程序)   │                            │  方向B：读懂我/改造我（便宜）   │
└────────────────────────────┘                            └──────────────┬───────────────┘
                                                                         │ spawn
                                                              ┌──────────▼───────────────┐
                                                              │  dsh Agent（完整工具链）    │
                                                              │  DeepSeek 模型（默认）      │
                                                              └──────────────────────────┘

Two Directions

Direction A: Drive Me — consumes DeepSeek Harness quota, requires user confirmation

Each call to dsh_ask / dsh_converse / dsh_tool spawns a full dsh Agent process, which does the actual work (using DeepSeek models): reading/writing files, running commands, searching the web, dispatching subagents. This consumes DeepSeek Harness token quota, so:

1. The call first returns confirmation_required (no quota is consumed at this point), and clearly states that "DeepSeek Harness quota will be consumed";

2. The caller must show this request to the user (MCP clients usually display tool calls automatically);

3. After the user approves, call dsh_confirm(requestId, approve=true) to actually execute; or dsh_deny(requestId) to cancel.

Each pending request also prints a prominent warning line to the server's stderr. Unconfirmed requests expire after 10 minutes.

⚠️ Risk switch: DSH_MCP_AUTO_APPROVE=1 skips the confirmation gate (for unattended/fully trusted environments). A single call can also pass confirm: false to skip it.

Direction B: Read Me / Modify Me — consumes the other side's tokens, cheap on the server side

When other Agents want to understand "what I am, how I'm designed, how to build plugins / change config for me", they use these interfaces (the server only does local reads/validation, does not consume dsh model quota; the other model reads the results into its own context, consuming its own tokens):

Typical usage: an external Agent first reads the dsh://self/* resources to understand the design (spending its tokens), then calls dsh_patch_config to propose config changes (e.g., switching models, mounting new skills, disabling a plugin), or writes a dsh plugin locally based on dsh_plugin_contract.

Related MCP server: dsh-orchestrator

Quick Start

cd E:\DeepSeek Harness\dsh-mcp
npm install          # 安装 @modelcontextprotocol/sdk

# 冒烟测试：不经过 MCP，直接验证 dsh Agent 后端可用
node scripts/smoke.mjs

# 以 stdio 传输启动服务器（MCP 客户端的标准方式）
node src/index.js

The server automatically discovers the locally installed dsh (scanning npx cache / npm cache / this directory); no configuration needed. If not found, specify it with an environment variable: DSH_MCP_DSH_BIN=C:\...\@deepseek-ai\dsh\lib\bin.js.

Connect to Claude Desktop

Edit %APPDATA%\Claude\claude_desktop_config.json:

{
  "mcpServers": {
    "dsh": {
      "command": "node",
      "args": ["E:\\DeepSeek Harness\\dsh-mcp\\src\\index.js"]
    }
  }
}

Connect to Claude Code / Cursor / VS Code

Use examples/claude-code.json, examples/cursor-mcp.json, and examples/vscode.json respectively.

Connect to your own Agent (HTTP mode)

node src/index.js --transport http --port 3005
# 端点：http://127.0.0.1:3005/mcp  （Streamable HTTP）

Tool List

Environment Variables

Permissions & Security

• dsh Agent inherits dsh's permission system: default workspace-write (can only write to the working directory), adjustable to read-only / danger-full-access.

• All Direction A executions go through the confirmation gate, with clear quota disclosure.

• Direction B read-only paths never expose any secret values; the write path (dsh_patch_config) defaults to dry-run, auto-backs up before writing, requires confirmation, and warns that the home layer affects all profiles (including a running Web UI).

• Sessions persist in ~/.dsh/sessions; credentials are shared via ~/.dsh/.credentials.yaml.

• The server only listens locally (stdio pipe / 127.0.0.1).

Switching Models (typical Direction B usage)

The default model comes from dsh's agent-default-model (locally deepseek-official / deepseek-v4-flash). To change it:

1. Use dsh_patch_config (recommended): submit a patch to the home layer; after dry-run validation passes and the user confirms, it is written (with automatic backup). Example patch:

   - id: agent-default-model
     config:
       provider: deepseek-official
       model: deepseek-chat

2. Change global settings: edit the agent-default-model section of ~/.dsh/settings.yaml.

3. Switch the whole profile: use DSH_MCP_PROFILE to specify another profile (different toolset/persona).

Known Limitations

• Direction A spawns a new process per call (about 2~3 seconds cold start + model response), no streaming, task text ≤ ~30k characters.

• The confirmation gate relies on the caller showing confirmation_required to the user; if the caller is an unattended program and DSH_MCP_AUTO_APPROVE is not set, requests will hang until they expire.

• Resource/tool count: 6 resources + 11 tools.

Development & Testing

node scripts/smoke.mjs              # 仅测 dsh 后端（无 MCP）
node scripts/demo.mjs               # 演示：确认闸门 + 读懂我 + 改配置提议
node scripts/mcp-client-test.mjs    # stdio 端到端：闸门/拒绝/多轮/自省/patch/资源
node scripts/http-client-test.mjs   # HTTP 端到端（自动批准模式）

Directory Structure

dsh-mcp/
├── src/
│   ├── index.js     # CLI 入口（stdio / HTTP 传输）
│   ├── server.js    # MCP 工具与资源注册
│   ├── dsh.js       # dsh 子进程运行器（spawn/超时/输出捕获/并发闸门）
│   ├── approvals.js # 确认闸门（额度披露、待确认队列、过期）
│   ├── self.js      # 自省：设计快照、技能发现、配置路径、插件契约
│   └── sessions.js  # 会话记忆与多轮提示组装
├── scripts/         # 冒烟 + 演示 + 端到端测试
└── examples/        # 各客户端接入配置