Kling AI for DeepSeek Harness

The DeepSeek Harness plugin connects to regional services through the Harness official MCP tools bridge and the standard OAuth flow of the pinned mcp-remote version. The installation package inserts the domestic cordis.patch.yml (https://klingai.com/mcp) by default; the overseas cordis.global.patch.yml (https://kling.ai/mcp) is a replacement overlay for the same kling-ai-remote node and does not insert a second client. Before switching regions, stop the old DSH process and disconnect the old OAuth.

git clone https://github.com/Wlain/kling-ai-deepseek-plugin.git
cd kling-ai-deepseek-plugin
npm install
npm run check
npm run verify:bridge
npm run verify:installed
dsh plugin --profile web add "$PWD"
# 国内（安装后的默认区域）
dsh web --host 127.0.0.1 --port 3080

# 海外（从仓库目录执行；overlay 必须位于 web 子命令之前）
dsh --profile web --patch "$PWD/cordis.global.patch.yml" --host 127.0.0.1 --port 3080

You can also install the domestic default region directly from GitHub:

dsh plugin --profile web add github:Wlain/kling-ai-deepseek-plugin

verify:bridge only uses a local fake OAuth/MCP; verify:installed only installs and synthesizes configuration inside a temporary DSH_HOME and does not read or modify any existing Harness profile.

Do not use another insert patch on a profile that already has the domestic bundle installed. The overseas template replaces the installed node in place following DSH's post-overlay semantics, so the synthesized result still has only one Plugin-DeepSeek-kling-ai. Run dsh --profile web --patch "$PWD/cordis.global.patch.yml" --dump-config to check the effective configuration before authorization; the output should only contain the selected region's URL. When switching back to domestic, stop the overseas process and resume a normal dsh web startup.

On first launch, mcp-remote opens a browser to complete Kling OAuth. Both patches pin the DCR client_name to Plugin-DeepSeek via --static-oauth-client-metadata, carry X-Kling-Integration: Plugin-DeepSeek, and extend the callback wait time from the upstream default of 30 seconds to 180 seconds. Keep the dsh web process running, create a new Harness session after authorization completes, and enter /kling-ai to load the billing-safe flow. Real tool names use the mcp__Plugin-DeepSeek-kling-ai__* prefix.

The Harness official MCP client 0.0.1-rc.1 currently only bridges tools, does not consume MCP resources, and has no verified MCP Apps container. Therefore this release package does not register a self-made tool.call.toolview, overlay, or local HTML. Real generation consumes Kling credits; the Skill shows parameters and waits for confirmation before generating. Results use the text/resource fallback of the same remote tool call with at most one primary media link, until the official client supports and accepts MCP resources.

Cross-platform presentation contract

• Do not copy or link the local mcp-app/ at the repository root, and do not treat unpublished prototypes as runtime capabilities.

• Once the Harness official MCP client adds a resources consumer, consume the remote _meta.ui.resourceUri directly; do not declare Widget availability until acceptance is built against a real target.

Related MCP server: Remote MCP Server on Cloudflare

OAuth bridge boundaries

This package pins mcp-remote@0.2.0 and does not use @latest, which drifts over time. The repository's npm run verify:bridge verifies protected-resource discovery, dynamic registration, the Plugin-DeepSeek client name, S256 PKCE, the token endpoint, Bearer retry, and tools/list using a local fake OAuth/MCP service; the tests do not open a real browser, read credentials, or call Kling.

Upstream still has issue #248 where the callback listener is not rebuilt after both the running access/refresh tokens expire simultaneously, and issue #253 where an old callback port conflicts after an abnormal exit. When authorization expires, stop and restart dsh web first, and only complete the single authorization opened by the new process. Do not repeatedly click multiple old authorization pages, and do not directly share ~/.mcp-auth or raw logs produced by --debug; they may contain OAuth state and sensitive diagnostic information.