safe-agent-mcp
safe-agent-mcp
Pasarela MCP segura de múltiples agentes basada en DeepSeek Harness: encapsula las capacidades de ejecución de agentes de DSH en una herramienta MCP estándar, de modo que cualquier cliente MCP (Claude Desktop, Cursor, etc.) pueda utilizarla.
Qué resuelve este proyecto
DSH es un framework de múltiples agentes, pero sus capacidades solo se pueden usar en su propia interfaz;
MCP es un protocolo estándar, cualquier cliente puede usarlo, pero en sí mismo no tiene capacidades de agente;
safe-agent-mcp es el puente entre ambos: un servidor MCP que ofrece herramientas estándar hacia afuera y, internamente, impulsa los agentes de DSH (incluidos subagentes y sandbox).
Related MCP server: dsh-harness-mcp-server
Características
Palabra clave | Implementación |
MCP | Servidor MCP estándar ( |
Múltiples agentes | (planificado v1.1) impulsa a los subagentes de DSH para ejecutar tareas mediante |
Sandbox/seguridad | (planificado v1.2) bloqueo de comandos peligrosos, enmascaramiento de secretos, registros de auditoría y límites de tiempo de espera y concurrencia |
Inicio rápido
npm install
npm run smoke # 自动化冒烟测试(协议握手 + 工具调用)
npm run inspect # 打开 MCP Inspector 可视化调试Herramientas actualmente implementadas:
run_command: ejecuta un comando de shell en el sandbox y devuelve stdout / stderr / código de salida (en Windows se ha resuelto el problema de codificación GBK de cmd).
Estructura del directorio
src/index.ts # MCP 服务器入口
tests/smoke.mjs # 冒烟测试
docs/DEVELOPMENT.md # 开发文档(架构、里程碑、开发日志)Hitos
v1.0: servidor MCP + herramienta
run_command(todas las pruebas de humo en verde)v1.1: integración de múltiples agentes
run_agent_task(puente headless)v1.2: capa de seguridad (bloqueo de comandos peligrosos + enmascaramiento de secretos + registros de auditoría)
v1.3: panel web (punto extra)
Para más detalles, consulte docs/DEVELOPMENT.md.
Licencia
Available Tools
1 toolrun_commandA
在沙箱中执行一条 shell 命令,返回 stdout、stderr 和退出码。注意:command 只填命令本身(如 echo hello),不要传 JSON 包装。
| Name | Required | Description | Default |
|---|---|---|---|
| command | Yes | 要执行的命令 | |
| timeout_ms | No | 超时毫秒数,默认 15000 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses the return payload (stdout, stderr, exit code) and the sandbox context, which implies isolation. However, it does not mention potential side effects (e.g., resource usage, network access) or whether the command runs with any restrictions. Since annotations are absent, more behavioral detail would be helpful.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, consisting of one main clause and one clarifying note. It avoids unnecessary detail and is well-structured for quick comprehension.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool’s simplicity and lack of output schema, the description adequately explains the return format and provides usage guidance. It does not cover edge cases like error handling or timeouts beyond the schema’s timeout parameter, but for a basic shell execution tool this is sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already defines both parameters with descriptions, providing 100% coverage. The description adds a meaningful note about the command parameter (not JSON-wrapped), which supplements the schema without redundancy. Thus a score slightly above baseline is warranted.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool executes a shell command in a sandbox, with a specific verb and resource. It also provides an example command, making the purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Despite no sibling tools, the description includes a direct usage guideline: instructing the user to provide only the command itself without JSON wrapping. This clarifies the expected input format and preempts common misuse.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
1 tool update
v0.1.0- First observed
run_command
TDQS
Scored across 1 tool
With only one tool, there is no possibility of confusion between tools. The name 'run_command' clearly describes its function, eliminating any ambiguity.
The single tool follows a consistent verb_noun pattern ('run_command'). There are no other tools to create inconsistency, so the naming is perfectly consistent.
The server has only one tool, which feels thin for a typical tool set. While it may cover the core purpose of safe command execution, the surface is minimal and could benefit from additional related tools.
The server's stated purpose is to execute shell commands in a sandbox, and 'run_command' fully covers this operation by returning stdout, stderr, and exit code. No obvious gaps exist for the intended scope.
Maintenance
Related MCP Connectors
Your org's AI agents, tasks, runs, search, and brain files as MCP tools and resources.
MCP server for your apps' tools and custom tools, plus hosted AI agents and approval-gated workflows
Discover and call AI agents via MCP. Supports A2A agents and platform agents with async tasks.
Find, vet, and run MCP tools through a secure audited gateway with prompt-injection risk scoring
Related MCP Servers
AlicenseNot gradedqualityCmaintenanceEnables LLM clients to execute shell commands safely through the MCP protocol, with features like session management, safe mode, and process control.1Apache 2.0- AlicenseNot gradedqualityAmaintenanceExposes DeepSeek Harness agent capabilities as an MCP server, letting any MCP client drive Harness to execute real coding tasks with structured results, context isolation, and parallel execution.149 npm13MIT
- AlicenseNot gradedqualityBmaintenanceExposes opencode's coding agent and shell as MCP tools, enabling MCP-only AI clients to execute shell commands, manage files, and run agent sessions with async job handling.15 npmMIT
- AlicenseNot gradedqualityAmaintenanceEnables dispatching work to DeepSeek Harness agents from Claude Code/Codex, with native progress UI, tier policy, and vision/image generation through MCP tools.549 npm192MIT