Qichacha Legal Data MCP OAuth Plugin (DeepSeek Harness)

One-click OAuth connect to Qichacha legal data MCP inside DeepSeek Harness. One-click OAuth authorization to connect to the Qichacha legal-data MCP (regulations & provisions / judicial cases) inside DeepSeek Harness.

Features

• 🔑 One-click OAuth connection: Authorization Code + PKCE(S256), dynamic client registration (no client_secret), automatically opens the browser and redirects to the Qichacha authorization page, loopback callback completes automatically

• 🌐 One authorization, all servers available: a single access_token / refresh_token covers the Qichacha legal-data MCP SERVERs (legal-regulation regulations / legal-case cases, 2 in total); the plugin dynamically mounts servers according to the token's actual authorization scope — accounts with both regulations and cases get 2, accounts with only regulations get 1

• 🔄 Auto-refresh: automatically refreshes before the access_token expires (token rotation); re-authorization is needed only when it fails

• 💾 Secure persistence: tokens are stored in the DSH storage domain (~/.dsh/storages, directory 0700); the connection is automatically restored when the Host restarts

• 🛠 Manage via conversation: ships with three built-in tools — qcc_legal_oauth_connect / qcc_legal_oauth_status / qcc_legal_oauth_disconnect

• 🚪 One-click disconnect: calls OAuth revoke to revoke the refresh_token and disables the MCP tools

• 🧩 Coexists with the enterprise-data plugin: tool names, storage domain, and entry ids are fully independent from the "Qichacha MCP OAuth Plugin" (company/risk/...); both can be installed at the same time

Related MCP server: lark-mcp

Install

Prerequisites: DeepSeek Harness (dsh CLI, web profile), Node ≥ 20.

🤖 Let the Agent install it (easiest; recommended for users unfamiliar with the command line)

Send the link below directly to your DeepSeek Harness conversation (it is recommended to first search for "Qichacha legal data" in the dshmarket plugin marketplace and install it with one click; if the direct marketplace install fails, send the same link to the Agent and it will install it for you):

帮我安装这个插件 https://github.com/duhu2000/qcc-mcp-legal-oauth

The Agent will run the following commands according to this README (you can also run them yourself):

# 方式一：一键脚本（自动安装 + 注册 bundle + 提示重启）
bash <(curl -fsSL https://raw.githubusercontent.com/duhu2000/qcc-mcp-legal-oauth/main/install.sh)

# 方式二：手动两步
dsh plugin --profile web add qcc-dsh-mcp-legal-oauth   # 安装依赖并自动注册 bundle
# 重启 dsh web

Note: peer dependencies warnings during installation can be ignored — peer dependencies such as @deepseek-ai/* are bundled with the DSH web profile (host dependencies) and require no separate installation; after installation you must restart dsh web for it to take effect.

Option A: npm install

# 1. 安装插件到 profile（声明了 dsh.bundle 的包会被 dsh plugin add 自动注册到 bundles）
dsh plugin --profile web add qcc-dsh-mcp-legal-oauth

# 2. 重启 dsh web

If it is not registered automatically: manually append "qcc-dsh-mcp-legal-oauth" to dsh.profile.bundles in ~/.dsh/profiles/web/package.json (alongside @deepseek-ai/dsh-base and @deepseek-ai/dsh-web-app), then restart.

Option B: Install directly from GitHub

dsh plugin --profile web add github:duhu2000/qcc-mcp-legal-oauth
# 再重启 dsh web

Option C: Source code / local debugging

git clone https://github.com/duhu2000/qcc-mcp-legal-oauth.git
cd qcc-mcp-legal-oauth
dsh plugin --profile web add "link:$(pwd)"      # 或 pnpm add "file:$(pwd)"
# 再重启 dsh web

The plugin package ships with cordis.patch.yml (bundle patch); dsh plugin add automatically completes dependency installation and bundles registration, and the plugin line is merged in automatically — no manual file edits needed.

Usage

After restarting, the plugin will automatically initiate OAuth authorization (enabled by default; when active and without a valid authorization, it automatically opens the Qichacha authorization page). If it is not triggered automatically, enter the following in the conversation:

After a successful connection, the following tools are directly available (examples):

• mcp__legal-regulation__*: regulation_search (keyword search for regulations), regulation_detail (full text of regulations), regulation_detail_article (original text of legal provisions), etc.

• mcp__legal-case__*: case_search (keyword search for cases), case_detail (full case documents), etc.

• Source-tracing tools: regulation source tracing / case source tracing (citation verification + clickable hyperlinks)

How it works

Strictly follows the "Qichacha MCP OAuth Integration Guide" (Authorization Code + PKCE, public API edition) and shares the same authorization server with the enterprise-data MCP plugin:

1. Discover MCP Protected Resource Metadata → 2. Discover OAuth Server Metadata (all endpoints are read dynamically, not hard-coded)

2. Dynamically register the client (client_id, auto-renewed every 90 days) → 4. Open the authorization page (scope=mcp:tools)

3. Validate state on the loopback callback → 6. Exchange the authorization code + code_verifier for a token

4. Parse the resource actually authorized by the token (JWT claim), and inject the Bearer header via ctx.loader into the authorized @deepseek-ai/dsh-mcp-client entries (regulations + cases: 2 / regulations only: 1) → 8. Auto-refresh before expiry (rotation)

See docs/OAUTH-IMPLEMENTATION.md for details.

See docs/TOOLS.md for the tool list and usage examples.

Configuration

The plugin line is located in ~/.dsh/profiles/web/cordis.patch.yml (visible after the bundle is merged in):

- id: qcc-legal-mcp-oauth
  name: 'qcc-dsh-mcp-legal-oauth'
  config:
    issuer: 'https://agent.qcc.com'                 # OAuth 授权服务器
    clientName: 'DeepSeek Harness - QCC Legal MCP'  # OAuth 客户端名（授权页展示 + 后台品牌识别依据）
    refreshSkewMs: 300000                            # 过期前提前刷新（ms）
    openBrowser: true                                # 自动打开浏览器（false = 仅打印授权 URL）
    autoConnectOnActivate: true                      # 激活且无授权时自动打开授权页（false = 手动触发）
    persistTokens: true                              # 持久化 token（false = 仅内存）
    mcpEntryPrefix: 'mcp-qcc'                        # 受管 mcp-client 条目 id 前缀（条目：mcp-qcc-legal-regulation / mcp-qcc-legal-case）

About clientName: it is the OAuth protocol's client_name, which Qichacha writes into the client_name claim of the access_token for brand recognition on the backend dashboard (Qichacha removes spaces/hyphens/underscores and lowercases the name, then normalizes names with the deepseekharness* prefix to the activation source deepseekharness). The default value DeepSeek Harness - QCC Legal MCP already matches this prefix. If you want to customize it, please keep the DeepSeek Harness prefix, otherwise the backend will classify it as "other (unregistered)" and brand activations will not be counted correctly.

Security

• Tokens are written only to ~/.dsh/storages (0700) — never into git, never into conversation history

• While connected, the loader writes entry configuration back to the profile config file (including tokens). Recommended: chmod 600 ~/.dsh/profiles/web/cordis.yml; do not add ~/.dsh to any repository

• The Bearer token is sent only to the exact resource URLs within the authorized set

• On disconnect, revoke is called to revoke the refresh_token

• To remove completely: after qcc_legal_oauth_disconnect, remove the package name from bundles and run dsh plugin --profile web remove qcc-dsh-mcp-legal-oauth

Known limitations

• The plugin manages 2 legal-data SERVERs by default (legal-regulation regulations / legal-case cases); an account token may authorize only one of them, and the plugin mounts dynamically according to the token's actual authorization scope (2 / 1)

• Enterprise-data SERVERs (company/risk/ipr/operation/history/executive) are managed by the separate "Qichacha MCP OAuth Plugin" (qcc-dsh-mcp-oauth); this plugin does not manage them redundantly; both plugins can be installed at the same time

• Third-party plugins cannot register a settings page card in DSH (apiproxy allowlist restriction); the management entry point is the conversation tools

• The callback uses a local loopback address, suitable for desktop; SaaS/Web callback addresses need to be confirmed on Qichacha's allowlist in advance

• Static API key (Bearer YOUR_API_KEY) direct connection is another direct-connection channel of Qichacha and is not this plugin's responsibility; if you need a static key, just use a normal mcp-client configuration

Development

npm install          # 需要 host 依赖时（见 docs/INSTALL.md）
npm run lint         # 语法检查
npm test             # 单元 + 集成测试（含 mock OAuth 服务器全流程）

Test coverage: PKCE, metadata discovery, dynamic registration, full authorization-code flow (loopback), refresh rotation, revoke, plugin-level integration (connect / idempotency / auto-refresh / disconnect / restart recovery / dynamic mounting based on token authorization).

Marketplace listing and search keywords

This plugin can be discovered and installed through the following channels:

1. dsh-plugin topic (official recommended discovery channel): DeepSeek Harness officially recommends discovering plugins via the GitHub dsh-plugin topic, and this repository already carries the topic; community marketplaces such as dsh-plugin-marketplace automatically list plugins from it. Search goes through GitHub repository search (repo name / description / topic); listing is immediate but has no manual review.

2. dshmarket (community plugin marketplace, human-curated + PR gate review): its data source is the curated list awesome-dsh-plugin, and only sources in the list are installed. This plugin has already submitted a listing PR (data/plugins/duhu2000__qcc-mcp-legal-oauth.yml); once merged, you can browse and search for "Qichacha legal data" under "Settings → Plugin Marketplace" and install it with one click. Installation: the official CLI supports the generic install dsh plugin add <package>, and dshmarket provides dsh plugin --profile web add dshmarket accordingly.

To facilitate search in both Chinese and English, the following keywords are covered:

• Chinese: 企查查, 法律产品, 法律数据, 法规, 案例 (written into the repository description and the zh description of the curated list)

• English: qcc, qichacha, legal, law, legal-tech, legal-data, regulation, case (written into the repo name / description / topic / npm keywords)

License

MIT