dsh-cert-mcp
It is a read-only MCP server for looking up DeepSeek Harness plugin certification records from the dsh-plugin-certification registry.
get_certification(owner, repo)— returns one plugin's full certification record: grade, snapshot date, five-dimension evidence, veto, and notes.list_certified()— lists every certified plugin in the public registry with repo, grade, and snapshot date.certification_spec()— explains the certification spec v1: five dimensions, grade scale, and veto rule.The server is read-only, has zero runtime dependencies, and refreshes its embedded registry data from the public source at most once every five minutes.
Provides read-only certification records (grades, snapshot dates, and five-dimension evidence) for DeepSeek Harness plugins hosted on GitHub, enabling lookup of plugin certification before recommending or installing them.
dsh-cert-mcp
English · 简体中文 · Español · Português · हिन्दी
Read-only MCP server that exposes the dsh-plugin-certification registry: certification grades, snapshot dates and five-dimension evidence for DeepSeek Harness (DSH) plugins. Zero runtime dependencies, stdio transport.
Tools
Tool | Input | Returns |
|
| Full certification record (grade, snapshot, five dimensions, veto, notes) or "no record" |
| — | Every entry in the public registry: repo / grade / snapshot |
| — | Spec v1 summary: five dimensions, grade scale, veto rule |
The embedded snapshot lives in data/certified.json (synced from the certification repo) and the server refreshes it from the public registry at most once per five minutes. No writes, no secrets, no code execution.
Related MCP server: feedback-loop-mcp
Install
git clone https://github.com/PerryLink/dsh-cert-mcp
cd dsh-cert-mcp
node src/index.js # stdio serverRun it directly from the published npm package: npx dsh-cert-mcp.
Register in an MCP client
Claude Code:
claude mcp add dsh-cert -- node <path-to-repo>/src/index.jsClaude Desktop (claude_desktop_config.json):
{
"mcpServers": {
"dsh-cert": {
"command": "node",
"args": ["<path-to-repo>/src/index.js"]
}
}
}DSH: add it through dsh-mcp-panel as a stdio server, or any MCP client that supports stdio.
Install as a DSH bundle
The package declares dsh.bundle.patch → cordis.patch.yml, so it also installs as a DeepSeek Harness bundle:
# git channel (latest main)
dsh plugin --profile web add "github:PerryLink/dsh-cert-mcp#main"
# npm channel (published releases)
dsh plugin --profile web add dsh-cert-mcpThe inserted row loads the package through the standard Cordis plugin contract: the host half is a plain ESM module exporting name, inject and apply(ctx). This package ships no browser UI, so there is no dsh.client declaration.
// bundle entry (host half) — the contract the patch row loads
export const name = 'dsh-cert-mcp'
export const inject = ['tools'] // the host tool surface, provided by dsh-tools
export function apply(ctx) {
// registers the read-only certification lookup surface
// (get_certification / list_certified / certification_spec)
}The host half needs the tools service (shipped by @deepseek-ai/dsh-tools). A profile without it does not lose the tools silently: Cordis holds this row in PENDING until tools exists, which is visible in the profile's plugin list. Nothing else is required — no config keys, no credentials, and no network access at load time.
Two halves, one data path. The bundle row and the stdio server are separate entry points over the same handleRequest core. The server half is an independent process any MCP client can spawn (node src/index.js), and it is not part of the plugin path: installing this bundle never starts it, and removing the bundle never touches it. Conversely npx dsh-cert-mcp registers nothing on the DSH tool surface.
Remove the bundle with dsh plugin --profile web remove dsh-cert-mcp (or delete the row from the profile patch). The standalone stdio MCP server above keeps working for any MCP client.
Why this exists
The official DeepSeek Harness repository does not run a plugin registry and does not accept external PRs; discovery happens through the dsh-plugin GitHub topic and community lists, none of which certify anything. dsh-plugin-certification turns "can I install this plugin" into a reproducible five-dimension check (manifest, build hygiene, supply-chain Scorecard, release provenance, sandboxed install smoke test) with a public registry and README badges. This MCP server is the same data with an agent-facing interface: agents can look up a plugin's certification before recommending or installing it.
Registry
Data source: PerryLink/dsh-plugin-certification — data/certified.json, spec v1.
Compatibility
Node
^22.19.0 || >=24.0.0.DSH
>=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0(declared inengines.dsh, withdsh.manifestVersion: 1).Peer:
@deepseek-ai/cordis^4.0.2. The host half additionally needs thetoolsservice at runtime; the stdio half needs nothing but Node.
Development
pnpm install
pnpm run typecheck # the one type ruler: checkJs over the published host face
pnpm test # JSON-RPC smoke + the real-Cordis runtime suite
pnpm pack # the published tarballThe runtime suite mounts the REAL SystemPrompt/ToolRuntime registries and asserts that mounting this package puts all three certification tools into ctx.tools.schemas(), that disposing the fiber removes them again, and that a context without the tools service parks the plugin in PENDING. dsh --dump-config is deliberately not used as acceptance: a mounted row and a pending fiber look the same there.
There is deliberately one type ruler. @deepseek-ai/* resolves through this repo's own node_modules (the pinned devDependencies — the published line) and the package declares no DSH peer, so a second tsc configuration would be the same command over the same type universe. The typecheck:ci script is kept as the historical no-op duplicate (its only extra key is an empty paths: {}) for compatibility with existing references, not as a second face. The independent second piece of evidence is the runtime mount gate above.
PerryLink DSH Plugin Family
This project is one of the 41 DeepSeek Harness plugins maintained by PerryLink. If this one helps you, the others likely will too:
Plugin | One-liner |
Second-model auto-review on the approval chain, fail-closed by default | |
Automatic strong/cheap model-tier routing with deterministic risk guards and a | |
Durable background child agents with a Web UI sidebar, messaging and interrupt | |
Cost governance for DeepSeek Harness: budgets, carbon, and latency in one panel. | |
DSH Desktop Market standard catalog source for the PerryLink family | |
Unified session + workspace + config checkpoints with one-shot | |
Migrate Claude Code, Codex, OpenCode and Hermes sessions, memories and skills into DSH | |
Cross-platform native desktop control for DeepSeek Harness — Windows first. | |
Terminal-style input history for the web composer: arrows, Ctrl+R search | |
Deterministic dataset profiling, cleaning and citation verification | |
Prompt-injection, jailbreak, and secret-leak defense for DeepSeek Harness. | |
Engineering-discipline guard: requirements grill, test gates, adversary review | |
Unified static-image generation routing for DeepSeek Harness. | |
Read-only performance diagnostics: load, spill, compaction and cache hit rate | |
Chinese mutual-fund research with sealed, traceable source snapshots | |
GitHub PR/issue/CI integration with every write approval-gated | |
Industry and company research pack: chain map, policy timeline, company cards | |
One-command starter pack that installs the core family | |
Local document knowledge base with hybrid search and citation-aware injection | |
Local Ollama model discovery and task-based routing with cloud fallback | |
LSP diagnostics, formatting, completion, code actions, symbols and rename | |
PII masking at the model boundary with a host-side restore table | |
MCP management console: | |
Approval-gated cross-session memory protocol ( | |
OpenTelemetry and Langfuse telemetry export from the session event stream | |
Runtime-switchable model output styles | |
Declarative allow/deny/ask rules plus a process-level network policy | |
Community certification registry with repro-checkable grades and badges | |
Zero-dependency static + sandbox smoke detector for DSH plugins | |
Plugin-dev knowledge base, agent skill and the | |
Shared zero-runtime-dependency toolkit for the PerryLink DSH plugins | |
Zero-dependency static portal rendering the whole plugin family as one page | |
Merged | |
Multi-channel approval/question bridge: WeChat, Telegram, Feishu + a session console | |
Verifiable research reports: evidence ledger, manifest seal, per-claim verdicts | |
Multi-dimensional plugin quality scoring with an evidence-backed leaderboard | |
Pin sessions and workspaces in the Web sidebar with per-pin colors | |
Git-backed cross-device session synchronization with keep-both merges | |
Security-audit skill pack plus the | |
Voice-first session loop: speech-to-text input and text-to-speech replies | |
Cross-session team rooms: shared message bus, task board and timeline | |
Isolated install-and-smoke test drives with a pass/fail matrix | |
TickTick/Dida365 task bridge: session-header panel plus eleven agent tools | |
Vendor parameter translation and deterministic JSON repair | |
WeChat ↔ DSH bridge (Tencent iLink bot) developed with pan17, who hosts the repo | |
Personal directive injector with a top-bar toggle (fork of liucai2026/dsh-personal-directive) |
License
Apache-2.0. A listing or grade is an evidence record, not a security guarantee: plugins run inside your DSH process with your permissions.
Available Tools
3 toolscertification_specA
Explain the dsh-plugin-certification spec v1: the five dimensions, the grade scale and the veto rule.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral disclosure burden. 'Explain' signals a purely informational, non-mutating call, and the sentence specifies exactly which content will be delivered (five dimensions, grade scale, veto rule). It does not explicitly state that nothing is modified or describe the response shape, but for a zero-parameter explainer tool this is largely sufficient.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single 17-word sentence front-loads the key verb and resource, then packs the content scope into a compact list. There is no filler, tautology, or repetition — every word contributes information an agent needs.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's low complexity — zero parameters, no annotations, no output schema — the description names the full content scope (five dimensions, grade scale, veto rule), which is what an agent needs to decide whether to invoke it. The only omission is the return format, which is a minor gap for a purely explanatory tool that will predictably return a textual explanation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, and the rubric sets a baseline of 4 for that case. The empty input schema already exhaustively conveys the parameter surface, so there is nothing further the description needs to add about parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb, 'Explain', bound to a concrete resource, 'the dsh-plugin-certification spec v1', and enumerates the exact scope: 'the five dimensions, the grade scale and the veto rule'. This naturally distinguishes it from the siblings get_certification and list_certified, which connote retrieving certification data rather than explaining the spec itself.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit when-to-use or when-not-to-use guidance, and no alternative tool is named. The appropriate context (an agent wanting to understand the spec's evaluation model before or instead of querying actual certifications) is only implied by the verb 'explain', leaving the agent to infer routing from the tool name and sibling names.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_certificationB
Return the dsh-plugin-certification record for one DeepSeek Harness plugin repository (grade, snapshot date, five-dimension evidence).
| Name | Required | Description | Default |
|---|---|---|---|
| repo | Yes | GitHub repository name, e.g. dsh-auto-review | |
| owner | Yes | GitHub owner, e.g. PerryLink |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden. It clearly indicates this is a return/read operation and discloses the kind of data returned, which is adequate. However, it does not mention behavior when the repository/certification record is missing, whether live data is fetched from GitHub, or any response-shape details.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence with no filler. The core action is front-loaded, and the parenthetical packs useful output context without bloating the text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple get-by-owner/repo tool, the description covers the key context: what resource is returned and the main output dimensions. No output schema exists, so the parenthetical helps compensate, though a fuller description of the response structure or behavior when not found would make it complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the parameters owner and repo are already fully documented by the schema. The description adds context about the record type but does not explain the parameters beyond what the schema provides, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action ('Return') and a specific resource ('dsh-plugin-certification record'), scoped to one repository, with a useful parenthetical of the returned content (grade, snapshot date, five-dimension evidence). It does not explicitly contrast with sibling tools, but 'for one repository' clearly signals singular retrieval versus list_certified.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance about when to choose this tool over list_certified or certification_spec. The phrase 'for one repository' implies a singular lookup, but no explicit when-to-use, when-not-to-use, or alternative routing is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_certifiedA
List every plugin in the public dsh-plugin-certification registry with repo, grade and snapshot date.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses that the tool lists all plugins, not a filtered subset, and includes the output fields. However, it does not mention ordering, pagination, or any access requirements, leaving some behavioral aspects unstated for a list operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, pointed sentence that front-loads the action and resource, then lists the output fields. Every word contributes meaning; no filler or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple list tool with no parameters and no output schema, the description covers the key information: what is listed, from where, and which attributes are returned. It could be more complete by noting ordering or pagination, but the core calling context is sufficiently clear.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the baseline is 4. The description adds no parameter details, but none are needed because the schema is empty and there is nothing to explain.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('List') and resource ('every plugin in the public dsh-plugin-certification registry'), and names the returned attributes (repo, grade, snapshot date). This clearly distinguishes it from sibling tools like get_certification or certification_spec, which suggest retrieving a single item or a spec rather than the full list.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given about when to use this tool versus its siblings. It does not mention alternatives, exclusions, or conditions. While the simple zero-parameter interface reduces ambiguity, the presence of sibling tools makes the lack of explicit routing a notable gap.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
3 tool updates
v0.1.0- First observed
certification_spec - First observed
get_certification - First observed
list_certified
TDQS
Scored across 3 tools
Each tool serves a clearly distinct purpose: fetch a single certification record, list the full registry, or explain the certification spec. There is no overlap in behavior and an agent would not confuse them.
get_certification and list_certified follow a verb_first pattern, while certification_spec is a noun phrase. The names are still readable and predictable, but the mix is a minor deviation from full consistency.
Three tools is an appropriate, well-scoped size for a certification registry lookup service. Each tool earns its place: one for a specific record, one for the whole list, and one for the spec.
For the apparent read-only domain, the surface is complete: agents can retrieve a specific certification, list all certified plugins, and understand the grading spec. There are no obvious dead ends or missing operations.
Maintenance
Related MCP Connectors
Official MCP server for Certifier to issue, manage, and track certificates and badges.
MCP server for medicare-coverage
SAM.gov MCP — Federal contract opportunities and entity registration data
Remote MCP for MCP consent scope receipt, structured receipts, audit logs, and reviewer-ready eviden
Related MCP Servers
- -
- MIT
- -
- AlicenseAqualityAmaintenanceMCP server for HUD housing data, enabling Fair Market Rent lookups, Section 8 income limits, and ZIP-to-county crosswalk mapping for affordable housing assessments.64 npmMIT