deepseek-dsh
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| DSH_CLI_PATH | No | Absolute path override pointing to the DSH bin entry file (e.g. /absolute/path/to/node_modules/@deepseek-ai/dsh/lib/bin.js). Used when DSH is installed but not on PATH. If set incorrectly the adapter reports an explicit error instead of falling back to other resolution steps. | |
| DEEPSEEK_API_KEY | No | API key passed through to the upstream DeepSeek Harness (DSH) runtime for authentication. Authentication is a prerequisite of upstream DSH; the adapter requires no keys to be written into the repository or committed to configuration files. | |
| DSH_MCP_SEALED_ROOTS | No | Additional sealed roots as a JSON array of absolute existing directory paths, e.g. '["/absolute/path/to/private-artifacts","/absolute/path/to/sealed-data"]'. Only adds write protection and never expands any permission. Invalid JSON, non-arrays, relative paths, non-existent paths, broad roots (/ , /home, user home, /tmp, /usr, /etc, /var, /opt) and paths overlapping credential directories are rejected at startup. | |
| DSH_MCP_RUNTIME_ROOTS | No | Additional read-only runtime mounts as a JSON array of absolute existing directory paths, e.g. '["/absolute/path/to/toolchain/env"]'. Typically used so sandboxed commands can access a toolchain/environment directory. Mounted into bwrap with --ro-bind only; they do not become model-writable paths and are not added to read_roots. Validated the same way as DSH_MCP_SEALED_ROOTS. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| deepseek_delegateA | Delegate bounded development execution to DeepSeek Harness. Astra plans and accepts; DeepSeek reads/searches code, implements changes and runs the specified checks when execution is supplied. Provide the project constraints, writable paths, exact authorized commands and acceptance criteria. DeepSeek cannot spawn agents, redelegate, escalate permissions or start background jobs. Commands run without network in a scoped filesystem sandbox. read, glob and grep are read-only; write and edit exist only when write_paths are granted; bash exists only for the exact authorized commands. The model-visible bash schema enumerates exactly those authorized command strings: choose one verbatim, use workdir equal to the assigned workspace or ".", set timeoutMs greater than 0 and at most 120000 ms, and do not send background or escalation parameters. A command absent from the enum is refused before execution and reported as not executed; dependency or environment probes belong inside an authorized implementation/check command, not as extra commands. Use read/glob/grep for exploration: granting a file read root does not grant its parent directory. A clearly denied, unexecuted exploratory ls/glob/grep becomes a non-blocking warning only when all required authorized commands actually exited 0 and the same target evidence was later obtained through an authorized read/glob/grep; every other denial remains a failure, and a missing necessary permission must be reported as a blocker. Model request budget: max_steps 1..64 (default 24); hard deadline: timeout_seconds 10..900 (default 600); each command has a hard 120000 ms limit. Commands are matched as exact strings and run one per call: do not concatenate them with &&, ; or |. About 20% of the request budget (at most 12 requests) is reserved for verification and handoff; the final request is summary-only with tools disabled, and no additional model requests are granted. Returns a stable structured handoff with observed writes, actual command results, missing checks, non-blocking warnings and blockers, plus the actual tool transcript and session. Astra reviews the diff and evidence without redoing the implementation or automatically auditing it again. One active task per server/workspace; identical requests share a result. Omit execution only for a backwards-compatible text-only answer. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 1 tool
There is only one tool, so there is no possibility of misselection between competing tools. The single entry point's purpose (delegate a bounded execution task) is stated unambiguously in its description.
The lone name deepseek_delegate uses a clear snake_case namespace_verb pattern with no competing conventions to clash with. Nothing inconsistent can be observed in a one-name surface.
A single tool is on the thin side, and its description crams an entire agent runtime (read/glob/grep/write/edit/bash, budgets, sandboxing, handoff) into one parameterized call. It is defensible as one delegation entry point, but the scope feels compressed rather than well-factored.
The core workflow (submit constraints, run authorized commands, return a structured handoff) is covered, but there are no lifecycle companions such as task status, listing active tasks, or cancellation for tasks that can run up to 900 seconds. Agents must work around the absence of these operations.