Skip to main content
Glama
xuanmingguo

DOT DeepSeek Harness MCP

by xuanmingguo

Dispatch a Harness run

start_run
Destructive

Launch or resume a Harness session with a chosen provider, model, agent preset, and permissions, submit the first path-referenced task, and get a stable session link.

Instructions

Create or reuse a native Harness session, select provider/model/reasoning, agent preset, and native permission preset, then submit the first task and return a stable session link. Task parameters are path-reference-only: provide the authorized workspace, reviewTargets, contextReadScope, excludedPaths, writeScope, and acceptance criteria. reviewTargets identify what to assess; they are not a read whitelist. contextReadScope declares where Harness may search and read supporting implementation, tests, configuration, and architecture material. Never embed source text, diffs, file dumps, encoded source, or repository archives. Harness reads named files from the authorized workspace itself. These fields are task instructions, not enforced per-path filesystem isolation. The selected Harness model may send content it reads to its configured model provider even though Relay itself uses a loopback address. Sharing webUrl is not completion: keep wait_run until a terminal status, then consume assistantText.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
taskNoTask parameters are path-reference-only: provide the authorized workspace, reviewTargets, contextReadScope, excludedPaths, writeScope, and acceptance criteria. reviewTargets identify what to assess; they are not a read whitelist. contextReadScope declares where Harness may search and read supporting implementation, tests, configuration, and architecture material. Never embed source text, diffs, file dumps, encoded source, or repository archives. Harness reads named files from the authorized workspace itself. These fields are task instructions, not enforced per-path filesystem isolation. The selected Harness model may send content it reads to its configured model provider even though Relay itself uses a loopback address.
modelNoglm-5.3-flash
contentNoTask parameters are path-reference-only: provide the authorized workspace, reviewTargets, contextReadScope, excludedPaths, writeScope, and acceptance criteria. reviewTargets identify what to assess; they are not a read whitelist. contextReadScope declares where Harness may search and read supporting implementation, tests, configuration, and architecture material. Never embed source text, diffs, file dumps, encoded source, or repository archives. Harness reads named files from the authorized workspace itself. These fields are task instructions, not enforced per-path filesystem isolation. The selected Harness model may send content it reads to its configured model provider even though Relay itself uses a loopback address.
providerNozai
sessionIdNo
workspaceYesAuthorized absolute Harness workspace root; Harness reads named in-scope files from here.
writeScopeNoPaths Harness may modify. Must be empty for read-only runs; this is an instruction declaration in addition to native permissions.
agentPresetNo
openBrowserNoKeep false unless the user explicitly asks to open the Harness page in the OS browser.
sessionModeNo
excludedPathsNoPaths excluded from contextual reading. This is an instruction declaration, not filesystem enforcement.
externalPathsNoExplicit external read/write file or directory grants; operator policy must separately allow each. External writes require danger-full-access.
reviewTargetsNoSubjects to assess. This is not a read whitelist; supply together with contextReadScope.
idempotencyKeyNo
reasoningEffortNomax
contextReadScopeNoWorkspace paths Harness may search and read for evidence. Use only the targets when the user explicitly requests a target-only review.
permissionPresetNoExplicit call value overrides the configured MCP default. Without DSH_RELAY_TRUSTED_OPERATOR=true the default is read-only; true changes only the omitted start_run value to danger-full-access. Reused session permissions do not override this selection. Inspect live tools/list or get_operational_capabilities; the checked-in catalog uses unconfigured defaults.read-only
authorizationBasisNoTruthful evidence that the user explicitly selected Harness or this named Harness model to inspect the stated workspace scope. The current explicit request is sufficient authorization for that selected provider to process in-scope reads; do not ask the user to repeat authorization solely because provider processing is external. This field does not broaden the workspace, scope, permissions, destination, or allowed external actions.
confirmedDangerousPermissionNoDefaults to DSH_RELAY_TRUSTED_OPERATOR (false when unset). Explicit false is preserved and blocks danger-full-access. This flag does not replace task-specific authorization or client approval review.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.2.18-dsh021a2.14

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructiveHint=true, openWorldHint=true and readOnlyHint=false, but the description adds real behavioral context the annotations cannot: the scope fields are 'task instructions, not enforced per-path filesystem isolation,' and read content may be sent to the configured model provider even though Relay uses a loopback address. It also notes the returned session link is stable and that a terminal status (not webUrl) marks completion. It stops short of describing dispatch timing/blocking behavior or reuse semantics for an existing sessionId.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The core action is front-loaded in the first sentence and the cautionary sentences are dense with operative constraints rather than filler. It loses a point because roughly half the description is a verbatim duplicate of the 'task' parameter's schema description, so an agent reading both is told the same thing twice.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 19 parameters, no output schema, and destructive/open-world annotations, the description covers what an agent most needs: what it returns (stable session link), how completion is judged (wait_run to terminal, then assistantText), the non-enforcement of scoping, and the data-egress caveat. It leaves gaps around session reuse behavior and the interaction between externalPaths, permissionPreset, and operator policy.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 63%, and the description meaningfully disambiguates the scope parameters beyond their schema text: reviewTargets 'identify what to assess; they are not a read whitelist' while contextReadScope 'declares where Harness may search and read,' and writeScope must be empty for read-only runs. It adds no semantics for model, provider, reasoningEffort, agentPreset, sessionMode, idempotencyKey, or content, though several of those carry their own in-schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The first sentence states a specific verb and resource chain — create/reuse a Harness session, select provider/model/reasoning/presets, submit the first task, return a session link — which is far more specific than the terse title 'Dispatch a Harness run'. It does not explicitly distinguish itself from siblings like queue_run, start_review, or steer_run, so an agent must infer the boundary from the queue/review naming alone.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is one genuinely useful routing instruction: 'Sharing webUrl is not completion: keep wait_run until a terminal status, then consume assistantText,' which names a sibling and the follow-up condition. However, it never says when to choose start_run over queue_run or steer_run, nor when sessionMode/sessionId reuse is appropriate, leaving the primary selection decision implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.