dsh-mcp-manager

简体中文 | English

MCP server manager for DeepSeek Harness (DSH) — a Settings → MCP page where you add MCP servers once (remote HTTP or local stdio process), authenticate HTTP servers with OAuth in the browser, and expose their tools either directly or through a compact on-demand broker.

The built-in @deepseek-ai/dsh-mcp-client only accepts a static headers config — it has no OAuth support and no local stdio transport. This plugin fills that gap:

• OAuth (authorization code + PKCE) with RFC 7591 dynamic client registration, refresh_token rotation, and auto-reconnect across restarts — one browser login, then it keeps working.
• Static Bearer token mode for servers without OAuth — stored as an environment-variable name (Codex-style tokenEnv), never as plaintext in the config.
• Custom HTTP headers (headers for direct values, headerEnv for values read from environment variables) — matches Codex's http_headers / env_http_headers.
• stdio local processes: run npx / uvx / python etc. directly; the plugin speaks JSON-RPC over the child's stdin/stdout (spawns the process, reconnects, and reaps it on exit) — no remote server or auth required. Windows .cmd shims (e.g. npx.cmd) are resolved through cmd.exe.
• Edit-in-place: rename a server, switch stdio ↔ HTTP, or change auth/headers without deleting and re-adding it.
• Tool registration with the same mcp__<server>__<rawName> naming convention as the built-in client, including strict-schema sanitization for the DSH tool registry and isConcurrencySafe marking.
• Workspace isolation: declare per-project servers in <workspace>/.dsh/dshmm/mcp.json — their tools register only into that workspace's sessions, and you can mask specific global servers per workspace.
• Opt-in on-demand broker: keep the model-facing MCP surface fixed at mcp_search_tools, mcp_describe_tool, and mcp_execute_tool instead of sending every mcp__* schema on every Native-mode request. It is disabled by default.
• Stable tool refresh: notifications/tools/list_changed refreshes only added, removed, or schema-changed registrations for both stdio and Streamable HTTP servers.

Requirements

• DeepSeek Harness with the web profile (npx @deepseek-ai/dsh web)
• Node.js ^22.19 or >=24; pnpm on your PATH
• Windows 10/11: stdio commands are launched via cmd.exe so .cmd shims (npx, uvx) resolve correctly

Install

npx -p @deepseek-ai/dsh dsh plugin --profile web add github:hyqhyq3/dsh-mcp-manager

Then restart dsh --profile web and refresh the page. The package declares a dsh.bundle.patch, so the plugin activates automatically — no manual cordis.patch.yml editing.

The MCP server's OAuth provider must allow a loopback redirect (http://127.0.0.1:<port>/mcp-manager/callback/<id>), which is where the DSH GUI webserver receives the code. The origin is derived from your browser's own address, so any host/port the GUI is served on works.

Usage

…