Sprites for DeepSeek Harness

Use Sprites from DeepSeek Harness: isolated, persistent Linux environments for builds, tests, experiments, and long-running services.

This repository is a Harness bundle. Its cordis.patch.yml mounts:

• @deepseek-ai/dsh-mcp-client, connected to the hosted Sprites MCP server.
• This package's index.js entry, which mounts @deepseek-ai/dsh-skill-filesystem against the packaged Sprites workflow skill.

The result is a native Cordis composition: Sprites tools appear as mcp__sprites__*, and the Sprites skill is discoverable through Harness's normal skill system.

Requirements

• Node.js 20.19 or newer. The packaged filesystem provider currently depends on Chokidar 5, whose engine floor is Node 20.19.
• DeepSeek Harness developer preview.
• Browser access for the first Sprites OAuth authorization.
• Network access for npx to run the pinned [email protected] OAuth bridge.

Harness's current Streamable HTTP MCP transport accepts static headers but does not perform MCP OAuth. This bundle therefore uses Harness's supported stdio transport and mcp-remote to complete the standard browser OAuth flow without requiring a Sprites API token.

Install

Install the GitHub checkout into the profile you use. For the built-in Web profile:

npx @deepseek-ai/dsh plugin --profile web add github:superfly/sprites-deepseek-plugin

Then start that profile:

npx @deepseek-ai/dsh --profile web

On first connection, complete the browser OAuth flow, choose the Fly.io organization, and review the connector access policy. Restart Harness once if the initial tool synchronization timed out while you were authorizing.

For local development from this repository:

npx @deepseek-ai/dsh plugin --profile web add .
npx @deepseek-ai/dsh --profile web

To try the layer without installing it into a profile:

npx @deepseek-ai/dsh web --patch ./cordis.patch.yml

Verify the installed bundle and composed rows without booting the UI:

npx @deepseek-ai/dsh --profile web --dump-config

The output should include the dsh-sprites-plugin layer, sprites-mcp, and sprites-skill-filesystem.

First prompts

• "List my sprites."
• "Create a sprite for this experiment and run uname -a in it."
• "Create a checkpoint, then run the test suite in my sprite."
• "Start the web service in my sprite and give me its URL."

An empty sprite list is a successful authenticated response.

Authentication and access

The hosted endpoint is https://sprites.dev/mcp and uses OAuth 2.1. mcp-remote stores its OAuth state in its normal local credential directory; this repository contains no credentials.

The Sprites consent screen normally creates a restricted connector token. Its default name prefix is often mcp-, and it may cap how many sprites the connector can create. A custom non-empty prefix remains restricted. Choosing Full access removes the prefix restriction but grants access to every sprite in the organization.

Prefer restricted access for agent work. If a create call reports a required prefix, Harness should retry once with that exact prefix and report the actual name.

How it works

cordis.patch.yml contributes two rows:

…