Dsh MCP Manager

Name: Dsh MCP Manager
Author: hyqhyq3

@deepseek-ai/dsh · by hyqhyq3

MCP server manager plugin for DeepSeek Harness: Settings → MCP page, OAuth (PKCE + dynamic client registration) or static-token auth, tools registered as mcp____*

849.0k/wk GitHub npm

No known CVEs

MIT license

Actively maintained

Last commit 3d ago

Works with most clients

Transport: stdio, sse, http

0 tools

Grade F

MCPpedia last refreshed this data 1d ago

Edit this pageView history

Dsh MCP Manager is an MCP server that MCP server manager plugin for DeepSeek Harness: Settings → MCP page, OAuth (PKCE + dynamic client registration) or static-token auth, tools registered as mcp__ __*. Its tool list has not been published yet over stdio, sse and http, requires no API key, and scores 64/100 on MCPpedia's security, maintenance and efficiency rubric.

AI / ML Security

Step 1

Install in your client

Config is the same across clients - only the file and path differ.

Supported in Claude Desktopstdio, sse, http · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "exclude": [
    "github"
  ],
  "mcpServers": {
    "unity-mcp": {
      "url": "http://localhost:8090/",
      "type": "http",
      "authMode": "static",
      "tokenEnv": "UNITY_MCP_TOKEN"
    },
    "filesystem": {
      "args": [
        "-y",
        "@modelcontextprotocol/server-filesystem",
        "."
      ],
      "type": "stdio",
      "command": "npx"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/dsh-mcp-manager)](https://mcppedia.org/s/dsh-mcp-manager)

Read me

What Dsh MCP Manager does

MCP server manager for DeepSeek Harness (DSH) — a Settings → MCP page where you add MCP servers once (remote HTTP or local stdio process), authenticate HTTP servers with OAuth in the browser, and expose their tools either directly or through a compact on-demand broker.

Test This Server

Run this in your terminal to verify the server starts. Then let us know if it worked - your result helps other developers.

npx -y '@deepseek-ai/dsh' 2>&1 | head -1 && echo "✓ Server started successfully"

After testing, let us know if it worked:

Loading README…

Scored, not listed

Why this score

Five weighted categories - click any category to see the underlying evidence.

Score breakdown

64/100across 5 weighted dimensions

How we score →

0255075100

−36

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

No known CVEs.

Checked @deepseek-ai/dsh against OSV.dev.

Community

Reviews

Be the first to review

Have you used this server?

Share your experience - it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is Dsh MCP Manager safe to use?: Dsh MCP Manager has no known CVEs as of the latest MCPpedia security scan. Authentication requirements were not detected automatically - check the project's documentation before connecting in a shared environment. Licensed under MIT.
How do I install Dsh MCP Manager?: Dsh MCP Manager supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What AI clients work with Dsh MCP Manager?: Dsh MCP Manager is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.
Is Dsh MCP Manager actively maintained?: Dsh MCP Manager is actively maintained - last commit was 3 days ago.

Similar servers

Others in ai-ml / security

View all →

Codebase Memory Mcp95

Codebase knowledge graph for AI agents — 162 languages, sub-ms queries, 99% fewer tokens.

48.6k 6

Gemini Cli95

An open-source AI agent that brings the power of Gemini directly into your terminal.

108.8k 8

Bla95

🛡️ BLA (Blind LLM Agents) — Adversarial defense shield that protects binaries, Electron apps, JS bundles, Python, and WebAssembly against AI reverse-engineering agents like REA. Poison -> Exhaust -> Hallucinate.

5.4k 1

io.github.callstack/agent-device95

Open source device layer for AI agents: control mobile, web, TV, and desktop apps over MCP

5.4k 5

MCP Security Weekly

Get CVE alerts and security updates for Dsh MCP Manager and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?

{ "exclude": [ "github" ], "mcpServers": { "unity-mcp": { "url": "http://localhost:8090/", "type": "http", "authMode": "static", "tokenEnv": "UNITY_MCP_TOKEN" }, "filesystem": { "args": [ "-y", "@modelcontextprotocol/server-filesystem", "." ], "type": "stdio", "command": "npx" } } }

dsh-mcp-manager

Local 0.13.3 unreleased candidate: see the release notes for cumulative changes, provenance and verification limits. It supersedes 0.13.2.

MCP server manager for DeepSeek Harness (DSH) — a Settings → MCP page where you add MCP servers once (remote HTTP or local stdio process), authenticate HTTP servers with OAuth in the browser, and expose their tools either directly or through a compact on-demand broker.

The built-in @deepseek-ai/dsh-mcp-client only accepts a static headers config — it has no OAuth support and no local stdio transport. This plugin fills that gap:

OAuth (authorization code + PKCE) with spec-compliant discovery, RFC 7591 dynamic client registration, refresh_token rotation, and auto-reconnect across restarts — one browser login, then it keeps working.

Registration identity and secret (RFC 7591): the client_name sent to the registration endpoint is dsh-mcp-manager-<server> by default and configurable per server (Client name) for providers that gate registration on an exact name. When the authorization server advertises client_secret_post, the client registers confidentially: the issued client_secret is stored in the 0600 state file and sent on token exchange and refresh (never in a view, response or log). For a dynamically registered client, a changed client name — or a new GUI origin — re-registers and drops the old client's tokens; a manually configured Client ID is unaffected.
Client application type follows MCP SEP-837: HTTP loopback callbacks (localhost, IPv4 loopback, or [::1]) register as native; other callbacks register as web. This avoids OIDC providers defaulting a local GUI to web and rejecting its redirect. Registration failures show the provider's OAuth error code when available; the Logs panel retains the detailed reason. Providers may still restrict which clients or redirects they accept.
Callback origin accepts direct loopback Host values (including [::1]:port). Configure publicOrigins for a reverse proxy: one configured origin is the default callback even without forwarded headers; with multiple origins, a complete X-Forwarded-Proto/X-Forwarded-Host pair must match the allowlist. A foreign direct Host is rejected when no default is configured. Malformed forwarded host values are rejected. Callback messages are HTML-escaped.
Discovery follows RFC 9728 → RFC 8414: the MCP endpoint's 401 WWW-Authenticate header names its protected-resource metadata, that document names the authorization server, and the authorization server's metadata is read from the RFC 8414 path-inserted URL (e.g. https://github.com/.well-known/oauth-authorization-server/login/oauth). Only when nothing is discoverable does it fall back to guessing ${origin}/oauth/*, and the attempt log says so.
RFC 8707 resource taken from the protected-resource document and sent on authorize, token exchange and refresh. A server that binds tokens to an audience (Kontrcheck's connector does) rejects every step without it as invalid_target. Providers that publish no resource keep the previous behaviour exactly: nothing is invented.
Manual client credentials for authorization servers that do not support dynamic registration (GitHub's does not): set Client ID to an app you registered with the provider, optionally a Client secret environment variable name (sent as client_secret; the secret itself is never persisted), and a Scopes string. When the provider only accepts pre-approved client_name values, set Client name rather than letting the default through.
Scope selection (MCP authorization spec): the authorize request carries scope from, in order, the Scopes field (or a hand-edited oauth.scope in `~/.dsh/mcp-manage

Frequently Asked Questions

Is Dsh MCP Manager safe to use?

Dsh MCP Manager has no known CVEs as of the latest MCPpedia security scan. Authentication requirements were not detected automatically - check the project's documentation before connecting in a shared environment. Licensed under MIT.

How do I install Dsh MCP Manager?

Dsh MCP Manager supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.

What AI clients work with Dsh MCP Manager?

Dsh MCP Manager is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.

Is Dsh MCP Manager actively maintained?

Dsh MCP Manager is actively maintained - last commit was 3 days ago.

dsh-mcp-manager

Local 0.13.3 unreleased candidate: see the release notes for cumulative changes, provenance and verification limits. It supersedes 0.13.2.

The built-in @deepseek-ai/dsh-mcp-client only accepts a static headers config — it has no OAuth support and no local stdio transport. This plugin fills that gap:

Registration identity and secret (RFC 7591): the client_name sent to the registration endpoint is dsh-mcp-manager-<server> by default and configurable per server (Client name) for providers that gate registration on an exact name. When the authorization server advertises client_secret_post, the client registers confidentially: the issued client_secret is stored in the 0600 state file and sent on token exchange and refresh (never in a view, response or log). For a dynamically registered client, a changed client name — or a new GUI origin — re-registers and drops the old client's tokens; a manually configured Client ID is unaffected.
Client application type follows MCP SEP-837: HTTP loopback callbacks (localhost, IPv4 loopback, or [::1]) register as native; other callbacks register as web. This avoids OIDC providers defaulting a local GUI to web and rejecting its redirect. Registration failures show the provider's OAuth error code when available; the Logs panel retains the detailed reason. Providers may still restrict which clients or redirects they accept.
Callback origin accepts direct loopback Host values (including [::1]:port). Configure publicOrigins for a reverse proxy: one configured origin is the default callback even without forwarded headers; with multiple origins, a complete X-Forwarded-Proto/X-Forwarded-Host pair must match the allowlist. A foreign direct Host is rejected when no default is configured. Malformed forwarded host values are rejected. Callback messages are HTML-escaped.
Discovery follows RFC 9728 → RFC 8414: the MCP endpoint's 401 WWW-Authenticate header names its protected-resource metadata, that document names the authorization server, and the authorization server's metadata is read from the RFC 8414 path-inserted URL (e.g. https://github.com/.well-known/oauth-authorization-server/login/oauth). Only when nothing is discoverable does it fall back to guessing ${origin}/oauth/*, and the attempt log says so.
RFC 8707 resource taken from the protected-resource document and sent on authorize, token exchange and refresh. A server that binds tokens to an audience (Kontrcheck's connector does) rejects every step without it as invalid_target. Providers that publish no resource keep the previous behaviour exactly: nothing is invented.
Manual client credentials for authorization servers that do not support dynamic registration (GitHub's does not): set Client ID to an app you registered with the provider, optionally a Client secret environment variable name (sent as client_secret; the secret itself is never persisted), and a Scopes string. When the provider only accepts pre-approved client_name values, set Client name rather than letting the default through.
Scope selection (MCP authorization spec): the authorize request carries scope from, in order, the Scopes field (or a hand-edited oauth.scope in `~/.dsh/mcp-manage