MCP server for DeepSeek AI with chat, reasoning, sessions, function calling, and cost tracking
MCPpedia last refreshed this data
io.github.arikusi/deepseek is an MCP server that MCP server for DeepSeek AI with chat, reasoning, sessions, function calling, and cost tracking. Its tool list has not been published yet over stdio, sse and http, requires no API key, and scores 86/100 on MCPpedia's security, maintenance and efficiency rubric.
Config is the same across clients - only the file and path differ.
{
"mcpServers": {
"deepseek": {
"url": "https://deepseek-mcp.tahirl.com/mcp",
"headers": {
"Authorization": "Bearer ${DEEPSEEK_API_KEY}"
}
}
}
}Are you the author?
Add this badge to your README to show your security score and help users find safe servers.
MCP server for DeepSeek AI with chat, reasoning, sessions, function calling, and cost tracking
Run this in your terminal to verify the server starts. Then let us know if it worked - your result helps other developers.
npx -y '@arikusi/deepseek-mcp-server' 2>&1 | head -1 && echo "✓ Server started successfully"
After testing, let us know if it worked:
Five weighted categories - click any category to see the underlying evidence.
@arikusi/deepseek-mcp-server: Missing Authentication on Self-Hosted HTTP MCP Endpoint
## Summary The self-hosted HTTP transport of `@arikusi/deepseek-mcp-server` exposes `POST /mcp` without any authentication: `createMcpExpressApp` is called without an `authProvider` and no middleware guards the route, so any network-reachable client can issue an unauthenticated `initialize` request and obtain a valid MCP session identifier. In reproduced testing against commit `5e1302171e99`, an unauthenticated client was able to initialize a session, enumerate tools, and invoke the local `deeps
@arikusi/deepseek-mcp-server has an Authorization Bypass Through User-Controlled Key
# Cross-Session Data Exposure via Caller-Controlled `session_id` Project / Repository: `arikusi/deepseek-mcp-server` Affected version / commit tested: `1.6.0` / `04f28be2c6e99d3d4e443a6ae37cc35f0a71554a` Vulnerability type: Authorization bypass / cross-session data exposure Authentication required: No ## Summary The process-global `SessionStore` accepts caller-supplied `session_id` values without binding them to any authenticated principal or transport session. An attacker can enumerate a
Click any tool to inspect its schema.
deepseek://modelsQuery model information
deepseek://models
deepseek://configQuery configuration settings
deepseek://config
deepseek://usageQuery usage statistics and cost tracking
deepseek://usage
explain_quantum_computingUse DeepSeek to explain quantum computing
solve_math_problemAsk DeepSeek Reasoner to solve mathematical problems
Be the first to review
Have you used this server?
Share your experience - it helps other developers decide.
Sign in to write a review.
Others in ai-ml
Let any LLM watch a video locally — and search everything it has ever watched.
The official MCP server implementation for the Perplexity API Platform
2,700+ scientific tools for AI scientists: life science, research, literature, and more.
MCP server for mobile app automation: verify, control, and debug iOS, Android, TV, and desktop apps
MCP Security Weekly
Get CVE alerts and security updates for io.github.arikusi/deepseek and similar servers.
Start a conversation
Ask a question, share a tip, or report an issue.
Sign in to join the discussion.