Preface¶

Developing agents within DeepSeek Harness (DSH) often requires capabilities scattered across several categories: enabling agents to open web pages and manipulate forms, exposing local sessions to external MCP clients, automatically reviewing PRs/MRs on GitHub or GitLab, and having a centralized place to monitor module statuses. These capabilities typically necessitate finding separate plugins or writing custom integration scripts, with configuration settings dispersed across different locations.

dsh-reef (maintained by huey1in) packages these capabilities into a DSH plugin bundle. A single installation provides five modules sharing a unified configuration and panel. The current version of the plugin is 1.5.2, with approximately 16 stars on GitHub (MIT License). Below, we introduce its purpose, what each module does, as well as installation and typical usage.

What is This¶

dsh-reef is an “all-in-one” workflow plugin for DSH. Its design principle is: one-off operations that an agent can complete via bash (e.g., GitHub write operations using the gh CLI) are not re-implemented within the plugin; the plugin only handles continuous automation and integration tasks that bash cannot perform.

A single installation includes five modules:

The only third-party runtime dependency is playwright-core, which reuses the system-installed Edge/Chrome without requiring additional Chromium downloads; it does not depend on any @deepseek-ai runtime packages. Requires Node.js >= 22.

Core Features¶

Native Embedded Panel¶

After installation, the panel automatically injects into the DSH interface (based on official --dsw-alias-* design variables, adapting to light/dark themes). A floating button in the bottom-right corner opens the panel, which includes:

• Status Line: Browser toggle/tab count/current URL, MCP online status, GitHub webhook status and event count
• Real-Time View: Displays a thumbnail when the browser is open, clickable to enlarge; updates via 2-second polling; lists the 50 most recent visit histories below (isolated by profile)
• GitHub Event Dashboard: Shows the 3 most recent webhook events (time, event type, repository, number, processing result)
• Settings Area: Configurations for all five modules can be modified within the panel

Browser Automation¶

Provides agents with a shared browser session, defaulting to headless mode. channel: auto sequentially probes for msedge → chrome → chromium, or you can specify an executable via executablePath.

Commonly used tools include:

• Navigation & Page Reading: browser_open, browser_snapshot (text/links/input fields), browser_elements (interactive elements + CSS selectors)
• Interaction: browser_click, browser_type, browser_press, browser_eval
• Tabs & Sessions: browser_tabs, browser_profile (multiple profiles, persistent login state)
• Files & Forms: browser_download, browser_upload, browser_form / browser_form_save / browser_forms
• Others: browser_screenshot, browser_cookies, browser_wait, browser_back, browser_reload

browser_screenshot automatically cleans up saved PNGs: immediate cleanup after each screenshot, plus scheduled hourly cleanup; by default, retains the last 7 days and up to 200 images (adjustable via screenshotMaxAgeDays / screenshotMaxCount; set to 0 to disable the respective rule).

The browser starts automatically on the first call to a browser tool; startup failure prompts to install Chromium (npx playwright install chromium) or configure executablePath.

MCP Server¶

Turns DSH into an MCP server, accessible by any MCP client supporting Streamable HTTP:

{
  "mcpServers": {
    "dsh": { "url": "http://127.0.0.1:3080/reef/mcp" }
  }
}

Provides 5 tools: dsh_list_sessions, dsh_read_session, dsh_search_sessions, dsh_run_agent (runs a one-off agent with the default model, with streaming output for long tasks), and dsh_agents_status.

Authentication supports three methods (can coexist): configuring a static Bearer token within the panel, referencing an environment variable via authTokenEnv, or enabling OAuth 2.0 client_credentials (token endpoint /reef/mcp/oauth/token, discovery endpoint /.well-known/oauth-authorization-server).

GitHub Integration¶

Read-only tools (public repositories do not require a token; anonymous rate limit is 60 requests/hour; after configuring GITHUB_TOKEN, private repositories can be accessed without this limit):

For write operations, it is recommended that agents use the gh CLI or curl with GITHUB_TOKEN.

Webhook for Automatic PR Review: Add http://<machine>:3080/reef/github/webhook in the repository Settings → Webhooks, set Content type to application/json, set Secret to match GITHUB_WEBHOOK_SECRET, and select Pull requests for events. When a PR is opened/updated, it automatically fetches the diff, invokes the review model, and submits a review as a COMMENT. The same PR with the same head commit is reviewed only once by default (reviewDedupe).

Issue Auto-Fix Loop: After configuring autoFixRepos (repository → local path mapping), new issues can automatically trigger agents to fix locally, create a branch, run tests, push, and open a PR. autoFixLabels can restrict processing to issues with specific labels.

GitLab Integration¶

Read-only tools (requires GITLAB_TOKEN): gitlab_project, gitlab_issues, gitlab_mr_list. For write operations, use glab CLI or curl with GITLAB_TOKEN.

Webhook for Automatic MR Review: Add http://<machine>:3080/reef/gitlab/webhook in the repository Settings → Webhooks, set Secret Token to match GITLAB_WEBHOOK_SECRET, and select Merge Request for events. For self-hosted GitLab instances, the API base can be modified via apiBase.

Installation and Enabling¶

Execute under the DSH web profile:

dsh plugin --profile web add dsh-reef

Restart DSH to take effect.

If a module is not needed, you can remove the corresponding line (reef-browser / reef-mcp / reef-github / reef-gitlab / reef-console) from $DSH_HOME/profiles/web/cordis.patch.yml, or add config: { enabled: false } to that line.

Configuration is layered in three levels: plugin built-in defaults (cordis.patch.yml) → panel settings area (runtime, immediate effect) → user profile’s cordis.patch.yml (override at startup). Credential-type configurations are preferably written to $DSH_HOME/.credentials.yaml; general configurations are written to $DSH_HOME/.dsh-reef/settings.json. Path-type configurations (e.g., liveViewPath, webhookPath, MCP path) require restarting DSH after changes.

Typical Usage¶

Let the Agent Read and Manipulate Web Pages¶

The agent can first call browser_open to open the target URL, then use browser_snapshot to get page text and links, use browser_elements to obtain selectors for interactive elements, and finally use browser_click or browser_type to complete operations. To preserve login state, configure userDataDir or use browser_profile to separate work/personal sessions.

Expose DSH Sessions to External MCP Clients¶

In the MCP client configuration, enter http://127.0.0.1:3080/reef/mcp and set a Bearer token or OAuth as needed. External tools can then list local sessions via dsh_list_sessions and trigger one-off agent tasks with dsh_run_agent.

Configure GitHub PR Automatic Review¶

1. Set GITHUB_TOKEN and GITHUB_WEBHOOK_SECRET in the panel or environment variables.
2. Add a webhook in the target repository, with the URL pointing to http://<your-machine>:3080/reef/github/webhook.
3. After a PR is opened or updated, the plugin automatically reviews and leaves a COMMENT under the PR; recent events can be viewed in the GitHub row of the panel.

Configure Issue Auto-Fix¶

Configure autoFixRepos in cordis.patch.yml or the panel settings area, for example:

autoFixRepos:
  "owner/repo": "/path/to/local/repo"

When triggered by a new issue, the agent will create a fix/issue-N branch in the local repository, fix the issue, run tests, push, and automatically open a PR.

Use Cases and Considerations¶

Who is this for:

• Those who need to stably use browser automation within DSH agents and want multi-tab, multi-profile, and form replay capabilities in one go.
• Those who want to connect DSH sessions inversely to MCP clients like Claude Desktop, Cursor, etc.
• Those on GitHub/GitLab seeking automation for PR/MR reviews or issue-triggered local fix loops.
• Those who prefer viewing browser views, MCP status, and webhook events in a single panel.

Considerations:

• The plugin runs with the current DSH process permissions. Before installation, review the source code and MIT License to ensure credentials and webhook exposure scope meet your security requirements.
• Webhook endpoints must be accessible from your GitHub/GitLab instance to the machine running DSH (note NAT/firewall considerations for internal deployments).
• The browser module relies on locally installed Edge/Chrome or Playwright Chromium; GitHub anonymous API has rate limits, and private repositories require a token configuration.
• The community directory SkillHub is an independent site, with no official affiliation to DeepSeek or High-Flyer.

Conclusion¶

dsh-reef consolidates browser automation, MCP inverse exposure, GitHub/GitLab integration, and a native panel into a single installation, reducing the cost of switching between multiple plugins for configuration. If your workflow involves web operations, external MCP access, and code hosting event automation, you can try it using the installation command above.

• Community directory page: https://www.skillhub.cn/plugins/huey1in/reef
• GitHub repository: https://github.com/huey1in/reef