Preface

DSH extends its capabilities through a plugin architecture; the plugin directory page belongs to an independent community site and has no official affiliation with DeepSeek or High-Flyer.

When integrating external MCP services requiring authentication into DSH, several common issues arise: OAuth 2.1 authorization, dynamic client registration, browser callbacks, token storage, reconnection after disconnection, as well as MCP tool discovery, registration, and execution. The dsh-oauth-mcp-client plugin is provided to address these challenges and includes built-in configuration for connecting to the Springbrand production MCP Gateway.

What This Is

The @dsh-external/dsh-oauth-mcp-client maintained by springbrand-lab has a version of 0.1.0 in its package.json and is licensed under MIT.

It is a clearly positioned DSH client plugin: OAuth 2.1 Streamable HTTP MCP client plugin for DeepSeek Harness.

Verified key details include:

  • OAuth state is stored via the DSH credential service and is not stored in this repository.
  • Built-in configuration connects to the Springbrand production MCP Gateway, with the default serverName set to springbrand and the URL as https://connector.springbrand.ai/mcp.
  • src/connection.ts and src/tools.ts are adapted from DeepSeek Harness’s @deepseek-ai/dsh-mcp-client, which is licensed under MIT.

Core Features

The following capabilities are based on verified information:

  • OAuth 2.1 authorization code flow with PKCE
  • Dynamic OAuth client registration
  • Browser login with a loopback callback
  • Token and client metadata storage through the DSH credential service
  • Streamable HTTP transport with automatic reconnects
  • MCP tool discovery, registration, and execution
  • DSH Web connection management with live status and capability discovery
  • One-click persistent connection setup followed by browser OAuth

After adding the plugin bundle to the DSH profile, it simultaneously adds the built-in Springbrand MCP connection; there is no need to execute separate MCP registration steps.

Installation and Setup

First, prepare the runtime environment:

  • Node.js 22.19 or later
  • Git
  • A browser for the first OAuth login

This repository is not published to npm; the current installation uses a local checkout.

Step 1: Clone the repository and perform a local build:

git clone https://github.com/springbrand-lab/dsh-oauth-mcp-client.git
cd dsh-oauth-mcp-client
corepack enable
pnpm install
pnpm build

Step 2: Install the local plugin into DSH’s web profile and start DSH Web:

PLUGIN_DIR="$PWD"
npx --yes @deepseek-ai/dsh@latest plugin --profile web add "$PLUGIN_DIR"
npx --yes @deepseek-ai/dsh@latest web

On the first startup, the browser will open to complete the Springbrand login and OAuth authorization. After authorization, open Settings → Plugins → MCP Connections to see the connection status and registered capabilities.

Typical Usage

Below is a request that can be used directly with an agent:

Search the Springbrand marketplace for resources and list the first 10.

You can also verify the connection status using built-in tools:

mcp__springbrand__search_capabilities
mcp__springbrand__execute_capability

When calling mcp__springbrand__execute_capability, use the full name returned by mcp__springbrand__search_capabilities, for example:

platform:springbrand@0:springbrand.resources.list

Do not replace it with a shorter action_id, such as:

springbrand.resources.list

Connections can also be managed in DSH Web: open Settings → Plugins → MCP Connections, enter the unique server name and the server’s HTTPS MCP URL, then select Add and sign in, and complete the OAuth flow in the opened browser.

This operation writes the connection to a persistent configuration:

~/.dsh/profiles/web/cordis.patch.yml

The connection persists after restarting DSH; there are no temporary --patch commands involved.

Built-in Default Configuration

The verified built-in defaults include:

  • serverName: springbrand
  • url: https://connector.springbrand.ai/mcp
  • credentialRef: SPRINGBRAND_MCP_OAUTH_PRODUCTION
  • callbackPort: 0
  • authorizationTimeoutMs: 300000
  • toolCallTimeoutMs: 60000
  • failOnStartupError: true
  • reconnect: enabled

Here, callbackPort set to 0 indicates that a free port is selected; the callback listener binds to the local loopback interface.

Use Cases and Considerations

This plugin is suitable for scenarios where DSH needs to connect to external Streamable HTTP MCP services via OAuth 2.1 or needs to access the Springbrand production MCP Gateway.

When installing and using it, note the following:

  • The plugin runs with the current dsh process permissions; it is recommended to review the source code, dependencies, and licenses before installation.
  • OAuth state is stored via the DSH credential service and is not stored in this repository.
  • Do not manually configure the Authorization header; the OAuth client handles it.
  • Do not commit access tokens, refresh tokens, or exported credential data.
  • The license is MIT; src/connection.ts and src/tools.ts are adapted from @deepseek-ai/dsh-mcp-client under the MIT License.

Links