Introduction

DeepSeek Harness (DSH) integrates external tools, skills, and MCP capabilities through a plugin mechanism. For developers who need to build, test, experiment, or run long-running services within DSH, executing directly in the host environment can lead to issues such as dependency pollution, chaotic file states, and uncontrollable service processes.

The superfly/sprites-deepseek-plugin integrates Sprites into DSH, enabling builds, tests, experiments, and long-running services to occur within an isolated and persistent Linux environment.

What is This

The superfly/sprites-deepseek-plugin is a DSH plugin designed to access Sprites from DSH. It provides isolated, persistent Linux environments suitable for building, testing, experimenting, and running long services.

This plugin exposes Sprites MCP tools as mcp__sprites__* tools and mounts a Sprites skill discoverable through the Harness skill system. The repository is licensed under MIT.

Core Features

  • Provides isolated, persistent Linux environments for building, testing, experimenting, and running long services.
  • Creates and lists sprites within DSH.
  • Creates checkpoints within a sprite.
  • Runs test suites within a sprite.
  • Starts a web service in a sprite and obtains its service URL.
  • Invokes Sprites MCP capabilities via mcp__sprites__* tools.
  • Completes browser-based OAuth 2.1 authorization via mcp-remote.
  • Supports restricted connector token access and also offers an optional full access policy.

Prerequisites

Before installation, ensure the following conditions are met:

  1. Node.js version 20.19 or higher. The engines declaration in package.json is set to >=20.19.0.
  2. DeepSeek Harness developer preview.
  3. Browser access is required for the initial Sprites OAuth authorization.
  4. npx requires network access to run the pinned version of mcp-remote@0.1.38 OAuth bridge.

The Harness Streamable HTTP MCP transport accepts static headers but does not perform MCP OAuth. Therefore, this plugin uses stdio transport and completes the browser-based OAuth flow via mcp-remote.

Installation and Enabling

First, install to the web profile:

npx @deepseek-ai/dsh plugin --profile web add github:superfly/sprites-deokseek-plugin

Then start the profile:

npx @deepseek-ai/dsh --profile web

On the initial connection, you will enter the Sprites browser-based OAuth 2.1 authorization flow. After completing authorization, Sprites capabilities will appear in DSH as mcp__sprites__* tools, and the packaged Sprites skill can be used through the Harness skill system.

Typical Usage

Below are prompt examples that can be used directly in DSH:

  • List my sprites.
  • Create a sprite for an experiment and run uname -a in it.
  • Create a checkpoint, then run the test suite in a sprite.
  • Start a web service in a sprite and request its URL.

These use cases cover common operations: viewing existing sprites, creating experimental environments, creating a checkpoint before running tests, starting a web service, and obtaining the access URL.

Authentication and Permissions

The Sprites hosted endpoint is:

https://sprites.dev/mcp

This endpoint uses OAuth 2.1. The repository does not contain credentials; the OAuth flow is handled by mcp-remote.

Sprites consent typically creates a restricted connector token. This token often has an mcp- prefix and may limit the number of sprites the connector can create. Selecting full access removes prefix restrictions but grants access to all sprites within the organization.

When providing access to an agent, prioritize restricted access. Only consider full access when there is a clear need to access more sprites within the organization.

MCP attribution headers are advisory analytics only and are not used for authorization or rate limiting; modifying these headers will invalidate cached OAuth authorizations.

Usage Notes

  1. Treat services exposed via sprite URLs as potentially internet-reachable. Do not publish secrets, environment dumps, arbitrary files, debug endpoints, or unfiltered logs within them.
  2. Create checkpoints before making high-risk file changes, dependency upgrades, or migrations.
  3. Destroying a sprite is an irreversible operation. It should only be executed when the user explicitly requests deletion, destruction, or removal, or explicitly approves cleanup.
  4. Check the current network policy before modifying the outbound network policy.
  5. This plugin runs under the current DSH process permissions. Before installation, review the source code, dependencies, and licenses.

Conclusion

This plugin integrates Sprites’ isolated Linux environment into DSH, enabling agents to create environments, save checkpoints, run tests, start services, and obtain URLs, while confining builds, tests, and long-running services within clearer environmental boundaries.

The current documentation does not provide a catalog page URL. The repository address is as follows:

https://github.com/superfly/sprites-deokseek-plugin