Introduction¶

The extension mechanism of DeepSeek Harness (DSH) is all actual plugins. For agent developers, MCP Servers often already provide tool calling capabilities, but if tool results are only text or structuredContent, there is a lack of directly manipulatable interfaces within DSH sessions.

@sugarforever/dsh-mcp-apps is a DSH plugin maintained by sugarforever, under the MIT license, positioned as the MCP Apps host plugin for DeepSeek Harness. It renders MCP tools with UI resources as sandboxed interactive Apps within DSH sessions, while registering model-visible tools to ctx.tools, keeping these tools visible to the model.

The DSH community plugin directory is a separate site and is not equivalent to the DeepSeek or Hexagon official app store. Below is an introduction to its positioning, core capabilities, installation methods, configuration examples, and usage boundaries.

Positioning¶

This plugin enables DeepSeek Harness to act as an MCP Apps host:

The Host side connects to an MCP Server, registers its model-visible tools to ctx.tools, and possesses the MCP network or stdio traffic.
The Web Client side renders tools carrying _meta.ui.resourceUri as sandboxed interactive Apps in the Harness session.
Regular MCP tools remain regular Harness tools; the MCP Server does not need to provide a UI for every tool.

Core Capabilities¶

Verified capabilities include:

Supports MCP Apps extension negotiation: io.modelcontextprotocol/ui
Supports text/html;profile=mcp-app UI resources
Supports modern _meta.ui.resourceUri and legacy _meta["ui/resourceUri"]
Supports stdio and Streamable HTTP MCP transports
Supports model-visible, app-visible, and app-only tools
Passes the raw CallToolResult to the View, including structuredContent
Supports View-to-Server tools/call, resources/list, resources/read
Supports resource CSP metadata and iframe Permission Policy requests
Provides Cordis lifecycle disposal: tools, connections, RPC routes, Slots, and App bridges

Environment Requirements¶

DeepSeek Harness requires Node.js version ^22.19.0 or >=24.0.0. The DSH profile plugin manager invokes pnpm, and the README suggests installing the version used by the current DSH release:

npm install --global pnpm@11.7.0

Start the DSH Web profile first:

npx @deepseek-ai/dsh web

The default Web UI address is:

http://127.0.0.1:3080

The first run initializes the web profile in the following locations:

~/.dsh/profiles/web
$DSH_HOME/profiles/web

Installing the Plugin¶

Install the published package to the DSH Web profile:

npx @deepseek-ai/dsh plugin --profile web add @sugarforever/dsh-mcp-apps

When installing this package, DSH applies the cordis.patch.yml it carries. By default, it mounts the VibeFun MCP Apps server:

https://vibefun.app/api/mcp

If you are doing local development, you can install the local checkout:

npx @deepseek-ai/dsh plugin --profile web add /absolute/path/to/dsh-mcp-apps

If you have downloaded a tarball from a GitHub Release, you can also install the local tarball:

npx @deepseek-ai/dsh plugin --profile web add ./sugarforever-dsh-mcp-apps-0.1.2.tgz

Default Configuration¶

After installation, the default profile patch will contain an instance configuration similar to this:

- insert:
    - id: mcp-apps-vibefun
      name: '@sugarforever/dsh-mcp-apps'
      config:
        serverName: vibefun
        transport: streamable-http
        url: https://vibefun.app/api/mcp
        failOnStartupError: true

If you want to connect to a different MCP Server, you need to edit the installed profile patch:

~/.dsh/profiles/web/cordis.patch.yml

Replace the instance configuration within it, then start or restart DSH.

Starting¶

After installation, start the Web profile:

npx @deepseek-ai/dsh web

Then open in a browser:

http://127.0.0.1:3080

Configuring a stdio Server¶

If you want to configure a stdio MCP Server, you can first create mcp-apps.cordis.yml:

- insert:
    - id: mcp-apps-vibefun
      name: '@sugarforever/dsh-mcp-apps'
      config:
        serverName: vibefun
        transport: stdio
        command: node
        args: ['/absolute/path/to/your-mcp-server.js']
        env:
          VIBEFUN_API_KEY: !!js process.env.VIBEFUN_API_KEY
        failOnStartupError: true

Then start the DSH Web profile using the patch file:

dsh web --patch "$PWD/mcp-apps.cordis.yml"

This configuration hands local commands, arguments, and environment variables to the DSH process for handling, rather than handing them to the browser.

Configuring a Streamable HTTP Server¶

If you want to configure a Streamable HTTP MCP Server, you can set url, headers, and failOnStartupError in the profile patch:

- insert:
    - id: mcp-apps-vibefun
      name: '@sugarforever/dsh-mcp-apps'
      config:
        serverName: vibefun
        transport: streamable-http
        url: http://127.0.0.1:3000/mcp
        headers:
          Authorization: !!js '`Bearer ${process.env.VIBEFUN_MCP_TOKEN}`'
        failOnStartupError: true

After configuration, run:

npx @deepseek-ai/dsh web

Security Boundaries and Limitations¶

When using this plugin, pay attention to the following points:

The plugin runs in the DSH process environment and inherits the permissions and accessible environment of the current DSH process. You should check the source code, dependencies, and license before installation.
The browser does not receive the URL, command, headers, environment, or credentials. The RPC channel inside the package is loopback-only.
One plugin instance connects to one MCP Server. Multiple MCP Servers require mounting multiple instances.
UI tool discovery occurs during Client plugin activation. If the Server changes the UI tool list later, a Client refresh or plugin reload is required.
Currently, prompts, sampling, downloads, external-link opening, and model-context updates are not exposed to Apps.
App HTML is loaded via srcdoc. Apps should provide self-contained HTML or declare all remote origins in the resource CSP metadata.
Currently, iframe paths are directed at the Web client. Headless and ACP entry points will still receive these tools, but there is no embedded App surface.

Conclusion¶

The value of @sugarforever/dsh-mcp-apps lies in integrating MCP Apps UI resources into the DeepSeek Harness Web session: the model continues to see tools through ctx.tools, and the browser side can view interactive Apps with UI, while MCP network or stdio traffic is managed by the DSH Host side.

It is suitable for DSH developers who need to display MCP Server tools to users in the form of interactive interfaces. Project repository:

https://github.com/sugarforever/dsh-mcp-apps

If browsing through the DSH community plugin directory, you can search by repository name sugarforever/dsh-mcp-apps.

`sugarforever/dsh-mcp-apps`: DeepSeek Harness MCP Apps Host Plugin