Introduction

If an existing Editor wishes to enter the DeepSeek Harness Agent Chat—allowing the model side to invoke tools and the user side to continue interacting with the interface—rather than requiring each Editor to maintain a separate connection method, a unified Editor runtime is required.

DSH Uni Editor is maintained by creativedswork and is MIT licensed. It utilizes MCP Apps to provide a unified Editor runtime, integrating existing Editors into the DeepSeek Harness Agent Chat.

What is This

DSH Uni Editor is a Cordis plugin package. It is an npm package providing three types of content:

  • Host plugin
  • Browser bundle
  • dsh.bundle patch to activate both

Its positioning is a unified Editor runtime: All Editors, one DSH Editor. Unified Editor runtime for DeepSeek Harness, powered by MCP Apps.

The Host is responsible for its own MCP connection, exposes tools visible to the model via Harness, keeps app-only tools out of the model registry, and provides untrusted Views via a different-origin Sandbox Proxy. This solution does not require modifying the agent loop, nor does it require an external MCP proxy.

Core Features

Editor Integration & Tool Boundaries

DSH Uni Editor supports the following MCP capabilities:

  • Targets MCP Apps specification 2026-01-26
  • Advertises text/html;profile=mcp-app
  • Supports stdio and Streamable HTTP MCP transports
  • Applies _meta.ui.visibility; when visibility is not specified, it defaults to model and app

Tool visibility is divided into two categories:

  • model-visible tools: exposed to the model via Harness
  • app-only tools: only for the corresponding View to use, not entering the model-visible tool registry

For result presentation, it reserves readable text for the model, while keeping structuredContent and result _meta within bounded UI-only presentation metadata.

Prompt Injection & Workspace Metadata

DSH Uni Editor only injects explicitly allowlisted MCP Prompts, accompanied by source provenance, into the Harness system prompt.

prompts.autoInject is an explicit trust allowlist. Do not add prompts from untrusted Servers, as this content will acquire system-prompt authority.

For trusted local stdio Servers, if forwardWorkspace: true is configured, DSH Uni Editor will add the calling Agent’s immutable workspace cwd to the model-originated tools/call request metadata, located at:

ai.deepseek.dsh/workspace

This workspace metadata will not be added to the following locations:

  • remote HTTP calls
  • app-originated calls
  • model-visible tool arguments
  • results

View & Interaction

DSH Uni Editor uses the official AppBridge and PostMessageTransport to handle the View lifecycle, and app-originated tool/resource calls.

It provides the following interaction capabilities:

  • Retains Session-scoped Active App entry in the Header, and supports multiple MCP App instances
  • When opening the active App fullscreen, it does not recreate the iframe or AppBridge, preserving unsaved View state
  • Returns the original tool message via Locate in Chat
  • Mediates ui/download-file for Sandbox Views, supporting single embedded JSON resources, with a limit of 4 MiB
  • Falls back to a plain text tool result when the View fails to load

Security Boundaries

DSH Uni Editor’s Views run in an isolated environment:

  • Views are located in a double iframe
  • Uses HTTP CSP and explicit sandbox attributes
  • Before accepting bridge traffic, it verifies postMessage source and origin
  • Host APIs reject cross-origin writes
  • Host APIs impose limited boundaries on body and metadata

The web profile must be bound to:

127.0.0.1

The plugin will reject wider bindings, as the Sandbox Proxy currently only supports loopback browsers.

Installation & Enablement

Below is an introduction to how to install and enable DSH Uni Editor.

Install Official Package

First, install it to the Web profile:

dsh plugin --profile web add @creative-dswork/dsh-uni-editor

After installation, the bundle is activated. Next, you need to configure its mcp-apps line, with the configuration path being:

$DSH_HOME/profiles/web/cordis.patch.yml

Key configuration items include:

  • serverName: Must match [A-Za-z0-9_-]{1,32} and become part of the public tool name
  • transport: Supports stdio and Streamable HTTP
  • forwardWorkspace: Disabled by default, only recommended for trusted local stdio Servers
  • prompts.autoInject: Explicit trust allowlist, do not include prompts from untrusted Servers

For stdio Servers, you can configure local Server parameters such as command, args, cwd, env, forwardWorkspace, etc.

For transport: streamable-http, it does not receive Workspace metadata; it accepts url and optional headers, instead of command, args, cwd, env.

Start Harness

Once configured, start Harness:

dsh web

Note that the Web profile must be bound to 127.0.0.1.

Typical Usage

Local checkout Installation

If you are doing local development in the current repository, you can install the local checkout to the profile:

dsh plugin --profile web add .

Standalone Counter Demo

The repository provides a Standalone Counter Demo. The following commands come from the README, used to run the Demo from the current checkout:

pnpm install
pnpm run build
export DSH_HOME="$PWD/.tmp/demo-home"
pnpm dlx @deepseek-ai/dsh@0.1.0-rc.6 plugin --profile web add "$PWD"
pnpm dlx @deepseek-ai/dsh@0.1.0-rc.6 web --patch "$PWD/demo/cordis.patch.yml"

This Demo demonstrates the combination of Editor and Agent Chat: model-visible tools trigger Views, and app-only tools only serve that View.

Applicable Scenarios & Notes

Suitable for the following scenarios:

  • Existing Editors or MCP Apps wishing to integrate into DeepSeek Harness Agent Chat
  • Need to distinguish between model-visible tools and app-only tools
  • Need to inject allowlisted MCP Prompts into the Harness system prompt
  • Need Sandbox Proxy, CSP, and postMessage origin verification
  • Need Session Header, fullscreen View, Locate in Chat, etc. interactions
  • Need local stdio Servers or Streamable HTTP MCP Servers

Things to note before use:

  • The plugin runs with the current dsh process permissions; check source code and license before installing
  • Web profile must be bound to 127.0.0.1; wider bindings will be rejected
  • forwardWorkspace is disabled by default and should only be enabled for trusted local stdio Servers
  • transport: streamable-http does not receive Workspace metadata
  • serverName must match [A-Za-z0-9_-]{1,32}
  • prompts.autoInject is an explicit trust list; do not include prompts from untrusted Servers
  • Tool-list changes are synchronized, but automatic transport reconnection is not yet implemented
  • Browser refreshes catalog every 5 seconds
  • Development environment requires packageManager to be pnpm@11.7.0, and node version to be ^22.19.0 || >=24.0.0
  • Publishing requires NPM_TOKEN, and the token must have @creative-dswork scope permissions

Links