Preface

When using the Qichacha Legal Data MCP in DeepSeek Harness (DSH), you need to handle OAuth authorization, token refresh, local storage, disconnecting authorization, and mounting the MCP Server. duhu2000/qcc-mcp-legal-oauth is a DSH plugin designed to perform one-click OAuth authorization connection to the Qichacha Legal Data MCP in the DSH web profile, and provide a chat tool to complete connection, status query, and disconnection operations.

Plugin Positioning

duhu2000/qcc-mcp-legal-oauth is maintained by duhu2000 under the MIT license. The plugin package name is qcc-dsh-mcp-legal-oauth, used to connect to the Qichacha Legal Data MCP SERVER: legal-regulation (Regulations) and legal-case (Cases).

After one-time authorization, the plugin will use access_token / refresh_token to override the aforementioned legal data MCP SERVER. The plugin mounts dynamically based on the actual token authorization scope: mounting 2 SERVERs when Regulations + Cases are authorized, and mounting 1 when only Regulations are authorized.

Core Features

One-click OAuth Connection

The plugin uses the Authorization Code + PKCE(S256) flow and adopts dynamic client registration, not using client_secret. During the authorization process, the browser will automatically open and redirect to the Qichacha authorization page; upon completion, the authorization is finished via a loopback callback.

One-time Authorization and Automatic Refresh

A single access_token / refresh_token can be used for the Qichacha Legal Data MCP SERVER: legal-regulation and legal-case. access_token will automatically execute a refresh before expiration and perform token rotation; only when the refresh fails does re-authorization need to be performed.

Token Persistence and Security

Tokens are written to the DSH storage domain: ~/.dsh/storages, with directory permissions set to 0700. After restarting the Host, the plugin will automatically restore the connection.

Verified materials mention that tokens are only written to ~/.dsh/storages, not committed to git or included in chat history. The materials also suggest tightening permissions on the profile configuration file:

chmod 600 ~/.dsh/profiles/web/cordis.yml

Chat Tool Management

The plugin includes three built-in chat tools:

qcc_legal_oauth_connect
qcc_legal_oauth_status
qcc_legal_oauth_disconnect

Among them, qcc_legal_oauth_disconnect will invoke the OAuth revoke to revoke refresh_token and disable the corresponding MCP tools.

Coexistence with Corporate Data Plugins

This plugin manages the Qichacha Legal Data MCP SERVER: legal-regulation and legal-case. Corporate data SERVERs, such as company/risk/ipr/operation/history/executive, are managed by the independent plugin qcc-dsh-mcp-oauth; this plugin does not manage them redundantly. Both plugins can be installed simultaneously, with tool names, storage domains, and entry IDs being independent of each other.

Installation and Enablement

Prerequisites:

DeepSeek Harness (dsh CLI, web profile)
Node ≥ 20

Installation command:

dsh plugin --profile web add qcc-dsh-mcp-legal-oauth

This command installs the plugin under the web profile. After installation, dsh web must be restarted to take effect.

Since the plugin runs with the current dsh process permissions, you should check the source code, license, and dependency sources before installation. This plugin’s license is MIT.

Typical Usage

After restarting, the plugin will automatically initiate OAuth authorization by default. If not triggered automatically, you can input in the chat:

连接企查查法律数据

This triggers qcc_legal_oauth_connect, taking you to the Qichacha authorization page to complete login authorization.

Check Connection Status

Input in the chat:

查一下企查查法律数据连接状态

This triggers qcc_legal_oauth_status, displaying the authorization status, token expiration time, and the covered MCP Servers.

Disconnect

Input in the chat:

断开企查查法律数据

This triggers qcc_legal_oauth_disconnect, revoking refresh_token, clearing local authorization, and disabling the corresponding MCP tools.

After successful connection, you can use the following tools:

mcp__legal-regulation__*
regulation_search
regulation_detail
regulation_detail_article

And:

mcp__legal-case__*
case_search
case_detail

Applicable Scenarios and Notes

Suitable for scenarios where you want to stably use Qichacha regulations and case data in DSH and wish to unify OAuth authorization, token refresh, persistence, and disconnection operations to be handled by the plugin.

Notes:

  • The callback uses a local loopback address and is suitable for desktop clients; SaaS/Web callback addresses need to be confirmed as whitelisted with Qichacha in advance.
  • Third-party plugins cannot register DSH settings page cards due to apiproxy allowlist restrictions; the management entry is via chat tools.
  • Corporate data SERVERs are managed by qcc-dsh-mcp-oauth; this plugin does not manage them redundantly.
  • clientName defaults to DeepSeek Harness - QCC Legal MCP; if customization is needed, the DeepSeek Harness prefix should be kept; otherwise, the Qichacha backend might categorize it as other (unregistered).
  • The token storage location is ~/.dsh/storages; directory permissions are recommended to remain 0700, and the directory should be avoided from being added to version control.

Conclusion

duhu2000/qcc-mcp-legal-oauth integrates OAuth authorization, automatic refresh, local persistence, status query, and disconnection operations for the Qichacha Legal Data MCP into the DSH plugin workflow. Verified materials do not provide a directory page URL; the repository address is:

https://github.com/duhu2000/qcc-mcp-legal-oauth