Introduction

When integrating external MCP services into DeepSeek Harness (DSH), OAuth authorization, token maintenance, and MCP Server mounting are often scattered across different steps. duhu2000/qcc-mcp-oauth is a DSH plugin designed for one-click OAuth authorization to connect Qichacha (QCC) MCP services and manage connection states and disconnections within DSH.

What is this

duhu2000/qcc-mcp-oauth is a DeepSeek Harness plugin, licensed under the MIT license. It targets scenarios where the Qichacha MCP Enterprise Data Service needs to be invoked within DSH conversations, handling OAuth connection, token refresh, local persistence, and MCP Server mounting.

Core Features

  • One-click OAuth Connection: Uses Authorization Code + PKCE(S256), dynamically registers the client, automatically opens a browser to redirect to the Qichacha authorization page, and completes the loopback callback automatically.
  • One-time authorization covers multiple Qichacha MCP Enterprise Data SERVERs: company, risk, ipr, operation, history, executive. Note that history requires enterprise authentication before token authorization; there are 6 enterprise accounts and 5 personal accounts. The plugin mounts dynamically based on the actual token authorization scope.
  • Auto Refresh: Automatically refreshes access_token before expiration and rotates tokens; re-authorization is only required if refresh fails.
  • Persistence: Tokens are stored in the DSH storage domain ~/.dsh/storages with directory permissions 0700; the connection is automatically restored after restarting the Host.
  • Conversation Management: Built-in qcc_oauth_connect, qcc_oauth_status, qcc_oauth_disconnect.
  • Revoke Authorization: Calls OAuth revoke to revoke the refresh_token and disables the MCP tools.

Installation and Activation

Prerequisites:

  • DeepSeek Harness (dsh CLI, web profile)
  • Node ≥ 20

Verified installation command:

dsh plugin --profile web add qcc-dsh-mcp-oauth

After installation, dsh web must be restarted for it to take effect. Warnings about peer dependencies during installation can be ignored; @deepseek-ai/* and other peer dependencies are included in the DSH web profile.

Typical Usage

After restarting dsh web, operate in DSH conversations using the following commands:

  1. Say “Connect Qichacha” to trigger qcc_oauth_connect: Automatically opens a browser to redirect to the Qichacha authorization page, and completes the connection automatically after logging in and authorizing.

  2. Say “Check Qichacha connection status” to trigger qcc_oauth_status: Displays authorization status, token expiration time, and covered MCP Servers.

  3. Say “Disconnect Qichacha” to trigger qcc_oauth_disconnect: Revokes refresh_token, clears local authorization, and disables tools.

After successful connection, you can use the Qichacha MCP Enterprise Data tools in DSH. If history does not appear in the mounted scope, confirm whether the Qichacha account has completed enterprise authentication.

Use Cases and Notes

Suitable for scenarios where DSH is used on the desktop and requires connecting to the Qichacha Enterprise Data MCP Server. Usage notes:

  • The plugin runs with the permissions of the current dsh process; check the source code, dependencies, and MIT license before installing.
  • Tokens are only written to ~/.dsh/storages (0700), not committed to git, and not entered into conversation history.
  • Recommended to execute:
chmod 600 ~/.dsh/profiles/web/cordis.yml
  • Do not add ~/.dsh to any repository.
  • Bearer tokens are only sent to the precise resource URL within the authorized set.
  • Non-enterprise SERVERs (regulation, case, legal, tender, document) are not within the default management scope of this plugin.
  • Callbacks use a local loopback address, suitable for desktop environments; SaaS/Web callback addresses need to be confirmed with Qichacha for whitelisting in advance.
  • Third-party plugins cannot register cards on the DSH settings page; the management entry is the aforementioned conversation tools.

Conclusion

This plugin handles the OAuth connection, token maintenance, and MCP Server mounting for the Qichacha MCP service within the DSH plugin environment, suitable for users who need to connect, check status, and disconnect the Qichacha MCP service within DSH conversations. Verified sources do not provide a directory page URL; the repository address is https://github.com/duhu2000/qcc-mcp-oauth.