Introduction

When calling external interfaces in DSH, two things are usually needed: first, encapsulate HTTP(S) requests into callable tools; second, avoid writing API keys, tokens, and other secrets directly into prompts or configuration files. http-request-dsh-plugin is a native DSH plugin provided for this scenario: it provides the http_request tool, credential whitelist Settings, and corresponding usage skills.

Unlike exposing tools through an MCP Server, this plugin is a pure DSH Plugin that does not use MCP, does not start an MCP Server, and does not communicate via MCP stdio. Below is an introduction to its positioning, installation methods, typical usage, and precautions.

Overview

http-request-dsh-plugin is a native DeepSeek Harness (DSH) plugin, the repository maintainer is gao-gao-zai, and the license is MIT.

It solves a specific problem: providing an http_request tool within DSH to initiate HTTP(S) requests; while configuring a credential reference whitelist via DSH Settings and registering the http-request-tool skill to introduce the tool and whitelist configuration. The tool directly uses undici to initiate requests without depending on extra MCP processes.

Core Features

The plugin supports the following capabilities:

  • Supports GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS
  • Supports request headers, query, JSON or text body
  • Supports direct connection, system proxy, and manual HTTP(S) proxy
  • Supports timeout, response truncation, response header display, and full response saving
  • Supports credential reference: Windows uses Credential Manager, Linux uses pass
  • Supports configuring Credential Manager whitelist via DSH Settings
  • Registers the http-request-tool skill to automatically introduce the tool and whitelist configuration
  • All tool results are returned as plain text JSON strings

The tool name is fixed as http_request. Its canonical output type is fixed as string and is rendered as a text block by Native render. Success, HTTP non-2xx, timeout, and exceptions will all return valid JSON text.

Installation and Activation

Method 1: One-click Installation via DSH CLI

Execute the following command first to let DSH automatically modify the target Profile, install dependencies, and register the bundle:

dsh plugin --profile web add github:gao-gao-zai/http-request-dsh-plugin

This command does not require cloning the repository first. Here, github:gao-gao-zai/http-request-dsh-plugin is the GitHub shorthand supported by pnpm, and DSH will hand it over to pnpm to download and install directly.

Wherein:

  • web is the target Profile name; if using another Profile, please replace it
  • github:gao-gao-zai/http-request-dsh-plugin is the GitHub installation identifier for this repository
  • No need to manually execute git clone
  • No need to manually edit the Profile configuration file

After installation, refresh the WebUI; if DSH prompts for a restart, restart DSH to make the new bundle take effect.

Method 2: Local Installation after Cloning the Repository

If you wish to retain the source code, view it offline, or modify it yourself, you can first clone the repository and then let DSH install from a local directory:

$PLUGIN_DIR = Join-Path (Get-Location) "http-request-dsh-plugin"
git clone https://github.com/gao-gao-zai/http-request-dsh-plugin.git $PLUGIN_DIR
pnpm --dir $PLUGIN_DIR install
pnpm --dir $PLUGIN_DIR run check
dsh plugin --profile web add $PLUGIN_DIR

$PLUGIN_DIR can be any local directory. DSH will install this directory as a local dependency into the web Profile and automatically register the bundle without the need to manually edit the Profile configuration file.

If you modify the source code later, re-execute:

pnpm --dir $PLUGIN_DIR run check
dsh plugin --profile web add $PLUGIN_DIR

This method is suitable for local development and debugging; ordinary installation can directly use the GitHub CLI method mentioned above.

Verification After Installation

After restarting or refreshing DSH, check in order:

  1. http_request appears in the tools directory
  2. credentialPrefixes appears in Settings > Plugins > http-request-mcp
  3. http-request-tool appears in the Skills directory
  4. The result of calling the tool is plain text JSON, not an object or MCP content block

This plugin is a pure DSH Plugin and does not require registering an MCP Server or starting an MCP process.

Typical Usage

Request Parameters

The basic parameters for the http_request tool are as follows:

{
  "method": "GET",
  "url": "https://api.example.com/status",
  "headers": {},
  "query": {},
  "body": null,
  "proxy": "none",
  "timeoutMs": 30000,
  "showHeaders": false,
  "maxChars": 10000,
  "outputFile": ""
}

Additionally supported are:

  • headersFromCredential
  • queryFromCredential
  • bodyFromCredential
  • maxResponseBytes (compatibility field)

headersFromCredential, queryFromCredential, and bodyFromCredential are used to read secrets from the credential backend and fill them into the request’s headers, query, or body. The plugin distributes automatically based on the platform: Windows reads Credential Manager, Linux uses pass.

Return Limits

You can set the return preview character count for a single request via maxChars:

{
  "url": "https://example.com",
  "maxChars": 10000
}

When maxChars is not passed, the plugin uses defaultMaxChars from the Settings.

The return limit can be modified in the DSH Web GUI:

Settings > Plugins > http-request-mcp

Example configuration items:

{
  "defaultMaxChars": 2048,
  "maxCharsLimit": 200000
}

maxCharsLimit is the manually configured upper limit, and the maxChars passed in a single request cannot exceed it. The plugin also retains an internal absolute safety limit of 1000000 characters; if set above this value, it will automatically be processed as 1000000. Changes take effect in real-time after modifying Settings.

Even if the return preview is truncated, specifying outputFile will still save the full response body.

Credential Whitelist

The default allowed target prefixes:

newapi/
openclaw/
upstreamops/

The plugin will only read the credential backend when the target starts with an allowed prefix. Requests that do not pass the whitelist will return a JSON error and will not read or send secrets.

Open in the DSH Web GUI:

Settings > Plugins > http-request-mcp

Simply modify the credentialPrefixes string array. The setting takes effect in real-time after modification and is persisted to the Profile configuration file by the DSH Settings Provider.

It also supports environment variables:

$env:HTTP_REQUEST_MCP_CREDENTIAL_PREFIXES = "newapi/,openclaw/,upstreamops/"

The priority is:

DSH Settings > Environment Variables > Built-in Defaults

The target is not allowed to contain .. path segments.

Linux Credential Backend

The Linux platform only supports pass. The plugin will execute:

pass show <target>

and take the first line of the output as the secret.

Before use, pass needs to be installed and the password store initialized:

pass init <gpg-id>
pass insert newapi/mykey

Here, the first line of newapi/mykey is the injected secret. Both platforms share the same set of credentialPrefixes whitelist validation; when the target is not in the password store, the error message will include the raw output of pass show.

Applicable Scenarios and Notes

This plugin is suitable for the following usage methods:

  • Need to call HTTP(S) interfaces in DSH
  • Wish to place secrets in system credential backends instead of writing them directly into request parameters
  • Need to limit which target prefixes can read secrets through a whitelist
  • Do not want to introduce an extra MCP Server or MCP stdio process

Please note before installation:

  • The plugin runs with the permissions of the current dsh process
  • Should check the source code and license before installation
  • The credential reference capability relies on local credential backends: Windows is Credential Manager, Linux is pass
  • Targets that do not pass the whitelist should not read or send secrets
  • For large responses, it is recommended to use outputFile to save the full response body

Conclusion

The value of http-request-dsh-plugin lies in making http_request a native DSH tool while providing a credential whitelist and usage skills to avoid extra MCP processes. See the source code and license on GitHub:

https://github.com/gao-gao-zai/http-request-dsh-plugin