Introduction

In the pluggable workflow of DeepSeek Harness (DSH), an agent running on a workstation may need to access GPU, runtime, and configured source workspaces on lab servers, while the server remains isolated from the public internet. Providing the agent with a standard SSH terminal would expose arbitrary hosts, commands, and file paths. dsh-lab-ssh provides a set of securely controlled SSH development tools for DeepSeek Harness and standard MCP clients.

This is an independent community plugin, not an official package from DeepSeek AI. Version 0.3.0 is an experimental preview; you should pin to a tested version of DeepSeek Harness before deploying to a lab. The GitHub repository is https://github.com/gdgfd22/deepseek-harness-ssh, licensed under MIT.

Core Capabilities

The main capabilities of dsh-lab-ssh include:

  • Pin host aliases visible to the model, rather than exposing arbitrary SSH targets.
  • Pin OpenSSH SHA256 host key fingerprints.
  • Credentials can reference environment variables, local key files, or SSH Agent.
  • Configure command allow lists, auto-approval rules, and rejection rules per host.
  • Limit command output and timeouts.
  • Remote directory roots based on aliases, with canonical include checks.
  • Bounded UTF-8 reading, and atomic, hash-protected writing.
  • Support for optional alias command working directories.
  • Provide default-disabled HTTPS artifact bridging, targeting offline servers.
  • The same JSON policy can be used for both DeepSeek Harness and Codex MCP.
  • Provide a stdio MCP server implementation.

Not Provided

This plugin does not provide:

  • Arbitrary host access;
  • Interactive shell;
  • Inline keys;
  • Unrestricted file transfer;
  • Delete, move, or chmod operations;
  • Background commands;
  • Port forwarding;
  • Reverse tunneling;
  • SSH agent forwarding.

Generic SOCKS/HTTP proxies, SSH forwarding, and reverse tunneling are outside the scope to preserve server network isolation.

Installation and Enablement

Runtime Requirements:

  • Node.js ^22.19 or >=24;
  • DeepSeek Harness 0.1.0-rc.7 or compatible 0.1.x preview;
  • dsh plugin requires pnpm to be in PATH.

Build and Install:

Set-Location <PLUGIN_DIR>
npm install
npm run build
npx -y @deepseek-ai/dsh@0.1.0-rc.7 plugin --profile web add <PLUGIN_DIR>

This step installs dependencies and builds the plugin in the plugin directory, then registers the local plugin directory to the web profile.

Configuration and Execution

Copy the example configuration outside the repository, replace all placeholders, and point the DSH user patch to that file. For example:

- id: lab-ssh
  config:
    configFile: C:/Users/<USER>/.dsh/lab-ssh.private.json

If credentials use environment variables, they need to be set in the same process that starts DSH, for example:

$env:LAB_SSH_GPU01_PASSWORD = '<enter locally>'
npx -y @deepseek-ai/dsh@0.1.0-rc.7 web

You can also start the MCP server directly:

node <PLUGIN_DIR>/lib/mcp-server.js --config <PRIVATE_CONFIG_PATH>

Use the private config path when starting directly; do not put real configuration into the repository.

Tool Interface

The plugin provides the following tools:

  • ssh_list_hosts: List configured host aliases.
  • ssh_list_file_roots: List directory aliases and access policies.
  • ssh_list_directory: List items under authorized root directories.
  • ssh_read_file: Read bounded UTF-8 text.
  • ssh_write_file: Create or atomically replace bounded UTF-8 text, write with hash protection.
  • ssh_exec: Run allow-listed commands on fixed hosts and optional directory aliases.
  • ssh_stage_artifact: Stage a single artifact.

Artifact Bridging

HTTPS artifact bridging is disabled by default and is not a transparent proxy. It performs administrator domain allow-list checks on redirects, enforces size limits and mandatory trusted SHA256, and creates files in the controlled remote directory. Existing files will not be replaced.

Development Verification

Run in the plugin directory:

npm install
npm run typecheck
npm test
npm run build
npm run pack:check

This step is for type checking, testing, building, and packaging checks.

Security Considerations

  • The plugin runs in the same process that starts DSH, so it inherits the permissions of that process; check the source code, dependencies, and MIT license before installing.
  • Do not commit or publish real SSH configuration, credentials, logs, local profiles, build outputs, or archives.
  • Do not place private configuration files inside the repository.
  • 0.3.0 is an experimental preview; pin to a tested DSH version before lab deployment.

Summary

The value of dsh-lab-ssh lies in restricting access to remote lab servers for DSH or MCP clients to fixed hosts, fixed paths, fixed commands, and auditable artifact workflows. GitHub Repository: https://github.com/gdgfd22/deepseek-harness-ssh.