DeepSeek Harness (DSH) supports extending features through plugins. When building agents that involve financial data queries or trading, integrating with Futu OpenAPI is a common requirement. This article introduces the @yangzhe1991/dsh-futu-mcp plugin, which exposes the tools provided by the Futu MCP server to agents through a standard protocol and handles the underlying secure authentication flow.

Plugin Description

This plugin serves as a DSH component responsible for establishing a connection to the official Futu MCP server (https://mcp.futunn.com/mcp) and registering the tools provided by the server as mcp__futu__<toolName>.

Core Features

  1. Connection and Registration: Connects to the Futu server using the MCP streamable HTTP transport protocol with pagination support, and registers the available tools into the agent’s tool context.
  2. OAuth 2.1 Authentication: Handles OAuth 2.1 authorization entirely in-process, supporting RFC 9728 / RFC 8414 discovery, dynamic client registration (RFC 7591), PKCE S256, and refresh token rotation.
  3. Access Control: Strictly restricts authorization scopes. By default, only quote:read (read-only quotes) and trade:read (read-only trades) are enabled. The plugin intercepts server metadata to ensure that client registration and authorization requests do not request permissions beyond the configured scopes.
  4. Lazy Authorization: When the plugin is loaded, it only registers the tool list and generates no network traffic. The connection, token refresh, or browser login is triggered only when the agent actually calls a Futu tool.
  5. Secure Storage: Tokens are stored outside the workspace directory. The default path is ~/.dsh/credentials/futu-mcp, and file permissions are set to 0600 to ensure security.

Installation and Enablement

Use the official installation command to add the plugin:

dsh plugin --profile web add @yangzhe1991/dsh-futu-mcp

After installation, restart dsh web.

Configuration and Usage

Use tool names directly in the conversation. For example, asking “Check Tencent’s real-time stock price” can trigger connection verification.

If trading operations are required, adjust the authorization scopes in the configuration file. The default configuration is read-only:

scopes: [quote:read, trade:read]

If placing orders or canceling orders is required, change the scopes to:

scopes: [quote:write, trade:write]

Notes

  • Token Validity: Access tokens are valid for about 2 hours, and refresh tokens are valid for up to 14 days.
  • Login Trigger Timing: The browser login page is displayed only when the refresh token has expired or been revoked (after more than 14 days) and a tool is called.
  • Zero-Traffic Design: Loading the plugin does not trigger any network or browser prompts. Interaction occurs only when a tool is actually called.
  • Token Management: Tokens can be revoked at any time in the Futu OpenAPI dashboard.

This plugin is maintained by community developers and follows the MIT license. For more details, refer to the SkillHub Catalog or the GitHub repository.