DeepSeek Harness (DSH) is built on the core philosophy that “everything is a plugin.” The MCP service provided by Cloudflare requires OAuth 2.0 authentication, but the client built into DSH only supports static headers and cannot complete the full OAuth flow. The dsh-cloudflare-mcp plugin is implemented based on the official @modelcontextprotocol/sdk, adding logic for dynamic client registration, PKCE S256 validation, and loopback callbacks, enabling Agents to actually connect to and operate Cloudflare resources through DSH.

Core Features

This plugin connects the official mcp.cloudflare.com service to DSH and provides full authentication and tool management capabilities:

  • Full OAuth 2.0 flow: Supports dynamic client registration, PKCE S256, and loopback callbacks.
  • Web settings panel: Provides a graphical interface for managing authorization.
  • Cloudflare API tools: After authorization, Agents can invoke various Cloudflare APIs using the mcp__cloudflare__* prefix, including Accounts, Workers, Pages, DNS, R2, KV, D1, and AI.
  • Agent helper tools: Provides tools for status checks, starting the OAuth flow, completing code paste, connection testing, and credential cleanup.
  • Automatic token refresh: When the API returns 401, the plugin automatically refreshes the access token.

Installation and Enablement

Adding the plugin requires using the local link method. After installation is complete, the Host must be restarted for the plugin layer to take effect.

dsh plugin --profile web add link:/path/to/dsh-cloudflare-mcp

Typical Usage

Authorization and connection are mainly completed in two ways. Both flows point to mcp.cloudflare.com:

  1. Web interface operation:
    Go to Settings → Cloudflare MCP and click “Start Authorization.” The browser will open Cloudflare’s consent page, and the loopback callback will complete automatically. On the settings page, clicking “Test Connection” can list the discovered tools.

  2. Chat via Agent tools:

    • Ask the Agent to run cloudflare_mcp_oauth_start to obtain the browser redirect link.
    • After completing authorization in the browser, paste the code returned by the callback into cloudflare_mcp_oauth_finish.

Notes

  • Token storage: Access tokens are stored in ~/.dsh/dsh-cloudflare-mcp with permissions 0600. Do not modify them manually.
  • Network restrictions: Other than the OAuth callback endpoint, API routes listen only on 127.0.0.1 (loopback address).
  • Dependency versions: The plugin depends on @deepseek-ai/cordis and related DSH client runtimes. Ensure environment version compatibility.
  • License: Uses the MIT License.

Summary

zhengjy01/dsh-cloudflare-mcp solves the problem that the DSH native client cannot handle OAuth authentication, providing developers with a solution to call the full suite of Cloudflare APIs without manually managing tokens. See the GitHub repository or community directory for more details.