Introduction

The core design philosophy of DeepSeek Harness (DSH) is “everything is a plugin.” When building workflows or agents with DSH, you usually need to connect multiple Model Context Protocol (MCP) services. These services come in various forms: some expose HTTP interfaces, some rely on local processes; some require authentication, while others do not. Managing these services in DSH’s native configuration often requires manually editing YAML files, which can be complex and error-prone.

dsh-mcp-oauth-client is a general-purpose management plugin designed for this purpose. It provides a visual management interface and acts as a client bridge, allowing you to add, manage, and connect various MCP services through configuration files or the UI.

Plugin Overview

  • Plugin name: dsh-mcp-oauth-client
  • Maintainer: fangzaozao
  • License: MIT
  • Purpose: A general-purpose MCP management and client bridge plugin for DeepSeek Harness
  • Note: Although the package name retains the historical “oauth” name, it supports both authenticated services and unauthenticated MCP services.

Core Features

The plugin provides the following capabilities:

  • Visual management: Manage all services in one place through DSH’s “Settings → MCP” page.
  • HTTP streaming support: Supports streaming-capable HTTP protocols, including the following authentication methods:
    • No authentication
    • OAuth 2.1 + PKCE
    • Bearer token
    • Custom request headers
  • Local process support: Supports the stdio protocol, with configurable startup command, arguments, environment variables, and working directory.
  • Service control: Supports adding, removing, enabling, disabling, and reconnecting services, as well as viewing the current number of tools.
  • OAuth automation: Supports automatically opening a browser for authorization, completing authentication through the local callback URL, and using the official MCP SDK to handle token refresh.

Installation and Enabling

The plugin is managed as an npm package. When installing, the Web profile must be specified.

1. Install via npm

dsh plugin --profile web add dsh-mcp-oauth-client

2. Install via a local tarball

If the plugin has already been packed, you can install it directly:

pnpm pack
dsh plugin --profile web add ./dsh-mcp-oauth-client-0.3.0.tgz

3. Install via Git

When installing from Git, the plugin runs the prepare script to build. If you are using pnpm 10 or later, you need to explicitly allow this build script in the pnpm-workspace.yaml file of the DSH profile:

allowBuilds:
  dsh-mcp-oauth-client: true

Then install using a fixed commit SHA to ensure a stable build result:

dsh plugin --profile web add github:fangzaozao/dsh-mcp-oauth-client#COMMIT_SHA

Usage

After installation, start the Web profile, go to the “Settings → MCP” page, and click “Add Server” to begin configuration.

HTTP Service Configuration

For HTTP-based MCP services, the UI provides four authentication methods:

  1. No authentication: Suitable for public endpoints or endpoints protected by a network layer, such as a firewall.
  2. OAuth 2.1 / PKCE: Supports dynamic registration; you can also manually enter the client ID and client secret.
  3. Bearer token: Enter the token directly. The plugin automatically adds Authorization: Bearer <token> to the request headers.
  4. Custom request headers: Suitable for API keys or provider-specific request header formats.

stdio Service Configuration

For local stdio MCP services, you need to provide the executable command.

  • Command: The path to the executable file or script used to start the MCP service.
  • Arguments: Enter one command argument per line.
  • Environment variables: Use the name=value format.
  • Working directory: Optional.

Manager Mode

This package installs only the manager. It does not include default MCP endpoints, credentials, or local commands. Specific service entries added through the UI are written into the cordis.patch.yml file of the current profile. Only the manager entry itself needs manager: true; if the service is provided by a bundle and that bundle already includes the manager, you do not need to set it again.

Notes

  1. Secure storage: Credentials entered in the UI are written in plaintext to cordis.patch.yml. Do not commit this configuration file to a Git repository.
  2. Token persistence: OAuth access tokens and refresh tokens are stored only in the memory of the plugin process. If the plugin restarts, the tokens become invalid and re-authorization is required.
  3. System requirements: This plugin requires Node.js 20 or later.
  4. DSH version compatibility: Requires a DSH version that supports bundle packages and Web client extensions.
  5. Preview status: This plugin is a DeepSeek Harness developer preview. DSH is rapidly evolving, and later versions may contain breaking changes.

Summary

dsh-mcp-oauth-client addresses the configuration pain points of managing heterogeneous MCP services in DSH, especially those involving authentication and local processes. Through visual operations and standardized configuration output, it lowers the barrier to connecting external tools. For DSH users who need deep integration with the MCP ecosystem, it is a valuable infrastructure plugin.

For more details and source code, visit the GitHub repository.