Introduction

In DeepSeek Harness (DSH), the MCP client registers tools globally at the process level. This means @deepseek-ai/dsh-mcp-client injects the tool lists of all MCP servers into ctx.tools, in the form mcp__<serverName>__<toolName>. As a result, even a session used only for Jira tasks may carry three database servers and a browser driver, consuming the context window and risking accidental invocation.

The dsh-mcp-workspace-scope plugin constrains MCP tool injection at the directory level. It lets you define a directory allowlist, with subdirectories automatically inheriting the rules, and provides a session-level temporary toggle to enable services on demand outside the rules.

Plugin Overview

  • Name: dsh-mcp-workspace-scope
  • Maintainer: felix-lj-ct
  • Category: admin-security
  • License: MIT

The plugin provides clear tool boundaries for each project while keeping MCP services running, through two mechanisms: hiding tools and rejecting invocations.

Core Features

  • Directory-level allowlist: Defines the list of MCP servers allowed in each directory, with subdirectories automatically inheriting parent rules.
  • Dual rejection mechanism: Not only hides tools but also rejects invocations (guard), providing a hard boundary.
  • Session-level temporary toggle: Provides a Pill component in Composer, allowing specific servers to be temporarily enabled or disabled in the current session.
  • Honest status readout: Displays runtime server status and can identify “allowed but dead” servers.
  • Visual editor: Provides a rule editor on the settings page, with support for selecting from known workspaces via a dropdown.

Installation and Activation

Installing the plugin requires specifying a profile (for example, web). After installation, restart the profile for the change to take effect.

dsh plugin --profile web add dsh-mcp-workspace-scope

Restart the profile:

dsh --profile web

After installation, the plugin mounts the Host layer in the profile’s cordis.patch.yml. The default configuration file path is ~/.dsh/mcp-workspace-scope.json. If this file does not exist, the plugin remains inactive, and all sessions will still inject all MCP servers.

Rule Configuration

The rule file uses JSON format and contains two top-level fields: default and rules.

  • default: Controls behavior for directories that do not match any rule (that is, the root directory or paths not explicitly overridden). It can be "*" (inject all), [] (disable all), or an array of server names.
  • rules: An array; each item contains path (directory) and servers (allowed server list).

Configuration Example (~/.dsh/mcp-workspace-scope.json)

{
  "default": "*",
  "rules": [
    {
      "path": "D:/work/frontend",
      "servers": ["playwright", "context7"]
    },
    {
      "path": "D:/work/master-data-management",
      "servers": ["atlassian", "bigquery"]
    }
  ]
}

Matching Rules

  • Subdirectories inherit the rules of their parent directory.
  • Longest path match takes precedence.
  • For rules of the same length, later-defined rules take precedence.
  • Rule changes are applied immediately to running sessions (you can freeze this behavior by configuring applyToRunningSessions).

Usage and Interaction

  1. Enable/Disable: In Composer, an MCP Scope Pill appears next to the session. Clicking the Pill lets you temporarily enable or disable specific servers in the current session without changing global rules.
  2. UI Editing: In the “MCP scope” section of the settings page, you can add rules and select directories and servers directly in the UI editor.

Limitations and Caveats

  • No out-of-thin-air enablement: This plugin only supports “subtractive” operations and cannot enable servers that are already disabled in the profile.
  • Memory usage: Hidden servers continue to run and consume memory. If you need to stop the service completely, move it to an Agent Preset.
  • Subagent isolation: A subagent’s scope is determined by its own working directory and does not inherit parent-agent restrictions.
  • Runtime reload: Rule changes (whether saved via the UI or by editing the file directly) are recomputed immediately and applied to the current session.

Summary

dsh-mcp-workspace-scope addresses the problem of MCP tools polluting the context in DSH environments. Through directory inheritance and session-level toggles, it helps developers build cleaner context boundaries.

  • GitHub Repository: https://github.com/felix-lj-ct/dsh-mcp-workspace-scope
  • Plugin Directory: https://www.skillhub.cn/plugins/felix-lj-ct/dsh-mcp-workspace-scope