Introduction¶
Under the plugin-based architecture of DeepSeek Harness (DSH), managing external MCP (Model Context Protocol) connectors often faces issues such as unclear permission boundaries, silent configuration import failures, and invisible connection status. The dsh-mcp-registry plugin is designed to address these pain points by providing a governed registry for unified management of stdio and streamable-http MCP connectors. It draws on the design philosophy of dsh-mcp-connector and openhanako, offering a complete governance workflow from configuration import to runtime authorization.
Core Features¶
Registry and persistence
The plugin is responsible for registering stdio / streamable-http MCP connectors and persisting their configurations to ~/.dsh/mcp-registry/registry.json. The write process uses atomic operations, post-write readback, and a rolling snapshot mechanism (snapshot count ≤20) to ensure configuration reliability and traceability.
Four-tier fail-closed authorization
The authorization logic uses a multi-layer defense strategy and follows the fail-closed principle:
1. Global switch: controls the overall availability of the registry.
2. Connector-level mode: controlled by permissionMode (defaults to review-all).
3. Tool-level authorization: explicitly permits specific tools via the grant command.
4. Server-declared evidence: relies on server-side declarations (memory-only, invalidated on restart).
Within this model, destructiveHint acts as a hard veto and overrides any authorization.
Fail-loud import
The plugin strictly validates imported mcpServers JSON and reports errors when rejecting the following cases:
* The args field is a string instead of an array.
* The command contains spaces but args are not processed correctly.
* It contains potentially dangerous key names such as __proto__.
This serves as a countermeasure against bugs where some implementations silently drop parameters.
Full-boundary redaction
At the output boundaries of the registry, raw information involving tools, commands, exports, and HTTP status is projected (for example, retaining only origin / base command name). Sensitive information such as plaintext values for tokens and environment variables does not appear in registry data.
Honest bridging
When the Agent calls mcp_bridge_call, review mode returns a structured needs_review status that includes grant guidance, but it does not execute the tool and does not pretend to approve it.
Lazy loading for native tools
This is an optional feature designed to reduce token consumption in the resident prompt. When enabled, the full schemas of non-core native tools (such as shell, file, and search) are collapsed. The Agent must first use tool_discover to view the collapsed catalog, then use tool_activate to expand them on demand. It supports two modes (lazyEagerIndex, default true): in Eager mode the list is expanded directly; in Non-eager mode the Agent must discover first and then activate.
Installation and Enablement¶
Installing this plugin requires modifying the DSH profile configuration.
Method 1: Profile Patch
Insert the plugin ID in the profile:
profile patch
- insert: [{id: dsh-mcp-registry, name: "dsh-mcp-registry"}]
Method 2: Use the patch file directly
Use the cordis.patch.yml file provided by the repository to install it.
Typical Usage¶
The plugin provides a set of CLI commands for managing the registry.
Import connectors
Import a configuration file; all entries are disabled by default and marked as UNCONFIRMED:
mcp-reg import D:\configs\mcp.json
View and manage
mcp-reg list # 查看注册表
mcp-reg probe <id> # 执行一次 MCP initialize 握手
mcp-reg confirm <id> # 确认并启用连接器
Authorization control
mcp-reg mode <id> allowlist # 设置为允许列表模式
mcp-reg grant <id> <tool> # 显式放行特定工具
mcp-reg call <id> <tool> '{"k":"v"}' # 人工调用（视同批准）
Use Cases and Notes¶
Version requirements
The plugin has strict requirements for the host DSH version:
* DSH 0.2.0 line: use the latest version (corresponding to DSH 0.3.4).
* DSH 0.1.7 line: install dsh-mcp-registry@dsh-0.1.7 (corresponding to npm 0.3.3).
* 0.1.6 and earlier: no longer supported; installation will be rejected by engines.dsh.
Permissions and runtime environment
The plugin runs with the permissions of the current DSH process. It is recommended to review the source code and license (MIT) before installation.
Conclusion¶
dsh-mcp-registry provides a robust foundation for MCP connector management in DSH by offering a governed registry, a strict authorization model, and transparent diagnostics. It does not act as a persistent bridge for MCP sessions; instead, it focuses on catalog governance, health checks, and authorization decisions.