dsh-wind-aifin

DSH deliberately keeps credential-shaped environment variables out of model-visible shell processes, so an Agent can neither invoke the official Wind CLI through its Bash tool nor copy the key into a workspace file without defeating the boundary. dsh-wind-aifin resolves WIND_API_KEY inside the trusted host process and injects the Bearer token through a loopback-only adapter with an unguessable per-process route, ensuring the key is never returned to the model, written to disk, or reachable by ordinary shell commands.

Once connected, the Agent gains native tools across seven Wind Streamable HTTP MCP domains covering stocks, funds and ETFs, indices and sectors, bonds, filings and financial news, macro and industry indicators, and cross-asset analytics, plus the wind_alice workflow engine for fact checking, company one-pagers, earnings reviews, screening, macro analysis, bond and credit analysis, fund analysis, market-sizing, and comparable-company work. Two built-in runtime Skills route natural-language requests to the right domain and tool without requiring an API key or shell command in the prompt.

This plugin suits professional finance users who run sell-side or buy-side research, investment-committee materials, macro strategy tracking, and bond credit ratings inside DeepSeek Harness and care deeply about credential isolation. It ships no install script, does not bundle or redistribute Wind official Skills, resolves credentials per request without file caching, and the adapter accepts only the seven fixed endpoints so it cannot be repurposed as a general authenticated proxy.