dsh-futu-mcp

Want to ask your DeepSeek Harness agent "what is Tencent trading at right now" without standing up a separate MCP server or hand-rolling an OAuth flow? dsh-futu-mcp collapses that entire pipeline into a single plugin: install it, and the agent can immediately invoke mcp__futu__* tools for real-time market quotes and read-only account data with zero middleware boilerplate.

Under the hood the plugin implements the full OAuth 2.1 lifecycle in-process — RFC 9728/8414 metadata discovery, RFC 7591 dynamic client registration, PKCE S256, and automatic refresh-token rotation. On first use a browser window opens to the Futu authorization page; within the 14-day refresh window all subsequent authentications are silent. Scope handling is defensive: at both client-registration and authorization-request time the plugin intercepts the server's protected-resource metadata and clamps the requested scopes to exactly the set you configured (quote:read and trade:read by default), so trade:write is never requested unless you explicitly opt in. Loading is also deferred by design — plugin load only reads a locally cached tool list, incurring no network call, no token refresh, and no browser popup. The connection is established only the instant a mcp__futu__* tool is actually invoked, meaning a conversation that never touches Futu produces zero upstream traffic.

This is aimed at developers and quant analysts who work inside Harness for research conversations, real-time monitoring, or strategy scripting: you describe the quote or account data you need in plain language, and the plugin handles authentication, token lifecycle, and tool routing so your codebase stays free of raw HTTP or OAuth plumbing. Sensitive credentials are persisted to ~/.dsh/credentials/futu-mcp.json (file mode 0600, directory mode 0700), isolated from any project workspace, and can be revoked at any time from the Futu OpenAPI dashboard.