dsh-http-tools
HTTP / API debugging tools for DeepSeek Harness (DSH).
dsh-http-tools gives your DeepSeek Harness agent a complete REST client: send any request with full control over method, headers, body, and auth, paste a curl command and let the agent run or tweak it, and review or compare past requests — all inside the chat.
Comes with an optional UI companion package (dsh-http-tools-ui) that renders every http_request / curl_parse call as a DeepSeek-branded card in the web UI.
Features
http_request — full REST client: GET/POST/PUT/PATCH/DELETE/HEAD, custom headers, body, basic/bearer auth. Returns status, duration, size, response headers, truncated body, and an equivalent redacted curl command.curl_parse — parse a curl command into structured parts, or execute it in one step (execute: true).request_history — query in-session requests, inspect one, or diff two responses.- Pagination-aware — the
Link response header is surfaced to the model, so it can follow rel="next" / rel="last" without re-reading raw headers.
- Preview-slimmed logging — persisted session logs carry a 6000-char body preview, so logs stay readable as request volume grows.
- DeepSeek-branded UI cards (with
dsh-http-tools-ui) — fish logo, brand-colored method badge, official state dot (running chase animation), theme-aware colors, collapsible JSON body (JsonTree), and copy-body / copy-curl buttons.
Tools
| Tool | Description |
|---|
http_request | Send an HTTP request (GET/POST/PUT/PATCH/DELETE/HEAD) with custom headers, body, and auth. Returns status, duration, size, response headers, truncated body, and an equivalent curl command. |
curl_parse | Parse a curl command into its structured parts (method, URL, headers, body, auth). Optionally execute it in one step with execute: true. |
request_history | Query requests made in the current session, inspect one in detail, or compare two responses side by side. |
Install
dsh plugin --profile web add dsh-http-tools
# optional: DeepSeek-branded UI cards for the web client
dsh plugin --profile web add dsh-http-tools-ui
Works out of the box with zero configuration. Node.js >= 22 is required (uses the native fetch).
UI cards
dsh-http-tools-ui is a separate package that registers keyed tool views for http_request and curl_parse. Once installed, each call renders as a card in the conversation:
- Fish logo + brand-colored method badge (
GET / POST / …)
- Official state dot: green on success, amber on non-2xx, red on error, animated chase while running
- Status · duration · size · truncated summary on the row head
- Expandable response: key headers inline, JSON body as a collapsible tree (with copy actions), non-JSON bodies as text
- Copy / Copy curl buttons, all colors theme-aware (
--dsw-* tokens)
Try it
Tell your agent things like:
用 http_request 调 https://api.github.com/repos/deepseek-ai/deepseek-harness 看看 star 数
POST https://httpbin.org/post，body 传 {"hello":"world"}，看看返回什么
粘贴这个 curl 命令解析一下，然后改个 header 再重发：
curl -X POST https://api.example.com/v1/users -H "Content-Type: application/json" -d '{"name":"ada"}'
用 request_history 对比 #1 和 #3 两次请求的响应差异
Configuration
All options are optional. Set them in your profile's cordis.patch.yml:
- id: http-tools
name: dsh-http-tools
config:
maxBodyChars: 524288 # cap on response body characters returned to the model
timeoutMs: 10000 # per-request timeout in milliseconds
blockedHosts: [] # hostnames the plugin refuses to contact (e.g. ['169.254.169.254'])
localOnly: false # true = only loopback / private-network targets
historyLimit: 50 # in-session request history retention
auditHeader: true # tag every request with an X-DSH-Request audit header
Security model
- By default every URL is allowed; the request is tagged with an
X-DSH-Request audit header so the server can identify agent traffic.
blockedHosts rejects exact hostnames and their subdomains before any network I/O (e.g. block cloud metadata endpoints like 169.254.169.254).localOnly: true restricts requests to loopback and private networks — a one-switch "local debugging mode".- Response bodies are capped at
maxBodyChars (default 512 KB) and timeouts at timeoutMs (default 10 s) so a runaway call can never flood the model context.
- Credentials (Bearer tokens, basic-auth pairs) are sent only as request headers. Generated
curl commands redact authorization, cookie, proxy-authorization, and x-api-key values as ***, so secrets do not leak into session logs or request history.
Development
pnpm install
pnpm test # vitest unit tests
pnpm run typecheck
pnpm run build # tsdown -> lib/
pnpm --filter dsh-http-tools-ui run build # UI client bundle -> ui/lib/
To smoke-test against a local DeepSeek Harness checkout, mount the built plugin with a patch overlay that references the built file:
pnpm run build
# http-tools.patch.yml — reference the built entry
# (on Windows, absolute paths must be file:// URLs, percent-encoded)
- insert:
- id: http-tools
name: /absolute/path/to/dsh-http-tools/lib/index.js # POSIX
# name: file:///C:/Users/.../dsh-http-tools/lib/index.js # Windows
# from the deepseek-harness repo root:
pnpm dsh web --patch /absolute/path/to/http-tools.patch.yml
License
MIT
