@anht3889/dsh-mcp-mgmt-bundle
用于在 Web Settings 中管理 MCP 连接的 DeepSeek Harness 配置文件包
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add @anht3889/dsh-mcp-mgmt-bundle@0.0.6Mcp Mgmt Bundle 以 @anht3889/dsh-mcp-mgmt-bundle 发布，当前版本为 0.0.6。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
Out-of-tree MCP connection management for DeepSeek Harness. Architecture and scope live in docs/design.md.
From npm (after the packages are published):
npx @deepseek-ai/dsh plugin --profile web add @anht3889/dsh-mcp-mgmt-bundle@0.0.6
From a local checkout (development), with a deepseek-harness checkout beside this repository — tsc resolves harness project references from there:
pnpm install && pnpm run build
npx @deepseek-ai/dsh plugin --profile web add ./packages/bundle
Restart the Web profile after installation.
Do not also mount @deepseek-ai/dsh-mcp-client for the same serverName — both register MCP tools and will conflict.
Add a server. Open Settings → MCP Servers and choose Add server. Fill in the name, transport (stdio or HTTP), command or URL, and authentication, then Save. Timeout and reconnect options live under Advanced settings.
Server list. Each row shows the server name, an Enabled switch, and a summary of transport, connection state, and how many tools are enabled. Authorize appears only while an OAuth server has no token. Click the row to open details.
Server details. Toggle the server or individual tools, Reload to reconnect and re-list tools, open Connection logs, or use Edit configuration, Log out, and Delete. Disabling a tool unregisters it without dropping the connection; the choice is stored in the server record and survives a restart.
| Data | Default path |
|---|---|
| Non-secret server records, including disabled tool names | ~/.dsh/mcp/servers.json |
| Secrets (tokens, header values, client secret) | ~/.dsh/mcp/secrets.yaml, or ctx.credentials when mounted |
Override with the manager plugin's catalogPath / secretsPath config.
Node trusts only its own bundled certificate authorities, so an HTTP server whose certificate comes from a corporate CA fails to connect with self-signed certificate in certificate chain even though a browser or curl reaches it. Set trustSystemCertificates: true on the manager plugin to trust the host's authorities as well, or launch the host with NODE_OPTIONS=--use-system-ca. Both widen TLS trust for the whole host process, which is why the config stays off by default.
Each server's callback URL is the live web origin plus that server's auth.redirectPath (default /callback). Set publicOrigin on the manager when the browser reaches the host through a different origin. Authorization servers match the redirect URI exactly; a pre-registered public client usually allows /callback on any loopback port. The manager serves every configured path. Authorize and token requests also send the MCP URL as the RFC 8707 resource indicator.
| Package | Role |
|---|---|
@anht3889/dsh-mcp-mgmt-bundle | Installable surface: patch, manager, Settings UI |
@anht3889/dsh-mcp-mgmt-mcp | ctx.mcp vocabulary (library) |
@anht3889/dsh-mcp-mgmt-oauth | PKCE OAuth + discovery (library) |