dsh-as-mcp-server
通过 Streamable HTTP 将 DSH 作为 MCP 服务器公开：流式传输思考/工具/文件通知、共享意图、持有期间物理禁止 DSH 写入的操作锁、中途注入警报，以及委托审查。
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add dsh-as-mcp-server@0.1.4As Mcp Server 以 dsh-as-mcp-server 发布，当前版本为 0.1.4。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
English | 中文
Exposes DSH as an MCP server, so any MCP client can watch what the agent is doing and steer it mid-flight.
Two agents on one workspace normally means two agents overwriting each other. This bridge gives them a shared protocol instead: what the other side is thinking, what it's touching, who owns the floor, and a way to interrupt.
| Capability | Mechanism |
|---|---|
| See the agent think | LLM stream deltas → notifications/dsh/thinking (200 ms throttle) |
| See what it touches | tool calls → notifications/dsh/tool; write/edit targets → notifications/dsh/file |
| Share intent | dsh_set_intent / dsh_get_intent, auto-injected into DSH's system prompt every turn |
| One writer at a time | dsh_lock_acquire / dsh_lock_release floor lock — while held, DSH's write/edit/git are physically denied |
| Interrupt the current turn | dsh_inject_alert → injected through agent/pre-step into the running step |
| Delegate a review | dsh_review_request → inbox on disk (inbox/<id>.json), result written back to inbox/done/ |
dsh_get_status · dsh_get_intent · dsh_set_intent · dsh_lock_acquire · dsh_lock_release · dsh_lock_status · dsh_inject_alert · dsh_review_request
notifications/dsh/status · thinking · tool · file · intent · lock · alert-queued · review
dsh plugin --profile web add dsh-as-mcp-server
Then add the bridge to your MCP client — any client speaking Streamable HTTP works (WorkBuddy, Claude Desktop with an MCP-HTTP adapter, Cursor, Cline, …):
{
"mcpServers": {
"dsh-bridge": {
"type": "streamableHttp",
"url": "http://127.0.0.1:51630/mcp",
"timeout": 60000
}
}
}
Restart DSH. The log should show [dsh-as-mcp-server] MCP server 就绪: http://127.0.0.1:51630/mcp.
# terminal A — start a demo server on 51999
node dsh/mcp.js 51999
# terminal B — handshake, all 8 tools, floor lock, SSE stream
node dsh/mcp-test.js http://127.0.0.1:51999/mcp
Expected: 13 checks pass, ending with 全部通过 ✅.
There is also a unit-level regression suite that runs with no server:
node dsh/bridge-regression.test.mjs # 13 pass / 0 fail
~/.dsh-mcp-bridge/config.json (all optional):
{
"port": 51630,
"host": "127.0.0.1",
"token": "",
"lockTtlMs": 300000,
"denyTools": ["write", "edit", "git"],
"alertInjection": true,
"inboxRoot": ""
}
inboxRoot defaults to ~/.dsh-mcp-bridge/inbox.
127.0.0.1; a token is supported but empty by default. Do not expose the port.write/edit/git are denied at tools/pre-execute. The remote client is trusted to honour the lock by convention — this is a coordination primitive, not a security boundary between mutually hostile parties.agent/pre-step. If the current step cannot be injected, the alert stays queued and lands on the next step.sessionId.MIT