dsh-mcp-security
DeepSeek Harness 的故障关闭式 MCP 工具基线与运行时审批安全。
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add dsh-mcp-security@0.1.1Mcp Security 以 dsh-mcp-security 发布，当前版本为 0.1.1。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
English | 中文
Adds an MCP 安全 settings page and a fail-closed Host policy for tools registered by the official DSH MCP Client.
mcp__<serverName>__<rawName> are covered.tools/pre-execute policy.Accepting a baseline records only that the user reviewed and trusted the definitions visible at that moment. It does not prove that the initial server or its definitions were safe, authenticate the server implementation, or grant a tool call. Review the complete accepted list rather than relying only on a later “no differences” result: a harmful definition accepted initially remains a matching baseline until the visible definition changes.
The settings page shows:
Each tool in the accepted and current lists expands independently. “接受当前完整基线” replaces the entire accepted snapshot with the complete current snapshot; it is not a per-tool acceptance action. An empty accepted snapshot is valid only when the user deliberately accepts a generation containing no visible MCP tools.
The Host publishes the current ToolRuntime definitions when the Bundle starts and checks the registry every five seconds for UI visibility. It reads tools.schemas() again synchronously during every covered tools/pre-execute; that invocation-time comparison is the authorization decision and runs before the MCP Client dispatches tools/call.
The plugin observes the definitions currently registered by the DSH MCP Client, not an MCP server's source code or remote state directly. For stdio, SSE, and other supported transports, a remote definition change becomes detectable only after the MCP Client refreshes its registered tools. A server tool-list notification, reconnect, MCP Client restart, or DSH Host restart may be required. Until that synchronization occurs, the local registry still contains the earlier definition and no definition-only monitor can report the remote change.
The policy covers official MCP tools registered in the current DSH ToolRuntime under the official public-name format. Direct MCP SDK calls, clients in another process, subagents with separate MCP clients, and calls from other applications do not cross this runtime and are not covered.
The snapshot detects advertised capability changes. A server can preserve the same names, descriptions, and Schemas while changing implementation behavior, destinations, data handling, or side effects; such changes are invisible to this baseline. The snapshot also identifies a server by its configured serverName, not by a cryptographic server or binary identity. Endpoint authentication, TLS validation, network policy, server provenance, and behavioral monitoring remain separate controls.
approval-required and denied records are written by the pre-execution policy. executed and error-or-denied summarize the final ToolRuntime result. Result records are audit evidence only and cannot undo remote side effects. The settings namespace retains at most 200 audit entries, while the page displays the newest 100.
The Bundle adds no tools or prompt text. MCP tools remain model-visible. Calls with a missing, invalid, or drifted baseline fail before dispatch; calls matching the accepted baseline use the existing approval UI for one-call authorization.