@yangzhe1991/dsh-futu-mcp
DSH 插件：通过 OAuth 2.1 连接到 Futu (富途) MCP，并向代理提供其工具；令牌持久化存储在工作区之外
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add @yangzhe1991/dsh-futu-mcp@0.1.1Futu Mcp 以 @yangzhe1991/dsh-futu-mcp 发布，当前版本为 0.1.1。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
A DSH (DeepSeek Harness) plugin that connects the agent to the official Futu (富途) MCP server and registers its tools on ctx.tools under mcp__futu__<toolName>.
https://mcp.futunn.com/mcp using the pagination-aware MCP Streamable HTTP transport and publishes server tools to the agent as callable tools (mcp__futu__*).quote:read + trade:read). The plugin intercepts the server's protected-resource metadata (which advertises every scope including trade:write order placement) and narrows it to your configured set, so neither client registration nor the authorization request can ever request more than you approved.mcp__futu__* tools) with no network, no token refresh, no browser popup. A conversation that never touches Futu costs nothing. The moment a Futu tool is actually called, the plugin connects; if the token is stale it refreshes silently (only when the refresh token itself is expired/revoked — a 14-day cycle — does the browser login page open, and the same call then retries and succeeds). The one exception: on very first use there is no cached tool list yet, so the first sent message triggers the connect + login, after which the cache exists and everything is call-time-only.| When | What happens |
|---|---|
dsh web starts / plugin loads | Only reads the credentials file: cached tool list is registered (agent sees mcp__futu__*). No network, no token refresh, no browser. |
| You chat about anything unrelated | Nothing (zero Futu activity). Tool calls never reach Futu. |
| A Futu tool is actually called | Connect + sync happens now; stale token → silent refresh (no UI). |
| Refresh token expired/revoked (≤14 days) and a Futu tool is called | Login page opens at that moment; after you authorize, the same call retries and succeeds. |
| Very first use (no cached tool list) | Your first sent message triggers connect + login; after authorizing, the tool list is cached for all future starts. |
OAuth tokens, the registered client_id and the (non-sensitive) discovery cache are persisted to a credentials file outside any workspace or project directory:
~/.dsh/credentials/futu-mcp.json (i.e. $DSH_HOME/credentials/), file mode 0600, directory mode 0700.credentialFile in the plugin config (the path is resolved with ~ expansion; keep it inside your home directory, never inside a project).The access token is short-lived (~2h) and refreshed automatically; the refresh token lives up to 14 days, after which the browser prompt appears again. You can revoke tokens at any time from the Futu OpenAPI Dashboard.
dsh plugin --profile web add @yangzhe1991/dsh-futu-mcp
Then restart dsh web. On the first quote query the browser will open the Futu authorization page — log in and approve the requested scopes. Tip from the official docs: try asking the agent "查一下腾讯的实时股价" to verify.
Override configuration in your profile's cordis.patch.yml:
- id: futu-mcp
config:
# 授权范围:只读 = quote:read + trade:read(默认)。
# 需要自选管理/下单撤单时追加 quote:write / trade:write 并重新授权。
scopes: [quote:read, trade:read]
# 凭证文件(默认 ~/.dsh/credentials/futu-mcp.json,0600)。
credentialFile: ~/.dsh/credentials/futu-mcp.json
# 单次工具调用超时(ms)
toolCallTimeoutMs: 60000
# 授权页打开后的提醒间隔(ms)
authTimeoutMs: 300000
# 本地回调服务器端口(0 = 自动)
callbackServerPort: 0
reconnect:
enabled: true
initialDelayMs: 500
maxDelayMs: 30000
maxAttempts: 10
Dev mode (link) — edit your profile's package.json:
"dependencies": {
"@yangzhe1991/dsh-futu-mcp": "link:/path/to/dsh-futu-mcp"
}
pnpm install # in the profile directory
npm run build # in the plugin directory, then hard-refresh / restart dsh web
dsh.profile.bundles must include @yangzhe1991/dsh-futu-mcp (run dsh plugin add to reconcile, or add it manually the same way as other plugins).
MIT