dsh-mcp-manager

dsh-mcp-manager

简体中文 | English Local 0.13.3 unreleased candidate: see the release notes for cumulative changes, provenance and verification limits. It supersedes 0.13.2.

MCP server manager for DeepSeek Harness (DSH) — a Settings → MCP page where you add MCP servers once (remote HTTP or local stdio process), authenticate HTTP servers with OAuth in the browser, and expose their tools either directly or through a compact on-demand broker.

The built-in @deepseek-ai/dsh-mcp-client only accepts a static headers config — it has no OAuth support and no local stdio transport. This plugin fills that gap: OAuth (authorization code + PKCE) with spec-compliant discovery, RFC 7591 dynamic client registration, refresh_token rotation, and auto-reconnect across restarts — one browser login, then it keeps working. Registration identity and secret (RFC 7591): the client_name sent to the registration endpoint is dsh-mcp-manager- by default and configurable per server (Client name) for providers that gate registration on an exact name. When the authorization server advertises client_secret_post, the client registers confidentially: the issued client_secret is stored in the 0600 state file and sent on token exchange and refresh (never in a view, response or log). For a dynamically registered client, a changed client name — or a new GUI origin — re-registers and drops the old client's tokens; a manually configured Client ID is unaffected. Client application type follows MCP SEP-837: HTTP loopback callbacks (localhost, IPv4 loopback, or [::1]) register as native; other callbacks register as web. This avoids OIDC providers defaultin