dsh-wind-aifin

dsh-wind-aifin

Credential-safe [Wind AIFin](https://aifinmarket.wind.com.cn/) integration for

[DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) (DSH).

[简体中文](./README.zh-CN.md)

What it provides

• Seven official Wind Streamable HTTP MCP domains are connected through DSH's

own @deepseek-ai/dsh-mcp-client and exposed as native tools:

wind_stock, wind_fund, wind_index, wind_bond, wind_docs,

wind_economic, and wind_analytics.

• wind_alice invokes Wind Alice's professional financial-analysis workflows,

including fact checking, company one-pagers, earnings reviews, screening,

macro, bond, credit, fund, market-sizing, and comparable-company analysis.

• Two runtime Skills teach the agent how to route requests without putting an

API key or shell commands into the prompt.

• A Settings namespace declares WIND_API_KEY as a DSH credential reference.

Why a plugin is needed

DSH intentionally removes credential-shaped environment variables from

model-visible shell processes. Putting WIND_API_KEY in the host environment

therefore does not make the official Wind CLI available to an Agent's Bash

tool—and copying the key into the workspace would defeat the boundary.

This plugin resolves the credential inside the trusted host process. Wind MCP

traffic passes through a random, loopback-only adapter that injects the Bearer

token and then delegates protocol handling and tool registration to DSH's MCP

client. Alice resolves the same credential per operation. The key is never

returned to the model, stored in plugin configuration, or exposed to ordinary

Bash commands.

Install

DSH 0.1.0-rc.8 or newer is recommended.

dsh plugin --profile web add github:Xiamu-ssr/snowmountain-market

Restart the profile after installation. Install into another profile by

replacing web with that profile's name.

Configure

Create a Wind AIFin API key at the

[Wind developer portal](https://aifinmarket.wind.com.cn/#/user/overview), then

store it as the DSH credential reference WIND_API_KEY using the Credentials

page. A deployment may instead provide WIND_API_KEY in the trusted DSH launch

environment.

Do not put the key in a workspace file, Skill file, prompt, MCP headers in

cordis.patch.yml, or a model-visible shell profile.

Tool names

MCP tools follow DSH's standard qualified naming convention:

| Domain | Prefix |

| --- | --- |

| Stocks | mcp__wind_stock__ |

| Funds and ETFs | mcp__wind_fund__ |

| Indices and sectors | mcp__wind_index__ |

| Bonds | mcp__wind_bond__ |

| Filings and financial news | mcp__wind_docs__ |

| Macro and industry indicators | mcp__wind_economic__ |

| Cross-asset analytics | mcp__wind_analytics__ |

Wind Alice is exposed as wind_alice and accepts a prompt plus an optional

professional workflow name.

Security and data flow

• The credential adapter listens only on 127.0.0.1 and uses an unguessable

per-process route.

• The adapter accepts only the seven fixed Wind endpoints; users cannot turn it

into a general authenticated proxy.

• Credentials are resolved for each request and are not cached in files.
• Financial requests and selected context are sent to Wind's service. Review