dsh-mcp-console

An MCP server manager for DeepSeek Harness. One page in the sidebar: add, edit, enable/disable, sign in, import/export, and diagnose MCP servers.

Features

• One list, real state. Green = connected, yellow = needs sign-in, grey = starting, red = unreachable, no dot = disabled. Rows sort by name or by status.
• Live changes. Servers live in the profile patch (cordis.patch.yml) as insert entries; every edit is written there and re-applied through the loader, so no restart is needed.
• OAuth 2.1 (authorization code + PKCE) for HTTP servers that answer 401: RFC 9728 protected-resource metadata, dynamic client registration, loopback callback, token written back as an Authorization header.
• JSON import/export. Paste a Claude/Codex {"mcpServers": {...}}, a server array, or DSH patch rows; export all servers back in the same shape.
• View log. In the row menu: one-shot initialize + tools/list for HTTP servers, or a 6-second stdout/stderr capture for stdio servers, printed as a timestamped transcript with the OAuth metadata when it matters.

Install

Add to ~/.dsh/profiles/<profile>/package.json:

"dependencies": {
  "dsh-mcp-console": "https://github.com/shutongX/dsh-mcp-console/releases/download/v0.1.0/dsh-mcp-console-0.1.0.tgz"
}

and append "dsh-mcp-console" to dsh.profile.bundles, then restart DSH.

The tarball bundles its only runtime dependency (yaml).

Open the panel

The panel registers itself as a sidebar entry named MCP. If you want it elsewhere, change the order in lib/client.js (sidebar.panellist registration).

Notes and limits

• OAuth tokens are stored in clear text inside cordis.patch.yml, because the official MCP client only accepts static headers. Keep that file to yourself.
• No token refresh yet. When a token expires the row returns to "needs sign-in"; clicking the button again re-authorizes (the first round trip registers a client, later ones reuse it).
• Servers are written into a marker-delimited block (# >>> dsh-mcp-console:begin). Other entries in that file are left untouched, including rows written by other plugins.
• Tested with DSH 0.2.1 on Windows (the desktop build does not hot-apply profile config, so installs and upgrades need an app restart).

Development

Pure ESM JavaScript, no build step.

File	Role
lib/index.js	host half: patch block I/O, status probe, OAuth routes, import/export, diagnostics
lib/oauth.js	discovery, DCR, PKCE, loopback callback, token exchange
lib/client.js	web bundle, wrapped in window.__ModuleLoader__.load
node_modules/yaml	vendored, shipped through bundledDependencies

To hack on it, link the folder into a profile ("dsh-mcp-console": "link:<path>" + bundles) and restart.

License

BSD-3-Clause.