LKMeng2001/dsh-mcp-market

dsh-mcp-market

An MCP server marketplace inside DeepSeek Harness: browse a curated catalog and install MCP servers into the running profile with one click — live, no restart (powered by the official @deepseek-ai/dsh-mcp-client and the loader service).

Open Settings → MCP Market, search, click, done. The model immediately sees mcp__<serverName>__<tool> tools.

Features

• Browse / search / filter a bundled catalog (15 servers, every one verified usable), zh/en descriptions
• npm existence verification: every stdio entry is checked against registry.npmjs.org at load time; packages removed from the registry are greyed out and blocked from install (guards against dead entries and typosquat canaries)
• One-click install for stdio (local process) and streamable-http (remote URL); fill in command / args / env / url / headers before installing
• Hot activation via ctx.loader.create() — no restart; config persists across restarts
• Installed list with enable/disable, config edit (HMR reconnect), and uninstall
• Manual “add a server” form for anything not in the catalog
• Offline fallback: remote registry JSON with an in-memory cache and a bundled snapshot
• Clean persistence: installs only touch a # --- dsh-mcp-market managed --- block in the profile’s cordis.patch.yml; your own edits are preserved verbatim

Install

# from npm (for everyone)
dsh plugin --profile web add dsh-mcp-market

# from a local checkout (dev only — replace the path with yours)
dsh plugin --profile web add "D:\path\to\dsh-mcp-market"

# update
dsh plugin --profile web update dsh-mcp-market

# remove
dsh plugin --profile web remove dsh-mcp-market

Restart dsh web, then open Settings → MCP Market.

Development

npm install
npm run build        # tsc host → lib/, esbuild client → client/client.js
npm run typecheck

After changes: npm run build, restart dsh web (host changes; client changes can use a dev watcher).

Registry source

Live catalog: fetched from the GitHub Pages URL https://LKMeng2001.github.io/dsh-mcp-market/servers.json (canonical source is docs/servers.json in this repo — edit and push to update globally, no release needed), falling back to the bundled data/registry-snapshot.json (generated from docs/servers.json by npm run sync:catalog). A CI workflow checks every npm package in the catalog daily. Override per profile via the plugin config (registryUrl). Entry schema and the HTTP route/loader design are documented in README.zh.md.

Security

• Every mutating route is a same-origin POST with Origin checks
• MCP servers are third-party code/services: stdio servers spawn a local child process — install only sources you trust
• Config (incl. env) is stored in plaintext in the profile’s cordis.patch.yml; keep secrets out or encrypt before writing

License

MIT