@lcv-ideas-software/deepseek-cli

v0.3.2

Published

6 days ago

Standalone DeepSeek API agentic CLI with Ink/React startup UI, slash commands, MCP host capability, durable sessions, diagnostics, DeepSeek V4 controls, and the LCV hard-gate MCP allowlist.

0High
0Medium
0Low

lcv-leo

cli agent deepseek ai mcp model-context-protocol cross-review

deepseek-cli

Standalone DeepSeek API agentic CLI with first-class MCP host support, durable sessions, diagnostics, and DeepSeek V4 controls.

Install. npm install -g @lcv-ideas-software/deepseek-cli (npmjs.com) or npm install -g @lcv-ideas-software/deepseek-cli --registry=https://npm.pkg.github.com (GitHub Packages mirror).

Status. Alpha. Current release: v00.03.02 (npm package 0.3.2). See CHANGELOG.md for the release history. Public tags follow the organization display-tag standard (v00.00.00) while npm packages keep SemVer (0.x.y).

The version history at a glance:

| Release | Scope | |---|---| | v00.03.02 | Site sponsor card iteration. site/index.html GitHub Sponsors iframe (caixa branca cross-origin) substituído por link card dark navy com ❤ pink + meta cyan + seta animada; card movido para DEPOIS dos botões (lcv.dev/sponsor primário, GitHub Sponsors alternativa). Companion ship Phase 3 (12 repos). | | v00.03.01 | Patch — site/index.html visual identity refresh. GitHub Pages sponsor page reskin to the new LCV org dark-first navy/cyan visual identity (palette #050b18/#38bdf8/#34d399, radial gradients, glow shadows, gradient text on h1). Coordinated companion ship with cross-review-v1 1.12.9, cross-review-v2 v2.18.7, grok-cli 1.6.2, sponsor-motor APP v01.02.02, and .github-org/site (org root + /sponsor). No change to the published npm tarball (files[] does not include site/); only the GitHub Pages page changes. Patch bump (no public surface change). | | v00.03.00 | Ink/React startup UI + runtime MCP self-awareness. Added the rich dashboard, interactive slash commands, model-visible host MCP tools, loaded-server/version reporting, corrected hard-gate MCP runtime config, and expanded smoke coverage for Ink rendering, MCP host tools, version drift, and secret-leak guards. | | v00.02.00 | Agent foundation + full MCP host support. Added DeepSeek V4 defaults, operational commands, sessions, planning, verification, output formats, beta helpers, stdio/HTTP/SSE MCP transports, MCP inventory, remote-auth helpers, and expanded validation. | | v00.01.02 | CodeQL regex hardening. Replaced the endpoint trailing-slash regex with a non-regex loop to close the js/polynomial-redos finding without changing behavior. | | v00.01.01 | Governance + public package hygiene. Added funding, Pages sponsorship site, public formatting workflow, CODEOWNERS, SECURITY, THIRDPARTY, CONTRIBUTING, and package-file coverage. | | v00.01.00 | Initial standalone MCP-host release. Forked the embedded cross-review-v1-deepseek-cli into the standalone deepseek binary with the operator-mandated 4-server MCP allowlist and baseline smoke checks. |

deepseek-cli started as a standalone MCP host forked from the embedded cross-review-v1-deepseek-cli. The embedded peer subprocess still ships inside cross-review-v1; this repository ships the standalone deepseek binary. They coexist by design.

What It Does

deepseek-cli is now a real terminal agent foundation rather than only a thin prompt wrapper:

Headless API runs from stdin or --prompt, with text, json, and jsonl output.
DeepSeek V4 defaults: deepseek-v4-pro by default, deepseek-v4-flash in the local catalog, and legacy alias warnings for deepseek-chat / deepseek-reasoner.
Ink/React startup UI: running deepseek in a TTY opens a rich local dashboard with runtime, auth, MCP, sessions, git/workspace, model, and slash-command hints.
Interactive slash commands: /help, /dashboard, /status, /models, /mcp, /sessions, /plan, /verify, /login, /clear, and /exit.
Streaming, JSON mode, strict tools, prefix completion, and FIM exposed as CLI flags/commands.
Durable local sessions via --session new|latest|id and deepseek sessions.
Operational commands: status, models, plan, verify, login, and mcp.
Full MCP host support for stdio, Streamable HTTP, and legacy SSE transports, including headers/env placeholders, loaded-runtime status, serverInfo/version reporting, tool listing, add/remove, and bounded model tool-call loops.
MCP self-awareness for the model through built-in host tools: deepseek_cli_status, deepseek_mcp_servers, and deepseek_mcp_tools.
Safe auth posture: API key from DEEPSEEK_API_KEY; no browser-cookie reuse, private web endpoints, or subscription emulation.

deepseek
deepseek dashboard --live
echo "Explain this repo in JSON" | deepseek --json-mode --output-format json
deepseek models --json
deepseek status --json
deepseek verify --dry-run --no-write --json

Startup UI and Slash Commands

deepseek with no prompt now starts the Ink/React dashboard and interactive shell when stdin/stdout are TTYs. The dashboard is local by default, so it does not spend API calls just to start. Use deepseek dashboard --live when you want a live /models and /user/balance probe.

Inside the shell, normal text is sent as a DeepSeek prompt. Slash commands run local CLI operations:

/help
/dashboard --live
/status
/models --json
/mcp status
/mcp versions
/mcp tools
/sessions list
/plan improve MCP diagnostics
/verify --dry-run --no-write
/exit

Automation remains headless-safe:

deepseek dashboard --json --no-color --no-ink
deepseek --no-banner

DeepSeek API Support

The runtime follows the official DeepSeek API surfaces:

Chat completions at https://api.deepseek.com/chat/completions.
GET /models and GET /user/balance through deepseek models --live and deepseek status.
JSON mode through response_format: { "type": "json_object" }.
Function/tool calls, with --strict-tools routed through the beta base URL.
Chat prefix completion through deepseek prefix.
FIM completion through deepseek fim with the beta completions endpoint.

Commands

deepseek [options]
deepseek dashboard [--json] [--live] [--no-color] [--no-ink]
deepseek interactive [--no-color] [--no-ink]
deepseek login
deepseek status [--json]
deepseek models [--json] [--live]
deepseek plan [prompt...] [--json]
deepseek verify [--json] [--dry-run] [--no-write]
deepseek sessions <list|show|clear> [args]
deepseek mcp <list|status|loaded|versions|show|tools|test|add|remove> [name] [--json]
deepseek prefix --prompt "Write quicksort" --prefix "```js\n"
deepseek fim --prefix-file before.js --suffix-file after.js

Common headless flags:

--model <id>
--prompt <text>
--prompt-stdin
--stream
--json-mode
--strict-tools
--output-format <text|json|jsonl>
--session <new|latest|id>
--peer-review-mode
--disable-mcp
--mcp-config <path>
--allowed-mcp-server-names <name>
--allow-all-mcp-servers

MCP

deepseek-cli supports the MCP transports expected by modern agent CLIs:

stdio
http / streamable_http using the official StreamableHTTPClientTransport
legacy sse endpoints using the official SSEClientTransport

The default config remains intentionally restricted to the operator-mandated hard-gate allowlist:

ultrathink
code-reasoning
cross-review-v1
cross-review-v2

Adding a 5th server to the default host policy still requires explicit operator approval. The runtime, however, can load full MCP configs when the operator supplies --mcp-config, DEEPSEEK_MCP_CONFIG, or --allow-all-mcp-servers.

Example:

{
  "mcpServers": {
    "docs": {
      "type": "streamable_http",
      "url": "https://example.com/mcp",
      "headers": {
        "Authorization": "Bearer ${env:DOCS_MCP_TOKEN}"
      }
    },
    "local-tools": {
      "type": "stdio",
      "command": "node",
      "args": ["server.js"],
      "env": {
        "LOCAL_TOKEN": "${env:LOCAL_TOKEN}"
      }
    }
  }
}

deepseek mcp list --mcp-config ./mcp.json --allow-all-mcp-servers
deepseek mcp status --mcp-config ./mcp.json --allow-all-mcp-servers --json
deepseek mcp versions --mcp-config ./mcp.json --allow-all-mcp-servers --json
deepseek mcp tools docs --mcp-config ./mcp.json --allow-all-mcp-servers
deepseek mcp test docs --mcp-config ./mcp.json --allow-all-mcp-servers --json
deepseek mcp add docs --mcp-config ./mcp.json --type streamable_http --url https://example.com/mcp --header "Authorization=Bearer ${env:DOCS_MCP_TOKEN}"
deepseek mcp remove docs --mcp-config ./mcp.json

mcp list is configuration inventory. mcp status / mcp loaded connect the servers and report what actually loaded. mcp versions reports protocol serverInfo and calls server_info / runtime_capabilities when a server exposes them.

During normal prompt execution, the model can also call local host-introspection tools:

deepseek_cli_status
deepseek_mcp_servers
deepseek_mcp_tools

So questions such as “which MCP servers are loaded?”, “what version is cross-review-v2?”, or “what MCP tools can you call?” are answered from runtime evidence rather than from model memory.

Environment

| Variable | Purpose | |---|---| | DEEPSEEK_API_KEY | Required for API calls. | | DEEPSEEK_BASE_URL | API base URL override. | | DEEPSEEK_MODEL | Default model override. | | DEEPSEEK_REASONING_EFFORT | high or max (default max). | | DEEPSEEK_THINKING | enabled or disabled (default enabled). | | DEEPSEEK_MAX_TOKENS | Token budget (default 8192). | | DEEPSEEK_TIMEOUT_MS | Request timeout (default 1200000). | | DEEPSEEK_STREAM | Enable streaming by default. | | DEEPSEEK_JSON_MODE | Enable JSON mode by default. | | DEEPSEEK_STRICT_TOOLS | Enable DeepSeek beta strict tools by default. | | DEEPSEEK_OUTPUT_FORMAT | text, json, or jsonl. | | DEEPSEEK_HOME | Local state root (default ~/.deepseek). | | DEEPSEEK_SESSION_DIR | Session storage override. | | DEEPSEEK_MCP_CONFIG | MCP config JSON path. | | DEEPSEEK_ALLOWED_MCP_SERVERS | Comma-separated allowlist override. | | DEEPSEEK_DISABLE_MCP | Disable MCP tool loading. | | DEEPSEEK_MAX_TOOL_TURNS | Max internal MCP tool-call rounds. | | DEEPSEEK_SYSTEM_PROMPT | System prompt override. | | DEEPSEEK_NO_INK | Disable Ink/React dashboard rendering. | | DEEPSEEK_NO_COLOR / NO_COLOR | Disable colorized dashboard output. | | DEEPSEEK_BANNER | Set to 0/false to keep old no-prompt headless error behavior. |

Development

npm test
node dist/index.js verify --dry-run --no-write --json
npm audit --audit-level=moderate
npm pack --dry-run

This repository is currently dist-first. Runtime edits belong in dist/index.js until a future source tree is introduced.

Release Automation

The repository follows the same automation baseline as grok-cli, cross-review-v1, and cross-review-v2:

Do not publish from the workstation.
Pushes to main run CI and CodeQL.
auto-tag.yml creates the padded display tag (v00.00.00) from package.json.
The padded tag dispatches publish.yml.
publish.yml publishes to npmjs.com with npm Trusted Publishing / OIDC provenance, without NPM_TOKEN.
The same workflow mirrors the package to GitHub Packages.
Pages deploy from site/ to https://deepseek-cli.lcv.dev/.
Dependabot watches npm and GitHub Actions daily.

License

Apache-2.0. See LICENSE, NOTICE, and THIRDPARTY.md.

Published

Vulnerabilities

Links

Maintainers

Keywords

Readme