dsh-cert-mcp

Read-only MCP server that exposes the dsh-plugin-certification registry: certification grades, snapshot dates and five-dimension evidence for DeepSeek Harness (DSH) plugins. Zero runtime dependencies, stdio transport.

Tools

| Tool | Input | Returns | |---|---|---| | get_certification | owner, repo | Full certification record (grade, snapshot, five dimensions, veto, notes) or "no record" | | list_certified | — | Every entry in the public registry: repo / grade / snapshot | | certification_spec | — | Spec v1 summary: five dimensions, grade scale, veto rule |

The embedded snapshot lives in data/certified.json (synced from the certification repo) and the server refreshes it from the public registry at most once per five minutes. No writes, no secrets, no code execution.

Install

git clone https://github.com/PerryLink/dsh-cert-mcp
cd dsh-cert-mcp
node src/index.js        # stdio server

Run it directly from the published npm package: npx @perrylink/dsh-cert-mcp.

Register in an MCP client

Claude Code:

claude mcp add dsh-cert -- node <path-to-repo>/src/index.js

Claude Desktop (claude_desktop_config.json):

{
  "mcpServers": {
    "dsh-cert": {
      "command": "node",
      "args": ["<path-to-repo>/src/index.js"]
    }
  }
}

DSH: add it through dsh-mcp-panel as a stdio server, or any MCP client that supports stdio.

Why this exists

The official DeepSeek Harness repository does not run a plugin registry and does not accept external PRs; discovery happens through the dsh-plugin GitHub topic and community lists, none of which certify anything. dsh-plugin-certification turns "can I install this plugin" into a reproducible five-dimension check (manifest, build hygiene, supply-chain Scorecard, release provenance, sandboxed install smoke test) with a public registry and README badges. This MCP server is the same data with an agent-facing interface: agents can look up a plugin's certification before recommending or installing it.

Registry

Data source: PerryLink/dsh-plugin-certification — data/certified.json, spec v1.

Development

node test/smoke.mjs

License

Apache-2.0. A listing or grade is an evidence record, not a security guarantee: plugins run inside your DSH process with your permissions.