dsh-mcp-proxy

Context-cheap MCP access for DeepSeek Harness.

The shipped dsh-mcp-client registers every tool of every configured server on ctx.tools, so a handful of MCP servers puts hundreds of JSON schemas into the system prompt of every request — whether or not the model ever calls one.

This plugin registers exactly two tools regardless of how many servers you configure, and reaches those servers lazily. The standing prompt cost is constant in the number of MCP tools available.

Install

dsh plugin --profile web add dsh-mcp-proxy

Then declare your servers by overriding the row (the shipped row has none — see Trust).

What the model sees

| Tool | Purpose | |---|---| | mcp_discover | Search the tool catalog by keyword; returns each hit's server, name, description, and argument names | | mcp_call | Invoke one tool by server and name, passing arguments through unchanged |

The catalog is cached on disk, so mcp_discover answers from a cold start without connecting to anything, and keeps answering when a server is temporarily down.

How it behaves

• Nothing connects at boot. A server is contacted on first discovery or first call.
• A warm connection is reused across calls and closed after idleDisconnectMs of silence. Concurrent calls share one handshake.
• One unreachable server degrades discovery instead of failing it: the model gets the servers that answered, plus a named reason for each that did not.
• A tool-reported failure is a successful result carrying isError: true, so a Code Mode caller branches on the flag rather than parsing prose. Only transport and protocol failures are tool errors.
• Catalog entries for servers you removed are pruned at load, so a renamed server stops advertising tools nothing can call.
• A corrupt cache file starts empty rather than stopping the harness from booting — it is a derived cache, not a source of truth.
• Disposal closes every connection and clears every timer.

Configuration

- id: mcp-proxy
  name: dsh-mcp-proxy
  config:
    cachePath: !!js dshHomePath('mcp-proxy/catalog.json')
    catalogTtlMs: 86400000
    idleDisconnectMs: 300000
    connectTimeoutMs: 30000
    callTimeoutMs: 60000
    discoverLimitDefault: 15
    discoverLimitMax: 50
    servers:
      - name: github
        transport: stdio
        command: npx
        args: ['-y', '@modelcontextprotocol/server-github']
        env:
          GITHUB_TOKEN: !!js process.env.GITHUB_TOKEN

      - name: internal
        transport: streamable-http
        url: http://localhost:3000/mcp
        headers:
          Authorization: !!js `Bearer ${process.env.MCP_TOKEN}`

| Field | Default | Meaning | |---|---|---| | servers | [] | The servers this deployment can reach. Names are [A-Za-z0-9_-]{1,32} and must be unique | | cachePath | — (required) | JSON file caching each server's tool list | | catalogTtlMs | 86400000 (1 day) | Age at which a cached catalog is refetched on the next discovery | | idleDisconnectMs | 300000 (5 min) | Idle period after which a warm connection closes | | connectTimeoutMs | 30000 | Bound on one MCP handshake | | callTimeoutMs | 60000 | Bound on one callTool request | | discoverLimitDefault | 15 | Hits returned when the model omits limit | | discoverLimitMax | 50 | Hard cap, whatever the model asks for |

Trust

servers ships empty on purpose. Every MCP server command is trusted executable code running outside the agent sandbox, so no package may enable one on a user's behalf. The shipped harness makes the same choice for dsh-mcp-client.

This plugin adds no approval gate of its own. Gate mcp_call the way you gate any other tool — a tools/pre-execute listener, ctx.tools.guard(), or the permission presets — so the policy stays in one place instead of forking per transport.

Running alongside dsh-mcp-client

Supported, and often the right setup: promote the two or three servers whose tools you want natively visible (so the model calls them without a discovery round trip) to dsh-mcp-client rows, and leave the long tail behind this proxy. Tool names do not collide — dsh-mcp-client registers mcp__<server>__<tool>, this plugin registers only mcp_discover and mcp_call.

Trade-off

A proxy costs the model one extra round trip when it does not already know the tool name, and hides the tool's full JSON schema behind argument names. That is the deliberate exchange: constant prompt cost, at the price of discovery latency on first use. If you have one MCP server with four tools, dsh-mcp-client is the better fit.

Alternative worth knowing

The harness's own idiom for progressive disclosure is ctx.tools.restrict(), which masks a registered tool set per agent. That path keeps full schemas for the visible subset but still requires connecting at boot to enumerate. This plugin chooses the proxy shape instead so that nothing connects until the model asks — the property that matters when a deployment configures a dozen servers it rarely uses.

Development

pnpm install --ignore-workspace
pnpm run typecheck
pnpm test
pnpm run build

The suite runs against a real MCP stdio server (tests/fixture-server.mjs) over the real SDK transport, so it covers handshakes, listing, calling, tool-level failures, unreachable servers, and catalog persistence without depending on any third-party server.

License

MIT

Prior art

The context-saving proxy idea comes from pi-mcp-adapter (MIT) in the Pi ecosystem. This is an independent implementation against Harness extension points and shares no code with it; it covers the lazy-connection and proxy-tool core, not pi-mcp-adapter's OAuth flows, tool promotion, or /mcp configuration panel.