Apache-2.0 的模型无关 MCP 服务器，向 DeepSeek Harness 以 MCP 客户端方式暴露 18 个编码工具（文件、补丁、执行、git）——每台服务器一个工作区，由权限模式管控。
DSH 适配
兼容
作者声明
安全审计
未审计
最后核验
2026-08-21
许可证
Apache-2.0
01它能帮你完成什么？
Turn a DeepSeek Harness chat into a coding agent with real repository access
File reading and search, structured multi-file patches, command execution, interactive sessions and git operations — all confined to one workspace
Developers who want to give an existing chat/agent subscription real repo access without an extra product
Let an agent work on untrusted code inside a disposable sandbox
A containerized Docker server with toolchains and caches preconfigured, bounded to one workspace and gated by permission modes
Engineers reviewing sketchy PRs or running genuinely untrusted workloads safely
Code on your own machine from anywhere via an authenticated tunnel
Loopback-bound server exposed over an authenticated HTTPS tunnel (cloudflared / ngrok / Microsoft Dev Tunnel) with bearer tokens and OAuth 2.1 + PKCE
Developers who want to drive their home workstation from a phone or another device
02如何接入 DeepSeek Harness？
前置条件
- Python ≥ 3.11 (the server is published on PyPI), or a Node toolchain to use the npm launcher
- An MCP client (e.g. DeepSeek Harness) able to consume the standard mcpServers JSON config
安装步骤
- 01
Start the server with the Python toolchain: `uvx coding-tools-mcp --stdio --workspace /path/to/repo`
- 02
Or with the Node toolchain: `npx coding-tools-mcp --stdio --workspace /path/to/repo` (a thin launcher that starts it via `uv` or `pipx`)
$ npx coding-tools-mcp --stdio --workspace /path/to/repo
- 03
Add the MCP client config: `{ "mcpServers": { "coding-tools": { "command": "uvx", "args": ["coding-tools-mcp", "--stdio", "--workspace", "/path/to/repo"] } } }`
- 04
Optional HTTP: drop `--stdio` and the server speaks Streamable HTTP on `http://127.0.0.1:8765/mcp`
验证接入成功
作者未说明
03DSH 适配与能力边界
Model-neutral MCP server (stdio or Streamable HTTP) that DeepSeek Harness drives as an MCP client to get coding tools
File & search tools with atomic patching
a single workspace root→read_file · list_dir · list_files · search_text · apply_patch · view_image
apply_patch writes files — it is the sole file-mutation primitive, staged, baseline-checked, atomic across files, with rollbackCommand execution with interactive sessions
workspace-bound commands→exec_command · write_stdin · read_output · kill_command · request_permissions, with PTY REPL/debugger support
runs shell commands with workspace-bound cwd, scrubbed environment, timeouts and output caps; network/shell-expansion gated by permission modesGit inspection tools
the workspace repository→git_status · git_diff · git_log · git_show · git_blame
Safety boundary with permission modes
a chosen mode — safe (default) / trusted / dangerous→command policy gating network access, shell expansion, inline scripts and destructive commands; path boundaries enforced
sends anonymous usage telemetry by default (disable with CODING_TOOLS_MCP_TELEMETRY=off or DO_NOT_TRACK=1)
04适合谁？何时不该用？
适合
- Developers who want to give an existing chat/agent subscription real repo access without an extra product
- Engineers reviewing sketchy PRs or running genuinely untrusted workloads safely
- Developers who want to drive their home workstation from a phone or another device
不适合
- The safety boundary is not a complete OS sandbox. On Linux, Landlock adds kernel-level filesystem confinement, but other platforms only get an explicit warning — use the Docker image or a VM for genuinely untrusted work.
05兼容性、维护与安全提示
- The safety boundary is not a complete OS sandbox. On Linux, Landlock adds kernel-level filesystem confinement, but other platforms only get an explicit warning — use the Docker image or a VM for genuinely untrusted work.
- Requires Python ≥ 3.11 at runtime; the npm package is only a launcher that starts the Python server via uv or pipx, so a Python toolchain (or one it installs) is still needed.
- The server sends anonymous usage telemetry (per-tool success/latency counters and version/platform dimensions — never paths, arguments, commands or file contents) unless disabled.
Apache-2.0 · actively maintained (latest release v0.3.0, 2026-08-13)
06常见问题
DeepSeek Harness 如何接入 Coding Tools MCP？
以 MCP 客户端方式接入。用 `uvx coding-tools-mcp --stdio --workspace /path/to/repo`（或 `npx`）启动服务器，然后在客户端配置里加上标准的 mcpServers JSON 块。任何 MCP 客户端——包括 DeepSeek Harness——都能获得相同的 18 个工具。
这是原生集成还是 MCP？
是 MCP。它是一个模型无关的 MCP 服务器，通过 stdio 或 Streamable HTTP 提供服务；DeepSeek Harness 像驱动其他 MCP 客户端一样驱动它，并没有 dsh 专属的原生运行时。
运行它需要什么？
来自 PyPI 的 Python ≥ 3.11（通过 uvx/pipx），或者用 npm 启动器经 uv 或 pipx 拉起。若要 HTTP，去掉 --stdio，它会监听 http://127.0.0.1:8765/mcp。
它是如何沙箱化的，有什么限制？
每台服务器一个工作区根目录；拒绝绝对路径、.. 目录穿越和符号链接逃逸，权限模式管控网络、shell 展开、内联脚本和破坏性命令。在 Linux 上，Landlock 提供内核级文件系统隔离。它不是完整的操作系统沙箱，处理不可信代码请用 Docker 或虚拟机。
它会把我的数据发到别处吗？
只有匿名使用遥测（每个工具的成功率/延迟计数，以及版本/平台维度——绝不包含路径、命令或文件内容）。用 CODING_TOOLS_MCP_TELEMETRY=off 或 DO_NOT_TRACK=1 关闭；在 CI 中默认关闭。
07相关的 DSH 工作流
ruflo
作者 ruvnet
原版智能体元框架（meta-harness）：支持多智能体集群部署、自主工作流编排与对话式 AI 系统构建，内置自适应记忆、自学习智能与 RAG 检索，原生集成 Claude Code / Codex / Hermes 等大量工具。
reactive-resume
作者 amruthpillai
注重隐私的开源简历生成器，安全、可定制、可移植，永久免费，支持自托管。
everos
作者 evermind-ai
为所有 AI 智能体提供的便携统一记忆层，本地优先、Markdown 原生、数据归用户所有，跨应用与工作流自进化。
yao
作者 yaoapp
在桌面、移动端、浏览器或 API 上统一管理你的智能体与工作区，看板式任务追踪，支持自托管。
08数据与来源
file reading and search, structured multi-file patches, command execution, interactive sessions, and git — one server th…
Wire it into Claude Desktop, Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, or Cline — the JSON is the same…
页面基于项目公开文档、仓库元数据和 DSH Plugins 的结构化解析生成；最后核验于 2026-08-21。发现错误？提交更正。
最佳 DeepSeek Harness 插件
从全目录挑出的 12 个值得优先安装的插件，覆盖各个分类。