Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

dsh-baton

NPM · DSH-BATON-MCP

Hand tasks from Claude Code, Codex or any MCP client to a local DeepSeek Harness.

Available components

64 Trust /100

Last scanned (1 hour ago)

Scores higher than 37% of npm servers

Category AI and Machine Learning

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security50
  • Malware scan not yet available for this package.Unverified
  • No known CVEs affecting this package version or its production dependencies.Pass
  • No install/post-install scripts declared.Pass
  • No production dependencies, so there is no dependency health to assess. View diagnostics → Pass
Provenance & Transparency97
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Cryptographically verified build provenance (signed, bound to JialaoLiu/dsh-baton). View diagnostics → Pass
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 0 days ago).Pass
  • Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability71
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 1938 tokens (~161/item across 12 items; 12 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management3
  • Stability observed for 1 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
  • An AI judge read all 13 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities60
  • Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. See how to fix → Fail
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 23 Oct 26 −3
    • Malware scan: pass → unverified ▼ security
    • Known CVEs: unverified → pass ▲ security
    • Schema quality: pass → fail ▼ functional
    • Dependency health: unverified → pass ▲ functional
    • Schema quality: good → excellent functional
    • Destructive annotations: All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation. functional
    • Package version: 0.5.4 → 0.5.7 functional
  • 22 Oct 26 67

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 23 Oct 2026 · Analysed npm/dsh-baton-mcp@0.5.7

Provenance Verified

A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.

Result Verified
Ecosystem npm
Reason Verified
Discovered via Registry attestation endpoint
Source repo JialaoLiu/dsh-baton
Certificate issuer https://token.actions.githubusercontent.com
Certificate SAN https://github.com/JialaoLiu/dsh-baton/.github/workflows/release.yml@refs/tags/v0.5.7
Rekor log index 3411720369
Predicate type SLSA build provenance https://slsa.dev/provenance/v1
Subject digest sha512:8bfdcfb755a05653600a2aa3654ea0d394f16d271f73bb0306d13e00febb548a41d83918e0916b598085180e0052ddb9c0e7b853977c37aaa8764c80c

Background: How many MCP packages publish verified provenance →

Dependencies 0 packages
Packages resolved 0
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 12 exposed · ~1,759 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
dsh_cancel ~175

Stop everything a session is doing (running turn, sub-agents, background jobs, reminders), by run_id or session_id; the session itself is kept, and this is the only tool that stops work. It retries a few times until the session is quiet, then returns session_id, run (when run_id was given), attempts, still_busy, activity (whatever is still going) and queued_runs. Messages still waiting in the queue are not removed. Safe to repeat: on an idle session it does nothing and returns still_busy: false. Use dsh_session_activity first to see what would be stopped.

NameTypeReqDescription
run_idstring–Run id from dsh_send; stops the session that run belongs to
session_idstring–Session id, to stop work dsh-baton did not start

No output schema declared.

No examples provided.

dsh_create_workspace ~136

Add a folder to the DeepSeek Harness sidebar as a workspace without starting a session; dsh_list_workspaces only lists existing ones, and dsh_send with a cwd registers the folder by itself. Creates the folder unless create_dir is false. Idempotent: an already registered folder returns its existing workspace. Returns id, path, title and created (false when it already existed). Needs the dsh-baton-host plugin.

NameTypeReqDescription
create_dirboolean–Create the folder if missing
pathstringyesAbsolute folder path (~ allowed)
titlestring–Sidebar title; defaults to the folder name

No output schema declared.

No examples provided.

dsh_list_runs ~98

List the runs sent through dsh_send (the latest 100 are kept), newest first, to recover a lost run_id or review past hand-overs; dsh_list_sessions lists Harness sessions instead. Returns run_id, session_id, state, started_at, ended_at, message_preview, final_text and error for each; dsh_status shows one run in detail. Read-only.

NameTypeReqDescription
limitinteger–Max runs returned

No output schema declared.

No examples provided.

dsh_list_sessions ~176

List saved DeepSeek Harness sessions (conversations), newest first, to find a session_id; dsh_list_runs lists only the messages sent through dsh_send. Returns session_id, title, cwd, updated_at, running and bridge_runs (active dsh-baton run ids) for each. There is no paging: the list stops at limit, so to see older sessions raise limit or narrow it with cwd or query. Read-only. Sessions not in dsh_list_sessions are archived or gone: do not look for them on disk.

NameTypeReqDescription
cwdstring–Only sessions of this workspace folder
include_subagentsboolean–Also list sub-agent sessions
limitinteger–Max sessions returned
querystring–Case-insensitive text to match in title, folder or session id

No output schema declared.

No examples provided.

dsh_list_workspaces ~84

List the workspaces (project folders) in the DeepSeek Harness sidebar; dsh_list_sessions lists the sessions inside them and dsh_create_workspace adds one. Returns id, path, title and session_count for each; the id is the workspace_id for dsh_send and dsh_rename_workspace. Read-only. Needs the dsh-baton-host plugin.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

dsh_read_session ~133

Read what was said in one session (its past messages), to catch up before continuing it; dsh_session_activity shows what it is doing now and dsh_status follows one run. Returns title, cwd, total_messages and the last messages, each with role (user or assistant), time, text and the names of tools the assistant called (tool output is not included). Read-only.

NameTypeReqDescription
lastinteger–How many of the most recent messages to return; total_messages tells how many there are
session_idstringyesSession id from dsh_list_sessions, e.g. session-…

No output schema declared.

No examples provided.

dsh_rename_session ~112

Set the title of one DeepSeek Harness session (a conversation); dsh_rename_workspace renames a workspace (project folder) instead. Only the title changes; the conversation and any running turn are untouched. Can be called again at any time to change it back or to something else. Returns session_id and the saved title.

NameTypeReqDescription
session_idstringyesSession id from dsh_list_sessions
titlestringyesNew title; surrounding spaces are trimmed and it must not be empty

No output schema declared.

No examples provided.

dsh_rename_workspace ~126

Set the sidebar title of a DeepSeek Harness workspace (project folder); dsh_rename_session renames a single session instead. The folder on disk is not moved or renamed. Identify it by workspace_id or path. Can be called again to change it back. Returns id, path and the saved title.

NameTypeReqDescription
pathstring–Workspace folder, used when workspace_id is not given
titlestringyesNew title; surrounding spaces are trimmed and it must not be empty
workspace_idstring–Workspace id from dsh_list_workspaces

No output schema declared.

No examples provided.

dsh_send ~279

Send a message to a DeepSeek Harness session and return at once with a run_id, without waiting for the reply; dsh_wait then waits for it. With session_id it continues that existing session (same context, no new session); with cwd or workspace_id it starts a new session there (a cwd that is not a workspace yet is registered in the sidebar first). The turn runs in the background. If the session is already working, mode followup (default) queues the message after the current turn and steer adds it to the running turn; each message gets its own run_id. The message is delivered verbatim as a user message, with no prefix or label added: write it in the language the user works in, self-contained (Harness does not see this conversation), and say who is asking only if it matters. Then wait for the reply with dsh_wait (or the wait_command it returns, where offered).

NameTypeReqDescription
cwdstring–Workspace folder for a new session
messagestringyesThe task or reply to send
modestring–followup queues after the current turn (default); steer injects into a running turn
session_idstring–Existing session to continue
workspace_idstring–Harness workspace for a new session (from dsh_list_workspaces)

No output schema declared.

No examples provided.

dsh_session_activity ~110

Show what one session is doing right now, across all its work; dsh_status follows a single run and dsh_read_session shows past messages. Returns busy, activity (its running turn, sub-agents at any depth, background jobs and reminders) and bridge_runs (active dsh-baton runs). Read-only. Check it before dsh_send to a session that might be busy, or before dsh_cancel.

NameTypeReqDescription
session_idstringyesSession id from dsh_list_sessions

No output schema declared.

No examples provided.

dsh_status ~183

Look once at one run sent with dsh_send, without waiting; dsh_wait waits for it to end and dsh_session_activity covers the whole session. Returns state (queued/running/waiting/completed/failed/cancelled, or interrupted when a Harness restart cut it short), session_id, recent events (text, tool calls), final reply, waiting_on when the turn is over but sub-agents or background jobs are still working, and human_interjections when someone typed in the Harness UI during the run (its result then reflects that input too). A one-off look, never a way to wait: to wait for the reply use dsh_wait, and if dsh_wait timed out, call dsh_wait again.

NameTypeReqDescription
run_idstringyesRun id from dsh_send
tailinteger–How many recent events

No output schema declared.

No examples provided.

dsh_wait ~147

Wait for a run sent with dsh_send to end and return its final status and reply; dsh_status only looks once. Prefer the background wait_command from dsh_send when your client can run background shell commands and wake you when they exit: it costs no turns while waiting. Each call waits up to 50 s (set by the server to stay under this client's tool timeout); if the run is still going it returns timed_out: true with just the state: then call dsh_wait again with the same run_id, without summarising progress. Sends progress notifications while waiting when the client asks for them.

NameTypeReqDescription
run_idstringyesRun id from dsh_send

No output schema declared.

No examples provided.

Install

How do I install the dsh-baton MCP server?

dsh-baton runs locally as an npm package, launched with npx -y dsh-baton-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · dsh-baton-mcp

# add to Claude Code
claude mcp add jialaoliu-dsh-baton -- npx -y dsh-baton-mcp
Common questions

What is the dsh-baton MCP server?

dsh-baton is an MCP server listed in the public MCP registry as io.github.JialaoLiu/dsh-baton. Hand tasks from Claude Code, Codex or any MCP client to a local DeepSeek Harness. This page covers its npm package (dsh-baton-mcp).

Is the dsh-baton MCP server safe to use?

dsh-baton scores 64 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 23 October 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the dsh-baton MCP server expose?

dsh-baton exposes 12 tools: dsh_list_workspaces, dsh_create_workspace, dsh_list_sessions, dsh_read_session, dsh_send, and 7 more. Their descriptions and schemas cost roughly 1,759 tokens of context every time the server is loaded.

Is the dsh-baton MCP server still maintained?

dsh-baton is still listed as active in the MCP registry. We last reached this channel on 23 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the dsh-baton MCP server under?

dsh-baton declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.