Expose independently installed MCP providers inside DeepSeek Harness without bundling provider code, data, credentials, or machine-specific paths. Each package is a small configuration bundle with its own version and allowlist.
[!IMPORTANT]
@dff652/dsh-ai-asset-hub@0.1.1has a reviewed GitHub Release with an exact tarball andSHA256SUMS.@dff652/dsh-agent-mail@0.1.0remains a local public-source candidate until its separately authorized push and release. Neither package is published to npm, listed in a marketplace, or deployed to a live profile by this repository.
What you get
| Package | Contract |
|---|---|
@dff652/dsh-ai-asset-hub |
Starts a deployment-owned aiah mcp process. Eight read-only tools. Five-file package. |
@dff652/dsh-agent-mail |
Starts a deployment-owned agent-mail-mcp process. Eleven tools with non-human approval denial. Six-file package including NOTICE. |
The bundles do not ship provider executables, copy provider handlers, store credentials, start automatic wake, or inject sessions.
Validate a local candidate
Pack from a reviewed checkout, record the resulting digest, and install only that exact tarball into a disposable DSH profile:
npm pack --workspace @dff652/dsh-ai-asset-hub --ignore-scripts
sha256sum dff652-dsh-ai-asset-hub-0.1.1.tgz
dsh plugin --profile <profile> add -w ./dff652-dsh-ai-asset-hub-0.1.1.tgz
npm pack --workspace @dff652/dsh-agent-mail --ignore-scripts
sha256sum dff652-dsh-agent-mail-0.1.0.tgz
dsh plugin --profile <profile> add -w ./dff652-dsh-agent-mail-0.1.0.tgz
dsh --profile <profile> --dump-config
AIAH requires DSH_AIAH_COMMAND as the absolute path of a reviewed aiah
executable. Agent Mail requires absolute DSH_AGENT_MAIL_COMMAND,
DSH_AGENT_MAIL_HOME and a non-human DSH_AGENT_MAIL_ID. Neither bundle
resolves a provider through PATH.
How the boundary works
DeepSeek Harness profile
│
├─ @dff652/dsh-ai-asset-hub configuration only
│ └─ DSH_AIAH_COMMAND mcp
│
└─ @dff652/dsh-agent-mail configuration only
└─ DSH_AGENT_MAIL_COMMAND
Provider binaries, identities, homes, endpoints, credentials, and runtime data remain outside the packages. MCP annotations are descriptive metadata rather than a permission system.
Model-visible tool contracts
mcp__aiah__aiah_asset_status
mcp__aiah__aiah_diff
mcp__aiah__aiah_doctor
mcp__aiah__aiah_migration_readiness
mcp__aiah__aiah_migration_status
mcp__aiah__aiah_scan
mcp__aiah__aiah_validate
mcp__aiah__aiah_version
mcp__agent-mail__comm_send
mcp__agent-mail__comm_inbox
mcp__agent-mail__comm_claim
mcp__agent-mail__comm_ack
mcp__agent-mail__comm_list_agents
mcp__agent-mail__comm_approve
mcp__agent-mail__comm_reject
mcp__agent-mail__comm_approvals
mcp__agent-mail__comm_tail
mcp__agent-mail__comm_events
mcp__agent-mail__comm_diagnose
AIAH writer tools such as build, apply, and rollback are intentionally absent. Agent Mail advertises approval tools but a non-human Harness identity cannot execute them.
Verify from source
Run the portable repository and package checks:
npm run check:repo
npm test
npm pack --workspace @dff652/dsh-ai-asset-hub --dry-run --ignore-scripts
npm pack --workspace @dff652/dsh-agent-mail --dry-run --ignore-scripts
On a host with the reviewed DSH runtime, run the activation and process
lifecycle gates. These fail instead of silently skipping when dsh is absent:
npm run test:activation:aiah
npm run test:lifecycle:aiah
npm run test:activation:agent-mail
npm run test:lifecycle:agent-mail
npm run test:coexistence
For provider E2E acceptance, point the verifiers at separately reviewed executables and disposable stores—never a personal provider home or live profile:
npm run verify:aiah -- \
--command /absolute/path/to/aiah \
--testdata-root /absolute/path/to/disposable/aiah-testdata
npm run verify:agent-mail -- \
--tarball /absolute/path/to/agent-mail-1.0.0-alpha.4.tgz
For installation, upgrade, removal and rollback procedures, see the consumer operations guide. Release tags are package-specific in this monorepo.
Reviewed compatibility
| Component | Reviewed value |
|---|---|
| AIAH package | @dff652/dsh-ai-asset-hub@0.1.1 candidate |
| Agent Mail package | @dff652/dsh-agent-mail@0.1.0 source candidate |
| DeepSeek Harness | 0.1.0-rc.6 |
| MCP client | @deepseek-ai/dsh-mcp-client@0.1.0-rc.6 |
| Node.js | ^22.19.0 || >=24.0.0 |
| AI Asset Hub executable | Official Release v0.1.11 |
| Agent Mail provider | 1.0.0-alpha.4 at commit ca6601c |
CI runs the portable contract on Node 22.19 and 24.19.
Release state
| Transition | State |
|---|---|
| Clean repository and origin | AIAH source is on origin; Agent Mail source is local until a separate push |
Public repository and dsh-plugin topic |
Complete |
| AIAH GitHub Release | dsh-ai-asset-hub-v0.1.1; exact tarball and SHA256SUMS verified |
| Agent Mail GitHub Release | Not released; local source candidate only |
| npm publication | Not published |
| Marketplace listing | Not submitted |
| Model-visible L5 acceptance | Not claimed |
| Live-profile deployment | Not part of this repository |
Read the full release-readiness record for exact digests, environment evidence, remaining gates, and the rule that publication and deployment transitions require separate authorization. The project status matrix separates implementation, public export, GitHub Release, npm, marketplace and live-deployment states for the current and planned providers.
Project notes
- This is an independent project, not an official DeepSeek project or an official security review of AI Asset Hub or Agent Mail.
- Future providers must enter as separate workspaces after their own source, license, secret, artifact, and disposable-profile review.
- AgentMemory remains a future public-export scope. Automatic wake and automatic session capture are not claimed here.
Contributions are welcome within the documented public boundary. Start with CONTRIBUTING.md, and report vulnerabilities according to SECURITY.md.
No comments yet. Be the first to write one.