deepseek-subagent-mcp
Referenced as part of the supervised execution classifier, where version-control reads are allowed by default.
Used as the verification mechanism to confirm task completion, where the exit code determines whether a delegation is marked as completed or unverified.
The server is implemented in Python and requires Python 3.11+ to run, but this is an implementation detail rather than a target integration.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@deepseek-subagent-mcpFix the date parsing bug and verify with pytest"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
deepseek-subagent-mcp
Gives Claude Code, Codex, or any other MCP client a DeepSeek Harness agent it can delegate work to, the way it would delegate to one of its own subagents.
MCP (Model Context Protocol) is the standard by which a coding agent loads external tools. DeepSeek Harness is DeepSeek's open-source agent runtime — a model in a loop with file and shell tools, released August 2026 under MIT. This server sits between them: it runs a Harness agent in a separate process and exposes six tools for starting, watching, continuing, and stopping it.
The child agent has its own context window. That is the point — you hand it a self-contained task, it burns its own tokens working through the files, and you get back a result instead of a transcript.
Requirements
Python 3.11 or newer
A DeepSeek API key from platform.deepseek.com
macOS 14+ on Apple Silicon, or Linux on x86-64 or arm64
No Node.js install is needed: the Harness runtime ships as a self-contained
executable inside the deepseek-harness-sdk wheel. That wheel is also the
platform limit — it publishes macosx_14_0_arm64, manylinux_2_28_x86_64 and
manylinux_2_28_aarch64 and nothing else, so Windows, Intel macs, and macOS 13
cannot install this at all.
Related MCP server: dsh-crew
Install
uvx --from git+https://github.com/gaztrabisme/deepseek-subagent-mcp deepseek-subagent-mcpClaude Code
Add to .mcp.json in your project, or to ~/.claude.json for every project:
{
"mcpServers": {
"deepseek-subagent": {
"command": "uvx",
"args": [
"--from", "git+https://github.com/gaztrabisme/deepseek-subagent-mcp",
"deepseek-subagent-mcp"
],
"env": {
"DEEPSEEK_API_KEY": "sk-...",
"DSA_WORKSPACE": "/path/to/your/project"
}
}
}
}Codex
Add to ~/.codex/config.toml:
[mcp_servers.deepseek-subagent]
command = "uvx"
args = ["--from", "git+https://github.com/gaztrabisme/deepseek-subagent-mcp", "deepseek-subagent-mcp"]
env = { DEEPSEEK_API_KEY = "sk-...", DSA_WORKSPACE = "/path/to/your/project" }Tools
Tool | What it does |
| Start a new subagent on a task. Returns an |
| Block until a run finishes; returns the result. |
| Send follow-up work to an existing agent, in its original session. |
| Every agent this server owns, with state, cost, and run history. |
| Stop an agent and release its process. |
| What an agent actually did — tool calls, messages, turn endings, and the raw response. |
Runs are asynchronous by default because a coding task can take many minutes and
MCP clients time out individual tool calls. dsh_delegate returns as soon as the
work is queued; dsh_await does the waiting and reports progress while it does.
For short tasks, pass wait_seconds to dsh_delegate and skip the second call.
Each dsh_delegate creates one agent, holding one runtime process and one
persisted session. dsh_continue re-enters that session, so the child still has
its earlier turns in context.
Every delegation states how it will be checked
dsh_delegate requires a verification argument: the command that proves the
task is done.
dsh_delegate(task="Fix the failing date parser", verification="pytest -q tests/test_dates.py")The server runs that command itself, in the agent's workspace, after the child finishes. A child reporting its own test results is a claim; an exit code is a fact, and agents declaring victory prematurely is a well-documented failure mode.
Outcome | State |
Command exits 0 |
|
Command fails, times out, or was never given |
|
The command is classified by the same policy that gates the child's own calls
before it runs — the caller is another agent and can be prompt-injected, so
"the caller asked for it" is not authorization. Pass verification="true" when
there is genuinely nothing to check; an explicit lie beats a silent default.
What comes back
A subagent that returns its full transcript has defeated its own purpose. When
the child's answer is larger than DSA_SUMMARY_TOKENS, it is asked — in the same
session, as one further turn — to replace it with a handoff summary in seven
sections: Goal, Constraints & Preferences, Progress, Key Decisions, Next Steps,
Relevant Files, Critical Context. That is what crosses the MCP boundary.
An answer already under the cap is returned verbatim and costs no extra turn.
The raw response is always kept: dsh_transcript(run_id, raw=True).
Supervised execution
The child's tool calls are gated before they run. A PreToolUse hook inside the
runtime hands each proposed call to this server, which answers allow or deny; a
denied call comes back to the model as a blocked tool result carrying the reason,
and the model adapts.
A deterministic classifier decides first, and it decides most calls. Reading
files, ls, grep, version-control reads, running the workspace's own code and
tests are allowed with no model involved. Privileged commands, deletes outside
the workspace, fetch-piped-into-a-shell, and anything touching SSH keys or .env
are denied outright — including through a harmless-looking verb, because cat ~/.ssh/id_rsa is a read-only tool applied to a secret. Only what the classifier
cannot classify escalates.
Escalation runs at the best tier the client supports, resolved at startup and
reported by dsh_list:
Tier | Who decides | Requires |
| a reviewer process you configure |
|
| the MCP client's model | client advertises |
| you, in your client | client advertises |
| nobody — escalation denies | always available |
Running unattended. Claude Code advertises elicitation and not sampling, so out of the
box every escalation interrupts a person — wrong for an agent meant to work while you do
something else. DSA_SUPERVISOR=agent puts a local reviewer in that seat instead:
DSA_SUPERVISOR=agent # nothing prompts a human
DSA_SUPERVISOR_CMD="claude -p --model sonnet" # any CLI reading a prompt on stdinThe reviewer gets the same structured facts and answers ALLOW or DENY on its first line. Anything else denies. It costs a subprocess and roughly eight seconds per escalation, and spends tokens on whatever account that CLI is logged into.
A reviewer is a judgement, not a boundary. Given cp note.txt $TMPDIR/copy.txt, with the facts
correctly reporting the destination as unresolvable, a Claude reviewer reasoned that $TMPDIR "is
the same OS temp root the workspace lives under" and allowed it. The write landed outside the
workspace. That class of call is now refused by rule before any reviewer sees it — which is the
right division of labour: rules hold the boundary, the reviewer handles the grey area inside it.
Every tier fails closed. An unreachable supervisor, a timeout, a malformed request, or a client that supports neither capability all produce a denial, never an approval.
The ladder is walked rather than picked from once: a tier that errors falls through to the next one, so a client that drops sampling — deprecated in the 2026-07-28 spec revision, still working today — degrades to asking you instead of denying everything. A tier that times out does not fall through; an unanswered question is a no, and re-asking on another channel would only double the wait.
Set DSA_SUPERVISOR=off to disable the gate entirely.
What the supervisor is shown is structured facts, never the child's prose: the tool, the programs
in each pipeline segment, and every path the command names with an inside-or-outside-the-workspace
flag. The child writes both the command and any justification for it, and a child that can argue
its own case will. A path that cannot be resolved statically — $TMPDIR/out.txt — is reported as
unresolved rather than guessed at, and counts as outside.
examples/claude_supervisor.py runs the whole pattern against a real Claude, for clients that do
not advertise sampling themselves:
DEEPSEEK_API_KEY=sk-... uv run python examples/claude_supervisor.pyCeilings and cost
A delegated agent spends your money in a loop, so four independent ceilings bound it, and every run reports what it used.
Ceiling | Knob | Enforced by |
Wall-clock per run |
| killing the runtime |
Total tokens per run |
| killing the runtime |
Model calls per run |
| killing the runtime |
Identical repeated tool calls |
| killing the runtime |
There is no mid-turn cancel on the wire, so every stop is a process kill. A kill for a ceiling always outranks whatever the run itself reported: a killed process's output is never read as success.
dsh_delegate, dsh_await and dsh_list all report token usage — input,
output, cache reads and writes, and step count — summed from what the provider
reported. Per-step input is summed deliberately: every request bills the whole
resent prefix, so the total is what the delegation actually cost.
Traces, and what to do with them
Every delegation leaves two records.
The child's runtime writes its own durable log — every tool call with arguments,
every hook invocation with its exit code, duration and the verdict text, token
usage per step — under <session root>/<workspace>/<session>/session.jsonl.zstd.
This server appends its own side to <session root>/trace.jsonl: each verdict
with its tier, latency and the facts the supervisor was shown, each finished run
with its verification result and usage, and the chars-per-token ratio each
distillation turn actually produced. Lengths, never the text — the trace is for
measuring, not for keeping a copy of your source. Set DSA_TRACE to move it, or
DSA_TRACE=off to disable it.
uv run python scripts/trace_report.py # reads .dsh-sessions/trace.jsonlThe report answers the questions the defaults were guessed at: how often the
classifier escalates and on what, whether DSA_CHARS_PER_TOKEN matches
observation, and where DSA_MAX_STEPS and DSA_TURN_TOKEN_BUDGET sit relative
to real use. Its first run on this project found pwd && ls being escalated to a
model — eleven seconds and a model call to be told what the read-only list
already knew — which is now settled by policy in a third of a millisecond.
Configuration
Every setting is an environment variable on the server process.
Variable | Default | Meaning |
| — | Required. Passed to the child runtime. |
| DeepSeek's public API | Point at a proxy or a self-hosted endpoint. |
|
| Model id for delegated work. |
| the server's working directory | Directory the child reads and writes. |
|
| Live agents allowed at once. Each holds a process. |
|
| Where session logs are written. |
| provider default | Per-request output cap for the child. |
| unset | Total tokens one run may spend before it is killed. |
|
| Model calls one run may make before it is killed. |
|
| Identical tool calls before the run is killed as a runaway. |
|
| Seconds before a run is killed and reported failed. |
|
| Seconds before an idle agent is reaped and evicted. |
|
| Finished runs kept readable after their agent is reaped. |
|
| Result size above which the child is asked to distil. |
|
| Conversion used for that cap. Measured at 3.54 on this workload. |
|
| Seconds the verification command may run, capped by the run's remaining deadline. |
|
|
|
|
| Reviewer for |
|
| Seconds to wait for a verdict before denying. |
|
|
|
|
|
|
|
| Working budget compaction is measured against. |
|
| Executor-level bound on one bash call. |
| none | Seconds to wait on one runtime request. |
|
| Activity lines retained per run. |
|
| Server log level. Writes to stderr only. |
|
| Decision and run trace. |
| the packaged composition | A path, or |
|
| Provider route registered by the composition. |
Limits you should know before relying on this
These come from the Harness SDK wire protocol, not from choices made here.
The filesystem sandbox does not cover bash.
dsh-fs-sandboxconfines the model'swrite/edittools to the workspace, butdsh-bash-sandboxis not in the bundled runtime executable, so bash itself is unconfined. The supervisor covers this — it gates every tool including bash, upstream of execution. WithDSA_SUPERVISOR=offthere is no boundary on bash at all; point it at a branch or a scratch directory.The sandbox restricts file effects only — not network, processes, or syscalls. And
workspace-writepermits/tmpas well as the workspace root.Cancel kills the process. There is no mid-turn cancel on the wire, so
dsh_cancelterminates the runtime. Edits already written stay on disk, and the session cannot be resumed afterwards.A reaped agent's session is gone, but its results are not. After
DSA_IDLE_TIMEOUTthe process is released;dsh_awaitanddsh_transcriptstill work on its finished runs,dsh_continuedoes not.Sessions live as long as the process. There is no per-session close, so memory grows with an agent's history. Cancel agents you are done with.
Upstream is a developer preview.
deepseek-harness-sdkis pinned at==0.1.0rc7; two release candidates shipped inside a week. Expect the wire to move.
Development
uv sync
uv run pytest # 153 tests, no API key, no network
uv run ruff check .
uv run deepseek-subagent-mcp # starts on stdio; a client drives itLive tests need a real key and cost tokens; they are not collected by pytest:
DEEPSEEK_API_KEY=sk-... uv run python tests/smoke_task.py # the product works
DEEPSEEK_API_KEY=sk-... uv run python tests/smoke_result.py # distillation and the archive
DEEPSEEK_API_KEY=sk-... uv run python tests/smoke_supervisor.py # the gate works
DEEPSEEK_API_KEY=sk-... uv run python tests/smoke_escalation.py # both escalation tiers
DEEPSEEK_API_KEY=sk-... uv run python tests/smoke_limits.py # reaper and deadline
DEEPSEEK_API_KEY=sk-... uv run python tests/smoke_mcp.py # all six toolsCLAUDE.md carries the architecture and the upstream constraints; wiki/
carries the decision record and what was measured.
License
MIT.
Available Tools
6 toolsdsh_awaitA
Wait for a run to finish and return its result.
Safe to call repeatedly. If the run is still going when wait_seconds elapses, this returns the current state rather than an error. Runs whose agent has since been reaped are still readable — their results are archived.
Args: run_id: The run to wait on, from dsh_delegate or dsh_continue. wait_seconds: Maximum time to block. Use a longer value for big tasks.
| Name | Required | Description | Default |
|---|---|---|---|
| run_id | Yes | ||
| wait_seconds | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations present, the description carries the transparency burden and does well by disclosing that repeated calls are safe, that timeout returns current state rather than error, and that archived results from reaped agents remain readable. These are non-obvious runtime behaviors that help the agent decide when and how to call the tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is tightly structured: one purpose sentence, then behavioral notes, then parameter explanations. Every sentence adds meaningful information without repetition or fluff. The format uses clear separation and remains easy to scan.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the most important contextual aspects: repeatability, timeout behavior, run provenance, and archived result accessibility. Since an output schema is present, the description does not need to explain return values in depth. Minor gaps like error cases for unknown run_id are not critical for this tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description is the only source of parameter meaning. It adds useful semantics: run_id is tied to dsh_delegate/dsh_continue, and wait_seconds is 'Maximum time to block' with tuning guidance for large tasks. This largely compensates for the missing schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a clear, specific action: 'Wait for a run to finish and return its result.' It identifies the tool's resource (a delegated/continued run) and distinguishes it from siblings like dsh_list, dsh_cancel, and dsh_transcript by directly stating what this wait operation does.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for when to use this tool, such as waiting on a run identified from dsh_delegate or dsh_continue, and gives practical guidance to use a longer wait_seconds for big tasks. It does not explicitly mention exclusions or alternatives, but the usage context is unambiguous.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dsh_cancelA
Stop a subagent and release its runtime process.
The harness protocol has no mid-turn cancel, so this kills the child process. Any in-flight run is reported as cancelled, and file edits it already made stay on disk. Cancelling ends the session: its context cannot be resumed, so start a new agent rather than continuing this one.
Args: agent_id: Agent to stop.
| Name | Required | Description | Default |
|---|---|---|---|
| agent_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden, and it excels. It discloses the side effects: 'kills the child process,' 'in-flight run is reported as cancelled,' 'file edits it already made stay on disk,' and the session becomes non-resumable. This level of detail about runtime and session consequences is exemplary.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and well-organized, leading with the core action, followed by necessary behavioral caveats. Every sentence contributes meaningful information without redundancy. The Args section is minimal and to the point.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with a single parameter, no nested objects, and an existing output schema, the description covers all essential aspects: what it does, side effects, and parameter purpose. It could optionally mention expected return behavior or error handling, but those are likely captured by the output schema and are not critical for this simple cancellation operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema provides zero description for 'agent_id' (coverage 0%), so the description must compensate. It does offer 'agent_id: Agent to stop,' which accurately identifies the parameter's purpose. However, it adds minimal detail beyond the parameter name and does not mention expected format, validation rules, or how to obtain a valid agent_id. It is functional but not enriching.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource: 'Stop a subagent and release its runtime process.' It clearly differentiates from sibling tools like dsh_list, dsh_await, or dsh_continue by focusing on termination and process cleanup. The scope is unmistakable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains the critical usage constraint: 'The harness protocol has no mid-turn cancel, so this kills the child process' and warns that 'Cancelling ends the session: its context cannot be resumed.' This provides clear context for when to use the tool, though it does not explicitly name alternative tools or state when not to use it beyond the session-ending implication.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dsh_continueA
Send follow-up work to an existing subagent, in its original session.
The child keeps the full context of its earlier turns, so refer to prior work directly ("the migration you just wrote"). Work is queued: if the agent is mid-run, this message runs after it.
Args: agent_id: Agent to continue, from dsh_delegate or dsh_list. message: The follow-up instruction. verification: Command proving this follow-up is done. Omit to skip verification for this turn; the run then reports completed_unverified. wait_seconds: Block up to this long for the run to finish. 0 returns at once.
| Name | Required | Description | Default |
|---|---|---|---|
| message | Yes | ||
| agent_id | Yes | ||
| verification | No | ||
| wait_seconds | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description must carry the burden of behavioral disclosure. It explains queuing behavior, the preservation of context, the optional verification parameter with its consequence (completed_unverified), and the wait_seconds blocking behavior. This adequately covers the tool's operational nuances, though it does not mention potential error conditions or authorization requirements, which are not critical for a follow-up tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is efficient and well-structured. It opens with a one-sentence purpose, follows with a brief contextual note about queuing and context preservation, and then presents a clean, labeled Args list. Every sentence adds value; there is no fluff or repetition. The front-loaded purpose ensures agents quickly identify applicability.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity (4 parameters, optional verification, wait semantics), the description is complete. It covers the intended use case, operational behavior, and parameter meanings. Since an output schema exists, the description does not need to explain return values. It also implicitly addresses prerequisites by referencing dsh_delegate/dsh_list for obtaining agent IDs.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Despite a schema description coverage of 0% (i.e., the schema provides no textual descriptions), the description includes an 'Args' section that explains each of the four parameters: agent_id (identifies the target agent), message (the follow-up instruction), verification (optional command to prove completion), and wait_seconds (blocking duration). This adds rich meaning beyond the schema's bare types and defaults, fully compensating for the schema's lack of documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description begins with a clear, specific verb-resource combination: 'Send follow-up work to an existing subagent, in its original session.' This explicitly distinguishes it from sibling tools like dsh_delegate (which presumably creates a new agent) and dsh_await (which waits on runs). The phrasing is precise and immediately conveys the tool's core function.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear usage context by explaining that work is queued if the agent is mid-run and that the agent retains full context, enabling direct references to prior work. It also directs users to obtain agent IDs from dsh_delegate or dsh_list, indicating alternatives. However, it does not explicitly state when not to use this tool, such as when a fresh context is needed, so it stops short of full exclusion guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dsh_delegateA
Start a new DeepSeek Harness subagent on a task.
Returns immediately with an agent_id and run_id unless wait_seconds is set. Each call creates a fresh agent with its own runtime process and session; use dsh_continue to give more work to an agent that already exists.
Args: task: What to do, with a clear definition of done. The child cannot ask you clarifying questions, so state the acceptance criteria. verification: The shell command that proves the task is done, run by this server in the workspace after the child finishes — e.g. "pytest -q" or "npm test && npm run lint". Its exit code decides whether the run is reported completed or completed_unverified. Pass "true" if there is genuinely nothing to check. workspace: Directory the child reads and writes. Relative paths resolve against the server's configured workspace. Defaults to that workspace. instructions: Optional standing guidance prepended to the task, e.g. coding conventions or files to leave alone. model: DeepSeek model id. Defaults to the server's configured model. name: Human label for this agent, shown in dsh_list. wait_seconds: Block up to this long for the run to finish. 0 returns at once.
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | ||
| task | Yes | ||
| model | No | ||
| workspace | No | ||
| instructions | No | ||
| verification | Yes | ||
| wait_seconds | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description fully discloses behavior: creates a fresh agent per call, returns immediately unless wait_seconds, child cannot ask clarifying questions (must include acceptance criteria), verification exit code decides unverified vs completed, workspace resolution, and defaults. This is thorough behavioral disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured: a lead paragraph stating purpose and key behavior (fresh process, immediate return), then a clean Args section with one line per parameter. Each sentence adds value; no fluff. Front-loads the most important behavioral facts.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers every parameter with meaning, explains control flow (wait_seconds), explains the verification command's role in determining completion status, and mentions the sibling tool dsh_continue. It is complete enough for an agent to correctly invoke this tool without further context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has no descriptions (0% coverage). The description compensates fully: it explains task (with acceptance criteria and inability to clarify), verification (shell command, exit code semantics), workspace (relative paths, default), instructions (prepended standing guidance), model (default), name (human label), and wait_seconds (blocking behavior). Every parameter is given meaningful semantics beyond the schema's type-only definition.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb (start) and resource (a new DeepSeek Harness subagent), explains the immediate-return behavior, and explicitly distinguishes this from 'dsh_continue' for giving more work to existing agents. This effectively differentiates it from siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit guidance: states when to use dsh_continue for existing agents, explains the wait_seconds behavior, and describes the verification command's role in determining run status. This clearly orients the agent on when to invoke this vs. alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dsh_listA
List every subagent this server owns, with its state, cost, and run history.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, and the description does not explicitly state whether the operation is read-only, what side effects it might have, or any access requirements. It only lists what it returns.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, clear sentence that efficiently conveys the tool's purpose and output without any fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description mentions the output attributes (state, cost, run history) and scope ('this server owns'), but does not discuss pagination, ordering, or other response details. Given an output schema is present, this is adequate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has no parameters, and the description correctly omits any parameter details. With zero parameters, this is a baseline score of 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (List) and the resource (subagents) with specific attributes (state, cost, run history), making it distinct from sibling tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It is implied that this tool is for listing subagents, but there is no explicit guidance on when to use it versus alternatives like dsh_transcript or others.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dsh_transcriptA
Show what a subagent actually did during a run.
Returns the tail of its activity log — tool calls, assistant messages, turn endings. Use this to check progress on a long run, or to understand a failure. Returns live data while the run is still going.
Args: run_id: The run to inspect. limit: How many of the most recent activity lines to return. raw: Also return the child's full uncapped response. dsh_delegate returns a distilled version when the answer is large; this is where the original text lives.
| Name | Required | Description | Default |
|---|---|---|---|
| raw | No | ||
| limit | No | ||
| run_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Without annotations, the description carries the transparency burden. It explains that it returns the tail of the activity log, live data, and the effect of the 'raw' parameter. It implies read-only behavior by saying 'Show' and 'Returns', but doesn't explicitly state it has no side effects. This is adequate given the tool's nature.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with a clear overview and parameter explanations. It is slightly verbose but each sentence adds value. It is not overly long relative to the complexity of the tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the tool's purpose, typical use cases, return behavior, and parameter semantics. It doesn't explain output schema (not required), but it provides enough context for an agent to decide when and how to use it. The mention of dsh_delegate relationship adds completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description explains each parameter beyond the schema: run_id (which run), limit (how many recent lines), and raw (full uncapped response). It also connects raw to dsh_delegate, adding context. Since schema coverage is 100%, the baseline is 3, but the extra semantic detail raises it to 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: 'Show what a subagent did during a run.' It specifies the content returned (tool calls, assistant messages, turn endings) and distinguishes it as a transcript tool for inspecting activity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear usage scenarios: 'Use this to check progress on a long run, or to understand a failure.' It also mentions live data during a run, but does not explicitly contrast with sibling tools like dsh_list or dsh_delegate, which would make the guidance stronger.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
6 tool updates
v0.2.0- First observed
dsh_await - First observed
dsh_cancel - First observed
dsh_continue - First observed
dsh_delegate - First observed
dsh_list - First observed
dsh_transcript
TDQS
Each tool targets a distinct lifecycle operation: list, delegate, await, continue, cancel, and transcript. There is no overlap in purpose, and the descriptions clearly delineate when to use each.
All tools use the 'dsh_' prefix with clear verb names (list, delegate, await, continue, cancel, transcript). The pattern is consistent, though 'dsh_transcript' is a noun rather than a verb, which is a minor deviation.
Six tools cover the full lifecycle of subagent management without redundancy. This is well-scoped for the server's purpose.
The surface covers the complete lifecycle: create (delegate), monitor (await, transcript), extend (continue), and terminate (cancel), plus listing. No obvious gaps exist for managing subagents.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
AI-powered spec-to-task decomposition and execution orchestration for coding agents.
Coordination hub for AI coding agents: message teammates, ask humans, audit every event.
Shared control plane for AI coding agents — tasks, memory, decisions, file locks. 12 tools.
Task tracking built for coding agents. Work is leased, so two agents never take the same SubTask.
Related MCP Servers
- AlicenseAqualityBmaintenanceEnables Claude Code to delegate tasks to OpenCode subagents asynchronously, with tools for starting tasks, polling status, and fetching results.72732MIT
- AlicenseNot gradedqualityAmaintenanceEnables dispatching work to DeepSeek Harness agents from Claude Code/Codex, with native progress UI, tier policy, and vision/image generation through MCP tools.655132MIT
- AlicenseAqualityBmaintenanceEnables Codex to delegate routine repository exploration, implementation, refactors, tests, and fixes to DeepSeek Harness in isolated Git worktrees, returning compact results and patches for review while keeping the main workspace protected.511MIT
- AlicenseAqualityBmaintenanceLets MCP clients like Codex delegate independent sub-tasks to DeepSeek as a sub-agent via a single tool, with optional context, custom system prompts, and configurable model/temperature settings.1305MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/gaztrabisme/deepseek-subagent-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server