OOMOL Connector for DeepSeek Harness

Use apps and services connected through OOMOL directly from DeepSeek Harness.

dsh-oomol gives DeepSeek Harness progressive access to OOMOL Connector: discover the connectors available to an account, inspect an Action only when it is needed, and execute it without copying Provider credentials into Harness.

npm package · 中文文档

[!NOTE] This plugin uses DeepSeek Harness's official bundle, client-slot, credentials, and MCP-client standards. It does not patch Harness source code.

What you can do

With this plugin, DeepSeek Harness can:

• discover apps connected to your personal or team OOMOL identity;
• search the Actions exposed by a Connector;
• load an Action schema only when it is needed;
• execute Connector Actions through OOMOL's hosted MCP endpoint;
• open a native right-side Connections details panel to add, inspect, or disconnect Provider accounts;
• reload the OOMOL connection after its key is added, rotated, or removed; and
• test OOMOL authorization and Provider-catalog access from Settings > Plugins.

The plugin deliberately keeps a small discovery surface instead of registering every Connector Action as a permanent Harness tool.

Video tutorial

The YouTube walkthrough demonstrates the complete setup flow: install the plugin, get an OOMOL MCP API key, configure it in DeepSeek Harness, open Connections, and use connected apps from a conversation.

Quick start

Requirements

• Node.js 22.19 or later, or Node.js 24+
• DeepSeek Harness
• an OOMOL Console account

1. Install the plugin

The recommended path is to paste this prompt into a DeepSeek Harness session that has terminal access:

Install the latest stable OOMOL Connector plugin (`dsh-oomol`) into my
DeepSeek Harness `web` profile using the official `dsh plugin` CLI.

Before installing, verify that Node.js 22.19 or later and the `dsh` CLI are
available. Do not use sudo. Do not ask for, read, print, or store any API keys,
and do not modify unrelated Harness profiles or configuration.

After installation, verify that the package was added successfully. If the
current Harness process must be restarted, do not terminate this session;
give me the exact restart command instead. Then guide me to Settings > Plugins
> OOMOL Connector to configure my OOMOL MCP API key. If installation fails,
stop and show me the exact error instead of trying unrelated workarounds.

Or install the package manually into the Web profile:

dsh plugin --profile web add -w dsh-oomol

2. Restart DeepSeek Harness

The plugin becomes active after Harness restarts:

dsh web

Open the URL printed in the terminal.

3. Get an OOMOL MCP API key

Open OOMOL Console and sign in or create an account. In the sidebar, expand More, select API Keys, and find the OOMOL MCP API key section. Select Show, then copy the key from that section—not the Default API key or one of the User keys.

The key is a dedicated OOMOL MCP client key. It is not:

• your DeepSeek model API key;
• an OAuth token or API key for Gmail, Notion, Slack, GitHub, or another Provider; or
• an internal oo CLI authentication file.

Provider OAuth tokens and API keys remain in OOMOL Connector. DeepSeek Harness stores only the dedicated, revocable OOMOL MCP key.

Treat the key as a secret. Do not paste it into a chat message, commit it to Git, or include its value in a screenshot.

4. Configure the key in DeepSeek Harness

Configure the key through Harness's write-only credential field:

1. Open Settings in DeepSeek Harness.
2. Select Plugins.
3. Find OOMOL Connector under plugin configuration.
4. Expand the card, paste the dedicated OOMOL MCP key, and select Save key.
5. Select Test connection.
6. Confirm that the connection state changes to Connected.

After the key is saved, the card shows Configured and confirms that the key is securely stored. Harness does not display the stored value again; use Replace key only when rotating it.

The browser receives only whether the key is configured, its source, and whether it is writable. It never receives the stored value.

5. Open Connections and connect an app

After the test succeeds, select Connections in a conversation header to open Harness's native right-side details panel. The panel uses the official details slot and ctx.layout open/close service, so Harness owns its width, resizing, responsive concession, and session behavior. The Manage connections link in plugin settings opens the full OOMOL Console. OAuth continues in a popup; API keys and custom credentials are submitted directly to OOMOL Connector and are never saved by this plugin. The permanent OOMOL MCP key remains in the Harness Host and is never put in a browser URL or returned to browser code.

The details panel covers the common connection flow. Use the OOMOL Console for advanced connection settings that are not yet exposed in the preview.

You are ready when:

• OOMOL Connector appears under Settings > Plugins;
• the card shows Configured;
• Test connection reports Connected;
• the Connections button opens the right-side panel; and
• your connected apps appear in the list.

6. Try it

Start with read-only discovery prompts:

Show me the OOMOL connectors available to this account.

Find the available Actions for my Notion connector. Do not execute anything.

Check whether one of my connected apps can create a calendar event. Inspect
the Action schema first and do not execute it yet.

For an Action with side effects, ask Harness to show the proposed arguments and wait for confirmation:

Prepare an Action that adds a row to my connected spreadsheet. Show me the
target account, Action name, and proposed values, then ask for confirmation
before executing it.

Configuration

Team connections

The current settings card uses your personal OOMOL identity by default. To use a team-scoped identity, set the team name before starting Harness:

export OOMOL_TEAM_NAME="your-team"
dsh web

Leave OOMOL_TEAM_NAME unset for a personal identity. Team selection in the settings UI is planned.

Environment-only key configuration

For headless or managed environments, provide the key to the launching process:

export OOMOL_MCP_API_KEY="api_..."
dsh web

A key supplied by the launch environment is read-only in the settings card and must be changed at its source.

How it works

flowchart LR
    U["User in DeepSeek Harness"] --> P["dsh-oomol"]
    K["Harness credential storage"] -->|"OOMOL MCP key"| P
    U -->|"Manage connections"| D["Native Connections details panel"]
    D -->|"Sanitized loopback RPC"| P
    P -->|"Discover and execute"| M["OOMOL Connector MCP"]
    P -->|"Connect and disconnect"| R["OOMOL Connector REST API"]
    M --> A["Connected apps"]
    R --> A
    C["Provider credentials in OOMOL"] --> A

The Host plugin resolves the OOMOL MCP key through the Harness credentials service first and the launch environment second. It then composes DeepSeek Harness's official Streamable HTTP MCP client with OOMOL's hosted endpoint.

Connector capabilities are disclosed progressively: Harness searches for a relevant Action, reads the selected guide and schema, and then executes the exact Action. Normal execution uses MCP directly and does not launch OOCLI or read OOCLI's internal authentication files.

For implementation details, see Architecture.

Project status

The packaged artifact is covered by Node.js 22 and 24 CI, unit tests, a clean-profile install, and a Web boot smoke test. Authenticated Action execution against a real OOMOL account remains a release validation item. See the Roadmap for the full checklist.

Configuration reference

The installed bundle adds one oomol row. A later profile layer may replace its non-secret configuration:

- id: oomol
  name: dsh-oomol
  config:
    endpoint: https://connector.oomol.com/v1/mcp
    apiKeyEnv: OOMOL_MCP_API_KEY
    teamNameEnv: OOMOL_TEAM_NAME
    serverName: oomol
    toolCallTimeoutMs: 60000
    failOnStartupError: false

Do not place the API key itself in cordis.patch.yml. Runtime credential resolution keeps the secret out of the bundle layer and normal dsh --dump-config output.

Troubleshooting

The local environment doctor reports readiness without printing credential values:

pnpm run doctor

Security

For users

• Never paste an OOMOL MCP key into chat or commit it to Git.
• Use a separate, revocable OOMOL key for each Harness installation.
• Review externally visible, destructive, permission-changing, or broad-sharing Actions before approving execution.
• Do not automatically retry a side-effecting Action when its outcome is unknown.
• Removing this plugin does not remove or disconnect Provider accounts in OOMOL.

For developers

• Keep Provider credentials in OOMOL Connector; never persist them in this repository or a Cordis patch.
• Resolve the OOMOL MCP key through Harness credentials first, then the launch environment.
• Do not read OOCLI internal authentication files.
• The MCP execute_action contract does not carry the HTTP Action API's idempotency key.

Report vulnerabilities according to SECURITY.md. Do not open a public issue containing credentials, Provider data, or exploit details.

Development

Install dependencies and run the required checks:

pnpm install --frozen-lockfile
pnpm check

Install from a checkout

Build the plugin and install its absolute path into the Web profile:

pnpm build
dsh plugin --profile web add -w "$(pwd)"

Start Harness:

dsh web

Run the environment doctor without printing credentials:

pnpm run doctor

With a real OOMOL MCP key, verify Connector authorization and Provider-catalog access:

OOMOL_MCP_API_KEY="..." pnpm verify:connector

The verifier suppresses remote error text and never prints the credential value.

Uninstall

dsh plugin --profile web remove dsh-oomol

Uninstalling the plugin does not remove or disconnect Provider accounts in OOMOL.

License

MIT