dsh-wind-aifin

Credential-safe Wind AIFin integration for
DeepSeek Harness (DSH).

简体中文

What it provides

• Seven official Wind Streamable HTTP MCP domains are connected through DSH's
  own @deepseek-ai/dsh-mcp-client and exposed as native tools:
  wind_stock, wind_fund, wind_index, wind_bond, wind_docs,
  wind_economic, and wind_analytics.
• wind_alice invokes Wind Alice's professional financial-analysis workflows,
  including fact checking, company one-pagers, earnings reviews, screening,
  macro, bond, credit, fund, market-sizing, and comparable-company analysis.
• Two runtime Skills teach the agent how to route requests without putting an
  API key or shell commands into the prompt.
• A Settings namespace declares WIND_API_KEY as a DSH credential reference.

Why a plugin is needed

DSH intentionally removes credential-shaped environment variables from
model-visible shell processes. Putting WIND_API_KEY in the host environment
therefore does not make the official Wind CLI available to an Agent's Bash
tool—and copying the key into the workspace would defeat the boundary.

This plugin resolves the credential inside the trusted host process. Wind MCP
traffic passes through a random, loopback-only adapter that injects the Bearer
token and then delegates protocol handling and tool registration to DSH's MCP
client. Alice resolves the same credential per operation. The key is never
returned to the model, stored in plugin configuration, or exposed to ordinary
Bash commands.

Install

DSH 0.1.0-rc.8 or newer is recommended.

dsh plugin --profile web add github:Xiamu-ssr/snowmountain-market

Restart the profile after installation. Install into another profile by
replacing web with that profile's name.

Configure

Create a Wind AIFin API key at the
Wind developer portal, then
store it as the DSH credential reference WIND_API_KEY using the Credentials
page. A deployment may instead provide WIND_API_KEY in the trusted DSH launch
environment.

Do not put the key in a workspace file, Skill file, prompt, MCP headers in
cordis.patch.yml, or a model-visible shell profile.

Tool names

MCP tools follow DSH's standard qualified naming convention:

Wind Alice is exposed as wind_alice and accepts a prompt plus an optional
professional workflow name.

Security and data flow

• The credential adapter listens only on 127.0.0.1 and uses an unguessable
  per-process route.
• The adapter accepts only the seven fixed Wind endpoints; users cannot turn it
  into a general authenticated proxy.
• Credentials are resolved for each request and are not cached in files.
• Financial requests and selected context are sent to Wind's service. Review
  Wind's service terms before sending confidential information.
• This plugin has no install script and does not bundle or redistribute Wind's
  official Skills repository.

In version 0.1.0, Alice's final textual/data artifact is returned to the
Agent; Alice-generated downloadable files are not automatically copied into the
DSH workspace.

Development

npm install
npm test
npm pack --dry-run

See SECURITY.md for vulnerability reporting and the trust
boundary. This is a community adapter and is not an official Wind product.