dsh-mcp-mgr

Configuration

Layers, lowest precedence first. A later layer overrides an earlier entry of the same name.

Layer	Shown in the UI as	Path	Writable from the UI
user	Global	~/.dsh/mcp.json (or $DSH_HOME/mcp.json)	yes
project root	Project	/.mcp.json	no
project local	Local	/.dsh/mcp.json	no

The project-root layer exists only when the workspace is inside a git repository; outside one it is skipped entirely. Both project layers load only after you trust the workspace in the Settings tab, because a project-level stdio entry runs a command supplied by the repository. Until then they are neither loaded nor watched. Trust decisions live in ~/.dsh/trusted-workspaces.json.

{
  "mcpServers": {
    "unity": { "url": "http://localhost:8090/mcp" },
    "filesystem": { "command": "npx", "args": ["-y", "@modelcontextprotocol/server-filesystem", "/data"] },
    "legacy": { "transport": "sse", "url": "https://example.com/sse" },
    "paid": { "url": "https://api.example.com/mcp", "auth": "oauth" },
    "token": { "url": "https://api.example.com/mcp", "bearerTokenEnvVar": "MY_MCP_TOKEN" }
  }
}

• A missing transport is inferred: command means stdio, url means http. A legacy SSE endpoint therefore needs an explicit "transport": "sse" — see USAGE.md
• Per-entry enabled, startupTimeoutMs, toolTimeoutMs, enabledTools, disabledTools
• Remote entries take headers, bearerTokenEnvVar (the variable name, never the token), and auth: "oauth"
• With no cwd an stdio child runs in the workspace directory. A relative cwd in a project layer resolves against the file that declared it, so a repository can ship a working entry without knowing where it was cloned; in the user layer it is passed through as written and resolves against the workspace
• Secrets never reach the browser: the Remote surface projects env to envKeys and headers to headerKeys
• The parent environment is scrubbed before an stdio child starts (anything matching KEY|PASSWORD|SECRET|TOKEN, plus DSH_*); an entry's own env is merged on top, so a deliberately configured credential survives