Deepseek Mcp ServerBLOCK
MCP server for DeepSeek V4 (v4-flash, v4-pro, 1M context): chat, reasoning, function calling, thinking mode, cost tracking. deepseek-chat/reasoner aliases supported.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
DeepSeek MCP Server
MCP server for DeepSeek V4 (v4-flash and v4-pro, 1M context) with multi-turn sessions, function calling, thinking mode, and cost tracking.
Compatible with Claude Code, Gemini CLI, Cursor, Windsurf, and any MCP-compatible client. Officially listed on the MCP Registry, Smithery, Glama, LobeHub, and Fronteir AI.
26ad3de46633OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add deepseek-mcp-server --env DEEPSEEK_API_KEY=${DEEPSEEK_API_KEY} --env DEEPSEEK_API_KEY=${DEEPSEEK_API_KEY} -- npx -y @arikusi/[email protected]claude mcp add deepseek-mcp-server --env DEEPSEEK_API_KEY=${DEEPSEEK_API_KEY} --env DEEPSEEK_API_KEY=${DEEPSEEK_API_KEY} -- npx -y @arikusi/[email protected]Exposed tools (4)
4 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
deepseek_chat | read | |
deepseek_fim | read | |
deepseek_sessions | read | |
get_weather | read | Get the weather for a location |
Trust audit
BLOCKgrade D · trust 63/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (2 observation(s))
- Shell
- declared (3 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (17)
exec(input?: (string | URLPatternInit), baseURL?: string): URLPatternResult | null;
exec(cmd: string[], options?: ContainerExecOptions): Promise<ExecProcess>;
exec(query: string): Promise<D1ExecResult>;
CMD wget --no-verbose --tries=1 --spider http://127.0.0.1:3000/health || exit 1
baseUrl = `http://127.0.0.1:${addr.port}`;baseUrl = `http://127.0.0.1:${addr.port}`;baseUrl = `http://127.0.0.1:${addr.port}`;baseUrl = `http://127.0.0.1:${addr.port}`;atob(data: string): string;
declare function atob(data: string): string;
@modelcontextprotocol/sdk, ajv, openai, redos-detector, zod, @types/express, @types/node, @vitest/coverage-v8
@modelcontextprotocol/sdk, zod, typescript, wrangler
- **Missing authentication on the self-hosted HTTP endpoint.** In HTTP transport mode the server holds your `DEEPSEEK_API_KEY` and uses it for every `deepseek_chat` call, yet `POST /mcp` had no authen
- **BREAKING (HTTP transport only).** Each HTTP session now gets an isolated `SessionStore` instance. Conversation history, session listings, and session deletion are scoped to the HTTP session that c
- **Remote Endpoint**: Hosted BYOK (Bring Your Own Key) endpoint at `https://deepseek-mcp.tahirl.com/mcp`. Users send their own DeepSeek API key as Bearer token — no server-side key stored.
- **Streamable HTTP Transport**: New `TRANSPORT=http` mode with Express-based Streamable HTTP server. Per-session McpServer instances with shared DeepSeekClient. Supports POST/GET/DELETE on `/mcp` end
Send your DeepSeek API key as `Authorization: Bearer <key>`. No server-side API key stored — your key is used directly per request. Powered by Cloudflare Workers (global edge, zero cold start).
Gates applied: no_behavioural_pass.
26ad3de46633full audit observations/trust-audit/mcp-server/arikusi__deepseek-mcp-server.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 26ad3de46633 | BLOCK | D | 63 | first audit |
Questions
What is the @arikusi/deepseek-mcp-server MCP server?
MCP server for DeepSeek V4 (v4-flash, v4-pro, 1M context): chat, reasoning, function calling, thinking mode, cost tracking. deepseek-chat/reasoner aliases supported.
What tools does @arikusi/deepseek-mcp-server expose?
4 in total: 4 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is @arikusi/deepseek-mcp-server safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (63/100) and found 3 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does @arikusi/deepseek-mcp-server need?
It reads DEEPSEEK_API_KEY and HTTP_AUTH_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does @arikusi/deepseek-mcp-server run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as deepseek-mcp-worker at 2.3.0.
How current is this page?
The grade is for one exact copy of the source (26ad3de46633), read on 2026-10-12. The repository is watched and re-audited when it changes.