3. Done!
Open http://127.0.0.1:3080 and start a session on Standard or Code mode. (Minimal mode exposes only bash and str_replace_editor, so it hides MCP tools.) Composio's tools register as mcp__composio__*. Ask DeepSeek Harness to connect to Supadata or request any Supadata-related task, and Composio authorizes Supadata on demand on the first call.
The dsh-mcp-client config schema (transport, serverName, url, headers, plus reconnect.* and toolCallTimeoutMs) is the current developer-preview interface and may change between releases.
Alternative: OAuth via the community plugin
To use Composio Connect's OAuth flow instead of a static key, or to skip editing cordis.patch.yml by hand, use the community dsh-mcp-manager plugin. It installs as a self-contained external plugin, ships a bundle patch so it auto-mounts, and adds a Settings → MCP page plus OAuth (authorization code + PKCE, RFC 7591 dynamic client registration, and refresh-token rotation). It needs the web profile and Node.js ^22.19 or >=24, with pnpm on your PATH.
Install it from your source checkout, then restart pnpm dsh web and refresh:
Open Settings → MCP → + Add MCP server, choose HTTP, set the name to composio, the URL to https://connect.composio.dev/mcp, and the auth mode to OAuth. Click Authenticate, and Composio's login and consent screen opens in the browser, then redirects back and registers the tools as mcp__composio__*. The row should read connected (N tools).
The plugin catches the OAuth code on a loopback redirect (http://127.0.0.1:<port>/mcp-manager/callback/<id>), so Composio's OAuth provider must allow that loopback URL. Server configs and tokens persist at ~/.dsh/mcp-manager.json, so treat that file as a secret. Being a community plugin on a preview harness, its commands may change, so check the plugin repo if a step drifts.