dsh-mcp-hub

LIMITATIONS

Known limitations

- **Remote only.** No `stdio`, no local processes. - **No OAuth.** Header tokens only, and they are stored in the profile patch in plaintext (same as upstream). - **Host code changes need a DSH restart.** The HMR plugin watches config files, not plugin modules; client-only changes only need a page reload. - **Uninstall needs one extra step, but it is checked:** `remove_bundle` (or `dsh plugin remove`) clears the dependency and the bundle selection and leaves the `- id: mcp-hub` config row plus the `link:` symlink behind. `node tools/uninstall.mjs` refuses to run while the plugin is still installed, then removes both leftovers and verifies the profile is clean. `--dry-run`, `--keep-config` (keep the server list for a reinstall) and `--run-cli` are supported. - Tool-name collisions are renamed automatically (`_2`, `_3`, …) and shown in the panel; a name that cannot be freed is reported instead of silently dropped. - **Secrets:** header values are plaintext in the profile patch unless you write a Loader expression by hand, for example `Authorization: !!js \`Bearer \${process.env.MCP_TOKEN}\``. The panel preserves such expressions across edits (it re-attaches them from the user layer), but it cannot create them for you.