DeepSeek MCP Server 1.4.0

DeepSeek MCP Server 1.4.0 updates the DeepSeek API contract, MCP SDK, README, package metadata, and deployment guidance.

• MCP server/client 2.3.1 and Node adapter 2.1.1, current dependency releases, and CI for Node 20/22/24.
• Current Flash/Pro discovery metadata and model guidance; configured defaults now work across all generation tools.
• Responses apply_patch custom tools, complete output_items history, current effort aliases, and FIM usage streaming.
• Correct beta endpoints, documented tool/input constraints, 32 MiB inline-image, 48 MiB JSON body, and 600-image limits.
• End-to-end deadlines and cancellation, robust SSE aggregation, preserved stream logprobs/fingerprint, and credential-safe provider errors.
• Correct resource errors/capabilities, tool admission limits, and explicit HTTP token/gateway boundaries.
• Complete current API documentation and 31-page MCP core specification/schema audits in docs/research.

Validation: 87 tests pass locally on Node 20/22; CI passes Node 20/22/24 and Snyk. Live DeepSeek smoke passes nine endpoint checks and five MCP calls, including strict beta function calls, apply_patch, vision, and Files lifecycle cleanup. Zero npm audit vulnerabilities. The packed CLI starts on Node 20 and exposes all eleven tools. Independent review found no remaining blockers. The GitHub Codex bot could not review because the account's cloud GitHub connector is not configured.

Upgrade note: non-loopback HTTP requires MCP_HTTP_AUTH_TOKEN or explicit MCP_HTTP_TRUST_AUTH_GATEWAY=true behind a gateway that authenticates every request and blocks direct backend access. MCP_TOOL_RATE_LIMIT defaults to 120 invocations per minute.

Version 1.4.0 avoids historical npm version IDs 1.1.0–1.3.0, which cannot be reused. npm publication is pending renewed publishing credentials; this GitHub release includes the verified npm-format tarball. The hosted endpoint and OCI image have separate deployment cycles.

Documentation update (October 19, 2026): DeepSeek opened separate Search and Fetch APIs. Each costs $0.75 per 1,000 successful requests. The temporary free period for server-side Search/Fetch calls through DeepSeek Harness, Claude Code, and Codex ends October 31 at 16:00 UTC; DeepSeek does not state that the waiver covers other integrations. Responses web_search now runs server-side with Pro and is ignored with Flash. This release does not add standalone Search/Fetch MCP tools. See the current README notice and DeepSeek's billing guide. This note updates documentation after the v1.4.0 tag; the attached tarball remains the original release artifact.