truelove-dreamer/dsh-plugin-vetting
Vets third-party plugins before you trust them: static scan for malicious patterns (exfiltration, credential access, obfuscation, persistence) and over-privileged path use, transitive-dependency coverage, official-package hash baseline for supply-chain tamper detection, and an optional plugin-tool call gate.
$ dsh plugin --profile web add dsh-plugin-vetting$ dsh plugin --profile web add github:truelove-dreamer/dsh-plugin-vettingHealth breakdown
41 / 100Score reflects license, community signals, documentation and distribution. It is not a code audit — review the source before installing.
Security
Key metrics
Related
Related plugins
Browse, search and install community plugins from inside DeepSeek Harness settings, with category filters, one-click updates, enable/disable, theme switching and configuration backup.
[!WARNING] 📌 Announcement (v2.1.7) v2.1.7: Hardens remote/local capability boundaries, long-lived browser and persistent-cache resource ownership, DSH 0.1.5 connection/catalog compatibility, property-based fuzzing, and release provenance without raising the rc.8 Host floor. What’s new →
Free, keyless web search for DSH: 7 engines (DuckDuckGo/Bing/SearXNG free + Exa/Perplexity/DeepSeek paid), auto-failover, settings-page UI with API key inputs and official links, web_fetch, and an engine test tool.
Local-first code knowledge graph for coding agents: 10 MCP tools for layered context compression, DAG planning, incremental AST indexing, a cross-session skill flywheel, diagnostics, and graph artifact import/export.
Tell your agent what you want ("notify me on WeChat when a task finishes"), and it searches the DSH plugin ecosystem on GitHub for you — top results by stars, each with a one-line description and an install command.
MCP Connector for DeepSeek Harness: an MCP manager with one panel to connect servers, configure authorization, search tools across connections, and troubleshoot failures. Browse a continuously updated catalog of over one hundred connectors; filter by connection/server/status, inspect readable parameters and the last successful cache time, and rediscover tools. Supports OAuth 2.0 PKCE, API keys, stdio/HTTP, and mcpServers JSON import. Maintained by Qichacha/QCC.