DeepSeek Harness Plugin Marketplaces: In-GUI Market vs. Stores

DeepSeek Harness (dsh) still has no official plugin marketplace — GitHub Issues on the main repo remain disabled, and the only sanctioned discovery mechanism is still the dsh-plugin topic. What changed in the week of August 16–21, 2026, is everything built on top of that vacuum: the community project that supplies most directories' data embedded a browsable market directly into the dsh Web UI, a third-party storefront became the busiest Discussion thread the repo has ever had, and a handful of independent directories started publishing wildly different "plugin count" numbers that don't mean what they claim.

Still no official marketplace, one week later

Nothing changed on the official side. has_issues: false still holds on deepseek-ai/deepseek-harness, GitHub Discussions and Discord remain the only sanctioned feedback channels, and there's still no marketplace.json, no registry API, and no curated list maintained by DeepSeek itself. We covered this discovery landscape — the dsh-plugin topic, community awesome lists, and the package.json dsh field verification check — in how to find DeepSeek Harness plugins. Everything in this piece is a status update on the community layer, not a reversal of that baseline fact.

The context matters: the flagship repo's star count passed 178,538 (as of August 21, 2026), and growth like that pulls plugin authors and directory builders in fast. A vacuum with that much traffic behind it doesn't stay empty for long.

The biggest change: the market moved inside the GUI

The most consequential development isn't a new website — it's that awesome-dsh-plugin, the community-maintained project that supplies the manually reviewed list most directories (including this one) draw from, shipped a Plugin Market screen inside dsh itself. Open the Web UI, go to Settings → Plugins → Plugin Market, and you can browse, search, and install or remove plugins from that catalog without leaving the app. The catalog re-syncs against the dsh-plugin topic automatically every six hours, and the project also exposes a skill so the agent itself can search and install a plugin mid-conversation, on request, without you opening Settings at all.

That's a meaningful shift in the discovery path. Previously, finding a plugin meant leaving dsh, searching a topic page or a directory site, copying an install command, and pasting it back into a terminal or a chat. Now the cheapest path is zero-hop: stay inside the session, ask for what you need, or click through a Settings screen that's already there. Every independent plugin directory — including this one — is now competing with a market embedded in the tool people are already using. The org's own dsh-find-plugin plugin is the concrete example of that skill-exposed pattern: it gives the agent a searchable interface into the same curated catalog the in-GUI market browses.

The community storefronts

A second, separate development: dsh-hub.cc launched as a standalone plugin store with ratings, comments, and self-service publishing, and the Discussion announcing it became the single hottest thread on the repo this week — 91 comments, more than any other topic in the window we tracked. The author has been posting live progress numbers in-thread: 7,000+ repositories indexed and 3,800+ plugins verified at last count, up from 5,843/3,786 reported four days earlier. A second, similarly named site, dshfind.com, launched a few days earlier and is still drawing comments.

Neither is an official DeepSeek project. Both are exactly the kind of "in-app market plugin" sub-genre we described previously — convenient, but not carrying any additional vetting beyond what the underlying GitHub or npm listing already has. One commenter in the dsh-hub.cc thread summarized the moment well: DeepSeek hasn't built a marketplace, so the community built one first. That's true of at least four different projects simultaneously right now.

The directory arms race — and a digital-inflation problem

Search "deepseek harness plugins" this week and you'll find a genuine numbers race, not the handful of scattered directories that existed a week earlier:

Directory	Self-reported count	Verification disclosed?
deepseek1024.com (DSH 1024Store)	6,553	Not disclosed
imsai-sh/awesome-deepseek-harness-plugins	3,100+	Yes — open-source, public search API
dshbase.com	1,780	"Tested Extensions" label, method not published
DSH Plugin Store (per third-party report)	1,080	Not disclosed; touts 42,000+ combined GitHub stars across listed repos
GitHub topic `dsh-plugin` (raw)	10,071	None — purely self-tagged
npm `dsh-plugin` keyword	2,273	None — purely self-tagged
FindHarness	3,100+ (curated subset + broader discovery set)	Yes — `package.json` `dsh` field checked before indexing

The largest numbers here are also the least meaningful. The GitHub topic's 10,071 repositories include plenty of projects that have nothing to do with dsh but carry the tag anyway — the topic's own star ranking includes amruthpillai/reactive-resume (41,410★, a résumé builder) and tt-a1i/archify (14,878★, a general-purpose tool), neither of which ships anything dsh-specific. The npm keyword search has the same self-reported-tag problem. A count built on either signal alone is counting noise as inventory.

There is exactly one check that filters that noise out: does the package's package.json declare a dsh field with a bundle or profile sub-key? That's the field dsh plugin add itself reads to decide whether something is a real, activatable plugin rather than a plain dependency — we walked through it in detail in how to find DeepSeek Harness plugins. A directory that discloses this check (or an equivalent one) publicly is telling you something real; a directory that just reports a topic or keyword count is reporting a headline number, not a verified inventory.

How to evaluate any plugin directory

Given how many are launching in parallel right now, it's worth having a fixed checklist rather than trusting whichever site ranks first:

Is the verification method disclosed? "We check package.json for a dsh field" is a real claim you can spot-check yourself. "6,553 plugins" with no explanation of how that number was produced is not.
Are install commands correct? The actual syntax is:
```
dsh plugin --profile web add <specifier>
```
where <specifier> is an npm package name, a github:owner/repo reference, or a local path. A site that shows a different or malformed install pattern hasn't tested what it's publishing.
How fresh is the data? A one-time scrape goes stale within days at this growth rate; a disclosed sync cadence (the in-GUI market's six-hour resync, for example) tells you what you're looking at.
Does it separate curated from full-catalog? A hand-reviewed subset and an auto-discovered firehose answer different questions, and conflating them into one number hides which one you're browsing.
Is there any security review layer, and does the site say so honestly? Being indexed is a discoverability signal, not a security audit — a directory that implies otherwise is overselling itself.

FindHarness's own numbers follow that checklist by design: the curated set is sourced from the community awesome list (manually reviewed by that project's maintainers), the full catalog stands at 3,100+ entries as of August 21, 2026, and every entry — curated or discovered — is verified against the package.json dsh field before it's indexed. None of that is a security review; see the plugin security checklist for what actually is.

Marketplaces are supply chain too

A market or directory is itself a step in the supply chain, not a neutral window onto one. Rating and comment features on a self-service storefront can be gamed the same way any open review system can. And the naming collisions are already producing confusion deliberately or otherwise: on Hacker News, a submission pointing to deepseek-code.com drew a comment flagging it as "a spam website" impersonating the real project, whose actual home is deepseek.com/harness. If a lookalike domain can accumulate a Show HN post and upvotes within days of the original launch, a lookalike plugin listing on an unaudited storefront is not a hard thing to imagine.

None of the directories covered here — including this one — run a security audit on what they index. For the actual risk model of installing a plugin you haven't personally reviewed, see the plugin security checklist and the state of DeepSeek Harness security, which covers the sandbox and permission gaps a marketplace listing does nothing to close.

What's next

Whether DeepSeek ships an official marketplace is unknown — there's no roadmap statement on it, official or otherwise. What's clear after this week is that the short-to-medium-term reality is plural, not singular: an in-GUI market embedded by the community's own upstream data source, one or more community storefronts with ratings and self-publishing, and a growing set of independent directories with incompatible counting methods — all coexisting, none authoritative. Apply the same checklist regardless of which one you land on first.

FAQ

Does DeepSeek Harness have an official plugin marketplace?

No. The only official discovery mechanism remains the dsh-plugin GitHub topic. Everything described in this article — the in-GUI market, community storefronts, and independent directories — is third-party community infrastructure, not a DeepSeek product.

What is the in-GUI Plugin Market and how do I open it?

It's a Settings screen shipped by the awesome-dsh-plugin project, reached via Settings → Plugins → Plugin Market inside dsh's Web UI. It syncs against the dsh-plugin topic roughly every six hours and also exposes a skill that lets the agent search and install plugins directly in conversation.

Is dsh-hub.cc an official DeepSeek project?

No. It's a community-built storefront announced in a GitHub Discussion, not part of deepseek-ai/deepseek-harness. Its self-reported counts (7,000+ indexed, 3,800+ verified) come from the site operator, not from an independent audit.

Why do plugin directories report such different totals?

Because they're counting different things: raw topic-tagged repositories (noisy, includes unrelated projects), npm keyword hits (same problem), or repositories that pass an actual package.json dsh field check (the only signal that filters out noise). A directory's count is only as trustworthy as the method behind it, which is why disclosure matters more than the headline number.

Is a plugin safer just because it's listed on more directories or has ratings?

No. Being indexed anywhere — including here — means a repository has a real dsh field and a working GitHub source, not that its code has been security-reviewed. Ratings and comments on a self-service storefront are gameable. Apply the security checklist yourself before installing anything you haven't read.

Next steps

Start with how to find DeepSeek Harness plugins for the full discovery mechanics, and read the plugin security checklist before installing anything from any of the sources above. Browse categories directly at /categories/development-runtime, where most of the market/discovery plugins mentioned here live, or see the full plugin categories map. The catalog itself is at /plugins.