Plugins

Tool catalog for agents: search ~2,600 external endpoints (SEO and SERP, backlinks, social, people and company enrichment, ad libraries, scraping) by the task you want done, read each one's parameters and per-call price, then call it with the credential injected server-side. Ships the skill plus an MCP row that stays disabled until TREG_TOKEN is set.

One-click backup, export, import and migration of a whole DSH config: settings, plugins, MCP, skills and workspaces. Secrets are excluded by default and, if you opt in, are AES-256-GCM encrypted rather than written in the clear; imports preview first and auto-backup with rollback, profiles hold multiple setups, and remote sync pushes portable config through a private Git repo with secrets excluded.

Pre-submit pull-request hygiene checks inside DeepSeek Harness: scans the current diff for TODO leftovers, hardcoded secrets, and non-conventional commit subjects.

Commit-time audit harness for AI coding agents: 24 git-diff rules (secrets, out-of-scope edits, prompt injection), HMAC-signed audit trail, snapshot rollback, and an MCP server with 84 tools. Installable via dsh plugin add.

MCP server manager (stdio / streamable-http): per-working-directory project and global config tiers; project-level MCP collapsed into 4 atomic tools through a middleware layer by default (`middleware: all` folds in global servers too, hot-switchable in the settings page); workspace isolation prevents cross-project interference; configs keep `${ENV}` references only, with no plaintext secrets on disk; runtime registration API for other plugins to inject MCP servers.

PC environment diagnostics & port control board: zero-dependency inspection of system, CLI toolchains, active listening ports with hover-to-kill release, and model key readiness. No external calls, zero plaintext secrets.

Fine grained per tool permission rules for DSH at the tools/pre-execute gate, deny and ask lists in Claude Code rule syntax (`Bash(rm -rf:*), Read(_secrets_), mcp__server__tool`), works standalone without migrating.

Encrypted local credentials vault for the Harness: a web settings page and vault_* tools to store, search and copy passwords, API keys, TOTP secrets and card data, with health audits, expiry rotation, imports/exports and read-only/ask access modes.

Migrate Codex (OpenAI Codex CLI / Desktop) MCP servers, skills, instructions, memory and session history into DeepSeek Harness with a visual panel or CLI, with dry-run previews and secrets migrated as-is.

Honcho memory plugin by Plastic Labs: injects the user profile, session summary and relevant conclusions at session start, uploads each turn to Honcho in the background with secrets redacted, and adds honcho_search / honcho_chat / honcho_remember tools plus a /honcho status command; configured through the ~/.honcho/config.json shared with the other Honcho integrations, against hosted honcho.dev or a self-hosted instance.

DeepSeek Harness plugin for SecurStack security scans, policy checks, doctor diagnostics, and JSON CLI results.

Read-only pass / age secrets with allowPrefixes; reveal defaults to false.

SSH session manager for DeepSeek Harness: saved profiles, agent ssh_run, interactive terminals, and SFTP with secrets kept in the DSH credential center.

Uses a GitHub App to report open PRs and the latest Actions run for the current repo without returning secrets.

Safe Git Credential Manager hints for WSL without exposing secrets.

Automatic secret redaction in tool results: masks API keys, tokens, JWTs, private keys and configured secrets before the model sees them.

GitHub operations for DeepSeek Harness: releases, tags, a guarded generic API pass-through, workflow runs, secrets and sanitized mirror publication.

Deny an AI agent access to .env files, credential stores, keys and any path you hide — across file tools, shell commands, search selectors and run_code. A DeepSeek Harness (dsh) plugin.

密码本 for the DeepSeek Harness: an end-to-end encrypted personal secrets book on a private gist (age format, node:crypto only), with a browser page for people and value-free tools for the agent.

DSH plugin: an unattended AI software team. Feed it a bare Linux server, a set of secrets (env-var references only) and a git remote, and the plugin-driven AI team drives the whole project lifecycle — environment bootstrap, scaffolding, task decomposition

Secure credential vault for DeepSeek Harness: store GitHub/npm/API tokens (secrets never leave the host), run gh/npm/npx/node/git with the token injected in the environment, and manage tokens from a Settings page.

HashiCorp Vault backend for the credential seam: KV v2/v1, AppRole machine auth, per-operation reads so rotation needs no restart, and compare-and-swap writes.

Installation safety gate for DSH plugins: antivirus-style scan of install scripts, permissions, secrets and network callbacks on local directories or npm tarballs, returning a BLOCK/WARN/PASS verdict before "dsh plugin add".