Preface¶

DeepSeek Harness (command name dsh) is an agent runtime open-sourced by DeepSeek AI, with the core design of “everything is a plugin”: models, tools, skills, sessions, sandboxes, and interfaces can all be replaced or combined via plugins. There is also an independent plugin directory site deepseek-harness-plugin.com in the community, which has no official affiliation with DeepSeek / Fangfang (Huifang), and it collects community repositories tagged with the dsh-plugin topic.

The most error-prone tasks for agents in daily work are often not writing business code, but those seemingly simple operations that must have reproducible results: what time is it now, what is a certain field in this JSON, how many columns are there in the CSV, what is 15 + 27 * sqrt(9). Models are prone to making mistakes when mentally calculating time zones, leap years, and floating-point statistics; using the built-in bash will start a new process every time, and the syntax is inconsistent across platforms. The dsh-toolkit maintained by omdsh-dev packages ten zero-dependency deterministic tools into a collection, which can be installed all at once, or installed individually on demand.

What is dsh-toolkit¶

dsh-toolkit is a collection of “tools and capabilities” plugins for DeepSeek Harness, maintained by the GitHub organization omdsh-dev, with the repository address at omdsh-dev/dsh-toolkit. The community directory page categorizes it under the “Tools and Capabilities” section, with the MIT license and main language TypeScript. As of 2026-08-17, GitHub shows 21 stars; the directory page still showed 16 stars at that time, please refer to the repository page for the accurate number.

It solves a very specific problem: packaging ten tools including time, encoding, json, calculator, csv, regex, markdown, diff, stat, and schema into individually installable bundles, then freezing them into a pack artifact snapshot via vendoring in this repository for unified engineering, testing, and maintenance. The root package name is @deepseek-ai/dsh-toolkit, with "private": true in its package.json, which is only used for Git / collection distribution and does not mean it will be published to the npm registry, nor does it represent that it is a product in DeepSeek’s official app store.

The repository README positions it as a collection and installation auxiliary repository: each sub-package can be individually enabled, disabled, or uninstalled; the collection provides a directory, manifest, and bulk installation scripts. The adaptation target is the Profile Bundle plugin system of DSH 0.1.0-rc.6 (npm). The root package requires Node.js ^22.19.0 || >=24.0.0, and the current version is 0.0.1.

What each of the ten tools does¶

The repository’s catalog.json lists ten sub-plugins with the following capabilities. The README also marks the number of test cases for each sub-package, totaling 723; this is the statistics from the repository itself, not a third-party evaluation.

time (dsh-tool-time): Strict ISO 8601 parsing, IANA time zone conversion, UTC calendar arithmetic, fixed duration difference. Supports now / convert / add / diff. Does not accept natural language dates, and datetime strings without time zones will be rejected.
encoding (dsh-tool-encoding): Base64 / base64url / URL / hex encoding and decoding for UTF-8 text, as well as MD5 / SHA1 / SHA256 / SHA512 digests and UUID v4. The hashes are only suitable for non-secure integrity checks, do not use them to process confidential materials.
json (dsh-tool-json): JMESPath-style path query with a hand-written recursive descent parser. Supports dot notation access, bracket indexing, and array wildcard projection. Does not support filters [?...], pipes |, or function calls.
calculator (dsh-tool-calculator): Secure mathematical expression evaluation. Supports + - * / % **, parentheses, and whitelisted functions and constants such as abs, sqrt, sin, pow, PI, and E. The implementation does not use eval or new Function.
csv (dsh-tool-csv): RFC 4180 parsing, precise column-wise query, row and column statistics, and conversion to JSON. It forms a pair with the json tool: the json tool handles objects, while the csv tool handles tabular data.
regex (dsh-tool-regex): Test matching, extract capture groups, secure replacement, and statically explain regex semantics (explain does not perform matching). test / find / replace run in terminable workers with a hard timeout of 1000ms to block ReDoS attacks.
markdown (dsh-tool-markdown): HTML↔Markdown conversion, GFM table normalization, and table of contents generation. md2html uses a tag whitelist, and javascript: / data: links will be downgraded to plain text; content such as script / style / iframe will be stripped.
diff (dsh-tool-diff): Structured comparison of text / JSON / CSV / Markdown, and in-memory unified diff generation. It is read-only, does not read files, write files, access the network, or call git.
stat (dsh-tool-stat): Descriptive statistics, percentiles, frequency distribution, Pearson / Spearman correlation. Returns the same output for the same input; rejects NaN / Infinity.
schema (dsh-tool-schema): JSON Schema (draft 2020-12 subset) validation, failure path reporting, constraint explanation, and safe application of default. No network access, no dynamic code execution; unsupported keywords will fail by default instead of being silently ignored.

The common design philosophy of these tools is: zero third-party runtime dependencies, pure functions, deterministic results, and resource limits. They do not replace bash or git, but turn a category of operations that agents frequently use, error-prone, and must be verifiable from “guessed by the model” to “calculated by the tool”.

Installation and Activation¶

The installation command given by the community directory page is as follows, run it in the DeepSeek Harness terminal:

dsh plugin add github:omdsh-dev/dsh-toolkit

For reproducible installations, the directory page recommends pinning the commit hash:

dsh plugin add github:omdsh-dev/dsh-toolkit#commit

Replace #commit with the actual commit hash in the repository. The plugin runs with the permissions of the current dsh process, and may execute code during installation. You should check the source code and license before installing.

The repository README also describes two mounting models, which are not exactly the same as the “add root package once” method on the directory page.

Independent Bundle Model (Recommended in README): Each sub-package is installed, enabled, disabled, and uninstalled individually. For example, install only CSV or Diff:

# Install a single tool to the web profile
dsh plugin --profile web add github:omdsh-dev/dsh-tool-csv
# One-time task (headless) profile
dsh plugin --profile headless add github:omdsh-dev/dsh-tool-diff

You can use the scripts in the repository for bulk installation (idempotent, repeated execution will not add duplicates):

./scripts/install-web.sh       # Install all 10 tools → web profile
./scripts/install-headless.sh  # Install all 10 tools → headless profile
./scripts/install-all.sh       # Install to both profiles

Verification and operation:

dsh --profile web --dump-config | grep tool-csv
dsh run "Use the csv tool to parse 'a,b\n1,2'"

Web and headless are different profiles: installing to web will not automatically overwrite the headless profile; dsh run uses headless by default. Use forward slashes for Windows paths.

Meta Bundle Model (Optional): When you need to mount all tools atomically at once, mount the root package:

dsh plugin --profile web add github:omdsh-dev/dsh-toolkit
dsh --profile web --dump-config | grep tool-kit

If you have already installed a plugin with the same name (tool-time to tool-schema) in the profile, mounting the meta package will throw an error due to duplicate names. At this point, you should first remove the old plugins, or use the independent bundle model. The README states that the meta apply has atomicity: if any sub-plugin fails, it will roll back the registered tools in reverse order without leaving partial state residues.

You can also install via the tarball path after local npm pack, without relying on GitHub. The root meta package remains private: true, do not treat it as if it has been published to the public npm registry.

Typical Usage¶

After successful installation, the agent will gain the corresponding tool names. The following examples are all from the README of each sub-repository and can be directly cross-referenced.

Calculator, without bash arithmetic or eval:

calculator { expression: "15 + 27 * sqrt(9)" }  →  96

You can run a smoke test on the headless side like this:

dsh run "Use the calculator tool to calculate 1+2*3"

JSON path query:

json { input: <JSON>, query: "items[0].name" }        → "hello"
json { input: <JSON>, query: "items[*].name" }         → ["a", "b"]

Parse CSV into an array of objects (when there is a header row):

csv { action: "parse", csv: "name,city\nAlice,NYC" }
  → [{"name":"Alice","city":"NYC"}]

Get the current UTC time with the time tool:

dsh run "Use the time tool to get the current UTC time"

add always performs calculations according to the UTC calendar; adding one month to 2026-01-31 will clamp to 2026-02-28 instead of overflowing to March.

Encode text into standard base64 with the encoding tool:

encoding { action: "base64_encode", input: "foobar" }  →  "Zm9vYmFy"

Extract capture groups with regex, and use the explain function that only parses without executing:

regex { action: "find", pattern: "(\\w+)@(\\w+)", input: "a@b x c@d" }
regex { action: "explain", pattern: "\\d{4}-\\d{2}" }

Markdown conversion and secure downgrading:

markdown { action: "html2md", html: "<h1>Title</h1><p>Hello <b>World</b></p>" }
  → # Title

Hello **World**

markdown { action: "md2html", markdown: "[x](javascript:alert(1))" }
  → <p>x</p>

You can also hand over statistics and schema validation to the tools instead of letting the model calculate them mentally:

dsh run "Use the stat tool to calculate the descriptive statistics of [1,2,3,4,5]"
dsh run "Use the schema tool to verify whether {name: 'x', age: 3} conforms to the given JSON Schema"

Applicable Scenarios and Notes¶

It is suitable for users who are already using DeepSeek Harness and need to add a set of verifiable, reproducible basic capabilities to their agents. Typical scenarios include: extracting JSON / CSV from configurations and API responses, converting HTML to Markdown for documents, structured comparison of two pieces of text or tables, date and time zone conversion, and using JSON Schema to check plugin manifests or configuration files.

There are several boundaries you need to clarify before use.
1. Permissions and Source: The plugin runs with the permissions of the current dsh process, and may execute code during installation. Before installing, you should read the source code and MIT license of omdsh-dev/dsh-toolkit; pin the commit when you need a reproducible environment. The community directory is not DeepSeek’s official app store.
2. Do not confuse web and headless profiles: If you only install the tool in the web profile, it will not be visible in the default headless profile used by dsh run.
3. Do not install duplicate-named plugins together: The meta package and the separately installed dsh-tool-* will compete for the same set of tool names.
4. The capabilities are a subset, not a replacement for all-in-one tools: json is not a full JMESPath implementation; time does not accept natural language phrases like “next week”; calculator does not support scientific notation 1e5, and trigonometric functions use radians; encoding’s hash does not support HMAC; schema only covers a subset of draft 2020-12 keywords; diff / markdown / regex / schema all have input size and timeout limits. If you exceed the scope, fall back to bash, jq, or other dedicated tools.
5. Do not send confidential information into tool parameters: The README of encoding, markdown, diff, and schema all states that tool parameters will be recorded in the session log. Do not pass keys, session cookies, private keys as input / html / data.
6. Package names do not equal official releases: The sub-packages also use scoped names like @deepseek-ai/dsh-tool-*, which is the naming convention in the DSH ecosystem; the maintainer of this collection is omdsh-dev, and the root package is still private: true.

Summary¶

dsh-toolkit does something very restrained: it does not add new “thinking” capabilities to agents, only turns ten small things that must be calculated accurately into zero-dependency tools, and allows them to be installed all at once. The installation command on the directory page is dsh plugin add github:omdsh-dev/dsh-toolkit; for more detailed on-demand installation, profile selection, and tool semantics, please refer to the repository README.

Directory page: https://deepseek-harness-plugin.com/zh-CN/plugins/dsh-toolkit/

GitHub: https://github.com/omdsh-dev/dsh-toolkit

Install Ten Zero-Dependency Deterministic Tools for DeepSeek Harness with dsh-toolkit at Once