Preface¶

DeepSeek Harness (command name dsh) splits the agent runtime into plugins: MCP services, Skills, and built-in packages, all of which can be stacked into the current profile. Over time, it is common for ~/.dsh/profiles/web/cordis.patch.yml to grow longer and longer, and for ~/.dsh/skills/ to accumulate many directories. To temporarily turn off an MCP or delete an unused Skill, you often have to manually edit the YAML or move folders, and then confirm whether the host has applied the changes. A single wrong indentation will break the tool list; even if you fix it correctly, already opened sessions may not refresh immediately.

dsh-plugin-manager integrates this functionality into the dsh web settings panel. Open Settings → Plugin Management, use switches and delete buttons to operate MCPs and Skills, automatically back up before writing configurations, and let the host use HMR without restarting dsh web. This article is organized after cross-checking with the community directory details page, the repository README, the original package.json / index.js, and the DeepSeek Harness official repository.

The community plugin directory deepseek-harness-plugin.com is an independent site and has no official affiliation with DeepSeek / HyperGryph, so it cannot be regarded as an official app store. There are several plugins or managers with the same or similar names on GitHub with different scopes of capability; only the one收录 in the directory page and maintained by liqichen is introduced below.

What is this¶

dsh-plugin-manager is a development and runtime dual-end Web plugin for DSH: the browser side injects a “Plugin Management” page into the settings panel, and the Node side mounts backend APIs onto the dsh web host. It is maintained by liqichen, with source code at liqichen/dsh-plugin-manager, licensed under MIT, and the version in package.json is 0.1.0. The directory page records that the main language is JavaScript, and dsh.client.platform is declared as web. The platform badges in the README say macOS | Linux. As of 2026-08-18, both the directory page and the GitHub repository show 10 stars.

It solves the problem of “how to visually view, toggle, and delete MCPs/Skills/built-in packages that have been installed into the current web profile”, rather than building another plugin marketplace. Three tabs correspond to three types of objects:
- MCP Services: Reads and modifies ~/.dsh/profiles/web/cordis.patch.yml
- Skills: Browses ~/.dsh/skills/, and moves deleted directories into a recoverable .trash-* directory
- Built-in Plugin Packages: Read-only listing of package names, versions, and descriptions under ~/.dsh/profiles/node_modules/@deepseek-ai/

Changes take effect hotly after the host listens to the patch file. The official repository’s slogan is “Everything is a Plugin”; this plugin itself is also a standard DSH plugin, used to manage DSH configurations.

Core Features¶

The repository’s README lists capabilities in a table, which matches the implementation in index.js.

MCP Toggle and Delete¶

Each MCP has a card showing the name, transport method (stdio / http badge), running status, and configuration id. There is also the path of the patch file and the total number of entries at the top of the page.
- Toggle: Writes disabled: true to the corresponding entry when disabled, and deletes this line when enabled.
- Delete: Removes the entire MCP configuration segment from cordis.patch.yml, and the comment lines above the entry will be retained. There is a secondary confirmation in the interface.

Both write operations will first back up the file as cordis.patch.yml.bak-<timestamp> before modifying the original file. The README clearly states that what is deleted is the configuration entry, not the npm package; the package is still there, and you can add the entry back or restore it from the backup.

Skills Browsing and Recycle Bin¶

The Skills page lists all skill names, the description in SKILL.md, and the directory path. Deletion is not rm -rf, but renames the directory to ~/.dsh/skills/.trash-<timestamp>-<name>. The source code performs a ^[\w.\-]+$ check on the name, and directories prefixed with .trash- will not appear in the list. To restore, rename the corresponding .trash-* directory back to its original name; to delete completely, you need to handle the recycle bin directory yourself.

Read-only Browsing of Built-in Plugin Packages¶

The third page’s table shows the names, versions, and descriptions of DSH’s native plugin packages. The README describes the scale as “160+”, but the actual number depends on what is in ~/.dsh/profiles/node_modules/@deepseek-ai/ on your local machine. You cannot upgrade or uninstall from this page. The repository’s FAQ clearly states: to upgrade the本体, use npm update -g @deepseek-ai/dsh.

Embedded Backend, No Extra Ports¶

package.json declares dsh.bundle.patch and client-side injections (@deepseek-ai/dsh-client-runtime, dsh-client-locale, dsh-client-ui-settings). The Node side uses inject: ["webServer"] to register the /plugin-manager prefix on the host:
- GET /plugin-manager/api/state: Returns the current MCPs, Skills, built-in packages, as well as the paths of the patch file and skills directory
- POST /plugin-manager/api/action: kind can be mcp-toggle, mcp-delete, or skill-delete

It uses browser same-origin fetch, does not occupy extra ports, and has no separately exposed CORS service. There was also a standalone web version in legacy/server.py in the early repository, which was a fallback path when the plugin mechanism was unavailable, and is not part of the same installation line as the embedded settings panel version.

Installation and Activation¶

The installation command given on the directory page is as follows, run it in the DeepSeek Harness terminal:

dsh plugin add github:liqichen/dsh-plugin-manager

The dsh CLI will parse the plugin from GitHub and install it into the current configuration. For reproducible installations, fix the commit hash according to the directory page instructions:

dsh plugin add github:liqichen/dsh-plugin-manager#commit

Replace commit with the actual commit hash from the repository. The directory page also reminds you that the plugin runs with the permissions of the current dsh process, and may execute code during installation; check the source repository and license before installing.

The README also provides a local path installation “from this repository”, provided that dsh web has been installed and you are familiar with the ~/.dsh directory: copy index.js, client.js, and package.json to ~/.dsh/plugins/dsh-plugin-manager/, then run dsh plugin --profile web add ~/.dsh/plugins/dsh-plugin-manager, and declare dependencies and plugin IDs in the web profile’s package.json and cordis.patch.yml. After local installation, you need to restart dsh web once, then open Settings → Plugin Management. If the page prompts “Plugin backend not responding”, the README asks you to check the dependency declarations, the plugin entries in the patch, and whether ~/.dsh/profiles/node_modules/dsh-plugin-manager points to the plugin directory.

Typical Usage¶

Open DSH Settings → Plugin Management and operate via the three tabs.
- Temporarily turn off an MCP: Find the corresponding card in “MCP Services” and toggle the switch. After the configuration is written, the page will prompt that the changes have taken effect hotly. The currently opened session still holds the old tool list, and you need to open a new session to see the refreshed MCP.
- Delete an MCP entry from the configuration: Click delete and confirm. The entry will disappear from cordis.patch.yml, but the npm package is still there. If you delete by mistake, overwrite with the latest cordis.patch.yml.bak-* file, or paste the YAML snippet back manually.
- Clean up unused Skills: Delete them on the Skills page, then go to ~/.dsh/skills/ to find the .trash-<timestamp>-<name> directory, and rename it back when needed.
- Check which DSH native packages are installed locally: Open the “Built-in Plugin Packages” page to view the names and versions; you can only view here, not click to upgrade.

The README provides the following action request shape for easy reference when checking what the interface is doing (you generally don’t need to curl it manually):

{ "kind": "mcp-toggle",  "id": "mcp-scrapling", "disable": true }
{ "kind": "mcp-delete",  "id": "mcp-scrapling" }
{ "kind": "skill-delete", "name": "obsidian-cli" }

A successful response will look like { "ok": true, "message": "已禁用 mcp-scrapling(热生效)" } (translated as { "ok": true, "message": "Disabled mcp-scrapling (hot reload applied)" }).

Applicable Scenarios and Notes¶

It is suitable for people who are already using dsh web, have a growing number of MCPs and Skills, and do not want to manually edit YAML every time. It only manages the web profile by default: the MCP path is hardcoded as ~/.dsh/profiles/web/cordis.patch.yml, and the Skills path is ~/.dsh/skills/. For other profiles, you need to modify the path yourself, and this boundary is clearly stated in the README.

Pay attention to the following points before use:
1. You are modifying real configurations: Toggles and deletions write directly to disk. There is a .bak-* backup before writing, so look for the latest backup if something goes wrong.
2. Hot reload has boundaries: Changes to the patch file are applied via the host’s HMR, but the tool list of the current session will not refresh automatically, and you need to open a new session.
3. Deleting an MCP ≠ uninstalling the package; deleting a Skill ≠ permanent deletion: The former only removes the configuration, and the latter moves the directory to the recycle bin.
4. You cannot upgrade DSH from here: The built-in plugin packages page is read-only.
5. Permissions and source: The plugin runs in the current dsh process, and can read your .dsh directory under the home folder and modify configurations. Check the source code and MIT license before installing, and do not treat the directory page as official endorsement.
6. Homonymous projects: Searching for dsh-plugin-manager will encounter repositories maintained by other developers, some of which manage Cordis plugin startup/shutdown, some of which build marketplaces or extension centers. Before installing, check that the owner is liqichen and that the installation command matches the original text on the directory page.

Summary¶

When there are many MCPs and Skills, the bottleneck is often not “how to install”, but “how to clearly see and safely modify”. dsh-plugin-manager integrates these three functions into the settings panel: MCPs can be toggled, deleted, and take effect hotly; Skills are moved to the recycle bin for recovery; built-in packages can be viewed read-only; configurations are automatically backed up before writing. It is a community MIT plugin, not an official DeepSeek component; check the repository before installing, and fixing the commit hash is more secure.

Directory page: https://deepseek-harness-plugin.com/zh-CN/plugins/dsh-plugin-manager/
GitHub: https://github.com/liqichen/dsh-plugin-manager
DeepSeek Harness: https://github.com/deepseek-ai/deepseek-harness

Thermal Management of MCP and Skills in the Settings Panel via dsh-plugin-manager