Introduction

When developing a DeepSeek Harness (DSH) plugin, a common requirement is not to reimplement a set of security tools, but rather to enable agent workflows to directly call existing CLIs and obtain structured results. The SecurStack DSH plugin addresses this scenario: it invokes the securstack CLI within DeepSeek Harness for repository security scanning, policy checking, and local diagnostics, and returns a parsable JSON result when the CLI promises JSON output.

What is this

  • Repository name: securstack/securstack-dsh-plugin
  • npm package name: @securstack/dsh-plugin
  • Maintainer: securstack
  • Purpose: DeepSeek Harness plugin for SecurStack security scans, policy checks, doctor diagnostics, and JSON CLI results
  • License: MIT

This is an adapter: the plugin is not responsible for implementing scanning engines, encryption, upload logic, API contracts, or Shielding operations. The design goal of v1 is to avoid breaking hooks, Shielding writes, and duplicated product contracts.

Core Features

Below are the capabilities of the plugin listed in the verified resources:

  1. Repository Security Scanning: Get repository scan results via securstack scan --format json.
  2. Policy Thresholds: Perform CI-like pass/fail judgments via securstack policy check.
  3. Local Diagnostics: Check local settings and credential issues via securstack doctor.
  4. Structured Responses: Return Harness-friendly parsed JSON results when the CLI promises JSON output.
  5. Reuse Existing Authentication: Support securstack login, SECURSTACK_API_KEY, and optional SECURSTACK_API_URL.
  6. Conservative Boundaries: v1 avoids destructive hooks, Shielding writes, and duplicated product contracts.

Installation and Enablement

First, confirm the runtime environment: Node.js 20 or later is required, and the system must be in the DeepSeek Harness developer preview. SecurStack credentials can be provided via command line login or environment variables.

Command line login example:

securstack login --api-key <key>

If using environment variables, configure the following:

SECURSTACK_API_KEY=<key>
SECURSTACK_API_URL=<url>

Here, SECURSTACK_API_URL is an optional configuration item; fill in the specific value according to your SecurStack environment.

After configuration, install the plugin:

dsh plugin --profile securstack add @securstack/dsh-plugin

This command adds @securstack/dsh-plugin under the securstack profile, enabling the DeepSeek Harness workflow to call SecurStack CLI capabilities.

Typical Usage

The following three prompts come from verified resources and can be used directly in DeepSeek Harness:

Run a SecurStack scan on this repository and summarize critical findings.

This prompt is used to perform a SecurStack scan on the current repository and summarize critical findings.

Check whether the last SecurStack scan passes the repository policy.

This prompt is used to determine whether the last SecurStack scan meets the repository policy.

Run SecurStack doctor and tell me what is misconfigured.

This prompt is used to execute securstack doctor and explain which configuration items have issues.

Applicable Scenarios and Notes

Suitable for evaluation in the following scenarios:

  • Wish to integrate SecurStack scanning, policy checks, and local diagnostics into DeepSeek Harness workflows.
  • Need Harness to read the CLI’s JSON results rather than having the plugin reimplement scanning logic.
  • The team already has SecurStack accounts, API keys, or CLI usage habits.

Note:

  • The plugin runs with the permissions of the current DSH process and uses credentials and environment accessible to that process.
  • Before installation, you should check the source code, MIT license, dependency scope, and your organization’s security requirements.
  • v1 is an adapter and does not include scan engines, encryption, upload logic, API contracts, or Shielding operations.
  • Releasing a public version requires authentication with the securstack account on npm and GitHub; personal accounts should not publish or push public versions.

The DSH plugin ecosystem emphasizes “everything is a plugin”; the community directory is a separate site and should not be understood as the official app store for DeepSeek or Fantom, nor does it imply an official affiliation with DeepSeek / Fantom.

Links

  • Community Directory Page: The current verified resources do not provide a clear URL; you can search for the plugin name in the DSH plugin community directory.
  • GitHub: https://github.com/securstack/securstack-dsh-plugin