Introduction

In DeepSeek Harness (DSH), two common problems when using third-party plugins are: where to find available plugins? and how to confirm if a repository is safe and worth trying before installing?

dsh-plugin-finder is a DSH plugin owned by meme-dog and licensed under the MIT License. It provides live dsh-plugin topic search and source audit with trial-to-production install plans: searching for DSH plugins on GitHub within an agent session and performing read-only reviews of candidate repositories before installation.

Core Features

Searching for DSH Plugins

search_dsh_plugins performs real-time search of GitHub public dsh-plugin topics, excluding the official deepseek-ai organization. Results are sorted by star count and return:

  • Plugin name
  • star count
  • Last update time
  • Summary
  • issue count

Each result is accompanied by an executable installation command.

Auditing Plugin Repositories

audit_dsh_plugin is used to review repositories before installation. It:

  1. Downloads source code to a workspace sandbox, limited to 50MB; cached for 24h, requiring refresh: true to force re-download if needed.
  2. Performs a size guard after extraction; automatically cleans up and errors if over 200MB.
  3. Checks for dsh.bundle installation manifest and cordis.patch.yml.
  4. Scans 7 categories of dangerous patterns: process execution, dynamic execution, secrets and environment variables, file write/delete, network access, dangerous commands, and dynamic imports.
  5. Outputs entry source code excerpts and a “trial -> production” installation plan, including rollback steps.

Caching and Read-Only

Search results are cached in memory for 5 minutes to reduce rate limit pressure on anonymous GitHub API.

The plugin itself is strictly read-only: it does not install or modify any plugins or configurations.

Installation and Activation

Execute in the DSH environment:

dsh plugin --profile web add github:meme-dog/dsh-plugin-finder

Restart dsh web after installation to take effect.

You can also run it first in a session: registered via cordis_define / cordis_run, it expires after restarting. This method is suitable for experiencing the features first, then deciding whether to install them formally.

Typical Usage

After restarting dsh web, you can directly talk to the agent:

  • “Find a WeChat notification plugin”
  • “What TUI plugins are there?”
  • “Audit the / plugin before installing”

These prompts will correspond to calling search_dsh_plugins or audit_dsh_plugin.

Applicable Scenarios and Notes

It is suitable for discovering community plugins, comparing candidate repositories, and performing source code reviews within a DSH session before installation. The plugin runs in the dsh process environment, and permissions depend on the current dsh runtime configuration; therefore, you should check the source code, license, and the installation command to be executed before installing.

Usage Notes:

  • The tool only performs read-only GET requests and does not execute any installation actions.
  • The returned installation commands require you or the agent to execute them explicitly.
  • Please review the source code before installing third-party plugins.
  • When the sandbox refuses network requests, it reports errors explicitly and does not silently degrade.
  • This deployment disables the fetch provider to defend against SSRF; curl follows the same sandbox/approval chain as the bash tool.
  • audit_dsh_plugin limits source code download to 50MB and caches it for 24h; pass refresh: true to force re-download.
  • When the volume exceeds 200MB after extraction, it is automatically cleaned up and an error is reported.

Conclusion

dsh-plugin-finder puts DSH plugin search, pre-installation audit, and trial-to-production installation plans in the same session, suitable for reviewing before installing.

Repository: meme-dog/dsh-plugin-finder