Introduction

The DSH ecosystem philosophy is “everything is a plugin”. When developers simultaneously use plugins, MCP servers, and skills within the same profile, they need to view status, install/uninstall, enable/disable, and import configurations. dsh-plugin-manager is the plugin management system for DeepSeek Harness, managing these resources via a Web GUI and agent tools. The project is maintained by CHF-hub99 under the MIT license.

Core Features

Web GUI

The following describes the operations provided by the Web GUI:

  • Plugins: Install (package name), uninstall, enable/disable.
  • MCP: Add via form stdio / streamable-http; Import from JSON, .dxt, .mcpb packages; enable/disable, remove.
  • Skills: Upload .zip / .tar.gz, frontmatter validation, remove, display authorization status.

Agent Tools

This plugin also provides agent tools for managing the same resources within conversations:

  • plugin_list
  • plugin_set
  • plugin_install / plugin_uninstall
  • skill_list / skill_remove / skill_dir_add
  • mcp_list / mcp_add / mcp_remove

Installation and Enablement

The installation command provided in verified materials is:

dsh plugin --profile web add dsh-plugin-manager

The materials also point out that this command is related to the npm registry and is marked as after publishing; whether it has been published currently is not confirmed in the verified materials. It is recommended to verify the source is available before installing.

After installation, restart the web profile:

dsh web

How It Works

  • The host service reads the real-time Cordis Loader, modifies it in memory, and persists it to cordis.patch.yml in the profile.
  • The plugin exposes an HTTP API gateway: /plugin-manager/api/*, loopback only.

Local Verification and Development

First, install dependencies and run the smoke scripts listed in the materials:

npm install
node scripts/smoke.mjs
node scripts/smoke-api.mjs

After modifying the client, you can rebuild the client artifacts:

node scripts/build-client.mjs

For local verification, you can use a temporary profile:

dsh --profile dev --port 3081

Security and Usage Notes

  • API is loopback only.
  • Upload size limits: 50 MiB for archives, 1 MiB for JSON.
  • Zip-slip protection provided during extraction.
  • Skill deletion is limited to kebab-case names under ~/.dsh/skills/.
  • Runtime environment requires node >=22.19.
  • The plugin runs with the permissions of the current dsh process; check the source code and license before installing. This project is licensed under MIT.

Links

  • GitHub: https://github.com/CHF-hub99/dsh-plugin-manager
  • Directory page address: Not provided in verified materials.