Introduction

DeepSeek Harness (DSH) adopts a plugin-based architecture, and its agent capabilities can be extended through plugins. The xby-bbot plugin integrates the capabilities of the BBOT security scanning tool into the DSH environment via the BBOT MCP server, allowing scan tasks to be managed and executed directly within chat sessions.

What Is It

xby-bbot is a DSH plugin that functions as a client for the BBOT security scanning service. It provides module management, preset configuration, and real-time monitoring of scan tasks, enabling developers to invoke BBOT for security detection within DSH workflows.

Core Features

The plugin provides the following core capabilities:

  • set_xby_apikey: Sets the API key in chat. The key is automatically persisted and remains valid after a restart.
  • list_bbot_modules: Lists all available BBOT scanning modules.
  • list_bbot_presets: Lists all available BBOT preset configurations.
  • start_bbot_scan: Starts a new BBOT scanning task.
  • get_scan_status: Queries the status of a specific scanning task.
  • get_scan_results: Retrieves detection results from a specific scanning task.
  • list_active_scans: Lists all currently active scanning tasks.
  • wait_for_scan_completion: Waits for a specified scanning task to complete, supporting timeout control and progress reporting.
  • get_dependency_info: Retrieves information related to dependency management in BBOT scans.

Installation

Use the official installation command to add the plugin. Make sure the corresponding DSH Profile (for example, web) is configured before installation.

dsh plugin --profile web add github:xby_skill/xby-bbot

Typical Usage

1. Configure the API Key

Before using the scanning features, you need to obtain and set the API key. Register at the Xiaobenyang official website to obtain the key, then run the setup command in a DSH chat.

2. Start a Scan

When starting a scan, you must specify the target addresses (targets). Other parameters such as modules (modules), presets (presets), or flags (flags) are optional.

start_bbot_scan(targets="example.com", modules="subdomain,http")

Parameter Description:
* targets: Required. A comma-separated list of targets (domains, IPs, or URLs).
* modules / presets / flags: Optional. Comma-separated lists of modules, presets, or flags.
* no_deps: Whether to disable dependency installation to prevent sudo prompts. Defaults to True.

3. Wait for Completion

Wait for the scan to complete and retrieve progress.

wait_for_scan_completion(scan_id="scan_123", timeout=300, include_progress=True)

Parameter Description:
* scan_id: The scanning task ID.
* timeout: Maximum waiting time in seconds. Defaults to 300.
* poll_interval: Polling interval in seconds. Defaults to 5.
* include_progress: Whether to include progress updates. Defaults to True.

4. Get Results

Retrieve the scan results.

get_scan_results(scan_id="scan_123", limit=100)

Parameter Description:
* scan_id: The scanning task ID.
* limit: Maximum number of results to return. Defaults to 100.

Applicable Scenarios and Notes

Applicable Scenarios:
* Automated execution of security scanning tasks within the DSH environment is required.
* Real-time monitoring and status querying of the scanning process are required.

Notes:
* Permissions: This plugin runs with the permissions of the current DSH process. Ensure the DSH process has the system permissions required for scanning (for example, sudo may be needed for dependency installation).
* Source Review: Review the source code and license before installation to ensure compliance with your usage requirements.
* Official Affiliation: This plugin is maintained by community developers and has no direct affiliation with DeepSeek or the official Huanfang / High-Flyer teams.

Summary

Through a standardized MCP interface, the xby-bbot plugin seamlessly integrates BBOT’s security scanning capabilities into the DSH ecosystem. By configuring the API key and invoking the relevant commands, developers can automate detection, track task status, and retrieve results within agent workflows.