Introduction

The core philosophy of DeepSeek Harness (DSH) is “everything is a plugin.” In agent development scenarios, enabling an Agent to securely manage remote servers (such as Alibaba Cloud ECS) is one of the core requirements. Traditional SSH solutions often require maintaining complex proxy configurations or directly exposing a public IP, which poses security risks. The dsh-workbench-ecs plugin drives a local Workbench CLI, allowing an Agent to securely operate instances through the Workbench backend channel without requiring a public IP.

What This Is

This is a DeepSeek Harness (Cordis) plugin maintained by nishuoyang. Its core purpose is to provide a set of Agent-native tools that allow agents to control Alibaba Cloud ECS instances through the local Workbench backend channel. The plugin is licensed under the MIT License and supports running in Web and desktop environments.

Core Features

This plugin provides the following capabilities:

  1. Cross-platform support: Supports Web (dsh web) and the DeepSeek Harness desktop application (dsh-desktop-host), requiring version v0.9.0 or later.
  2. 11 Agent-native tools: Cover the full process from discovery to verification.
    • ecs_find: Search instances across regions.
    • ecs_list: List instances.
    • ecs_exec: Execute remote commands.
    • ecs_log: Read remote logs.
    • ecs_upload / ecs_download: File transfer.
    • ecs_diagnose: Diagnose instances.
    • ecs_deploy: Deployment operations.
    • ecs_runbook: Runbook orchestration.
    • ecs_snapshot: Create snapshots.
    • ecs_session: Session management.
  3. Security mechanism: All destructive commands (such as reboot and delete) must be approved by Harness; unless explicitly allowed, execution is denied (Fail Closed).
  4. No public IP dependency: Access instances through the Workbench backend channel, without configuring a public IP.
  5. Snapshot management (ecs_snapshot): Supports creating read-only collections and generating comparable snapshot manifests (written to the .dsh/workbench-ecs/snapshots/ directory) for rollback and diff checks.
  6. Advanced features: Supports parameter contract validation, upload retry, long-running task separation, log cursor reading, cross-region search, project-level instance anchors, and more.

Installation and Enablement

The plugin can be installed via a package manager or from source. After installation, it automatically registers the 11 tools above. In the settings panel of the desktop application or Web interface, you can check tool status, manage instance anchors, and perform verification.

Typical Usage

  • Instance discovery: Use ecs_find to search for instances by a specific name or tag, without needing to know the exact region where the instances are located in advance.
  • Snapshot creation: Before performing destructive operations, use ecs_snapshot create to generate a read-only snapshot manifest of the current state.
  • Secure execution: When executing destructive commands, the plugin triggers the Harness approval process; commands that are not approved will be denied.

Applicable Scenarios and Cautions

  • Applicable scenarios: Developers who need to automatically manage Alibaba Cloud ECS through Agents, especially those requiring cross-region search or strict approval workflows.
  • System requirements: Requires Node.js >= 18.
  • Notes:
    • The plugin connects to instances through the local Workbench backend channel, so make sure the Workbench service is running properly.
    • Execution of destructive commands is strictly restricted and must go through Harness approval mechanisms.
    • The code is hosted on GitHub; please review the source code and license before use.

Brief Conclusion

The dsh-workbench-ecs plugin solves networking and security challenges for Agent-managed ECS through a local CLI abstraction. For more details, refer to the GitHub repository.