dsh-harbor

DSH plugins run in the host Node realm with the same local permissions as DSH itself, so a useful security posture starts with verifiable facts rather than a single score or badge. DSH Harbor builds a read-only, evidence-backed ledger of the plugins already installed on your machine, showing what each package declares, what its code and live host actually expose, and what has changed since the last scan.

It scans third-party bundles across DSH profiles using a fixed 13-capability vocabulary and attaches inspectable evidence, such as file:line findings, manifest facts, or runtime registry entries. Declared capabilities are reconciled with detected behavior, while live tools, providers, and routes are attributed to plugins installed in the active profile. The ledger also surfaces same-profile conflicts, cross-profile version drift, optional upstream checks, and a change timeline covering additions, removals, moves, capability changes, and claim changes.

DSH Harbor is best suited for developers, platform maintainers, and security reviewers who need to understand or audit a DSH installation without blocking workflows. It is intentionally a mirror rather than a sandbox, installer gate, or policy engine: it gives you concrete, reviewable evidence so you can decide whether a plugin’s capabilities are visible, declared, attributable, and expected.