dsh-plugin-manager

Managing plugins, MCP servers, and skills in DeepSeek Harness used to mean flipping through config files, hand-editing JSON, and restarting the service before you could see any change take effect. dsh-plugin-manager unifies all of these scattered tasks into a single Web management panel reached from the sidebar: install, uninstall, and toggle plugins; add MCP servers via form or import from JSON/.dxt/.mcpb bundles; upload skill archives with frontmatter validation. Every change is applied immediately in memory and persisted to cordis.patch.yml, so it survives restarts without any manual sync.

Beyond the GUI, the plugin registers a set of conversation-facing agent tools so you can simply say "install plugin X" or "disable that MCP server" inside a chat and the agent handles it on the spot. Under the hood it relies on a loopback-only API gateway, zip-slip protection during archive extraction, path-traversal guards restricted to kebab-case names, and upload size caps, keeping its security posture level with the Harness shell itself.

If you juggle multiple plugins, MCP services, and skill packs at once, or you want your agent to manage these resources autonomously mid-conversation, this plugin eliminates a lot of repetitive manual configuration and lets you focus on what actually matters.