Last updated 2026-08-16 · data measured 2026-08-16
DeepSeek Harness (DSH) is an agent framework whose plugin model is not "the host leaves a few extension points for you" — the host itself is made of plugins. A plugin is an npm package declaring dsh.bundle in its package.json and exporting apply(ctx, config). It can register tools the model calls, register a settings page rendered straight from its own schema, mount components into UI slots, or replace a built-in capability outright. Because there are no second-class citizens, the community carpeted it within days.
The value of this directory is not coverage — a full mirror is neither maintainable nor useful. It is a selection rule you can recompute yourself, and an ordering by the problem each plugin solves rather than by name. If what you actually want is to bring other models into DSH rather than install a plugin, see Run any model in DeepSeek Harness — that path needs no plugin at all.
Every number was measured on 2026-08-16 from the public npm search API (text=keywords:dsh-plugin, paged through all 795 results). Each row is independently recomputable.
| Measure | Value |
|---|---|
| npm packages tagged dsh-plugin | 795 |
| of those, with a public repository | 608 |
| of those, with any weekly downloads | 56 |
| weekly downloads of 100 or more | 52 |
| weekly downloads of 1000 or more | 16 |
| publish window covering every package | 2026-08-13 — 2026-08-16 |
| listed on this page | 44 |
Put differently: roughly one in fourteen packages carrying the keyword has ever been downloaded. That is not a criticism — a five-day-old ecosystem is supposed to look like this. It just means that in the face of 795 results, "is anyone using it" is the more useful first filter than "does it exist". npm download stats lag by about a day, so anything published on the measurement date reads lower than it is.
Take all 795 npm packages carrying the dsh-plugin keyword, keep those with a public repository and at least 100 weekly downloads: 45 match. One of them targets a different harness and carries the keyword by mistake, so it was removed by hand, leaving 44. Descriptions here are rewritten by us from each package's own npm manifest, written separately in English and Chinese. We have not run all of them — this is a directory, not a review, and inclusion is not an endorsement.
DeepSeek models are text-only, so DSH cannot look at a screenshot, a design mock, or an error dialog out of the box. This is the single most duplicated category in the ecosystem: every one of these plugins solves the same missing capability by routing images to some other vision model.
A vision and computer-use runtime that keeps the source image auditable, so you can check what the model was actually shown.
Adds an inspect_image tool that ships a local file or URL to any OpenAI-compatible vision endpoint and brings the description back into the turn.
Routes images to a vision model and adds image generation and editing in the same plugin.
DSH ships two model sources: DeepSeek itself and a generic OpenAI-compatible adapter. Everything else — Claude, GPT, Gemini, a subscription you already pay for — arrives through a plugin or through that adapter.
Uses a ChatGPT Codex subscription inside DSH through a standalone OAuth flow, instead of a pay-per-token key.
Another take on the same problem: ChatGPT OAuth plus Codex model routing for DSH.
With 795 packages carrying the keyword and no official registry, discovery became a plugin category of its own within days. Several of these install other plugins for you from inside the UI.
The most-downloaded plugin in the ecosystem: a visual market inside DSH itself, with search and one-click install.
Lets the agent search the GitHub dsh-plugin topic live and rank what it finds, so discovery happens in the conversation.
Browses the same GitHub topic from the settings page, sorted by stars, with the install command for each repo.
Installs, removes and updates profile plugins by driving the dsh plugin command for you.
A DSH plugin runs inside the harness process with everything the harness can reach — no sandbox. These plugins exist because "npm install a stranger" is a real risk surface, and they turn blind installs into informed ones.
Static heuristic vetting before you install: flags malicious patterns, out-of-scope filesystem paths and unchecked dependencies.
A hard gate on self-modifying restarts: the harness only comes back up on a build that was green at that exact git HEAD.
Puts a second model in front of approval requests as a read-only reviewer, so a risky action gets a sanity check before you click.
DSH binds to loopback by default. If you want to drive the agent from your phone, from another machine, or over SSH into a remote workspace, that is a plugin.
Scan a QR code and drive the DSH running on your desktop from your phone, over LAN or the public internet.
Connects over SSH with a password or key and lets you pick a workspace on the remote machine.
Rewrites Host and Origin so the settings pages keep working when DSH is served from somewhere other than localhost.
A sidebar entry plus an embedded management console, with a gateway that starts and stops alongside DSH as its own systemd unit.
Embeds the whole DSH web UI in a Chrome side panel, so the agent sits next to the page you are reading.
DSH is a web UI launched from a terminal. A large share of early plugins wrap it into something double-clickable, or fix the parts of the terminal story that only bite on Windows.
The Windows survival kit: a persistent shell that actually runs inside the sandbox, foreground-command detection and legacy-encoding reads.
An Electron desktop shell for DSH on Windows — double-click instead of remembering a command.
Native Windows computer-use tools: the agent moves the mouse and keyboard on the real desktop.
A minimalist terminal interface, for driving DSH without a browser.
A desktop companion character that reacts to session events — the ecosystem grew pets within its first week.
A desktop-style project and AI workbench layout, for people who want windows rather than one chat column.
The built-in file tools are deliberately minimal. These replace or extend them: hash-anchored edits that cannot silently apply to the wrong line, dead-code analysis, and a real test harness for plugin authors.
Hash-anchored read, edit, batch edit and undo: every line carries a hash, so an edit cannot silently land on the wrong line.
Real-host lifecycle testing for plugin authors — boot a plugin against an actual harness instead of mocking the context.
Dead-code detection exposed as agent tools, so the model can ask what is unreachable instead of guessing.
A loopback WebSocket bridge that mirrors an application frontend’s own tools onto the agent.
The client SDK side of that bridge: an app registers its own tools with DSH.
DSH has no built-in web access. Search providers and real-browser drivers are how the agent gets to see the internet.
Web search, X search and page fetch for models with no native web access — the third most-downloaded plugin in the ecosystem.
A visible real browser the agent drives, shared across sessions — install and use, no separate driver setup.
Sessions start clean. These persist what the agent learned about you or your codebase across sessions, and let you pin a persona per workspace.
Persona cards plus long-term memory: write a persona in the settings page, pin it per workspace, switch it per conversation.
A layered memory pipeline — capture, extract, profile — with automatic recall injected back into the context.
Turning an agent turn into something a human hands to someone else: slides, PPTX, a WeChat article draft, a design spec, a reading digest.
Pulls core claims, argument structure and key evidence out of long documents instead of returning a flat summary.
A git-native slide format with an agent API, CLI and renderer — slides that diff properly in review.
Controllable UI generation driven by declarations rather than prompt phrasing, so the same spec produces the same layout.
Generates editable PPTX through a semantic intermediate form, so the deck opens as native shapes rather than flat images.
Turns markdown into a typeset WeChat Official Account draft, formatting included.
A deterministic academic-writing guard that protects numbers and citations from being rewritten by the model.
The seams that connect DSH to things outside it — other agent ecosystems, ACP clients, your speakers, an application frontend.
A multi-host plugin and CLI covering server connections, skills, MCP and low-code delivery; DSH is one of the hosts it targets.
A Pi host ABI that runs unmodified Pi extensions inside DSH, bridging two agent ecosystems.
Manages local skills and lets you inspect shared agent skills before they take effect.
An ACP server with block-level streaming and usage telemetry including cache-hit numbers.
Voice announcements when a run finishes, so a long agent loop does not need watching.
Plays an embedded chime when a session finishes — the smallest useful plugin on this list, and a good one to read as a first example.
# install into the profile behind the browser UI
dsh plugin --profile web add dsh-better-edit
# see the composed plugin tree without booting DSH
dsh --profile web --dump-configA statically installed plugin runs inside the harness process and can reach everything the harness can: your filesystem, your shell, the API keys you configured in settings. There is no sandbox. That is not a flaw in DSH so much as the price of making plugin capabilities exactly equal to built-in ones — what you buy with it is that a third party can do everything the official packages can. Dynamic plugins written during a conversation take a different route: approval gating, where one confirmation authorises that exact code version and a second authorises future versions of the same plugin. The vetting category above reads packaging and static patterns, which filters dead-on-arrival packages but is not a safety endorsement.
The two largest categories here — vision, and bringing other models in — exist for the same reason: DeepSeek models are text-only, and DSH ships just two model sources, DeepSeek itself and a generic OpenAI-compatible adapter. So vision routers, second-model reviewers, memory extractors and search summarisers almost all ask you for an endpoint and a key of your own.
Most of them accept any OpenAI-compatible base URL, which means one gateway key can feed all of them — instead of a separate account and a separate prepaid balance per vendor. APIMODELS is such a gateway: one endpoint in front of Claude, GPT, Gemini, Grok, DeepSeek and 60+ more, billed pay-as-you-go from a single balance.
Three files is the whole shape: a package.json declaring dsh.bundle, a cordis.patch.yml describing the layer your package contributes, and an ES module exporting name, inject and apply(ctx, config). Inside apply, ctx.tools.register adds a tool the model can call, and ctx.settings.register hands over a schema and gets you a settings page for free — the form is rendered from the schema, so the options a page offers can never drift from the parameters your code accepts. One hard rule: every contribution must hand back a disposer, or stopping the plugin leaves listeners behind and the process rots.
An npm package whose package.json declares a dsh.bundle field. DSH is built on the Cordis plugin framework, and the harness’s own features — its model adapters, credential store, settings storage and web UI — are plugins of exactly the same kind. A third-party plugin can therefore do everything a built-in one can: register tools the model can call, add a settings page, mount UI, or replace a capability wholesale.
dsh plugin --profile web add <package>. Plugins are per-profile rather than global; the web profile is the one behind the browser UI. The command forwards its arguments to pnpm in the profile directory, and any package declaring dsh.bundle is added to the profile’s bundle list automatically.
Treat it like running any npm package with your own privileges, because that is what it is: a plugin runs inside the harness process and can reach everything the harness can reach — your filesystem, your shell, your API keys. There is no sandbox for statically installed plugins. Dynamic plugins written during a conversation are approval-gated instead, where one confirmation authorises that exact code version and a second authorises future versions of the same plugin. Vetting tools listed above read packaging and static patterns, which filters dead-on-arrival packages but is not a safety endorsement.
No. As of 2026-08-16 there is no official registry, which is why discovery is itself a plugin category — several community marketplaces install other plugins from inside the DSH UI, and the de facto index is the dsh-plugin keyword on npm plus the dsh-plugin topic on GitHub.
Because DeepSeek models are text-only. Out of the box DSH cannot look at a screenshot, a design mock or an error dialog, so a whole category exists purely to forward images to some other multimodal model and bring the answer back. All of them need a model that accepts images, which means an endpoint and a key on top of DSH itself.
The ones that call a model do — vision routers, second-model reviewers, memory extractors and search summarisers all reach an external endpoint. Most accept any OpenAI-compatible base URL and key, so one gateway key can serve all of them instead of one account per vendor. APIMODELS is such a gateway: a single OpenAI-compatible endpoint in front of Claude, GPT, Gemini, Grok, DeepSeek and 60+ more, billed from one balance.
Three files. A package.json declaring dsh.bundle (pointing at a patch file) and the dsh.plugin metadata block; a cordis.patch.yml describing the layer your package contributes; and an ES module exporting name, an optional inject list of hard service dependencies, and apply(ctx, config). Inside apply you register what you contribute — ctx.tools.register for a model-callable tool, ctx.settings.register for a settings page rendered straight from your schema, slots for UI. Every contribution must hand back a disposer so stopping the plugin really stops it.
Run dsh --profile web --dump-config: it prints the composed plugin tree without booting, which tells you immediately whether your plugin’s layer landed at all. If the layer is missing, the usual causes are a package that never declared dsh.bundle, a patch row naming something the install cannot resolve, or a declared patch file that was left out of the published tarball. If the layer is there but the feature is not, check whether the plugin declared a hard dependency via inject on a service that is not mounted in your profile.
Measured on 2026-08-16 from the public npm search API: every package carrying the dsh-plugin keyword, filtered to those with a public repository and at least 100 weekly downloads. That rule matched 45 of 795; one was excluded because it targets a different harness and carries the keyword by mistake, leaving 44. Descriptions here are rewritten by us from each package’s own manifest — we have not run all of them, and inclusion is not an endorsement. Download counts are a snapshot with roughly a day of reporting lag, so packages published on the measurement day read lower than they are.