A plugin trust & discovery registry for DSH. We answer four questions about every plugin: what it is, whether it's safe, whether you can install it, and whether it's still maintained. Safety is answered in two layers: an automated static scan across the registry, plus a model-driven dynamic security audit of the entries flagged as needing review.

How do I install a plugin?

Copy the install command from any card (dsh plugin --profile web add ) and run it in your terminal. Commands are generated from the plugin's manifest and verified at L3 or above.

What do the verification levels (L1-L5) mean?

L1: found on GitHub. L2: manifest is valid. L3: install spec parsed. L4: installed in an isolated sandbox. L5: plugin loads and runs (smoke-tested). The rules are public on the Verification page.

What does "Security: pending" mean?

An automated static scan (dependencies, permissions, secrets, supply chain) has not run for this artifact yet. Results are shown on the detail page after the next nightly scan. Beyond that first layer there is a second, model-driven dynamic security audit that reads source context for entries flagged as needing review — it runs only on that subset, and when it reaches a conclusion that conclusion is authoritative: the published tier follows the finding counts of that audit — any critical finding makes it critical, otherwise any high finding makes it high, otherwise any medium finding makes it medium, otherwise low, so a softer conclusion lowers the tier too — with the static scan tier (vet primary, dsh backstop) applying only when there is no conclusion. Exemptions stay manual (the audit never writes the suppression list). Human review can withdraw a conclusion it considers wrong, which reverts the tier to the static value immediately (no pipeline rerun needed); entries outside the scanning scope follow the existing policy — they are skipped in the registry-wide risk statistics and their badge reads unknown. Both layers are automated, not a manual review.

How can I submit my plugin?

Submit a GitHub URL — it enters the review queue, gets L1-L2 checks within 24h, and appears on the site. Add the dsh-plugin or dsh-pack topic to your repo and dsh.so discovers it automatically too.

Is the site a marketplace?

No. dsh.so is a verification and intelligence layer over the official registry — no payments, no transactions, no ratings. We verify and inform; you install from the official sources.

Plugin Trust & Discovery Registry

Discover useful dsh plugins

We answer four questions about every plugin: What is it? Is it safe? Can I install it? Is it still maintained? Verified against the GitHub API, plus automated security scans and sandbox install testing — nothing padded.

DSH is an open-source agent harness developed by DeepSeek AI. It uses an architecture where everything is a plugin, and is powered by Cordis. Source: DSH README (https://github.com/deepseek-ai/deepseek-harness) · Architecture (https://github.com/deepseek-ai/deepseek-harness/blob/master/docs/architecture.md)

Browse all 29,440 artifacts How verification works

Browse:Developer workbench Creative & visual Finance & ops Study buddy Teaching Long-form writing Research Editor's picks

What is it?

29,440

artifacts indexed · browse →

Is it safe?

28,952

security scanned · 15,299 gold trust

Can I install it?

27,007

install-tested (L4) · 16,442 also run-tested (L5)

Is it maintained?

15,856

active repos · ecosystem →

Last updated 2026-11-13 06:20:38 UTC+8 · security scan 2026-11-13 07:49:55 UTC+8

DSH v0.2.1-alpha.4+ · custom index sources

Add dsh.so as a DSH plugin index source

Add either URL and dsh’s Discover tab lists, searches and installs them; both can be added.Full guide →

Full marketinstall-tested + low risk

https://cdn.dsh.so/market/index.json

Curatedtop 200 × 6 boards

https://cdn.dsh.so/market/top-rank.json

Setup:①Enable “Custom plugin indexes” under Experimental②Discover → Add index source③Search and install

What can developers do with dsh plugins?

Developers use dsh plugins to extend DSH with tools, terminal commands, memory, vision, notifications, databases, and integrations. Counts come from public repository metadata. Charts list plugins that passed L5 run testing — skins & themes from L4 sandbox-install verification — plus ecosystem apps (desktop / web shells, and entries that install but mount no plugin capability): ecosystem plugins still show their install command because the package installs, while ecosystem apps link to their source repository because they are not installed via dsh plugin add.

View all →

Files & data

Files & dataAll 2358 →

Includes File · Storage · Database

Memory & knowledge

Memory & knowledgeAll 3657 →

Includes Memory

Models & agents

Models & agentsAll 2215 →

Includes Agent orchestration

Dev workflow

Dev workflowAll 1986 →

Includes GitHub integration · Code review

Connect & integrate

Connect & integrateAll 2157 →

Includes Notifications

Look & feel

Look & feelAll 2045 →

Includes Skins & Themes

Office & docs

Office & docsAll 2353 →

Includes Office automation · Vision / OCR

Runtime & terminal

Runtime & terminalAll 1035 →

Includes Terminal / Shell

Creation & media

Creation & mediaAll 1415 →

Includes Creator & social

Web & search

Web & searchAll 2182 →

Includes Web search

Interface add-ons

Interface add-onsAll 628 →

Includes

Security & audit

Security & auditAll 780 →

Includes

Finance & trading

Finance & tradingAll 587 →

Includes

Fun & life

Fun & lifeAll 312 →

Includes

Desktop & clients

Desktop & clientsAll 745 →

Includes

Workbench

WorkbenchAll 420 →

Includes Desktop / web / mobile clients, launchers

Ecosystem plugins

Ecosystem pluginsAll 4355 →

installs but mounts no plugin capability (L4 passed, missing from the L5 manifest) — shown as L5 · ecosystem plugin, install slot still shows the install command

What was recently updated?

Plugins with recent commits, ordered by last commit

View all

These plugins had the most recent commits at the time of the registry refresh, ordered by last commit.

@woaiCarlos/dsh-minimax-quota

Displays remaining MiniMax coding-plan quota (5-hour and weekly windows) beneath the DSH chat composer, with click-through detail.

★ 0L4 install testedLowRiskUpdated 11-12

@ahmedibrahim085/dsh-claude-bridge

Bridges Claude Code and DeepSeek Harness so both agent brains exchange turn events, with an event-driven wait CLI and acpx/mcacp setup helpers.

★ 0L5 install verifiedLowRiskUpdated 11-12

@xiaobaifly7/dsh-codex-conductor

Delegates coding tasks to Codex CLI inside WSL with acceptance criteria and per-criterion verification reports, keeping the host agent read-only.

★ 0L5 install verifiedLowRiskUpdated 11-12

@klaus-2/dsh-redline

Point at any page element, tweak it live, and send structured visual feedback to your DeepSeek Harness agent.

★ 1L5 install verifiedLowRiskUpdated 11-12

@nacivageer/dsh-gif-gate

Host-only gate for DeepSeek Harness: the first animated-image read in a session is denied until the model has read a strategy document.

★ 0L3 install specLowRiskUpdated 11-12

@boldandigital/dsh-free-subagents

Route delegated subagents and Agent Teams over free-tier models in DeepSeek Harness

★ 0L3 install specLowRiskUpdated 11-12

@hanhan9999999999999999999/dsh-memory-nebula

Local-first memory nebula for DeepSeek Harness: graph, recall, paths, hygiene, snapshots.

★ 0L4 install testedMediumUpdated 11-12

@nacivageer/dsh-parchment-theme

羊皮纸主题：给 DeepSeek Harness Web GUI 的旧纸墨褐配色（浅色羊皮纸 / 深色墨夜）

★ 0L4 install testedLowRiskUpdated 11-12

@Domush/dsh-plugin-message-history

Native DSH plugin for persistent message history navigation via arrow keys

★ 0L4 install testedMediumUpdated 11-12

What is newly listed?

Recently published plugins

View all

These plugins were added to the registry most recently.

@43aquarius/dsh-auto-continue

Auto-continue interrupted DeepSeek Harness sessions: probe a healthy fallback model, switch durably, and resume automatically

Added 2026-11-12L3 install specLowRisk

@liuguangyu272/dsh-team-budget

DeepSeek Harness team budget plugin: managed API keys, usage analytics, monthly quotas and model access. 自托管团队额度管理。

Added 2026-11-12L3 install specMedium

@thegabopacheco-sudo/dsh-plugin-rss-digest

Lee feeds RSS/Atom de hosts permitidos y genera un resumen Markdown con titulos, fechas y enlaces, con timeout y sin inventar contenido.

Added 2026-11-12L4 install testedLowRisk

@thegabopacheco-sudo/dsh-plugin-scheduled-health

Chequeos locales de salud (disco libre, memoria, archivos) con historial en cache para ejecutar periodicamente desde automatizaciones.

Added 2026-11-12L4 install testedMedium

@thegabopacheco-sudo/dsh-plugin-focus-session

Modo concentracion: minimiza ventanas que coincidan con patrones configurables, con dry-run por defecto y confirmacion, sin cerrar apps.

Added 2026-11-12L5 · Ecosystem pluginMedium

@peter0429-ux/dsh-task-dock

A draggable dock in the DSH window corner: pending confirmations, then running sessions, then unread results.

Added 2026-11-12L5 install verifiedLowRisk

@kyle2241345145351324321/dsh-agent-memory

Durable agent memory for DeepSeek Harness — global + per-project memories, written by the agent and fully editable in Settings → Memory.

Added 2026-11-12L5 install verifiedLowRisk

@thegabopacheco-sudo/dsh-plugin-driver-report

Reporte de drivers y dispositivos de Windows: nombre, estado, fabricante y version desde PowerShell, solo lectura.

Added 2026-11-12L4 install testedMedium

@thegabopacheco-sudo/dsh-plugin-window-layout

Guarda y restaura layouts de ventanas de Windows (posicion y tamano) mediante UI Automation, con confirmacion y reporte real.

Added 2026-11-12L4 install testedMedium

Not sure what to install? Start with what you want to do

Tell us your goal, we point at the plugin — every scene links to install-tested options

🔔

I want DSH to notify me

Add a Telegram / email notification plugin

Plug into IM or email, get reports when jobs finish

Browse this scene

🔍

I want it to search the web

Add a web-search plugin

Give your agent live internet access

Browse this scene

🧠

I want it to remember things

Add a long-term memory plugin

Persist preferences and context across sessions

Browse this scene

💻

I want it to run commands

Add a terminal / remote-ops plugin

Run commands, manage files, connect over SSH

Browse this scene

👁️

I want it to understand images

Add a vision plugin

Read screenshots and recognize image content

Browse this scene

🎨

I want a different look

Add a skin / theme plugin

Swap colors, wallpapers and sidebar chrome

Browse this scene

🖥️

I want a workbench client

Browse workbench clients (desktop · web)

Desktop and web client shells for DSH, plus sidebar and workbench plugins

Browse this scene

📊

I want it to handle office files

Add a Word / Excel / PowerPoint plugin

Generate spreadsheets, batch-edit documents, read and write slides

Browse this scene

📣

I want to run social media

Add a creator / multi-platform publishing plugin

Publish and track content on WeChat, Xiaohongshu, Douyin and Bilibili

Browse this scene

How does dsh.so verify plugins?

Five levels, from "found" to "run-tested" — rules are public.

Read the rules

dsh.so checks each entry against the GitHub API and applies a public five-level scale from repository found (L1) to run tested (L5) — verification currently covers install-tested (L4) and, for smoke-tested entries, run-tested (L5).

100%

Found

Repo accessible, non-empty, README exists

29,440 artifacts reached

100%

Structured

Manifest / package.json valid, key fields complete

29,440 artifacts reached

100%

Install Spec

Install command parsed, DSH version declared

29,440 artifacts reached

92%

Install Tested

Installed in an isolated sandbox, no dep errors

27,007 artifacts reached

56%

Run Tested

Plugin loads and runs (smoke test passed)

16,442 artifacts reached

What do the security scans say?

The full answer to "is it safe" — risk distribution across the registry

Security audits

The first layer is a registry-wide static scan: automated static analysis (dependencies, permissions, secrets, supply chain) for every indexed entry — not a manual review, with verdicts re-computed registry-wide as rules evolve. The second layer is a model-driven dynamic security audit, applied only to entries the static scan already flags as needing review; it reads source context and covers that subset, not the whole registry. Merging works the other way round: when the dynamic audit has a conclusion, that conclusion is authoritative — it can raise the tier or lower it; only when there is no dynamic conclusion does the static scan tier (vet primary, dsh backstop) apply. A dynamic conclusion really moves the tier here: the tier follows the audit's own finding counts — any critical finding reads critical, otherwise any high finding reads high, otherwise any medium (warning-level) finding reads medium, otherwise low — with badges, list filters and registry-wide counts following, and a conclusion softer than the static scan lowering the site tier accordingly. The audit script never writes the suppression list — exemptions stay manual — and a conclusion a human review withdraws stops applying, dropping the tier back to the static scan level. 2,922 dynamic audit records exist so far (including runs that produced no conclusion), of which 2,341 carry a model conclusion and 2,340 set the site tier from the dynamic conclusion (a conclusion a human review withdraws stops moving it). Entries outside the scanning scope (for example not yet through L4 install testing, or with the discovery topic removed) follow the existing policy: they do not participate in the registry-wide risk statistics and get no published risk-badge value. The plugin detail page and the per-plugin JSON are the authoritative tier.

What is it?

Type, categories, use cases extracted from the repo — no guessing.

Is it safe?

Automated static scan plus a model-driven dynamic security audit — a dynamic conclusion is authoritative when there is one (it can raise or lower the tier, and the tier follows the finding counts of that audit: critical → Critical, high → High, medium → Medium, otherwise Low), the static scan tier (vet primary, dsh backstop) applies otherwise, and exemptions stay manual; out-of-scope entries stay outside the risk statistics and their badge reads unknown.

Can I install it?

Verification L1-L5 — from "found" to "installed and tested in an isolated sandbox".

Is it maintained?

Health: active / stable / inactive / archived / broken.

Discover useful dsh plugins

Registry trust in numbers

Add dsh.so as a DSH plugin index source

Editor picks: start with these

@deepseek-ai/deepseek-harness

@anywhere-labs/dsh-desktop

@liustack/modlens

@omdsh-dev/DSH-better-sidebar

@xiazhi88/dshgo

@Ebony-Vinyl/dsh-our-free-model

@Alterssss/dsh-bili-whale

@MeteorNOX/DeepSeek-Balance-Whale-Widget

What can developers do with dsh plugins?

Files & data

Memory & knowledge

Models & agents

Dev workflow

Connect & integrate

Look & feel

Office & docs

Runtime & terminal

Creation & media

Web & search

Interface add-ons

Security & audit

Finance & trading

Fun & life

Desktop & clients

Workbench

Ecosystem plugins

What was recently updated?

@woaiCarlos/dsh-minimax-quota

@ahmedibrahim085/dsh-claude-bridge

@xiaobaifly7/dsh-codex-conductor

@klaus-2/dsh-redline

@nacivageer/dsh-gif-gate

@boldandigital/dsh-free-subagents

@hanhan9999999999999999999/dsh-memory-nebula

@nacivageer/dsh-parchment-theme

@Domush/dsh-plugin-message-history

What is newly listed?

@43aquarius/dsh-auto-continue

@liuguangyu272/dsh-team-budget

@thegabopacheco-sudo/dsh-plugin-rss-digest

@thegabopacheco-sudo/dsh-plugin-scheduled-health

@thegabopacheco-sudo/dsh-plugin-focus-session

@peter0429-ux/dsh-task-dock

@kyle2241345145351324321/dsh-agent-memory

@thegabopacheco-sudo/dsh-plugin-driver-report

@thegabopacheco-sudo/dsh-plugin-window-layout

Not sure what to install? Start with what you want to do

How does dsh.so verify plugins?

What do the security scans say?

AI News

Connect a Verified Plugin Market to DSH: Index Source Guide

DSH Quick Start: From Install to Your First Verified Plugin

FAQ

Built a DSH plugin?

Find dsh plugins, clients, and integrations in one trusted directory