How to Install DeepSeek Harness Plugins (dsh) — Safely

First: what "installing" means here

DeepSeek Harness plugins are not installed through a central package manager like a browser extension store. A plugin is a Cordis plugin, and installing one means adding an entry to your profile or patch configuration so it joins the plugin tree on next start. The plugin's own README documents the exact line.

The good news is the reversibility guarantee: removing the entry removes everything the plugin registered. There is no uninstall residue to hunt down — which is exactly what makes trying plugins low-stakes (see the configuration guide for how the layers work).

The dsh plugin install command

People coming from other ecosystems search for one command — the equivalent of npm install or pip install. It helps to separate two different "install commands":

# 1. Install the harness itself (the dsh CLI) — this one IS a package-manager command
npm install -g @deepseek-ai/dsh

# 2. Install a plugin — there is no `dsh install <plugin>`;
#    a plugin is installed by adding its entry to your config

Installing a plugin means adding one entry to your profile or patch configuration — an ordered stack of cordis.patch.yml files — so the plugin joins the plugin tree on next start. The exact entry shape (name, package source, options) is documented in each plugin's own README, because each plugin declares what it needs. After editing the config, restart dsh so the tree is reassembled.

Why no central install command? Because a dsh plugin can replace any part of the harness — not just add to it — a config layer that upper levels can override is a better fit than a flat package list. The trade-off: one extra file edit per plugin, in exchange for total reversibility.

Where to find plugins

• This directory — browse by category, stars or recency; detail pages show license, language, archived status and which sources list the repo.
• The dsh-plugin GitHub topic — the ecosystem's registry backbone, with hundreds of repos.
• The community lists — four curated catalogs this directory aggregates, mapped in the ecosystem guide.

The five-minute vetting routine

Before adding the line to your config, spend five minutes on the repo:

1. Read the README — what it does, how to install it, and (ideally) what it accesses: files, network, sessions.
2. Check the license — open source is normal in this ecosystem; a missing or weird license is a reason to pause.
3. Look at the source — you don't need to audit every line, but skim the entry points for anything that phones home or touches files outside the workspace.
4. Check recency and health — last push date, open issues, archived status. The detail pages here surface all three.
5. Prefer curated entries — if a human-maintained list picked it and wrote a description, someone else already did step 1–4 for you.

Installing and verifying

1. Follow the install line from the plugin's README into your profile/patch config.
2. Restart the harness so the plugin tree picks it up.
3. Open a session and confirm the plugin actually registered — a tool appears, a UI panel shows up, whatever the README promises.
4. Try it in a disposable workspace first, starting at read-only sandbox and moving to workspace-write (see the safety guide).

Red flags that should stop an install

• The README asks for credentials or environment variables unrelated to what the plugin does.
• The code sends data to an endpoint the README never mentions.
• It claims to need danger-full-access for a job that shouldn't touch anything outside the workspace.
• The repo has no license, no README, and no activity.

None of these are automatic verdicts — but each one means you should read the source before proceeding, not after.

If something breaks

1. Stop the session.
2. Remove the plugin's entry from your profile/patch config.
3. Restart and confirm the harness is healthy again — it should be, thanks to reversible registration.
4. Open an issue on the plugin's repository with what happened; maintainers in this ecosystem move fast.

FAQ

Is there a dsh plugin install command? No. The only package-manager command in the ecosystem installs the harness itself: npm install -g @deepseek-ai/dsh. Plugins are installed by adding their entry to your profile/patch config — each plugin's README documents the exact line — followed by a restart.

Do I need to restart dsh after installing a plugin? Yes. The plugin tree is assembled at startup from your config layers, so a new entry takes effect on the next launch.

How do I uninstall a dsh plugin? Delete its entry from your profile/patch config and restart. Registration is required to be reversible, so everything the plugin registered — tools, UI panels, services — is revoked with it. No residue.

Are plugins from this directory vetted? Listing is not endorsement. The directory surfaces license, activity and archived status to make your own five-minute check fast — the routine above is the vetting.

Keep exploring

• What are dsh plugins? — the concepts behind the install line
• Plugin development 101 — the other side of the install line
• The dsh plugins ecosystem — where the catalog data comes from
• Browse all plugins