A native dsh pentest mode that records and visualizes authorized engagements (goals or findings or assets) in the web UI; sqlite-backed, Node >= 22.5.
DSH integration
Native runtime
Author-claimed
Safety audit
Unaudited
Last verified
2026-08-22
License
Not specified by the author
01What can it help you accomplish?
Run an authorized pentest inside DeepSeek Harness: record targets, explore leads, verify findings, and visualize the attack path
A session graph of goals or facts or findings or assets, plus Web tabs for the exploration path, vulnerabilities (severity or steps or impacted assets), assets, and a Markdown report
Security engineers running authorized pentests who want DSH to track and visualize the engagement
02How to install into DeepSeek Harness
Prerequisites
- Running DeepSeek Harness with `dsh` CLI
- Node.js >= 22.5 (for the node:sqlite backend)
- PowerShell (the install command is shown for Windows)
Installation steps
- 01
$ dsh plugin --profile web add https://github.com/howmp/dsh-pentest/releases/latest/download/dsh-pentest.tar.gz
- 02
Or from a local file: dsh plugin --profile web add file:C:\path\to\dsh-pentest.tar.gz
- 03
Restart dsh, then pick the auto-registered "渗透模式" (Pentest Mode) in a new session
Verify the integration
Not specified by the author
03DSH integration and capability boundaries
Native dsh plugin (web profile) - a pentest mode that records targets, explores leads, verifies findings, and visualizes the attack path, assets, and vulnerabilities in the DSH web UI. For authorized testing only.
Pentest session graph (goals or facts or findings or assets)
pentest_* tool calls (e.g. pentest_add_goal, pentest_add_finding)→deterministic session graph with edges (spawns or yields or derived_from or proves)
Web visualization tabs (path or vuln or assets or report)
active pentest session→exploration-path graph, vulnerability list, asset list or graph, Markdown report
04Who is it for? When not to use it?
Good for
- Security engineers running authorized pentests who want DSH to track and visualize the engagement
Not for
- ONLY test targets you are authorized to test. `pentest_add_goal` authorization field records the scope for audit, but it is not a gate - scanning or exploit actions are still bound by your deployment sandbox and approval policies.
- Pentest records are written to `$DSH_HOME/storages/pentest-sessions.db` (sqlite via a bundle-patched route); other host domains keep their default JSON backend. Records are per-session; a new engagement needs a new `pentest_add_goal`.
- The sqlite backend uses Node.js `node:sqlite`, so the host runtime must be Node.js >= 22.5. Web graph keeps the latest 200 nodes or assets or edges per session (oldest evicted); full records come from pentest_state or pentest_report.
05Compatibility, maintenance and safety notes
- ONLY test targets you are authorized to test. `pentest_add_goal` authorization field records the scope for audit, but it is not a gate - scanning or exploit actions are still bound by your deployment sandbox and approval policies.
- Pentest records are written to `$DSH_HOME/storages/pentest-sessions.db` (sqlite via a bundle-patched route); other host domains keep their default JSON backend. Records are per-session; a new engagement needs a new `pentest_add_goal`.
- The sqlite backend uses Node.js `node:sqlite`, so the host runtime must be Node.js >= 22.5. Web graph keeps the latest 200 nodes or assets or edges per session (oldest evicted); full records come from pentest_state or pentest_report.
License undeclared in metadata - pre-release (v0.1.0-rc.24, 2026-08-20)
06Frequently asked questions
Is this for authorized testing only?
Yes. ONLY test targets you are authorized to test. The authorization field on `pentest_add_goal` records scope for audit but is not a gate - scanning or exploit still follows your sandbox and approval policies.
Where are records stored?
In `$DSH_HOME/storages/pentest-sessions.db` (sqlite, routed via a bundle patch). The host other storage domains keep their default JSON backend.
What Node version is required?
Node.js >= 22.5, because the sqlite backend uses the built-in `node:sqlite` module.
How do I install it?
Install the release asset directly: `dsh plugin --profile web add https://github.com/howmp/dsh-pentest/releases/latest/download/dsh-pentest.tar.gz`, restart dsh, then pick the auto-registered "渗透模式" in a new session.
07Related DSH workflows
dsh-plugin-radar
by adamplatin123
An ecosystem radar for the DeepSeek Harness (dsh) plugin community that auto-discovers thousands of candidate plugins and runs continuous k8s-level validation, publishing the results as a browsable plugin catalog.
picgo-core
by picgo
:zap:The ultimate image uploading engine. Both CLI & API supports.
helloagents
by hellowind777
Autonomous AI companion that doesn't just analyze problems — it keeps working until the implementation is built and verified.
k8e
by xiaods
k8e.sh - OpenSource Agentic AI Sandbox Matrix
08Data and sources
dsh plugin --profile web add https://github.com/howmp/dsh-pentest/releases/latest/download/dsh-pentest.tar.gz
重启 dsh 后，在新会话中选择自动注册的「渗透模式」。
渗透记录写入 `$DSH_HOME/storages/pentest-sessions.db`（sqlite，经 bundle 补丁路由）。
只测试有授权的目标。`pentest_add_goal` 的 `authorization` 参数可填写授权说明
运行时要求：sqlite 后端使用 Node.js `node:sqlite`，宿主运行时需 Node.js >= 22.5。
本目录是自包含 bundle 包（`@howmp/dsh-pentest`）：宿主插件、Web 界面和 sqlite 后端通过包内 `exports` 一同分发。
This page is generated from the project’s public documentation, repository metadata and a structured parse of DSH Plugins; last verified on 2026-08-22. Found an error? Submit a correction.
Best DeepSeek Harness Plugins
Twelve plugins worth installing first — picked from the whole catalog, across every category.