MIT-licensed DeepSeek Harness plugin (TypeScript) that exposes the Harness Web UI and privileged APIs over an authenticated reverse proxy, with one-time QR invites, per-device sessions and a Cloudflare quick-tunnel option for secure remote/mobile access.
DSH integration
Native runtime
Author-claimed
Safety audit
Unaudited
Last verified
2026-09-05
License
MIT
01What can it help you accomplish?
Use the DeepSeek Harness Web UI from any device through a tunnel or LAN while privileged APIs stay available
Full Web UI over a public tunnel or LAN — settings, credentials, directory browsing, tool approvals and plan reviews reachable remotely
Self-hosters and developers running DeepSeek Harness on a home server or desktop who want secure mobile/remote access
Let a phone or remote browser control Harness through a one-time QR invite without exposing the standing token
One-time QR / link invite (15-minute, single use) that never contains the standing access token; per-device sessions with hash-only persistence
Mobile users who need to approve tools, answer questions and browse directories from a phone, away from the host screen
02How to install into DeepSeek Harness
Prerequisites
- Node.js `^22.19.0 || >=24`
- A DeepSeek Harness **web** profile (the plugin depends on `webServer` and Host `connection` services)
Installation steps
- 01
Install with the dsh CLI: `dsh plugin --profile web add dsh-full-remote`, then start the web profile with `dsh --profile web`.
$ dsh plugin --profile web add dsh-full-remote
- 02
Open **Settings → Reverse proxy**, press **Start proxy**, then **Start Cloudflare quick tunnel** and scan the QR code to connect a phone.
Verify the integration
Not specified by the author
03DSH integration and capability boundaries
DeepSeek Harness plugin that runs an authenticated reverse proxy in front of the Harness Web server, so the Web UI and privileged APIs stay reachable over a public tunnel or LAN.
Authenticated reverse proxy with Host/Origin rewrite
Public tunnel (cloudflared / ngrok / frp / SSH / Tailscale) or LAN traffic to the Harness Web server→Privileged APIs (settings.*, credentials.*, host.listDirectory) reachable remotely; HTTP, SSE and WebSocket forwarded
Disables Harness's original loopback trust check for remote clients and replaces it with its own access-control layerPer-device sessions and access control
Incoming requests carrying an access token, a one-time invite, or an existing device session→192-bit access token (file mode 0600), HttpOnly SameSite=Strict session cookies, per-IP lockout, optional CIDR allowlist
One-click Cloudflare quick tunnel and phone invite
Local panel action plus a phone or remote browser→Temporary https://…trycloudflare.com address and a one-time QR/link invite that never contains the standing token
Random per-start tunnel URL; cloudflared is downloaded on demand (18–52 MB) unless a path is configured
04Who is it for? When not to use it?
Good for
- Self-hosters and developers running DeepSeek Harness on a home server or desktop who want secure mobile/remote access
- Mobile users who need to approve tools, answer questions and browse directories from a phone, away from the host screen
Not for
- Control actions (start, stop, reveal token, change listen address) can only be performed from the local Harness window, not from the tunnel URL.
- The plugin replaces Harness's remote trust check with its own access-control layer; a defect in that layer has serious consequences, so the access token must be treated as a secret.
05Compatibility, maintenance and safety notes
- Control actions (start, stop, reveal token, change listen address) can only be performed from the local Harness window, not from the tunnel URL.
- The plugin replaces Harness's remote trust check with its own access-control layer; a defect in that layer has serious consequences, so the access token must be treated as a secret.
- Requires a DeepSeek Harness web profile; the plugin depends on webServer and Host connection services and is not intended for headless profiles.
MIT · actively maintained (latest release v0.3.9, 2026-09-04)
06Frequently asked questions
How do I install dsh-full-remote?
Run `dsh plugin --profile web add dsh-full-remote`, then `dsh --profile web`. Open Settings → Reverse proxy, press Start proxy, and optionally start the Cloudflare quick tunnel and scan the QR code.
Does it only work on the DeepSeek Harness web profile?
Yes. The plugin depends on the webServer and Host connection services and is not intended for headless profiles; it is verified against Harness 0.1.2-rc.1.
Can I use DeepSeek Harness from my phone?
Yes. Generate a one-time QR or link invite (15-minute expiry, single use) that never contains the standing token; tool approvals and plan reviews show up as a confirmation sheet on the phone.
How do privileged APIs keep working through a tunnel?
The reverse proxy rewrites Host/Origin to 127.0.0.1 so settings.*, credentials.* and host.listDirectory pass Harness's trust check, behind its own token and per-device session access control.
07Related DSH workflows
open-design
by nexu-io
🎨 Best DeepSeek Harness Design Plugin. The open-source Claude Design alternative. 🖥️ Local-first desktop app. 🖼️ Your coding agent becomes the design engine: prototypes, landing pages, dashboards, slides, images & video — real files, HTML/PDF/PPTX/MP4 export. 🤖 Claude Code / Codex / Cursor / DeepSeek Harness / OpenCode & 20+ CLIs via BYOK.
picgo
by molunerfinn
:rocket: The Ultimate Image Uploader for Efficient Creators. Supports Obsidian, Typora, VS Code etc. and 60+ image hosting services (S3, GitHub, Cloudflare R2, Imgur, Aliyun OSS...). Paste, upload, done.
dsh-desktop
by anywhere-labs
Modern desktop client for the DeepSeek Harness (dsh) plugin ecosystem. Everything is a plugin — even the desktop shell itself.
openbiliclaw
by whiteguo233
Local-first, open-source AI content discovery agent that learns your taste and proactively finds content across Bilibili, Douyin, YouTube, Reddit, X and the open web.
08Data and sources
places an authenticated reverse proxy in front of the Harness Web server,
dsh plugin --profile web add dsh-full-remote dsh --profile web
This page is generated from the project’s public documentation, repository metadata and a structured parse of DSH Plugins; last verified on 2026-09-05. Found an error? Submit a correction.
Best DeepSeek Harness Plugins
Twelve plugins worth installing first — picked from the whole catalog, across every category.