MIT-licensed FDE Harness layer: 9 native DeepSeek Harness plugins that audit, trace and snapshot every AI change so work stays constrained, recoverable and compliant.
DSH integration
Native runtime
Author-claimed
Safety audit
Unaudited
Last verified
2026-09-03
License
MIT
01What can it help you accomplish?
Govern every change your AI coding agent makes inside DeepSeek Harness — gate edits, record an audit trail, and snapshot before commit
A forced audit on each commit (24 git-diff rules: secret-leak, cross-boundary, injection detection) with hard evidence, an immutable audit log, and one-click rollback to any snapshot
Solo founders and small teams running DeepSeek Harness (DSH) who want AI work constrained, traceable and recoverable
Onboard AI nodes into your business with the FDE method — map workflow, build the dual ontology, deploy and continuously govern
Enterprise profile, AI-node plan with annual savings, and three-layer deliverables (docs + Skill + runtime) that run inside your DSH agent
FDE / deployment engineers and small businesses adopting AI without a dedicated platform team
02How to install into DeepSeek Harness
Prerequisites
- Node.js ≥ 18 (required for the full `bash bootstrap.sh` install)
- Install on the device that runs your AI agent (enterprise machine), not the FDE's own laptop
- A git repository to audit
Installation steps
- 01
$ npx -y -p @sofagent/audit sofagent-audit
- 02
$ curl -fsSL https://raw.githubusercontent.com/KongFangXun/sofagent/refs/tags/v1.4.3/bootstrap.sh -o bootstrap.sh
- 03
less bootstrap.sh # review the script before running
- 04
bash bootstrap.sh && rm bootstrap.sh
- 05
sofagent-audit --init # install git hook for per-commit audit
- 06
sofagent-audit --doctor # verify environment (optional)
Verify the integration
- sofagent-audit --doctor # validate the environment (optional)
03DSH integration and capability boundaries
Native DSH runtime plugins: 9 `cordis-plugin-sofagent-*` plugins mount into the DeepSeek Harness (Cordis) runtime at the deepest, plugin-grade tier
Zero-config audit
any git repository's latest commit→audit result against 24 git-diff rules (quick default 17 + 7 extended via config): secret-leak / cross-boundary / injection detection with hard evidence
Constraint injection (4-layer)
your enterprise constraints at agent startup→four-layer constraint injection into the DeepSeek Harness agent
constraints are advisory — an agent may skip them; only the audit is mandatorySnapshot rollback (回溯)
each audited change→an automatic snapshot archive; one-click restore to any snapshot
04Who is it for? When not to use it?
Good for
- Solo founders and small teams running DeepSeek Harness (DSH) who want AI work constrained, traceable and recoverable
- FDE / deployment engineers and small businesses adopting AI without a dedicated platform team
Not for
- config.yml is not fail-closed by default — rules can be tampered with / bypassed by the agent, and multi-tenant isolation is not yet implemented. For strong compliance use CI as a backstop and lock the file (`chmod 444 .sofagent/config.yml`); do not run the single-machine default in production.
- Designed for a single machine / single user; multiple agents share one knowledge base and audit history, and multi-tenant isolation is in the roadmap. task/logs are stored in plaintext (static encryption not yet wired).
05Compatibility, maintenance and safety notes
- config.yml is not fail-closed by default — rules can be tampered with / bypassed by the agent, and multi-tenant isolation is not yet implemented. For strong compliance use CI as a backstop and lock the file (`chmod 444 .sofagent/config.yml`); do not run the single-machine default in production.
- Designed for a single machine / single user; multiple agents share one knowledge base and audit history, and multi-tenant isolation is in the roadmap. task/logs are stored in plaintext (static encryption not yet wired).
MIT · actively maintained (latest release v1.4.3, 2026-09-01)
06Frequently asked questions
How does sofagent integrate with DeepSeek Harness?
It ships 9 `cordis-plugin-sofagent-*` plugins that mount into the DeepSeek Harness (Cordis) runtime at the deepest integration tier — plugin-grade, deeper than the Skill / hook tiers used for other agents.
Do I need to install anything besides the plugins for DeepSeek Harness?
The plugins mount into the runtime automatically; for per-commit enforcement you also run `sofagent-audit --init` once to install the three-layer git hook (pre-commit / commit-msg / post-commit).
Does sofagent replace the model or DeepSeek Harness?
No. It does not build agents and does not replace the model — it sits between DeepSeek Harness and the model layer to add governance (inject · audit · rollback · evolve), only supplementing reliable execution.
Can I run the audit without a full install?
Yes. `npx -y -p @sofagent/audit sofagent-audit` audits the latest commit of any git repo in seconds with zero config — the full `bootstrap.sh` install is only needed on the device that runs your AI agent.
Is the audit mandatory even if an agent ignores the constraints?
Constraints are advisory, but the audit is mandatory: every commit is checked against 24 git-diff rules and violations are blocked on the spot; the recommended backstop for strong compliance is CI + file-permission locking.
07Related DSH workflows
tencentmeeting-cli
by tencentcloud
Tencent Meeting command-line tool with OAuth2 authorization for meeting, recording and attendance-report management.
dsh-auto-review
by perrylink
Second-model AI auto-review for DeepSeek Harness approval requests: a read-only reviewer subagent returns structured allow/deny verdicts with reasons, fail-closed by default, fully auditable from the session log (approval/asked -> autoReview/verdict -> approval/decided).
dsh-permission-rules
by perrylink
Claude Code-style declarative permission rules for DeepSeek Harness: ordered allow/deny/ask rules with tool-name, argument (glob/regex), and workspace-path matching on the tools/pre-execute waterfall, session-log audit, and HMR reload.
dsh-secure-audit
by pensivefei
Read-only security & compliance plugin for DeepSeek Harness: prompt-injection detection, Chinese-PII redaction, and local configuration audit with redacted, reproducible reports.
08Data and sources
9 款 `cordis-plugin-sofagent-*` 挂载进运行时（见上章）
开源 9 款插件已挂载进 DSH，烧录即用。
This page is generated from the project’s public documentation, repository metadata and a structured parse of DSH Plugins; last verified on 2026-09-03. Found an error? Submit a correction.
Best DeepSeek Harness Plugins
Twelve plugins worth installing first — picked from the whole catalog, across every category.