AGPL-3.0 local security audit for AI API relays and LLM proxies — installed as a native DeepSeek Harness plugin via `dsh plugin add`, run with `/relay-audit`, producing reviewable Markdown reports.
DSH integration
Native runtime
Author-claimed
Safety audit
Unaudited
Last verified
2026-08-21
License
AGPL-3.0
01What can it help you accomplish?
Audit a third-party AI API relay or LLM proxy before trusting it, from inside DeepSeek Harness
A local 14-step audit with per-step findings and a final `LOW / MEDIUM / HIGH` verdict in a structured Markdown report
Developers and agent operators who rely on third-party AI API relays or OpenAI/Claude-compatible proxies and want repeatable evidence before sending production or coding-agent traffic
Detect relay tampering: prompt injection, model substitution, tool-call rewriting and SSE anomalies
Per-step detector evidence covering prompt safety, relay integrity, model identity, and Web3 wallet safety checks
Security-conscious teams evaluating Claude-compatible or OpenAI-compatible proxies for hidden prompt injection, model swaps, context truncation, or rewritten tool output
Run wallet-safety checks before Web3 agent workflows touch signing or transactions
Profile-gated Web3 probes: ETH transfer guidance, signed-transaction refusal, and private-key leak refusal checks
Web3 agent builders who route wallet-related actions through a relay and want wallet-oriented prompt-injection probes first
02How to install into DeepSeek Harness
Prerequisites
- DeepSeek Harness (dsh) Web or a profile-based TUI client using the official `@deepseek-ai/dsh-commands` registry
- An API key stored in DSH Credentials for the relay/provider being audited
Installation steps
- 01
Pin a release tag and install the plugin: `DSH_PLUGIN_REF=v2.4.0` then `dsh plugin --profile web add "github:toby-bridges/api-relay-audit#${DSH_PLUGIN_REF}"`
$ dsh plugin --profile web add "github:toby-bridges/api-relay-audit#${DSH_PLUGIN_REF}"
- 02
For dsh-cc-tui and other compatible profile-based clients: `dsh plugin --profile cc-tui add "github:toby-bridges/api-relay-audit#${DSH_PLUGIN_REF}"`
$ dsh plugin --profile cc-tui add "github:toby-bridges/api-relay-audit#${DSH_PLUGIN_REF}"
- 03
Run the audit command in the session: `/relay-audit`, or `/relay-audit --connectivity` for a lower-cost check
Verify the integration
Not specified by the author
03DSH integration and capability boundaries
Installable dsh-api-relay-audit plugin bundle for DeepSeek Harness Web and compatible profile-based TUI clients, installed pinned to a release tag via `dsh plugin add`
14-step relay security audit
Relay base URL plus API key (standalone) or current DSH provider's baseURL / model / credential reference (DSH plugin)→Structured Markdown report with per-step findings and a final `LOW / MEDIUM / HIGH` verdict
Sends audit probes and your API key to the chosen relay URL; a full audit may consume metered tokensRuntime profiles: general / web3 / full
`--profile general|web3|full` flag→General relay checks by default, wallet-safety probes for Web3 flows, or both combined
Credential handling via DSH Credentials
DSH credential reference (or `--credential-ref`)→API key resolved from DSH Credentials and delivered to the local audit process
Credential is delivered through an environment variable — never through command arguments or the session logZero-dependency standalone audit
Python stdlib plus `curl`→Local audit run via the single-file `audit.py` without Python package dependencies
Downloads `audit.py` from raw.githubusercontent.com via curl
04Who is it for? When not to use it?
Good for
- Developers and agent operators who rely on third-party AI API relays or OpenAI/Claude-compatible proxies and want repeatable evidence before sending production or coding-agent traffic
- Security-conscious teams evaluating Claude-compatible or OpenAI-compatible proxies for hidden prompt injection, model swaps, context truncation, or rewritten tool output
- Web3 agent builders who route wallet-related actions through a relay and want wallet-oriented prompt-injection probes first
Not for
- Independent wrappers without DSH profiles and the DSH command registry are not compatible with this bundle.
- The DSH distribution does not add a new model baseline: the selected route must identify as Claude, although the relay API itself may be Anthropic-compatible or OpenAI-compatible.
05Compatibility, maintenance and safety notes
- Independent wrappers without DSH profiles and the DSH command registry are not compatible with this bundle.
- The DSH distribution does not add a new model baseline: the selected route must identify as Claude, although the relay API itself may be Anthropic-compatible or OpenAI-compatible.
- A report is not a safety certificate: the tool does not certify that a relay is safe, and `inconclusive` results (blocked probes, ambiguous responses) stay visible instead of being treated as clean.
AGPL-3.0 · actively maintained (latest release v2.4.0, 2026-08-15)
06Frequently asked questions
How do I install API Relay Audit in DeepSeek Harness?
Pin a release tag and run `DSH_PLUGIN_REF=v2.4.0` then `dsh plugin --profile web add "github:toby-bridges/api-relay-audit#${DSH_PLUGIN_REF}"`. The same command works with `--profile cc-tui` for dsh-cc-tui and other compatible profile-based clients.
How do I run an audit after installing?
Type `/relay-audit` for the full default audit, or `/relay-audit --connectivity` for a lower-cost check. You can also target a specific relay with `/relay-audit --url <URL> --model <claude-model> --credential-ref <DSH_CREDENTIAL_REF>`.
Where does my API key go?
The plugin reuses the current DSH provider's baseURL, model and credential reference. The credential stays in DSH Credentials and is delivered to the local audit process through an environment variable, never through command arguments or the session log; your API key is sent only to the relay URL you choose.
What are the limitations?
Independent wrappers without DSH profiles and the DSH command registry are not compatible with this bundle, and the selected route must identify as Claude. The report is reviewable evidence — it does not certify that a relay is safe, and `inconclusive` steps stay visible instead of being treated as clean.
07Related DSH workflows
dsh-context
by bowenliang123
Context dashboard tab + /context command showing context-window composition, per-turn history, compaction/prune events, per-message token costs
awesome-deepseek-harness-plugins
by zhiyuan-fan
Curated DeepSeek Harness (DSH) plugins, extensions, tools, skills, clients, runtimes, integrations, and verified references — English and Chinese.
awesome-ai-pedia
by awesome-ai-pedia
One-stop AI resource encyclopedia for dsh — LLMs, agents, RAG, multimodal, MLOps, AI tools, vibe coding and learning roadmaps, constantly updated.
jingyun-dsh
by jingyunstudio
A one-stop AI commercialization desktop client built on Jingyun Studio plus DeepSeek Harness (DSH).
08Data and sources
The repository is also an installable `dsh-api-relay-audit` bundle for DeepSeek Harness Web and community TUI surfaces t…
DSH_PLUGIN_REF=v2.4.0 dsh plugin --profile web add "github:toby-bridges/api-relay-audit#${DSH_PLUGIN_REF}"
This page is generated from the project’s public documentation, repository metadata and a structured parse of DSH Plugins; last verified on 2026-08-21. Found an error? Submit a correction.
Best DeepSeek Harness Plugins
Twelve plugins worth installing first — picked from the whole catalog, across every category.