MIT-licensed AI security platform (Shield code audit + Spear authorized pentest) that integrates with DeepSeek Harness as a native plugin and uses DeepSeek as the default LLM for semantic analysis — offline L1/L2, API-backed L3, scope-gated by an authorization allowlist.
DSH integration
Native runtime
Author-claimed
Safety audit
Unaudited
Last verified
2026-08-25
License
MIT
01What can it help you accomplish?
Audit AI-generated code for security flaws before it ships
A 3-layer report (L1 hallucinated packages / hardcoded secrets, L2 SAST, L3 semantic gaps) exportable as SARIF / JSON / HTML / Markdown
Developers and teams shipping AI-written code who need to catch missing safeguards and AI-pattern errors
Run authorized, automated penetration testing against targets you own
End-to-end Recon → Explore → Fact → Reflect → Report → PoC pipeline with multi-format reports (Markdown / SARIF / JSON / HTML)
Security engineers, red teams and CTF players who need an automated, scope-gated pentest engine
Get live security feedback inside your editor and terminal
VSCode / JetBrains real-time diagnostics + Quick Fix, plus a Rust + ratatui TUI workbench with slash commands
Developers who want security scanning embedded in their IDE and a terminal workflow
02How to install into DeepSeek Harness
Prerequisites
- Python 3.10+ for the core runtime
- Optional: a Rust toolchain to build the TUI, and a supported IDE (VSCode / JetBrains 2025.2+)
Installation steps
- 01
Install the Python core + CLI: `pip install -e .`
- 02
Optionally build the Rust TUI: `cargo build --manifest-path tui/Cargo.toml`
- 03
Launch the terminal workbench with `deepsec tui`, or download a prebuilt binary (e.g. deepsec-tui-windows.exe) from Releases
Verify the integration
Not specified by the author
03DSH integration and capability boundaries
Ships as a DeepSeek Harness plugin (dsh-plugin / dsh-plugin-market tags) and uses DeepSeek as the default LLM provider for L3 semantic code analysis.
Shield — code security audit
A project directory or agent config (e.g. ./src, ./agent-config)→3-layer findings (L1 regex/entropy, L2 Tree-sitter AST, L3 LLM semantic) with SARIF / JSON / HTML export
L3 semantic analysis calls an external LLM API and requires an API keySpear — authorized pentest engine
An authorized target listed in ~/.deepsec/targets/scope.json→Recon → Explore → Fact → Reflect → Report → PoC pipeline with Markdown / SARIF / JSON / HTML reports
Only attacks targets in the scope.json allowlist; everything else is rejectedIssues real network requests to authorized targetsTUI terminal workbench
Slash commands such as /shield scan and /spear run→Three-panel security workbench (workspace · transcript · findings inspector) with Plan / Agent / YOLO modes
IDE plugins (VSCode / JetBrains)
Source files open in the editor→Real-time diagnostics, Quick Fix suggestions and a Findings sidebar
Scans on save by default (deepsec.scanOnSave = true)MCP Server
MCP clients such as Claude Desktop and Cursor→Exposes tools for Shield scanning, Spear recon and report generation
04Who is it for? When not to use it?
Good for
- Developers and teams shipping AI-written code who need to catch missing safeguards and AI-pattern errors
- Security engineers, red teams and CTF players who need an automated, scope-gated pentest engine
- Developers who want security scanning embedded in their IDE and a terminal workflow
Not for
- Spear only attacks targets explicitly listed in scope.json; anything else is rejected, and private/loopback addresses stay blocked to prevent hitting internal networks. Only scan assets you own or have written authorization for.
- L3 semantic analysis depends on an external LLM API (DeepSeek by default) and needs an API key plus network access; offline runs cover L1 + L2 only.
05Compatibility, maintenance and safety notes
- Spear only attacks targets explicitly listed in scope.json; anything else is rejected, and private/loopback addresses stay blocked to prevent hitting internal networks. Only scan assets you own or have written authorization for.
- L3 semantic analysis depends on an external LLM API (DeepSeek by default) and needs an API key plus network access; offline runs cover L1 + L2 only.
- The TUI needs a Rust build or a prebuilt binary, and the JetBrains plugin requires JetBrains 2025.2+; the Python core needs Python 3.10+.
MIT · actively maintained (latest release v0.2.0, 2026-08-12)
06Frequently asked questions
How does DeepSec relate to DeepSeek Harness?
DeepSec is published as a DeepSeek Harness plugin (dsh-plugin / dsh-plugin-market tags) and uses DeepSeek as its default LLM provider for L3 semantic analysis. DeepSeek is configured out of the box (provider `deepseek`, base URL `api.deepseek.com/v1`, model `deepseek-chat`).
Do I need a DeepSeek API key to use DeepSec?
Only for L3 semantic analysis. L1 (regex/entropy) and L2 (Tree-sitter AST) run fully offline. To enable L3, set `deepsec config set llm.provider deepseek` and `deepsec config set llm.api_key "sk-xxx"`, or export `DEEPSEC_LLM_API_KEY`.
Is Spear safe to run — will it hit unauthorized targets?
Spear is gated by an authorization allowlist. Only targets listed in `~/.deepsec/targets/scope.json` can be attacked; everything else is rejected with `target ... is not present in the scope manifest`, and private/loopback addresses stay blocked. Never add assets you don't own or lack written authorization for.
How do I scan AI-generated code in DeepSeek Harness?
Run `deepsec shield scan ./src` for offline L1+L2, or add `DEEPSEEK_API_KEY=... deepsec shield scan ./src --layer l3` for LLM-backed semantic checks. Output can be SARIF for CI integration.
What IDEs and interfaces are supported?
VSCode and JetBrains 2025.2+ get real-time diagnostics and Quick Fix; there is also a Rust + ratatui TUI workbench and a built-in MCP Server callable from Claude Desktop / Cursor.
07Related DSH workflows
open-design
by nexu-io
🎨 Best DeepSeek Harness Design Plugin. The open-source Claude Design alternative. 🖥️ Local-first desktop app. 🖼️ Your coding agent becomes the design engine: prototypes, landing pages, dashboards, slides, images & video — real files, HTML/PDF/PPTX/MP4 export. 🤖 Claude Code / Codex / Cursor / DeepSeek Harness / OpenCode & 20+ CLIs via BYOK.
picgo
by molunerfinn
:rocket: The Ultimate Image Uploader for Efficient Creators. Supports Obsidian, Typora, VS Code etc. and 60+ image hosting services (S3, GitHub, Cloudflare R2, Imgur, Aliyun OSS...). Paste, upload, done.
dsh-desktop
by anywhere-labs
Modern desktop client for the DeepSeek Harness (dsh) plugin ecosystem. Everything is a plugin — even the desktop shell itself.
openbiliclaw
by whiteguo233
Local-first, open-source AI content discovery agent that learns your taste and proactively finds content across Bilibili, Douyin, YouTube, Reddit, X and the open web.
08Data and sources
DeepSeek | `api.deepseek.com/v1` | `deepseek-chat`
交互设计借鉴 DeepSeek-TUI
This page is generated from the project’s public documentation, repository metadata and a structured parse of DSH Plugins; last verified on 2026-08-25. Found an error? Submit a correction.
Best DeepSeek Harness Plugins
Twelve plugins worth installing first — picked from the whole catalog, across every category.