Installing a DSH plugin is one command; installing one safely means checking three things first. Plugins are installed into a profile rather than globally, and the web interface uses the web profile, so community install commands take the form dsh plugin --profile web add <package>, where the package name must match what the repository actually publishes. Before you run it, read the listing’s verification level: L1 means the repository was found and has a README, L2 that its manifest parses, and L3 that the install command was parsed and a compatibility target declared. Then compare the declared dshTarget with your own harness release, and check what the plugin can reach — files, shell, network or credentials. This directory has run no automated security scan on any listing, so “unverified” means neither safe nor unsafe. Start the harness with npx @deepseek-ai/dsh web first, or the plugin has nowhere to register itself. The steps below take each of those checks in turn.
Step 1: start the harness
You need a running harness before a plugin has anywhere to register itself:
npx @deepseek-ai/dsh webThe Web UI opens at http://127.0.0.1:3080. Leave it running in one terminal and use a second terminal for installs.
Step 2: understand profiles
Plugins are installed into a profile, not into a global location. The web interface uses the web profile, so community install instructions look like this:
dsh plugin --profile web add <package>Underneath, that command forwards to pnpm inside the profile directory. The practical consequences are worth knowing before you install anything:
- The plugin is a normal npm package, so its dependency tree lands on your disk.
- Removing it is a normal package removal, which means leftover data files may stay behind.
- A plugin installed to a different profile will not appear in the web UI.
Step 3: install the plugin
Take the install command from the plugin’s listing. For example, the free search provider:
dsh plugin --profile web add dsh-free-searchThen restart or reload the session so the harness picks up the new plugin. Many interface plugins appear immediately; tool plugins usually need a fresh session before the model can call them.
Step 4: verify before you trust
Copying a command is not the same as trusting a plugin. Before you run something that reads files, executes shell commands or touches credentials, check four things:
| Check | What you are looking for |
|---|---|
| Source | A real repository with history, not a wrapper around someone else’s archive |
| Install spec | The exact package name matches the repository it claims to come from |
| Permissions | Filesystem, network, browser or shell access the plugin actually needs |
| Maintenance | Recent commits, an open issue tracker and a declared license |
Every listing on this site carries a verification level, a security scan status and a health field so these four checks are visible at a glance. The verification methodology explains what each level means.
Step 5: keep it working
DSH is in developer preview, and plugins declare the harness versions they tested against — this directory records that declaration verbatim as dshTarget, for example >=0.1.0-rc.6 <0.2.0. When the harness moves to a new release:
- Read the plugin’s release notes for a matching update.
- If there is no update, expect the plugin either to keep working or to fail to load. A plugin that fails to load normally reports an error at startup rather than breaking the session.
- If a plugin must keep working across upgrades, pin its version and upgrade deliberately.
Pin exact versions when a plugin matters to your workflow:
dsh plugin --profile web add dsh-memento@0.5.10Common problems
The plugin installed but the model cannot use it. Tool plugins register into the tool registry at startup. Start a new session, or restart the harness.
Two plugins claim the same interface surface. Interface plugins sometimes replace the same region of the UI. Install one, check it, then add the next.
The install fails with a dependency error. That is usually a package resolution problem in the profile rather than a harness problem. Re-running the command after dsh plugin --profile web list shows what is already present.
FAQ
Which profile should I use?
Use web for anything you interact with through the Web UI. Other profiles exist for other entry points.
Do I need admin rights?
No. Everything installs into your user profile directory.
Can I install several plugins at once?
Yes, but install one at a time when you are evaluating, so a failure is attributable.
How do I uninstall a plugin?
Use the matching remove operation for the profile. Check for leftover data in the profile directory afterwards if the plugin stored state.
Next steps
Learn what DSH actually is in What is DeepSeek Harness, or start browsing the plugin directory.