5 DeepSeek Harness plugins wey VPS owners need

Which DeepSeek Harness plugins dey worth installing

DeepSeek Harness plugins na third-party code wey dey run inside your agent, with your agent privileges, for machine wey you dey pay for. The community list get more than twenty categories and over a thousand entries. For rented virtual private server (VPS), you need five: dsh-budget for spend caps, dsh-permission-rules for tool gating, dsh-defend for injection and secret scanning, dsh-memory for facts wey dey survive session, and dsh-web-lan-access only after you don decide how you go authenticate.

The harness na dsh, DeepSeek open-source agent harness, wey dem build so say everything na plugin. The README itself call am developer preview and warn THERE WILL BE COMPATIBILITY-BREAKING CHANGES. This one fact shape every choice wey follow. Pin wetin you install, expect upgrade to break am, and keep the set small enough say you fit actually read everything inside. If the harness never dey run, start with DeepSeek Harness install for VPS and come back here. If the parts wey these plugins hook into — the agent loop, its tools, and its memory — still dey unclear, work through the fundamentals first, because every choice wey follow easier to judge once you sabi wetin each layer dey do.

How dsh dey install plugin, and where the config dey

dsh dey build itself from Cordis plugins, so one running instance na tree of plugins, no be one program. Profile na named combination of those plugins. The two templates na web and headless. $DSH_HOME default na ~/.dsh, and profile dey for $DSH_HOME/profiles/<name>/, where e get im own package.json, one dsh.profile manifest, and one cordis.patch.yml.

dsh plugin --profile web list
dsh plugin --profile web add dsh-budget
dsh plugin --profile web remove dsh-budget

Four source forms dey work: bare npm package name, scoped name like @towzai/dsh-memory, GitHub reference like github:PerryLink/dsh-budget#main, and local path with link: or ./. Use the GitHub form, because you fit replace #main with commit and get the same code again next month.

dsh plugin --profile web add "github:PerryLink/dsh-budget#461d478"

Layers dey apply for fixed order: every bundle for the order wey profile list dem, then profile cordis.patch.yml, then home-level cordis.patch.yml, then any --patch overlay. Order matter because later layer fit reconfigure or remove wetin earlier layer set up. So when plugin look like say e install but e no do anything, open profile cordis.patch.yml and check two things: say im insert block dey there, and say no later layer disable am.

As of 17 August 2026, npm package @deepseek-ai/dsh dey for 0.1.0-rc.7, while every plugin below declare compatibility with 0.1.0-rc.5 to 0.1.0-rc.6. This gap normal for this ecosystem, and na the usual reason plugin stop loading: harness dey move faster than the plugins around am. Upgrade the harness deliberately, then test one plugin at a time.

Read plugin before you trust am

A dsh plugin no dey sandbox away from harness. E dey load inside the same Cordis tree, for the same process, as the same operating system user, with access to the same model credentials and the same working tree. To install one dey closer to running another person script with sudo than to adding browser extension. Na the same trust question wey Claude Code plugins dey raise, and the answer still be the same: read the code, or no install am.

Four things to check, for this order:

• Which extension points e dey tap. tools/pre-execute mean say e dey see every tool call and fit block am. agent/pre-step mean say e dey see your messages. webServer.tapIndex mean say e dey rewrite the page wey e serve to your browser. Plugin wey no tap any of dem fit do very little; plugin wey tap all of dem na your security boundary.
• Whether e dey talk to network. Search the source for fetch, http, and any hard-coded hostname. Cost meter wey dey phone home dey send your usage pattern go somewhere.
• Whether e dey read credentials. Anything wey touch credentials.* or provider key need get clear reason for the README.
• The license and the last commit date. Plugin wey no get license, wey nobody touch for months, for ecosystem wey dey change every week, na liability.

After that, install by commit instead of branch, then read the insert block wey installer write inside cordis.patch.yml. That block name the plugin id and the config wey e register, and na the shortest honest description of wetin you just add. Keep provider keys away from plugin reach where harness allow am, similar to how to keep secrets away from AI agents.

dsh-budget: how I fit stop agent from spending all night?

Agent wey dey run unattended for VPS dey do exactly wetin you put am there for, but na also the risk be that. dsh-budget dey measure tokens and estimated cost for each model, session, and day, then enforce caps against those totals.

dsh plugin --profile web add "github:PerryLink/dsh-budget#461d478"

The default values dey generous: 10 USD per session, 50 per day, and 500 per month. Dem fit work for team wey get funding. For personal server, dem high reach say runaway loop fit finish before cap take effect, so lower dem on the first day.

[
  {
    "label": "Per session",
    "plugin_default_usd": 10,
    "suggested_start_usd": 2
  },
  {
    "label": "Per day",
    "plugin_default_usd": 50,
    "suggested_start_usd": 5
  },
  {
    "label": "Per month",
    "plugin_default_usd": 500,
    "suggested_start_usd": 40
  }
]

The suggested column na starting point for one operator on one box, no be published figure. Increase am when one real month of usage show say you need am. Monthly cap of 40 USD with session cap of 2 go fail loudly and early. Na so e suppose be while you still dey learn the tool appetite.

- id: budget
  config:
    budgets:
      session: 2
      daily: 5
      monthly: 40
    warnRatio: 0.8
    overLimit: block

The setting wey changes how the machine dey behave na overLimit. Default na alert. E go print warning but continue spending, so this plugin be dashboard out of the box. Set am to block and the harness go refuse more model calls once cap reach. That mean overnight job go stop instead of billing until morning. degrade na the third mode. E go replace the model with cheaper one from the degradation map. Use am when job must finish but e no need your best model. warnRatio default na 0.8, so e go notify you when spending reach 80 percent of the cap.

Two limits dey clear. Cost dey come from prices wey you provide: prices empty by default, and defaultPrice dey fall back to 1.0 USD per million input tokens and 3.0 per million output tokens. Enter the real numbers for your models. Otherwise, the dashboard na guess wey dem dress like measurement. Second, plugin dey aggregate totals inside the running process from the session event stream, so totals reset whenever the harness restart. Crash loop, or supervisor wey dey restart dsh, go reset daily cap. Treat dsh-budget as guardrail against your own jobs, and keep spend limit for provider account as the real ceiling. This na the wider point for how to control AI agent cost for VPS.

For daily work, use /budget for overview, /budget models for breakdown by model, and /budget unblock <scope> to remove a block after you decide say you want continue.

dsh-permission-rules: which tool calls no suppose ever run?

dsh-permission-rules dey put declarative rules for tools/pre-execute waterfall, so dem dey evaluate rule before tool run. Three actions dey. allow allow the call pass, deny block am and return reason wey model fit read, and ask route am go the official approval seam.

dsh plugin --profile web add "github:PerryLink/dsh-permission-rules#b30b4fb"

Rules dey inside .dsh/rules.yaml relative to the session working directory. Global fallbackPath and optional searchUp fit make system walk upward toward filesystem root. Matching cover tool-name globs, parameter key and value globs, workspace-relative path globs, agent selectors like main or subagent, and network targets.

rules:
  - match: { tools: [bash], params: { command: "rm -rf*" } }
    action: deny
    reason: "No recursive deletes"
  - match: { tools: [edit, write], paths: ["**/.env*", "**/secrets/**"] }
    action: ask
    reason: "Secret files need confirmation"
  - match: { tools: ["mcp__*"] }
    action: ask
    reason: "MCP tools need confirmation"

Evaluation na first match wins, so broad allow near the top fit quietly cancel every narrower rule under am. Write the denials first, then put permissive rules last. Tool-name glob cover mcp__*. Na so you fit control tools wey come from model context protocol (MCP) server instead of the harness itself. This matter as soon as you dey run MCP servers for VPS.

Plan for one behaviour: ask need person or process wey go answer am. For headless profile, nobody fit dey watch am, so ask rule fit hold run until somebody show. Use deny for anything wey you no go ever approve. Keep ask for the profile wey you dey sit in front of. If you want approvals to work unattended, you need real answering path. Na this how to gate AI agent actions with approvals dey explain.

dsh-defend: prompt injection and leaked secrets nko?

dsh-defend dey scan for points three: inbound messages for agent/pre-step, tool arguments for tools/pre-execute including guard against destructive-delete, and tool results for tools/post-execute. That last one na the interesting part, because na there content wey dem fetch from web page dey get check before model act on am.

dsh plugin --profile web add "github:PerryLink/dsh-defend#7ba3427"

Defaults dey cautious instead of strict: detection.injectionAction, detection.jailbreakAction and detection.secretAction all na ask, while detection.secretBlockCritical na true, so e go block critical secret no matter wetin the other settings talk. For unattended box, change the actions wey you care about to block, because ask when nobody dey available to ask no be decision.

The audit design deserve credit. defend/detection events dey record rule id, family, category, severity, decision and scan facts, but dem never record the matched text; secrets dey recorded by type only. So enabling audit log no go create another copy of the credential wey you dey try protect.

Make you understand wetin this one give you. Detection dey use rules, and README talk am plainly say new phrasing and multi-step attacks fit pass through. E reduce how often obvious attacks succeed. E no make agent safe to point at untrusted content, so keep permission rules underneath am.

dsh-memory: agent go remember wetin tomorrow?

Two different plugins dey use name dsh-memory, so e good make you know this before you type install command. Install am with explicit source so you go get the one wey you read about.

The one wey I go put for small server na the SQLite build. E register as memory, keep one file for $DSH_HOME/memory/memory.db wey all profiles share, and expose memory_write, memory_search and memory_forget. Search dey use keywords for the stored text and tags. No embedding service dey, no API key dey, and no extra process dey.

dsh plugin --profile web add "github:ben7am1n/dsh-memory#def7c6a"

The configuration wey you go touch small: path for the database file, promptRecentCount (default 10) for how many unpinned memories dem go inject, and promptMaxChars (default 2000) for the rendering budget. E depend on node:sqlite, wey Node 22 and 24 still mark as experimental, so Node upgrade na something wey you suppose test, no be something to assume say e go work.

This na wetin memory really change for the machine: injected memories dey enter system prompt for every turn. 2000-character budget mean say you go add some hundred input tokens to every request, forever. Na real cost for your bill, and na why dsh-budget suppose dey for the box before dsh-memory. Keep promptMaxChars tight and prune with memory_forget instead of allowing the file grow.

The alternative build dey store memories for YAML file and dey use embedding search with automatic prompt injection; install am with dsh plugin --profile web add github:towzai/dsh-memory. E need local ollama instance and embedding model, qwen3-embedding:0.6b by default, but you fit override am with DSH_MEMORY_EMBED_MODEL. Semantic recall better pass keyword recall. But e also mean say second service and model weights go dey resident for the same server. For small plan, na memory wey this work fit use, instead of the work wey you rent the box to do. Pick am when you get extra RAM. The general tradeoff between recall quality and resident cost dey covered for local memory for agents.

dsh-web-lan-access: web UI suppose listen beyond loopback?

npx @deepseek-ai/dsh web dey serve the interface for 127.0.0.1:3080. Browser only expose crypto.randomUUID() inside secure context, so if you load that same page through plain HTTP from another machine, e no go work. dsh-web-lan-access fix am by tapping webServer.tapIndex to inject small polyfill, and e change the server binding to 0.0.0.0.

Read the warning wey e get before you install am. Binding 0.0.0.0 make anybody for the same local area network (LAN) reach the agent without authentication. For server wey get public IP address, this mean say the whole internet fit reach am. Small list of sensitive methods (settings.*, credentials.*, llm.discoverModels) remain pinned to loopback and return 403 from remote origins, so e reduce the possible damage. But e no stop the problem, because anybody wey find the port still fit use the tool-calling surface.

Most times, you no need this plugin at all. Forward the port through SSH instead.

ssh -N -L 3080:127.0.0.1:3080 you@your-server

Then open http://127.0.0.1:3080 for your local browser. The harness still listen only on loopback, so nothing dey exposed. Also, because browser treat 127.0.0.1 as secure origin, crypto.randomUUID() dey available and you no need polyfill. Na one command, no plugin, and no new attack surface.

Install the plugin only when forwarding no go work, for example when phone for the same network need reach the UI. If you install am, bind am behind private network interface, keep firewall rule wey allow only that interface, and list the names wey you go use under trustedHosts for the web-runtime entry. For real multi-user access, dsh-passwords dey available. E add subuser permissions, hourly token quotas and daily time quotas for each subuser, automatic TLS (transport layer security) certificates through Let's Encrypt, and encrypted audit log. Treat am as platform, no be ordinary plugin: e need ports 80 and 443, e ship with im own installer, and the documented quick path pipe shell script from network directly into bash. Prefer npm install -g dsh-passwords followed by dsh-passwords install, so the code dey on disk where you fit read am before e run.

Plugin gut how you fit remove am cleanly

Uninstall get two steps, but people dey skip the second one.

dsh plugin --profile web remove dsh-budget
dsh plugin --profile web list

list no suppose show am again. Then open $DSH_HOME/profiles/web/cordis.patch.yml and delete any insert block wey still name that plugin, because na that entry dey load am into the tree. Restart the harness so e fit rebuild the tree; plugin wey don already load go remain loaded until you do this. Finally, remember say data dey survive code. $DSH_HOME/memory/memory.db and .dsh/rules.yaml go still remain after uninstall. Delete dem yourself if na removing the data you wan do.

Wetín I read, and when

Every reference for here na commit, no be branch, because main go don be different code by the time you read this. I read everything on 17 August 2026, and the harness itself dey at 0.1.0-rc.7 for npm that day.

Check those pins again before you copy command. For developer-preview ecosystem, version number wey get date na the only kind wey get real meaning.

FAQ

Which DeepSeek Harness plugins should I install first on a VPS?

Install dsh-budget and dsh-permission-rules before anything else. Budget wey get overLimit: block go stop unattended run from spending all night, while .dsh/rules.yaml file go stop tool call wey you for never approve. Add dsh-defend once agent dey read anything from public web, and dsh-memory when you notice say you dey paste the same context into every session. Skip the themes and status chips: dem add code wey dey run with your agent privileges without changing wetin the machine dey do.

Are dsh plugins sandboxed from the harness?

No. Plugin dey load inside the same Cordis tree as harness, for the same process, as the same operating system user, with the same model credentials and same working tree. Plugin wey dey tap tools/pre-execute fit see and block every tool call; one wey dey tap agent/pre-step fit see your messages. So read the source, check the license and the last commit date, and install by commit instead of branch so the code no fit change under you.

Will dsh-budget actually stop the agent, or only warn me?

E depend on overLimit. Default na alert, wey dey warn for warnRatio and continue spending. block dey refuse more model calls once e reach cap, and /budget unblock <scope> dey remove the cap when you choose to continue. degrade dey switch to cheaper model from degradation map. One limit dey important: totals dey aggregate for the running process from session event stream, so restarting harness go reset dem, and restart loop go defeat daily cap. Keep spend limit for provider account as the real ceiling.

How do I remove a dsh plugin completely?

Run dsh plugin --profile web remove <package-name>, confirm with dsh plugin --profile web list, then open $DSH_HOME/profiles/web/cordis.patch.yml and delete any leftover insert block for that plugin, because na that entry dey load am. Restart harness so plugin tree fit rebuild. Data wey plugin write stay for disk: $DSH_HOME/memory/memory.db and .dsh/rules.yaml both survive uninstall until you delete dem yourself.

Is it safe to expose the dsh web UI over the network?

No, not by itself. dsh web dey listen on 127.0.0.1:3080, and dsh-web-lan-access dey change that binding to 0.0.0.0. The plugin README itself talk say this one make anybody for the same network reach the agent without authentication, and if na public IP address, that means internet. Some methods (settings.*, credentials.*, llm.discoverModels) stay pinned to loopback and return 403 from remote origins, wey reduce the damage but no stop am completely. Use SSH port forward, ssh -N -L 3080:127.0.0.1:3080 you@your-server, or put the port behind private network interface plus firewall rule, then add real authentication before anything fit reach am from outside.