deepseek-harness-community-plugins

Expose independently installed MCP providers inside DeepSeek Harness without bundling provider code, data, credentials, or machine-specific paths. Each package is a small configuration bundle with its own version and allowlist.

[!IMPORTANT] @dff652/[email protected] has a reviewed GitHub Release with an exact tarball and SHA256SUMS. @dff652/[email protected] now has the same reviewed Release boundary; its marketplace submission is open as awesome-dsh-plugin#2988 with both automated checks passing. @dff652/[email protected] remains public source only because no portable, publicly reviewable adapter is shipped. The AIAH marketplace entry from awesome-dsh-plugin#2957 is merged and visible in the public catalog. No package is published to npm or deployed to a live profile by this repository.

What you get

Package	Contract
@dff652/dsh-ai-asset-hub	Starts a deployment-owned aiah mcp process. Eight read-only tools. Five-file package.
@dff652/dsh-agent-mail	Starts a deployment-owned agent-mail-mcp process. Eleven tools with non-human approval denial. Six-file package including NOTICE.
@dff652/dsh-agentmemory	Starts a deployment-owned AgentMemory stdio adapter. Exact eight tools. Five-file package. Users supply the reviewed adapter.

The bundles do not ship provider executables, copy provider handlers, store credentials, start automatic wake, or inject sessions.

Validate a local candidate

Pack from a reviewed checkout, record the resulting digest, and install only that exact tarball into a disposable DSH profile:

npm pack --workspace @dff652/dsh-ai-asset-hub --ignore-scripts
sha256sum dff652-dsh-ai-asset-hub-0.1.1.tgz
dsh plugin --profile <profile> add -w ./dff652-dsh-ai-asset-hub-0.1.1.tgz

npm pack --workspace @dff652/dsh-agent-mail --ignore-scripts
sha256sum dff652-dsh-agent-mail-0.1.0.tgz
dsh plugin --profile <profile> add -w ./dff652-dsh-agent-mail-0.1.0.tgz

npm pack --workspace @dff652/dsh-agentmemory --ignore-scripts
sha256sum dff652-dsh-agentmemory-0.1.0.tgz
dsh plugin --profile <profile> add -w ./dff652-dsh-agentmemory-0.1.0.tgz

dsh --profile <profile> --dump-config

AIAH requires DSH_AIAH_COMMAND as the absolute path of a reviewed aiah executable. Agent Mail requires absolute DSH_AGENT_MAIL_COMMAND, DSH_AGENT_MAIL_HOME and a non-human DSH_AGENT_MAIL_ID. AgentMemory requires absolute DSH_AGENTMEMORY_COMMAND pointing at a reviewed stdio adapter; this repository does not ship that adapter. None of the bundles resolve a provider through PATH.

How the boundary works

DeepSeek Harness profile
        │
        ├─ @dff652/dsh-ai-asset-hub      configuration only
        │          └─ DSH_AIAH_COMMAND mcp
        │
        ├─ @dff652/dsh-agent-mail        configuration only
        │          └─ DSH_AGENT_MAIL_COMMAND
        │
        └─ @dff652/dsh-agentmemory       configuration only
                   └─ DSH_AGENTMEMORY_COMMAND

Provider binaries, identities, homes, endpoints, credentials, and runtime data remain outside the packages. MCP annotations are descriptive metadata rather than a permission system.

Model-visible tool contracts

…