Introduction
"This list doesn't rank plugins or judge their quality, and we don't want to."
This is article #239 in the "One Open Source Project a Day" series. Today's subject isn't a single tool but a curated list — Awesome DSH Plugin, maintained by the organization of the same name, covering the plugin ecosystem for DeepSeek Harness (dsh, DeepSeek's open-source agent harness). 19,015 Stars, CC0-1.0 license, and the README now tracks over 5,000 entries.
DeepSeek Harness is DeepSeek's open-source runnable coding agent (Web and headless), built around an "everything is a plugin" architecture: models, tools, sandboxes, session storage, UI, even the agent loop itself can be swapped out or extended by a plugin. That radical pluggability has produced an unusually dense third-party ecosystem — and Awesome DSH Plugin exists to solve a very concrete problem: with thousands of plugins out there, how do you find the one you actually need, and know it really installs and really does what its description claims?
What You'll Learn
- A "don't rank, just verify" maintenance philosophy for an Awesome List — what the actual bar for inclusion is
- Just how large a plugin-first Agent Harness ecosystem can grow (22 categories, 5,000+ entries)
- How "meta-plugins" like
dsh-marketanddsh-find-pluginloop back to serve this very list - How a one-file-per-plugin YAML data layout solves the merge-conflict problem that plagues large Awesome Lists
- A problem every third-party plugin ecosystem eventually has to face head-on: how to disclose security risk honestly instead of glossing over it
Prerequisites
- Basic hands-on experience with an AI coding agent (Claude Code, Codex, Cursor) helps you place DeepSeek Harness in context
- A general sense of plugin/extension systems (manifests, registration, install flows)
- No need to have read DeepSeek Harness's source — just a rough idea of what an "agent harness" is
Project Background
Overview
Awesome DSH Plugin is, at its core, a data-aggregation + static-site-generation project: the real source of truth lives in thousands of YAML files under data/plugins/ (one file per plugin). README.md and README.zh.md are auto-generated from those YAML files by a script, and the website awesome-dsh-plugin.com renders from the same data. The project doesn't host any plugin code itself — it's a link directory with a verification process attached.
What sets it apart from most Awesome Lists is an explicit refusal to rank quality: being listed proves a plugin met a handful of objective, checkable criteria — nothing more.
Author / Team
- Maintained by: the awesome-dsh-plugin organization (an org account, community-maintained rather than a single author's project)
- Primary language: JavaScript (mostly generation scripts and automated checks)
- License: CC0-1.0 (Creative Commons Zero — a public-domain dedication, notably different from the MIT/Apache licenses used by most open-source projects)
- Created: 2026-08-13
- Status: Actively maintained, with heavy GitHub Actions automation; most recently pushed within the last day
Project Stats
- ⭐ GitHub Stars: 19,015+
- 🍴 Forks: 4,310+
- 📄 License: CC0-1.0
- 📅 Created: 2026-08-13 (grown to 5,000+ plugin entries in under two months)
- 👥 Core contributors: fkysly leads with 1,505 commits; github-actions[bot]'s 838 commits reflect a highly automated generation pipeline; 173787247, PerryLink, zhengjy01, and others round out an active contributor base
- 📬 Open Issues: 836 (the sheer volume says something about how active this ecosystem is)
- 🏷️ Topics: awesome, awesome-list, deepseek-harness, dsh, dsh-plugin
- 📊 The official plugin-count endpoint (
awesome-dsh-plugin.com/count.json) currently reports: 5,065 plugins
Quick Start
Option 1: Just Browse the List
The simplest path is to open the README or awesome-dsh-plugin.com, browse by category (22 of them — AGI Architecture Exploration, UI Enhancements, Models & Providers, Security & Permissions, and more), and install whatever you find with dsh plugin add:
# Example: install the officially recommended plugin market
dsh plugin --profile web add dshmarketOption 2: Browse Visually with dsh-market
After that one command, a searchable plugin-card market shows up right in Settings — category filters, one-click install/upgrade, one-click theme switching. Effectively, this turns the Awesome List into a GUI.
Option 3: Let Your Agent Find Plugins For You
If you'd rather not leave the chat to browse a list, install dsh-find-plugin:
dsh plugin --profile web add dsh-find-pluginOnce installed, you can just ask your agent in plain language — "I want something that plays a sound when a task finishes" — and it searches this curated registry and hands you an install command. It's a nice microcosm of the whole ecosystem: using an agent to manage the agent's own plugins.
Submitting Your Own Plugin
If you've built a dsh plugin and want it listed, the submission flow is deliberately lightweight: add one file at data/plugins/<owner>__<repo>.yml with url, name, category, a required English description, and an optional Chinese one, then open a PR. Both READMEs regenerate automatically once it merges.
Core Deep-Dive
Don't Rank, Just Verify: An Awesome List's Philosophy on Inclusion
The README states its bar for inclusion plainly: "An entry is added when the plugin installs with dsh plugin add, does what its one-line description says, sits in the right category, and is maintained." Every submission is actually checked against its source — if a description claims "46 tools," someone counts them.
What follows is the more notable part: "This list doesn't rank plugins or judge their quality, and we don't want to." This is a disciplined, deliberately narrow stance. Plenty of "Awesome X" projects drift, often unintentionally, into acting as a "best-of" ranking or a recommendation list. This project draws a hard line instead — a listing proves a plugin cleanly satisfies a few objective rules, nothing about it being better than any other listed plugin. Entries whose repos go stale, break, or turn out to be broken get removed — but staying active is not itself a quality endorsement either.
That restraint matters a lot at this scale (5,000+ entries, 22 categories): ranking and scoring degrade fast once a list grows exponentially — gaming, Matthew effects, and uneven reviewer bandwidth all creep in. "Objective verification, no subjective judgment" is a rule set that's actually sustainable long-term, where ranking systems typically aren't.
One File Per Plugin: Solving a Large Collaborative List's Core Conflict With a Data Layout
Awesome Lists have a classic collaboration pain point: every contributor's PR edits the same section of the same README file, so whichever PR merges first forces everyone else in the queue to rebase around a conflict. Awesome DSH Plugin's fix is structural — the README stops being the source of truth and becomes a build artifact. The real data is split into one file per plugin, data/plugins/<owner>__<repo>.yml:
url: https://github.com/owner/repo
name: owner/repo
category: ui
description:
en: One-line description ending with a period.
zh: 一句话描述，以句号结尾。The contributing docs put it well: "Separate files never collide. Generated README lines always did." Both READMEs (English and Chinese) are regenerated on main after a PR merges — contributors don't need to run anything locally, and shouldn't hand-edit the README at all. This is a textbook move for converting "human editing conflicts" into "pure data appends" — and at a scale of five thousand entries, it's closer to a necessity than an optional optimization.
A Problem No Third-Party Plugin Ecosystem Can Dodge: Honest Disclosure of Security Risk
What's most worth calling out about this list is that it doesn't paper over the central tension: being listed is not the same thing as being safe. A [!WARNING] block sits right at the top of the README, stated directly:
Installing a plugin runs third-party code on your machine with your own permissions — it can read your files, use your credentials, and reach the network. Tool approvals don't sandbox plugin code. Being on this list is not a security review: check the source before you install, and try unfamiliar plugins somewhere that doesn't hold your keys.
This isn't boilerplate legal cover — it names a specific, easy-to-miss technical distinction: the harness's "tool approval" mechanism governs permission confirmation when the agent calls a tool, which is a completely different layer from runtime isolation of the plugin's own code. Once a plugin is installed, its code runs directly under your user permissions — the approval system simply doesn't reach that layer at all. That also explains why the "Security & Permissions" category is so densely populated: static scanners for install packages (lifecycle scripts, dynamic execution, credential-exfiltration combos), sandbox-escape detectors, tiered permission gateways, LLM pre-review before approval — these are, in large part, the community voluntarily patching a trust boundary that the harness itself never provided.
From an ecosystem-health standpoint, this is actually a fairly mature signal: when a plugin ecosystem grows large enough to need its own dedicated category of "plugin security auditing plugins" to defend against the risk introduced by other plugins, that's a sign the ecosystem is big enough to attract a real attack surface — not a toy project anymore.
Resources
- 🌟 GitHub: awesome-dsh-plugin/awesome-dsh-plugin
- 🌐 Website: awesome-dsh-plugin.com
- 🛒 Plugin market: dsh-market
- 💬 Conversational plugin search: dsh-find-plugin
- 📖 Contributing guide: contributing.md
- 🖥️ Compatible desktop clients: dsh-desktop, deepseek-harness-desktop (hairyf / anywhere-labs variants), among others — all ship dsh-market built in
- ⚠️ Disclaimer: a community-maintained index; listing is not a security review or a quality endorsement; installing third-party plugins is at your own risk
Summary
Awesome DSH Plugin answers a question every plugin-first agent harness eventually has to confront: once a plugin count grows from dozens to five thousand, how do you keep the list itself trustworthy and maintainable, rather than letting it rot into an unmanageable pile of dead links?
Three things worth noting:
The "don't rank, just verify" philosophy is a disciplined choice that still holds up at five-thousand-entry scale. Many Awesome Lists quietly start layering in star-count sorting or "editor's picks" once they grow large enough. This project draws a firm boundary — objective verification only, no quality judgment — and that boundary is likely a big part of why it could grow to five thousand entries in two months without losing credibility.
The one-file-per-plugin YAML layout is a design pattern worth stealing for any large collaborative list. Demoting the README from "source of truth" to "build artifact," and replacing a shared append-only text block with independent files, eliminates merge conflicts at scale by construction. The idea generalizes well beyond plugin lists — to anywhere many people need to append entries to the same catalog.
The candid disclosure of third-party code execution risk fills in the gap that pluggable architectures most often leave unaddressed. The "everything is a plugin" design gives the ecosystem enormous extensibility, but it inherently introduces supply-chain and runtime trust problems. Rather than hiding that, this list puts a WARNING front and center, spelling out exactly where the approval mechanism's coverage ends — a level of transparency that's rare for an "Awesome List" category, and exactly the information users actually need.
If you're using DeepSeek Harness, or you're simply curious how large an ecosystem a fully pluggable agent system can grow, Awesome DSH Plugin — and the engineering thinking behind credibly maintaining a five-thousand-entry community catalog — is worth a look.
Explore PrimeSkills — a curated marketplace of AI agents and skills, each validated against real enterprise workflows. No hype, just what actually works.
Visit my personal site for more insights and interesting products.