deepseek-harness-community-plugins

Expose independently installed MCP providers inside DeepSeek Harness without bundling provider code, data, credentials, or machine-specific paths. Each package is a small configuration bundle with its own version and allowlist.

[!IMPORTANT] @dff652/dsh-ai-asset-hub@0.1.1 has a reviewed GitHub Release with an exact tarball and SHA256SUMS. @dff652/dsh-agent-mail@0.1.0 remains a local public-source candidate until its separately authorized push and release. Neither package is published to npm, listed in a marketplace, or deployed to a live profile by this repository.

What you get

Package	Contract
@dff652/dsh-ai-asset-hub	Starts a deployment-owned aiah mcp process. Eight read-only tools. Five-file package.
@dff652/dsh-agent-mail	Starts a deployment-owned agent-mail-mcp process. Eleven tools with non-human approval denial. Six-file package including NOTICE.

The bundles do not ship provider executables, copy provider handlers, store credentials, start automatic wake, or inject sessions.

Validate a local candidate

Pack from a reviewed checkout, record the resulting digest, and install only that exact tarball into a disposable DSH profile:

npm pack --workspace @dff652/dsh-ai-asset-hub --ignore-scripts
sha256sum dff652-dsh-ai-asset-hub-0.1.1.tgz
dsh plugin --profile <profile> add -w ./dff652-dsh-ai-asset-hub-0.1.1.tgz

npm pack --workspace @dff652/dsh-agent-mail --ignore-scripts
sha256sum dff652-dsh-agent-mail-0.1.0.tgz
dsh plugin --profile <profile> add -w ./dff652-dsh-agent-mail-0.1.0.tgz

dsh --profile <profile> --dump-config

AIAH requires DSH_AIAH_COMMAND as the absolute path of a reviewed aiah executable. Agent Mail requires absolute DSH_AGENT_MAIL_COMMAND, DSH_AGENT_MAIL_HOME and a non-human DSH_AGENT_MAIL_ID. Neither bundle resolves a provider through PATH.

How the boundary works

DeepSeek Harness profile
        │
        ├─ @dff652/dsh-ai-asset-hub      configuration only
        │          └─ DSH_AIAH_COMMAND mcp
        │
        └─ @dff652/dsh-agent-mail        configuration only
                   └─ DSH_AGENT_MAIL_COMMAND

Provider binaries, identities, homes, endpoints, credentials, and runtime data remain outside the packages. MCP annotations are descriptive metadata rather than a permission system.

Model-visible tool contracts

mcp__aiah__aiah_asset_status
mcp__aiah__aiah_diff
mcp__aiah__aiah_doctor
mcp__aiah__aiah_migration_readiness
mcp__aiah__aiah_migration_status
mcp__aiah__aiah_scan
mcp__aiah__aiah_validate
mcp__aiah__aiah_version

mcp__agent-mail__comm_send
mcp__agent-mail__comm_inbox
mcp__agent-mail__comm_claim
mcp__agent-mail__comm_ack
mcp__agent-mail__comm_list_agents
mcp__agent-mail__comm_approve
mcp__agent-mail__comm_reject
mcp__agent-mail__comm_approvals
mcp__agent-mail__comm_tail
mcp__agent-mail__comm_events
mcp__agent-mail__comm_diagnose

AIAH writer tools such as build, apply, and rollback are intentionally absent. Agent Mail advertises approval tools but a non-human Harness identity cannot execute them.

Verify from source

Run the portable repository and package checks:

npm run check:repo
npm test
npm pack --workspace @dff652/dsh-ai-asset-hub --dry-run --ignore-scripts
npm pack --workspace @dff652/dsh-agent-mail --dry-run --ignore-scripts

On a host with the reviewed DSH runtime, run the activation and process lifecycle gates. These fail instead of silently skipping when dsh is absent:

npm run test:activation:aiah
npm run test:lifecycle:aiah
npm run test:activation:agent-mail
npm run test:lifecycle:agent-mail
npm run test:coexistence

For provider E2E acceptance, point the verifiers at separately reviewed executables and disposable stores—never a personal provider home or live profile:

npm run verify:aiah -- \
  --command /absolute/path/to/aiah \
  --testdata-root /absolute/path/to/disposable/aiah-testdata

npm run verify:agent-mail -- \
  --tarball /absolute/path/to/agent-mail-1.0.0-alpha.4.tgz

For installation, upgrade, removal and rollback procedures, see the consumer operations guide. Release tags are package-specific in this monorepo.

Reviewed compatibility

Component	Reviewed value
AIAH package	@dff652/dsh-ai-asset-hub@0.1.1 candidate
Agent Mail package	@dff652/dsh-agent-mail@0.1.0 source candidate
DeepSeek Harness	0.1.0-rc.6
MCP client	@deepseek-ai/dsh-mcp-client@0.1.0-rc.6
Node.js	^22.19.0 || >=24.0.0
AI Asset Hub executable	Official Release v0.1.11
Agent Mail provider	1.0.0-alpha.4 at commit ca6601c

CI runs the portable contract on Node 22.19 and 24.19.

Release state

Transition	State
Clean repository and origin	AIAH source is on origin; Agent Mail source is local until a separate push
Public repository and dsh-plugin topic	Complete
AIAH GitHub Release	dsh-ai-asset-hub-v0.1.1; exact tarball and SHA256SUMS verified
Agent Mail GitHub Release	Not released; local source candidate only
npm publication	Not published
Marketplace listing	Not submitted
Model-visible L5 acceptance	Not claimed
Live-profile deployment	Not part of this repository

Read the full release-readiness record for exact digests, environment evidence, remaining gates, and the rule that publication and deployment transitions require separate authorization. The project status matrix separates implementation, public export, GitHub Release, npm, marketplace and live-deployment states for the current and planned providers.

Project notes

• This is an independent project, not an official DeepSeek project or an official security review of AI Asset Hub or Agent Mail.
• Future providers must enter as separate workspaces after their own source, license, secret, artifact, and disposable-profile review.
• AgentMemory remains a future public-export scope. Automatic wake and automatic session capture are not claimed here.

Contributions are welcome within the documented public boundary. Start with CONTRIBUTING.md, and report vulnerabilities according to SECURITY.md.

License

MIT