Plugins & ecosystem

Goal

Enable one low-risk plugin safely, and know how community packages are discovered.

What can be a plugin

Model providers, tools, skills, sessions, sandboxes, storage, loops, schedulers, and UI pieces can ship as Cordis/npm plugins. You compose them in configuration so swaps do not require forking deepseek-harness.

Discovery

• Start from official repository docs and trusted npm scopes.
• Community listings often use the dsh-plugin topic for discoverability.
• Read each package’s required secrets, network access, and filesystem scope before enabling.

Safe enablement practice

1. Use a disposable workspace.
2. Enable one plugin at a time.
3. Run a Minimal or Creative profile if you are unsure.
4. Watch Trajectory for unexpected tool calls.
5. Disable and remove packages that request broader access than you need.

Authoring sketch

Plugin authors register tools/services with Cordis, document config keys, and test under Minimal/Creative before promoting a preset to Standard. Keep sample repos free of real API keys.

This site’s role

We explain the model; we do not host a live marketplace binary. Evaluate sources yourself and prefer upstream docs for install pins.

FAQ

• Is a curated card a security approval? No. Use the plugin security checklist before dsh plugin add.
• Where do install commands live? Community plugins and the plugin guide.

Next

Finish with Observability & Trajectory so every run is auditable.