dshmarketplace-py

English · 简体中文

---

Find and install DeepSeek Harness (DSH) plugins from Python.

pip install dshmarketplace

import dshmarketplace as dshm

for plugin in dshm.search("memory", limit=5):
    print(plugin.full_name, "—", plugin.summary)

Zero dependencies. Typed. Works as a library, a CLI, or a pair of agent tools.

Why this exists

DeepSeek Harness is DeepSeek's open agent harness, where every capability is a plugin. There are over a thousand of them, and the ecosystem is weeks old — which means a plugin name recalled from a model's training data is more likely to be wrong than right, and a wrong name is either a failed install or somebody else's package.

This package is how a Python agent looks one up instead of guessing.

It reads the same catalogue as dshmarketplace.dev, the dshmarketplace-cli npm package and the in-DSH plugin, so a listing cannot say one thing here and something else in a browser.

Library

from dshmarketplace import Client

client = Client()

results = client.search("vision", category="vision", limit=5)
print(results.total)

plugin = client.get("Anionex/dsh-vision-toolkit")
plugin.summary                 # English
plugin.summary_zh              # Chinese, hand-written — not a translation
plugin.summary_in("zh")        # whichever the locale asks for
plugin.stars, plugin.license, plugin.risk_flags

plan = client.resolve("Anionex/dsh-vision-toolkit")
plan.command                   # 'dsh plugin --profile web add dsh-vision-toolkit'
plan.argv                      # the list that would actually be executed

client.install("Anionex/dsh-vision-toolkit", dry_run=True)

Async, for agents that cannot block the event loop:

from dshmarketplace import AsyncClient

plugins = await AsyncClient().search("memory")

The transport is still urllib, moved off the loop with asyncio.to_thread. That is deliberate and stated plainly: it does not block, and it does not pretend to be a native async client. Pulling in httpx to make it one would cost every user a dependency conflict for one request per turn.

CLI

dshm find memory
dshm find vision --limit 5 --category vision
dshm info Anionex/dsh-vision-toolkit
dshm add NanmiCoder/dsh-agent-teams --dry-run

Option
--json	Machine-readable output, stable schema (all commands)
--limit <n>	Results to show (find, default 10)
--category <id>	Filter by category (find)
--profile <name>	DSH profile to install into (add, default web)
--source github	Force the GitHub source over npm (add)
--dry-run	Resolve without running the install (add)

Agent tools

Two tools in the JSON-Schema shape OpenAI, Anthropic and most frameworks accept, plus a dispatcher — wiring is two lines.

from dshmarketplace.tools import TOOLS, dispatch

response = anthropic.messages.create(model="claude-opus-4-6", tools=TOOLS, ...)

for block in response.content:
    if block.type == "tool_use":
        result = dispatch(block.name, block.input)

resolve_dsh_install never executes anything. It returns the exact command, the source repository and the detected risk flags, so the decision to run stays with the caller.

Two things about installing DSH plugins

Neither is this package's doing, and both cost real time to find.

--profile is mandatory. dsh plugin forwards to pnpm inside a profile directory, so dsh plugin add x exits with required option '--profile <name>' not specified and installs nothing. Every command produced here carries it.

github:owner/repo#subpath cannot work — pnpm reads everything after # as a git ref. Monorepo plugins with no published npm package therefore have no one-line install. plugin.install is None for them and installable is False; you will never be handed a command that fails.

A GitHub-sourced install also needs pnpm's allowBuilds allowlist before the package's build script will run. That, not download size, is why npm is offered first.

Safety

Plugins are third-party code running with your agent's permissions. Listing in the catalogue is not a security review.

An install command is never assembled from free text and never reaches a shell. The catalogue supplies it already built; plan_from_command accepts only a bare npm specifier or github:owner/repo, rejects anything containing .., and argv is passed as a list with shell=False. If the catalogue were ever compromised, the blast radius stops there — tests/test_install.py exists to keep it that way.

risk_flags reports what was detected automatically: an install script, a terminal surface, a credential requirement. An empty list proves nothing. The source repository is always available; read it first.

Configuration

Variable
DSHM_API	Point at a mirror, a staging deployment or a local catalogue
NO_COLOR	Plain CLI output

Development

pip install -e ".[dev]"
pytest
pytest -m live        # opt-in, hits the real catalogue

Related

• dshmarketplace.dev — the catalogue, a page per plugin
• dshmarketplace — the site
• dshmarketplace-cli — the same thing for Node
• dshmarketplace-plugin — inside DSH itself
• GET /api/v1/plugins — the public API all four read

Contact

• Community — LINUX DO
• Issues — GitHub Issues

Acknowledgements

• LINUX DO — where the DSH ecosystem is actually discussed, and where this project is published and takes its feedback.
• awesome-dsh-plugin (CC0-1.0) — the seed the catalogue grew from.

License

MIT. Independent project, not affiliated with DeepSeek. DeepSeek and DeepSeek Harness are marks of their respective owners, used here only to describe what these plugins are for.