Install
Inside DeepSeek Harness, with dsh-market
dsh plugin --profile web add dshmarket
Or from the command line
dsh plugin --profile web add dsh-code-security
Installing runs third-party code with your own permissions — it can read your files, use your credentials and reach the network. Review the source first, and pin a commit (github:owner/repo#sha) when you can.
README
0.3.6 update (2026-09-28)
Rejects unknown scan arguments and empty targets before scanning or replacing state, preventing misspelled scopes from expanding to the whole workspace. Fixes standard-mode output incorrectly displaying zero files and a failed verdict: counts, verdicts and findings now come from the actual scan result.
Validation host: Harness 0.2.0-rc.1 built from official sources (commit 407e65c8) with Node 24.16.0 on 2026-09-28. All 31 plugin tests pass in an isolated environment; all 18 plugins mount together in one host registering 10 tools, with tool schemas and health-check contracts passing. No live ports or external services were exercised in this round.
Every agent code change passes a local security scan before delivery.
A DeepSeek Harness plugin for AI code security review: deterministic rule engine, git-diff incremental review, fix-verify loop, and policy gate. Methodology borrows from Codex security skills (evidence-first findings, severity ordering, supply-chain layers). Zero runtime dependencies.
Compatibility
2026-09-13 fix: retain the service receiver when calling subprocess.spawn, preventing failures caused by passing the method as an unbound callback. Verified against a real isolated host subprocess service. secure_diff reads a real isolated Git repository through the host subprocess service and reports the changed file and added line.
Tools
| Tool | Purpose | Write |
|---|---|---|
secure_scan |
Scan files with CWE/severity/line/snippet evidence | state |
secure_diff |
Review only added lines of git diff | state |
secure_fix_verify |
Compare with baseline: closed / remaining / fresh | state |
secure_report |
Aggregate by rule/file with gate verdict | no |
secure_export |
Export SARIF 2.1.0 / Markdown | file write approval |
secure_baseline |
Accept current findings as baseline; gate on new issues only | approval |
secure_deps |
SBOM-lite: parse dependency manifests and version-risk flags | no |
secure_policy_show |
Show .code-security.json | no |
secure_policy_set |
Replace policy JSON | approval |
40+ deterministic rules: injection, deserialization, weak crypto (including shell TLS bypass flags), secrets, dangerous config, sensitive logging, path traversal, SSRF.
dsh plugin --profile web add dsh-code-security
MIT
License
MIT (see LICENSE)
Comments
Comments live in GitHub Discussions. Sign in with GitHub to post or react.