How do I install dsh-commandcode-provider?

Install dsh-commandcode-provider in your harness: Source — https://github.com/Mars-Sea/dsh-commandcode-provider/releases; Any agent — npx skills@1.7.4 add Mars-Sea/dsh-commandcode-provider; DeepSeek Harness — dsh plugin add github:Mars-Sea/dsh-commandcode-provider. Full step-by-step guidance is on the HOL plugin page.

How do I install dsh-commandcode-provider in Source?

To install dsh-commandcode-provider in Source, start with https://github.com/Mars-Sea/dsh-commandcode-provider/releases. The complete step-by-step install guide for Source is on the HOL plugin page.

How do I install dsh-commandcode-provider in DeepSeek Harness?

To install dsh-commandcode-provider in DeepSeek Harness, start with dsh plugin add github:Mars-Sea/dsh-commandcode-provider. The complete step-by-step install guide for DeepSeek Harness is on the HOL plugin page.

How is the Trust Score for dsh-commandcode-provider computed?

dsh-commandcode-provider has a HOL Trust Score of 72 out of 100. The score is a weighted sum of six components from a static scan of the source, capped for high-severity findings and adjusted by two disclosed policies. Memberships and payments are not inputs, and a scan is not a safety guarantee. Full breakdown: https://hol.org/registry/plugins/mars-sea%2Fdsh-commandcode-provider/trust

Who publishes dsh-commandcode-provider?

dsh-commandcode-provider is published by Mars-Sea and listed on HOL.

dsh-commandcode-provider

mars-sea/dsh-commandcode-provider · v0.17.2 · source dc38c6a · DeepSeek Harness Plugins

by Mars-SeaScan grade: Acceptable

DeepSeek Harness plugin that adds a Command Code provider with live model catalog, account rotation, and usage dashboard; install with dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@latest

Install Source Claim this plugin

Follow0

Trust Score72 Security scan73 Components2

Protect this install with HOL Guard

Guard checks the skills and MCP servers a plugin adds on your machine and asks you before a risky action runs. The scores above are free, and no plan changes them.

Is dsh-commandcode-provider a fit?

From the plugin's manifest and HOL's scan. Anything the plugin does not declare is shown as not declared.

Works with

DeepSeek Harness

2 skills

Before you install

Sign-in: Not declared
Declared access: Not declared
License: Not declared

Check before relying on it

Some security checks did not finish: Cisco skill scan. See the evidence
2 medium findings from the scan. See the evidence
The publisher has not verified ownership on HOL.
No license declared in the manifest.

What is dsh-commandcode-provider?

dsh-commandcode-provider is a published deepseek harness plugins plugin for AI coding agents in the DeepSeek Harness ecosystem, developed by Mars-Sea and distributed through the HOL AI plugin registry. DeepSeek Harness plugin that adds a Command Code provider with live model catalog, account rotation, and usage dashboard; install with `dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@latest`.

Canonical slug: mars-sea/dsh-commandcode-provider
Version: v0.17.2 · source dc38c6a · updated Nov 6, 2026
Open data: entity.json (JSON-LD)

Registry snapshot

Repository: https://github.com/Mars-Sea/dsh-commandcode-provider
Canonical profile: https://hol.org/registry/plugins/mars-sea%2Fdsh-commandcode-provider
Owner verification: Not verified
Scanner: HOL plugin scanner
Security result: Needs review
Digest verified: Yes

2 bundled skillsRead, copy or download each SKILL.mdOpen skills

Trust and security

Trust & reputation

HOL Trust Score

Per-metric points (0–100 each) combined via a weighted average into the overall score.

Installability

100/100

Maintenance

85/100

MCP server setup

100/100

Plugin Security

73/100

Provenance

70/100

Publisher Quality

75/100

Provenance

Plugin root: .
Source repo: https://github.com/Mars-Sea/dsh-commandcode-provider
Source commit: dc38c6acc87c…
Publisher verified: No
Owner verified: Not owner verified
Agent Plugins 1.0: Not detected

Continuous scanner CI not detected

This plugin remains listed. Its overall trust score is reduced by 10% because security checks are not maintained in the source repository's CI.

Optional: maintain the scanner in the source repository's CI to receive the full trust score. Listing does not require that change.

README badge not detected

Plugin owners can add the HOL badge to the repository README from Guard Plugins. Distribution, not security evidence. It adds a 2% engagement adjustment to the overall trust score and never changes the security result.

Security posture

See how the Trust Score is computed

Needs review

Security result

Security score

High findings

Provider: codex-plugin-scanner
Grade: C · Acceptable
Version: 3.24.2

codex:hol-plugin-scanner-K7857z / cisco-skill-scanner: failedcodex:hol-plugin-scanner-K7857z / cisco-mcp-scanner: skipped

[codex:.] Manifest Validation

21/31

9 checks

[codex:.] Security

13/16

9 checks

[codex:.] Operational Security

3/6

5 checks

[codex:.] Best Practices

9/12

5 checks

[codex:.] Marketplace

N/A

3 checks · not applicable

[codex:.] Skill Security

5/5

4 checks

[codex:.] Code Quality

10/10

2 checks

[deepseek-harness:.] DeepSeek Harness Plugin

10/20

4 checks

[deepseek-harness:.] Security

13/16

6 checks

[deepseek-harness:.] Operational Security

3/6

5 checks

[deepseek-harness:.] Code Quality

10/10

2 checks

Published advisories

None matched in GitHub security advisories, checked 2026-11-02. This covers published advisories only, not problems nobody has reported.

GitHub security advisories are those the source repository has published.

Findings

mediumsecurityDSH_BUNDLE_PATH_UNSAFE

The declared bundle patch is missing or escapes the package root.

Update the native DSH declaration in package.json.

mediumsecurityDSH_RUNTIME_APPLY_MISSING

package.json main/exports must reference a regular in-package module exporting Cordis apply(ctx).

Update the native DSH declaration in package.json.

lowsecuritySECURITY_MD_MISSINGReported 2 times

Plugins should publish a SECURITY.md file for responsible disclosure and support guidance.

Add a SECURITY.md file with reporting guidance and supported versions.

lowoperational-securityDEPENDABOT_MISSINGReported 2 times

Automation or dependency surfaces exist, but .github/dependabot.yml is missing.

Add Dependabot updates for GitHub Actions and dependency manifests.

infomanifest-validationPLUGIN_JSON_RECOMMENDED_AUTHOR

The manifest is missing the documented recommended field "author".

Add "author" to strengthen the plugin manifest metadata.

infomanifest-validationPLUGIN_JSON_RECOMMENDED_LICENSE

The manifest is missing the documented recommended field "license".

Add "license" to strengthen the plugin manifest metadata.

infomanifest-validationPLUGIN_JSON_RECOMMENDED_KEYWORDS

The manifest is missing the documented recommended field "keywords".

Add "keywords" to strengthen the plugin manifest metadata.

infomanifest-validationPLUGIN_JSON_INTERFACE_SHORTDESCRIPTION

The interface object is missing a valid "shortDescription" value.

Add a valid "shortDescription" field to the interface metadata.

infomanifest-validationPLUGIN_JSON_INTERFACE_LONGDESCRIPTION

The interface object is missing a valid "longDescription" value.

Add a valid "longDescription" field to the interface metadata.

infomanifest-validationPLUGIN_JSON_INTERFACE_CAPABILITIES

The interface object is missing a valid "capabilities" value.

Add a valid "capabilities" field to the interface metadata.

infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_WEBSITEURL

The interface field "websiteURL" must use HTTPS or point to a safe in-repo asset.

Update "websiteURL" to use HTTPS or an existing relative asset path.

infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_PRIVACYPOLICYURL

The interface field "privacyPolicyURL" must use HTTPS or point to a safe in-repo asset.

Update "privacyPolicyURL" to use HTTPS or an existing relative asset path.

infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_TERMSOFSERVICEURL

The interface field "termsOfServiceURL" must use HTTPS or point to a safe in-repo asset.

Update "termsOfServiceURL" to use HTTPS or an existing relative asset path.

infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_COMPOSERICON

The interface field "composerIcon" must use HTTPS or point to a safe in-repo asset.

Update "composerIcon" to use HTTPS or an existing relative asset path.

infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_LOGO

The interface field "logo" must use HTTPS or point to a safe in-repo asset.

Update "logo" to use HTTPS or an existing relative asset path.

infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_SCREENSHOTS

The interface field "screenshots" must use HTTPS or point to a safe in-repo asset.

Update "screenshots" to use HTTPS or an existing relative asset path.

infobest-practicesCODEXIGNORE_MISSING

A .codexignore file helps prevent accidental inclusion of local artifacts and secrets.

Add a .codexignore file with generated assets, local state, and secret paths.

Install guidance

Install in Source

Install from a native release archive or the assessed source revision.

Install guide

1
Download the release archive
Use a published GitHub release archive. The catalog version is the package version at the assessed commit.
shell
2
Follow the publisher install guide
https://github.com/Mars-Sea/dsh-commandcode-provider/blob/dc38c6acc87c57875670e5181924846c82ac4ae1/docs/INSTALL.md

Did setup work in Source?

No setup reports for Source yet. Self-reported by signed-in visitors. Copying a command is not counted, and most installs are never reported.

Attested installs: Fewer than 10 attested installs of this plugin in week 2026-W44, so no number is shown. Counted from opt-in HOL Guard install reports, once per machine and runtime, and never mixed with the answers above. How install reports work.

Loading reviews

Plugin manifest

{
  "name": "dsh-commandcode-provider",
  "version": "0.17.2",
  "description": "DeepSeek Harness plugin that adds a Command Code provider with live model catalog, account rotation, and usage dashboard; install with `dsh plugin --profile web add @mars-sea/dsh-commandcode-provider@latest`",
  "repository": "https://github.com/Mars-Sea/dsh-commandcode-provider",
  "homepage": "https://github.com/Mars-Sea/dsh-commandcode-provider",
  "interface": {
    "displayName": "dsh-commandcode-provider",
    "developerName": "Mars-Sea",
    "category": "DeepSeek Harness Plugins"
  },
  "skills": "./",
  "holManifestOrigin": "synthesized",
  "registryIndexVersion": 9
}

Skills

2 SKILL.md files ship with this plugin. Preview, copy, or download each one, then install them with the Skills CLI.

skills-cli

dsh-commandcode-upstream
.agents/skills/dsh-commandcode-upstream/SKILL.md
Check or update this plugin against official Command Code CLI and documentation changes, including model capabilities, reasoning efforts, plans, deals, pricing schedules, zero-data-retention coverage and protocol drift. Use for upstream upgrade checks or evaluating whether the plugin needs synchronization.
Raw SKILL.md
dsh-release-upgrade
.agents/skills/dsh-release-upgrade/SKILL.md
Audit and upgrade this plugin against an official DeepSeek Harness (dsh) release. Use when a new dsh tag/release is published, when peer ranges or dsh compatibility records need changing, or when a release may affect plugin services, client slots, settings, tools, or the LLM adapter. This skill is for DSH itself; use dsh-commandcode-upstream for Command Code CLI/catalog changes.
Raw SKILL.md

File inventory

.agents/skills/dsh-commandcode-upstream/references/data-contracts.md

file

10,076 bytes

c70ee9610ff02800…

.agents/skills/dsh-commandcode-upstream/references/protocol.md

file

4,634 bytes

e47760a382119d0c…

.agents/skills/dsh-commandcode-upstream/scripts/audit.py

file

32,229 bytes

86fc2188540cae19…

.agents/skills/dsh-commandcode-upstream/scripts/extract-cli.mjs

file

17,659 bytes

e85e8f527850ebd1…

.agents/skills/dsh-commandcode-upstream/scripts/fetch.py

file

6,138 bytes

a011c43bafd517ac…

.agents/skills/dsh-commandcode-upstream/SKILL.md

skill

11,493 bytes

162881eb306730e8…

.agents/skills/dsh-commandcode-upstream/tests/extract-cli.test.mjs

file

6,686 bytes

0003ab6a1f59d353…

.agents/skills/dsh-commandcode-upstream/tests/test_audit.py

file

9,722 bytes

d8b20db27cd2f187…

.agents/skills/dsh-release-upgrade/scripts/collect.py

file

11,550 bytes

48960f72fbb96a84…

.agents/skills/dsh-release-upgrade/SKILL.md

skill

12,238 bytes

902ace779fb320fe…

.agents/skills/dsh-release-upgrade/tests/test_collect.py

file

4,456 bytes

a3c7bfc7b5caf5ce…

.codex-plugin/plugin.json

plugin-manifest

605 bytes

f6a072f2f879f930…

AGENTS.md

file

4,370 bytes

aa4ce4338bc459cb…

LICENSE

file

1,420 bytes

e98c8a6f4bc74f97…

package-lock.json

file

86,244 bytes

920f69a7e2f337b7…

package.json

file

6,472 bytes

4358864955a1111c…

README.md

file

23,553 bytes

8baac453e5ad5ff6…

README.md

file

23,553 bytes

8baac453e5ad5ff6…

tsconfig.json

file

721 bytes

f0f0e493809e86ea…