dsh-dolphin-security: A Proactive Security Patrol Plugin for DeepSeek Harness
ccr-wer/dsh-dolphin-security
Dolphin is a proactive security patrol plugin for DeepSeek Harness that uses SSH and Semgrep to scan local and remote hosts, run health checks, and archive findings.
dsh-dolphin-security brings penetration-testing thinking into DeepSeek Harness, so the agent stops waiting for alerts and instead scans target hosts on a regular basis. It uses Semgrep for local static scanning and SSH to dispatch scans to remote hosts and collect results, deploying the scanner in isolation when the target lacks it. All findings map to a unified SecurityFinding model and are archived as JSON reports, any controller/target OS combination works, and the host store uses atomic writes with 0600 permission semantics.
How to Install
dsh plugin --profile web add dsh-dolphin-security- Category
- Tools & Capabilities
- Platform
- DSH Plugin
- Author
- ccr-wer
- Distribution
- Plugin
dsh-dolphin-security Key Features
dsh-dolphin-security Repo Summary
What Does It Do?
Dolphin is a DSH plugin for DeepSeek Harness that turns penetration-testing methodology (reconnaissance, vulnerability probing, exploitation validation, reporting) into a proactive security patrol workflow. It solves the problem of waiting passively for alerts by letting an agent actively scan and assess target hosts on a schedule. Built on SSH and Semgrep, maintained by ccr-wer, it runs across Windows, Linux, macOS and WSL2, and was last updated in 2026-09.
Core Features
- Local static scanning: runs Semgrep against a chosen local directory and produces a structured vulnerability list with an archived report.
- Remote SSH patrol: dispatches scan commands to remote hosts over SSH, handling health checks, scanner detection, JSON result collection and local archiving.
- Automatic remote scanner deployment: when Semgrep is missing on the target, the scanner is uploaded to a remote temp directory and executed as a fallback.
- Unified data model and reports: all results map to a SecurityFinding model and are archived as JSON reports for later comparison.
- Cross-platform with a pure-JS SSH layer: any controller/target OS combination works, and remote commands are POSIX-validated and escaped against injection.
- Host store: keeps SSH host records with atomic writes and 0600 permission semantics, including tags and environment fields.
How to Use This Plugin?
Once mounted in the official DSH host, the plugin registers a local scan tool and a remote patrol tool that the agent can call directly. A local scan only needs a target directory to return findings and a report; remote patrol requires registering a host first (alias, address, port, user, password or key auth, tags, environment), then specifying the alias and remote directory, after which the plugin runs the full health check, scan, collection and archiving loop. Data, report and scanner-cache locations can be adjusted through environment variables, and reports are treated as sensitive data that stays out of version control.
How to Troubleshoot This Plugin?
If the command line reports that Semgrep cannot be found, its install directory is missing from PATH; locate the install path, add that directory to the system environment variables and restart the terminal. On Windows, if remote rule files land in the wrong temp directory and the scan directory ends up empty, upgrading to the version that fixes this resolves it, since the newer release unifies remote temp directory mapping.
This page is an independent rewrite of the plugin's official README — for authoritative documentation and the latest changes, refer to the source: ccr-wer/dsh-dolphin-security. The plugin is third-party code that runs on your machine once installed; inclusion does not imply endorsement — please review the source before installing.