Degurechaff57/dsh-openapi
40Last commit Aug 13, 2026
dsh-openapi DSH plugin
dsh-openapi indexes configured OpenAPI documents and exposes three model-facing tools: openapi_list, openapi_describe, and openapi_call. It enforces security defaults like read-only operations, credential isolation, SSRF checks, and output limits without patching the Harness agent loop.
How to install the dsh-openapi DSH plugin
dsh plugin --profile web add github:Degurechaff57/dsh-openapiCopying does not run this command. Review the repository and version before installing the dsh-openapi DSH plugin.
dsh-openapi DSH plugin data source
dsh-openapi DSH plugin snapshot date: Aug 16, 2026
discovered
What the dsh-openapi DSH plugin can do
- Provides openapi_list, openapi_describe, and openapi_call tools for API discovery, parameter inspection, and validated invocation
- Supports OpenAPI 3.0 and 3.1 specifications in JSON and YAML with local $ref resolution
- Enforces security defaults: read-only GET/HEAD by default, environment-based credentials, private network blocking, and response body cap
- Allows configuration of multiple APIs, static headers, method restrictions, and per-API credentials
- Includes SSRF protection: blocks private IPs, localhost, and rechecks redirect destinations; credentials stripped on cross-origin redirects
Where the dsh-openapi DSH plugin fits
- Let an AI assistant safely query public APIs (e.g., Petstore, weather services) with controlled permissions
- Integrate internal REST APIs into DeepSeek Harness workflows, using environment variables for authentication tokens
- Discover and invoke operations from a large OpenAPI spec without loading the entire document into the model context
- Automate API testing or data retrieval tasks by chaining discovery, description, and call tools in a single conversation
Who the dsh-openapi DSH plugin is for
- Developers using DeepSeek Harness who need to grant their agents controlled access to external HTTP APIs
- Teams building AI-powered automation that consumes OpenAPI-defined services, especially those requiring credential management and security boundaries
dsh-openapi DSH plugin limitations
- Only supports OpenAPI 3.x (3.0 and 3.1); OpenAPI 2.x is not supported
- Remote $ref documents and complex serialization styles (e.g., deepObject) are not yet implemented; the plugin fails loudly instead of making ambiguous requests
- DeepSeek Harness itself is in developer preview (tested against 0.1.0-rc.5/6); compatibility may break with upstream changes
- Specs must be administrator-configured; the model cannot load arbitrary specs at runtime
dsh-openapi DSH plugin: from the repository README
Quoted from the Degurechaff57/dsh-openapi README, the upstream source of the dsh-openapi DSH plugin. Copyright remains with the original authors.
**Give DeepSeek Harness a safe, structured doorway into any OpenAPI 3.x API.** [中文说明](README.zh-CN.md) · [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) `dsh-openapi` is a native DeepSeek Harness bundle that indexes configured OpenAPI documents and adds three model-facing tools: - `openapi_list` discovers APIs and searches operations. - `openapi_describe` returns parameters, request bodies, servers, and responses for one operation. - `openapi_call` validates and invokes an operation with bounded output. It is plain ESM JavaScript, so installing from GitHub does **not** run a build or `prepare` script. ## Why this plugin Harness already gives an agent a shell. APIs still benefit from a narrower interface: operation discovery without reading a huge spec into the model context, declared-parameter validation, environment-backed credentials, read-only defaults, SSRF checks, and response limits. This plugin provides those controls without patching the Harness agent loop. ## Install ```sh dsh plugin --profile web add github:Degurechaff57/dsh-openapi ``` The bundle installs with an empty API catalog. Add API entries to your profile's `cordis.patch.yml`: ```yam
Read the full READMERepository license: MIT
dsh-openapi DSH plugin questions
How do I install dsh-openapi in DeepSeek Harness?
Run `dsh plugin --profile web add github:Degurechaff57/dsh-openapi` from your terminal. The plugin is plain ESM JavaScript, so no build step is needed. After installation, you must add API entries to your profile's `cordis.patch.yml` configuration file.
Can the model call any API with this plugin?
No. The plugin only allows calls to APIs that you have explicitly configured in `cordis.patch.yml` under the `apis` section. The model cannot load arbitrary OpenAPI specs at runtime. Additionally, you can restrict allowed HTTP methods, block private network destinations, and require environment-variable credentials.
How do I securely pass API tokens or secrets?
Use the `credentials` field in the API configuration. Map a request header to an environment variable. For example, set `credentials: [{ header: 'Authorization', env: 'INTERNAL_API_TOKEN', prefix: 'Bearer ' }]`. The value is read from the environment at call time and is never included in tool results or exposed to the model.
Does the plugin support OpenAPI 2.x (Swagger)?
No. Currently only OpenAPI 3.0 and 3.1 are supported. If you have a Swagger 2.0 spec, you would need to convert it to OpenAPI 3.x first before using with this plugin.
What happens if the API returns a large response?
The plugin caps the response body at `maxResponseBytes` (default 256 KB). Any response exceeding this limit is truncated. Additionally, sensitive response headers like `set-cookie` are stripped from the tool result to protect user privacy.