securstack/securstack-dsh-plugin
30Last commit Aug 13, 2026
securstack-dsh-plugin DSH plugin
This plugin registers non-destructive Harness tools that call the official `securstack` CLI to scan repositories, return structured JSON results, run environment diagnostics, and evaluate scan output against repository policy gates. It is a thin adapter that does not implement scan engines or encryption. Requires Node.js 20+, DSH developer preview, and SecurStack credentials.
How to install the securstack-dsh-plugin DSH plugin
dsh plugin --profile securstack add @securstack/dsh-pluginCopying does not run this command. Review the repository and version before installing the securstack-dsh-plugin DSH plugin.
securstack-dsh-plugin DSH plugin data source
securstack-dsh-plugin DSH plugin snapshot date: Aug 16, 2026
discovered
What the securstack-dsh-plugin DSH plugin can do
- Run security scans (SAST, SCA, secrets, IaC) on repositories using `securstack scan --format json`
- Execute policy gates to get pass/fail decisions with `securstack policy check`
- Diagnose local setup and credentials via `securstack doctor`
Where the securstack-dsh-plugin DSH plugin fits
- Scan a repository for security vulnerabilities and get structured results
- Check if a codebase passes SecurStack policy gates
- Diagnose credential or configuration issues with SecurStack doctor
- Embed security checks into an AI-agent workflow via DeepSeek Harness
Who the securstack-dsh-plugin DSH plugin is for
- Developers using DeepSeek Harness who want to add security scanning to their AI-agent workflows
- Security engineers who need to automate security checks and policy enforcement in CI-like environments
securstack-dsh-plugin DSH plugin limitations
- Requires Node.js 20 or newer
- Requires DeepSeek Harness developer preview
- Requires SecurStack credentials (API key or login) to be configured
securstack-dsh-plugin DSH plugin: from the repository README
Quoted from the securstack/securstack-dsh-plugin README, the upstream source of the securstack-dsh-plugin DSH plugin. Copyright remains with the original authors.
DeepSeek Harness plugin for running SecurStack security checks directly from an AI-agent workflow. The plugin registers safe, non-destructive Harness tools that call the official `securstack` CLI to scan repositories, return structured JSON results, run environment diagnostics, and evaluate scan output against repository policy gates. It lets DeepSeek Harness ask SecurStack what is risky, what is misconfigured, and whether a codebase passes policy without reimplementing SecurStack product logic inside the plugin. This package is intentionally a thin adapter. It does not implement scan engines, encryption, upload logic, API contracts, or Shielding operations. Those responsibilities stay in `@securstack/cli` and the SecurStack SaaS. ## Capabilities - Repository security scans via `securstack scan --format json`. - Policy gates for CI-like pass/fail decisions with `securstack policy check`. - Local setup and credential diagnostics through `securstack doctor`. - Harness-friendly tool responses with parsed JSON where the CLI promises JSON output. - Existing SecurStack authentication through `securstack login`, `SECURSTACK_API_KEY`, and `SECURSTACK_API_URL`. - Adapter-only design tha
Read the full READMERepository license: MIT
securstack-dsh-plugin DSH plugin questions
How do I install the SecurStack DSH plugin?
Run the command `dsh plugin --profile securstack add @securstack/dsh-plugin` in your terminal. Then start DeepSeek Harness with `dsh --profile securstack` to activate the plugin. Make sure you have Node.js 20+ and the DSH developer preview installed first.
What are the prerequisites for using this plugin?
You need Node.js 20 or newer and the DeepSeek Harness developer preview. Additionally, you must have SecurStack credentials configured, either by running `securstack login --api-key <key>` or by setting the `SECURSTACK_API_KEY` environment variable. Optionally, you can set `SECURSTACK_API_URL` for a custom API endpoint.
How do I configure my SecurStack API key?
You can set the API key via the environment variable `SECURSTACK_API_KEY`. Alternatively, run `securstack login --api-key <your-api-key>` in your terminal. The plugin will automatically use the credentials found by the `securstack` CLI.
What types of security scans does this plugin support?
The plugin supports SAST (static code analysis), SCA (dependency checking), secrets detection, IaC security configuration review, and policy-as-code gates. DAST (dynamic testing) can be surfaced through scan output if your SecurStack project supports it. All scans are performed via the `securstack scan` command.
How can I use the plugin in DeepSeek Harness?
Once the plugin is installed and activated, you can ask DeepSeek Harness to run security tasks. For example, say "Run a SecurStack scan on this repository and summarize critical findings" or "Check whether the last SecurStack scan passes the repository policy." The AI agent will call the plugin's tools (`securstack_scan`, `securstack_policy_check`, `securstack_doctor`) to execute the requested operations.