dsh-plugin-pkgseek
PkgSeek Linux package, command and CVE
intelligence as native DeepSeek Harness
(DSH) tools — plus a system-prompt segment that tells the agent when to use them.
The plugin is a thin adapter over PkgSeek's public MCP-over-HTTP endpoint: at
load time it fetches tools/list and registers one native DSH tool per
definition (names prefixed pkgseek_), so tools go through the same approval,
guard and logging pipeline as built-in tools. Every call is forwarded as
tools/call to the hosted API — all tools are read-only and need no API key.
Install
# interactive (web) profile
dsh plugin --profile web add dsh-plugin-pkgseek
# one-shot (headless) profile — dsh run uses this one
dsh plugin --profile headless add dsh-plugin-pkgseek
web and headless are separate profiles; install into both if you use both.
The package is published on npm as
dsh-plugin-pkgseek;
dsh plugin add resolves it from the registry. Installing from the GitHub
source also works (dsh plugin --profile web add github:web-casa/dsh-plugin-pkgseek).
The published manifest declares support for DSH >=0.1.0-rc.7 <0.2.0 on both
the web and Desktop clients. That declaration lets a strict Cordis v4 catalog
verify exact registry evidence; it does not by itself grant marketplace or
Microsoft Store approval.
Verification
The plugin was smoke-tested against a live dsh 0.1.0-rc.7 headless
profile: it loaded, fetched tools/list from the production API,
registered pkgseek_resolve_install, the model called it, and the session
log shows the API answer (sudo apt install ripgrep) flowing back through
tools/call. Unit tests cover the JSON-RPC client, the schema adapter, the
offline snapshot and the config surface (npm test).
Configuration
All settings are optional and live in the plugin's config: row:
- id: pkgseek
name: dsh-plugin-pkgseek
config:
apiBase: https://api.pkgseek.com # any PkgSeek API deployment
timeoutMs: 20000 # per-request timeout
promptGuidance: true # register the usage-guidance prompt section
refreshTools: true # refresh tools/list at load (snapshot fallback)
enabledTools: [] # allowlist of unprefixed names; empty = all
If the live tools/list fails at load time (offline, API down), the plugin
registers from its bundled snapshot and tool calls fail individually with a
clear error instead of breaking the profile.
Tools
22 read-only tools, registered with the pkgseek_ prefix:
- Command/tool intelligence:
pkgseek_search_tools, pkgseek_get_tool,
pkgseek_resolve_install, pkgseek_identify_binary,
pkgseek_query_file_provides, pkgseek_compare_distros, pkgseek_get_context
- Error & command doctor:
pkgseek_diagnose_linux_error, pkgseek_lint_command,
pkgseek_explain_command, pkgseek_suggest_fix
- Packages:
pkgseek_search_packages, pkgseek_get_package,
pkgseek_compare_package_versions, pkgseek_get_package_history
- Vulnerabilities:
pkgseek_search_vulnerabilities, pkgseek_get_vulnerability
- Lifecycle & migration:
pkgseek_check_release_lifecycle,
pkgseek_get_distro_lifecycle, pkgseek_compare_distro_releases,
pkgseek_plan_distro_migration
- Meta:
pkgseek_get_repository_health
Development
npm install
npm run sync-tools # refresh tools.snapshot.json from the live endpoint
npm test # build + node --test
Layout: src/mcp-client.ts (JSON-RPC over HTTP), src/adapter.ts (MCP tool
definitions → defineTool), src/prompt.ts (guidance section),
src/index.ts (wiring, config schema).
License
MIT
