DeepSeek Harness Plugin Hub

发布与管理完整 Harness Profiles，发现适合你的插件。

探索

插件目录环境预设文档中心动态

社区

发布插件联系我们报告问题

相关链接

Plugin Hub GitHubDeepSeek Harness 官方项目系统状态隐私说明
© 2026 DeepSeek Harness Plugin HubPowered byPaxTech

独立、非官方社区项目，与 DeepSeek 官方无隶属、授权或背书关系。

Access Review Proof — DeepSeek Harness 插件（DSH Plugin）
DeepSeek Harness Plugin Hub
ProfilesPlugins分类动态文档登录管理 Profiles
ProfilesPlugins分类动态文档登录
← Plugins
A

dsh-access-review-proof

Access Review Proof

针对所提供的访问审查关闭证据的离线内容寻址证明

插件会安装到这里；不确定时保持 web。

npx -y @deepseek-ai/dsh plugin --profile web add github:dongsheng123132/dsh-access-review-proof#3e5f37e8e3ae9f59f02a6dc07d71f34495b0b10c
README兼容性版本

兼容性与来源证明

Access Review Proof 以 dsh-access-review-proof 发布，当前版本为 0.1.1。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。

DSH 兼容范围
*
运行环境
any
发布来源
github
Registry 更新时间
2026/9/7

版本

0.1.1stable
2026/9/7
0.1.0stable
2026/8/26

相关插件

正在加载相关插件…

最新版
0.1.1
DSH
*
HMR
重启进程
Tree shaking
未声明可安全裁剪
解包体积
未提供
文件数
未提供
Surface
any
许可证
MIT
发布源
github
GitHub
★ 0
周下载
0
最近提交
2026/9/7
查看源码 ↗
README Badge

点击下方 Badge 复制 Markdown，粘贴到 README 即可。

这是你的 Plugin？认领权益 · 优先安全扫描

验证 package.json 声明的 GitHub 仓库，即可管理这个公开页面。认领后，Hub 会优先安排当前版本的安全扫描，并在通过后公开展示结果。

认领这个 Plugin →
报告问题

相关插件

继续浏览 security-access 分类下经过校验的插件。

Doctor@linxin666/dsh-doctorDSH 配置档案的事务性救援模式，配备受监督的启动器、隔离的恢复容器、确定性修复、健康监控以及本地 Web 恢复控制台Pocketdsh-pocket把 DeepSeek Harness 装进你的口袋：一个包、一个设置页，手机扫码即同步访问电脑上的 DSH（局域网 + 公网，实时同屏）。DSCODE@toddzheng024/dscode-bundle完整的 DeepSeek 编码代理，支持持久化 shell、Ultra 协作和自动权限审查。Auto Reviewdsh-auto-review针对 DeepSeek Harness 审批请求的第二模型 AI 自动审查：只读审查子代理在审批应答链上决定允许或拒绝，并采用故障关闭回退机制和完整的会话日志审计。

README

dsh-access-review-proof

Offline, deterministic evidence for one narrow question: does the supplied access-review campaign cover every declared entitlement, satisfy its risk-based review stages, and close each keep/revoke decision into a fresh post-review inventory?

The same headless core is exposed as a DSH bundle, standalone MCP stdio server, JavaScript API and CLI. Reports are redacted, content-addressed and verified after writing.

Complementary boundary

Microsoft Entra access reviews govern and recertify access to groups, applications, access packages and roles. This plugin only verifies supplied structured evidence; it is not an identity-governance platform.

  • dsh-principal-binding-proof verifies which authority and principal an evidence chain binds.
  • dsh-policy-waiver-proof verifies a declared policy exception.
  • dsh-break-glass-settlement-proof verifies closure of one emergency-access session.
  • This plugin checks a complete declared entitlement inventory, staged reviewer decisions, applied keep/revoke closure and a post-review snapshot.

It never approves, keeps or revokes access; authenticates receipts; queries live identity infrastructure; or proves the supplied inventory contains every real entitlement. A supplied closure or snapshot is evidence to authenticate elsewhere.

Checks

  • review start, completion, due date, closure, snapshot and evaluation chronology;
  • exact coverage of the declared entitlement set;
  • risk-based stage counts and contiguous ordered decisions;
  • independent reviewers for configured high-risk classes, excluding self-review;
  • a common review binding across decisions, closures and snapshot;
  • one closure per entitlement, after review completion;
  • final keep/revoke decisions matching active/revoked closures;
  • non-zero application receipts for revocations;
  • exact active/revoked partition in the post-review snapshot;
  • observer diversity and evidence freshness;
  • secret/raw rejection, workspace confinement, symlink defense and content-addressed read-back.

Use

npm test
npm run check
node bin/dsh-access-review-proof.mjs inspect examples/closed.json
node bin/dsh-access-review-proof.mjs verify examples/closed.json

dsh plugin --profile <profile> add /absolute/path/to/dsh-access-review-proof
dsh plugin --profile <profile> add github:dongsheng123132/dsh-access-review-proof#<commit>

DSH tools are dsh_access_review_inspect and dsh_access_review_verify. MCP tools are access_review_inspect and access_review_verify.

See examples/closed.json. Only public IDs, timestamps, counts and SHA-256 bindings belong in a manifest. Never put credentials, account names, tokens, raw identity exports or business text in it.

References: Microsoft Entra access reviews overview, plan an access reviews deployment, complete an access review.