dsh-ssh-logs
从 DeepSeek Harness 对话中通过 SSH 读取列入允许名单的远程日志
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add github:452926826/dsh-ssh-logs#4dbc65c4bb250f72388edfd42b3d3e4d0103699cSsh Logs 以 dsh-ssh-logs 发布，当前版本为 0.1.0。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
English | 简体中文
A read-only SSH log tool for DeepSeek Harness. It uses the built-in @deepseek-ai/dsh-mcp-client bridge to expose three MCP tools to the model:
mcp__ssh_logs__list_log_serversmcp__ssh_logs__read_logmcp__ssh_logs__search_logServers are configured under fixed aliases. The model cannot select arbitrary hosts, execute arbitrary commands, or modify remote files. Every requested file must remain under an allowlisted log root.
git clone https://github.com/452926826/dsh-ssh-logs.git
cd dsh-ssh-logs
npm install
dsh plugin --profile web add "$PWD"
It can also be installed directly from GitHub:
dsh plugin --profile web add github:452926826/dsh-ssh-logs
Create ~/.dsh/ssh-logs.yml using config.example.yml as a reference. Use a dedicated read-only account on each server and authenticate with an SSH key or ssh-agent. Do not store passwords or private key contents in the YAML file.
Restart dsh web and refresh the page after configuring the plugin. The Bundle registers an MCP client so agent presets can discover the log tools.
Read the last 300 lines of service/api.log from the app log root on production.
Search logs/backend.log under staging/app for request-id=abc123 and include 3 lines of context.
If a request names a physical directory instead of a root alias, the model should call list_log_servers first, map the directory to a configured root, and then call the read or search tool.
defaults:
maxBytes: 131072
connectTimeoutSeconds: 10
commandTimeoutMs: 120000
servers:
production:
description: Production application server
host: prod-app.example.com
user: log-reader
port: 22
identityFile: ~/.ssh/prod_log_reader
knownHostsFile: ~/.ssh/known_hosts
proxyJump: bastion.example.com
roots:
app: /srv/myapp/logs
nginx: /var/log/nginx
Each server supports description, host, user, port, identityFile, knownHostsFile, proxyJump, roots, maxBytes, connectTimeoutSeconds, and commandTimeoutMs.
BatchMode=yes, StrictHostKeyChecking=yes, and an explicit known_hosts path... traversal are rejected.head, tail, sed, and grep -F commands. Dynamic values are shell-quoted.Enforce least privilege on the server as well: use a dedicated log-reader account, read-only ACLs, restricted source IPs, and authorized_keys restrictions when appropriate.