dsh-pentester

PTES pentesting orchestration plugin for DeepSeek Harness.

It is a standard DSH bundle: package.json declares dsh.bundle.patch, and cordis.patch.yml inserts the plugin into a profile.

Capabilities

• PTES 7-stage workflow
• Orchestrator + subagent Agent Runs
• Agent Templates, Skills, MCP, Toolboxes
• Tool Broker (Scope, grant, AUTO / APPROVAL / DENY)
• Docker and MCP execution backends
• Artifact / Evidence / Finding persistence
• Approval and capability control
• Pentester Native UI (conversation.view)
• Reporting (report.md)

Architecture status: docs/status.md. AI / contributor rules: AGENTS.md. Docs index: docs/README.md.

Install

dsh plugin --profile web add .
dsh --profile web --dump-config   # look for "# == dsh-pentester"
dsh web --profile web

A successful load prints [dsh-pentester] loaded. Production default: devSeed=false. DEV fixture only: dsh web --patch ./cordis.dev.patch.yml.

From GitHub (pnpm ≥10 will refuse prepare until you allow the build):

dsh plugin --profile web add github:fb0sh/dsh-pentester
# copy into ~/.dsh/profiles/web/pnpm-workspace.yaml:
#   allowBuilds:
#     dsh-pentester: true
dsh plugin --profile web add github:fb0sh/dsh-pentester

Remove: dsh plugin --profile web remove dsh-pentester.

Keep these names in lockstep: package.json name, src/index.ts name, cordis.patch.yml id/name.

Develop

pnpm install
pnpm test
pnpm run check
pnpm run build

pnpm run check is tsc --noEmit plus pnpm run build (host tsdown + client bundle).

Official Quickstart: https://deepseek-harness.github.io/deepseek-harness/guide/quickstart

License

MIT