DSH Marketplace API

Two endpoints

Both are open over CORS and need no authentication. If you are building a directory, a chat tool or an agent that installs plugins, take them — that is what they are for, and it beats crawling the GitHub topic again.

GET /api/v1/plugins

curl -s 'https://dshmarketplace.dev/api/v1/plugins?q=memory&limit=5'

Every result carries both summaries, the resolved install command, the detected risk flags and the source repository:

{
  "fullName": "liustack/modlens",
  "summary": "…",
  "summaryZh": "…",
  "category": "vision",
  "stars": 2325,
  "license": "MIT",
  "npmPackage": "@liustack/modlens",
  "installKind": "npm",
  "install": "dsh plugin --profile web add @liustack/modlens",
  "installable": true,
  "installOptions": [{ "label": "npm", "cmd": "…", "note": "…" }],
  "riskFlags": ["terminal surface"],
  "repoUrl": "https://github.com/liustack/modlens",
  "url": "https://dshmarketplace.dev/plugins/liustack-modlens"
}

The install contract

install is null rather than a placeholder when no command can install the plugin. This is the part worth reading twice if you are writing an agent. A caller that runs whatever is in that field must never be handed a string that fails, so the field is empty instead — and installable says the same thing as a boolean.

Two cases produce it, and both are real:

• A plugin in a monorepo subdirectory. dsh plugin add forwards to pnpm, and pnpm reads everything after # as a git ref, so github:owner/repo#packages/thing cannot resolve. There is no one-line install, so none is offered.
• A plugin published nowhere. No npm package and no installable repository root.

Every command that is returned carries --profile web. dsh plugin is a thin forward to pnpm inside a profile directory, so the flag is mandatory — without it the CLI exits with required option '--profile <name>' not specified and nothing installs. Swap web for your own profile name if you run another one.

GET /api/v1/index

curl -s 'https://dshmarketplace.dev/api/v1/index'

The whole catalogue in one response, for clients that must decide whether a page full of repositories contains plugins and cannot ask about them one at a time. Rows are positional to keep it small — around 22 KB over the wire — and the column names ship with the payload:

{
  "generated": "2026-08-17T09:12:44.108Z",
  "count": 1837,
  "site": "https://dshmarketplace.dev",
  "fields": ["fullName", "category", "install", "path", "npm"],
  "plugins": [
    ["liustack/modlens", "vision", "dsh plugin --profile web add @liustack/modlens", "/plugins/liustack-modlens", "@liustack/modlens"]
  ]
}

path is null when a listing has no page of its own yet, and npm is null when the plugin publishes nowhere. As with install, none of them is ever a placeholder.

What is in the catalogue

1,837 listings, drawn from the community registry and the dsh-plugin GitHub topic. The topic is not a registry, so admission is gated — and the bar is published here because a filter nobody can check is not a filter:

• It declares a DSH plugin. A dsh manifest in package.json, a dependency on @deepseek-ai/* or Cordis, or a cordis.patch.yml. Other harnesses and agent clients tag themselves dsh-plugin for the attention; they are not installable here and are not listed.
• Ten commits or more. Taken from awesome-dsh-plugin's own bar rather than invented here, so the standard is one you can check against someone else's. A scaffold has a valid manifest on its first commit; commit count is what tells it apart from work.
• It says what it does. A repository with no description at all is a link, and a link is what every other directory already gives you.

Applying that bar removed 1,415 rows in one pass — 754 of them repositories with fewer than five commits. A directory's value is what it leaves out.

Caching and fair use

Responses carry Cache-Control and are served from Cloudflare's edge. There is no rate limit and no key, which only works if clients behave like clients: cache the index rather than fetching it per page view, and prefer one /api/v1/index call over a thousand /api/v1/plugins calls. The userscript below refreshes at most every six hours, and that is the intended shape.

Four reference implementations

Every one of these reads the endpoints above, and all of them are MIT on GitHub. If you are wiring this into something, one of them has already solved your problem:

Terms

Free to use, including commercially. No key, no sign-up, no attribution required — a link back is appreciated and never demanded. The data is public repository metadata plus summaries written here; it carries no warranty, and a listing is not a security review. See what this site is not.

Found a listing that is wrong, or want yours removed? Say so and it will be fixed.