mario03690/dsh-adversarial-review
Adversarial review for code, MCP configs and system prompts: every finding carries a repro path and confidence, and anything unreproducible is marked suspected rather than presented as confirmed.
PROJECT TOPICS
INSTALL REFERENCE
dsh plugin --profile web add github:mario03690/dsh-adversarial-review
该命令指向仓库当前默认分支；尚无绑定当前 commit 的完整验证结果。
PROJECT README
Adversarial review for code, MCP configs and system prompts — every finding carries a repro path and confidence; unreproducible ones are marked suspected, never confirmed.
Not a scanner: it reviews code/config/prompts YOU provide, it does not attack third-party services. adversarial_review probes named surfaces (injection, trust boundaries, secret handling, side effects, idempotency, swallowed errors) — each finding with a repro path and high/medium/low confidence, and anything it cannot reproduce is downgraded to suspected, not presented as confirmed (the same honesty contract as our tables' arithmetic self-check). mcp_config_audit checks agent/MCP configs for over-broad grants, embedded secrets, unannotated destructive tools. red_team_prompt attacks your own system prompt and hands back hardening. Pass model to run on a flagship (Claude/Kimi K3/GPT via AllRouter).
Start with what_can_you_do — describe your task in any language, get the exact tool and a ready-to-run call.
dsh plugin --profile <your-profile> add github:mario03690/dsh-adversarial-reviewThin config layer only (one @deepseek-ai/dsh-mcp-client row, shipped as cordis.patch.yml) — no tool code on your machine. Built against the dsh v0.1 developer preview's MCP client config shape (2026-08-13); if a later preview changes it, open an issue for a same-day fix.
First heavy call is free (anonymous, no signup); afterwards billed at real upstream cost, reported in every response; failed calls are not charged. Bring an AllRouter key to run any tool on a flagship model at direct rates. The config URL carries ?s=dsh-dsh-adversarial-review — a channel tag identifying the install path, not you.
Disclosure: built and run by the team behind ainetcafe.com. Full bundle: dsh-netcafe. MIT.
| Signal | This plugin |
|---|---|
| Runtime | dsh v0.1 developer preview (2026-08-13, Cordis v4). Touches only the MCP client config shape — the narrowest surface available. Verified against a live endpoint on 2026-08-17. |
| What runs locally | Nothing. Ships one cordis.patch.yml row; there is no tool code, no build step and no lifecycle script in this package. |
| Filesystem access | None. |
| Shell / process access | None. |
| Network access | Outbound HTTPS to ainetcafe.com only, from the MCP client that dsh already ships. |
| Credentials | None required. No signup, no API key for the free tier. An optional AllRouter key, if you supply one, is sent by dsh as a request header and is never stored by us. |
| Data retention | Documents and prompts are processed in memory and not retained. |
| Dependencies | One peer dependency: @deepseek-ai/dsh-mcp-client (ships with dsh). |
| License | MIT (see LICENSE). |
| Publisher | The team that runs ainetcafe.com — our own hosted service, free tier plus paid usage. Issues get a same-day reply. |
A directory listing is not a security review. Read
cordis.patch.yml— it is short enough to read in full in under a minute.
CLASSIFICATION EVIDENCE
系统优先读取 GitHub Topics，再与站内分类词典和词根规则比对。当前命中： mcp。
ZSeven-W
The world's first open-source AI-native vector design tool and the first to feature concurrent Agent Teams. Design-as-Code. Turn prompts into UI directly on the live canvas. A modern alternative to Pencil.
agentrq
AgentRQ: Human-in-loop realtime conversational task manager for AI Agents. Self-hosted! Control your own agents from wherever you want Mobile, Web, Desktop. Designed to work well with your own Claude subscriptions and any harness.
alvinunreal
Local first, desktop companion platform with animated pets, plugin SDK and coding-agent integrations.