DeepSeek Harness (DSH) plugins are just npm packages that patch an agent profile — small, powerful, and easy to ship. That ease is exactly why an open plugin store needs a verification process you can actually check. At WhaleHarness we run one on a simple bet: trust neither the author nor the reviewer — trust the record.
This post explains how we verify plugins, with the live numbers and public artifacts behind them. Everything below is on the site and machine-readable; none of it is a marketing claim.
The two trust failures a plugin store actually faces
A plugin directory worries about two different kinds of failure. The first is a bad plugin: something that calls out to the network, reads credentials off disk, or fakes what it returns to the model. The second is a bad review: when authors wait on a private queue, they cannot tell whether their submission is being judged fairly or silently dropped.
Most stores fix the first problem with manual review and hope the second never comes up. We inverted the design: the review itself is public.
