dsh-redteam-model: ten red team work modes for DeepSeek Harness

The problem: knowledge without a workflow burns tokens

The README opens with an argument rather than a feature list. Its stated concern is that feeding knowledge to a model produces a system that can answer questions but cannot complete a task efficiently, because nothing tells it how to proceed or where to stop. The author's framing is that a workflow, written down as a skill or an agent, is what turns stored knowledge into work, and that skipping it wastes tokens or traps the model in a dead end.

That is the gap this repository tries to fill for security work. DSH itself, according to the README, offers limited structure in this area and can only be shaped through playbooks. So the project ships ten work modes, each carrying what it calls four layers of assets: a persona with role, epistemology, boundaries and reporting discipline; a playbook holding methodology and gate contracts; loadable skills; and a refs directory of indexed external knowledge.

The audience is narrow and explicit. The README names authorized security testing, CTF competitions, bug bounties and security research, and repeats a prohibition on illegal use. Nine of the ten modes are professional (pentest, code-audit, binary-analysis, attack-defense, av-evasion, incident-response, cloud-security, ctf-solver, asset-mapping); the tenth, redteam, is a general mode with no forced gate chain, and the README says deep tasks belong in the professional modes instead.

How the two-layer defence actually works

The design principle stated in the README is a double line: textual discipline in persona and playbook files, plus runtime enforcement in plugins. The split matters because the two halves fail differently. Text can be ignored by a model under pressure; a plugin that intercepts a tool call cannot.

The gate machinery is the clearest example. dsh-stage-gate exposes stage_gate and gates_list tools and performs structural validation across 32 stage gates in eight modes, writing verdicts to gate-log.md. The README is explicit that the model cannot self-assess a gate: structural validation must be a tool call. Semantic gates go to a separate reviewer, and key findings require double sign-off, where the DSH review and a claude or codex review agree before anything enters a report. Every verdict lands in an audit trail.

Around that sit the other plugins. dsh-route-boost injects a per-turn governance envelope with phase inference, gate checklist, mode boundaries, evidence-level prediction and refs pointers, and the README notes it delivers only on change and records injection volume. dsh-sec-enforce is the deterministic interceptor: report gate, write boundary, high-risk commands that require asking first, and rate limiting for unthrottled scanning. dsh-trace-vault stores all tool calls from the ten modes and offers trace_search, trace_get, trace_recent and trace_stats. dsh-campaign-memory persists playbooks across sessions, refreshed rather than duplicated for the same mode, workspace and topic, with a 30-day decay ranking and workspace isolation. None of this is a scanning engine, and the author says so directly.

Installing dsh-redteam-model and verifying it in two minutes

The prerequisite is Node.js >= 22, which the README attributes to DSH itself. You do not need pnpm or dsh preinstalled, since npx pulls them, and bash or python are not required. The project is an enabler for deepseek-harness, so the README instructs installing that first.

The recommended route treats the whole collection as one DSH plugin. The README requires dsh web 0.1.0-rc.6 or later and says it was verified on 0.1.1-rc.2. The README gives this command.

dsh plugin --profile web add github:SeaOf0/dsh-redteam-model

After that you open the dsh web settings page and the Redteam Manager entry, where you can deploy the ten modes with one click, and install, update or uninstall the seventeen runtime plugins. Mode copy status refreshes on page reload; host-plane plugin installs, uninstalls and manager self-updates need a dsh web restart. The manager keeps the last 50 records per profile and marks unfinished tasks as interrupted failures on restart.

The second route is the source CLI. Clone the repository or download the ZIP, then run the deploy script from the deploy directory. The README describes the install as idempotent and rerunnable, and the check as an offline validation of the ten preset mounts, real plugin loader paths and bundle declarations.

cd dsh-redteam-model/deploy
node deploy.mjs            # 安装：预设链接 + 插件挂载 + 依赖安装（幂等可重跑）
node deploy.mjs --check    # 离线校验：十预设挂载 + 插件真实 loader 路径 + bundle 声明
node deploy.mjs --start    # 后台启动 dsh web → http://127.0.0.1:3080

Windows uses the same flow, with junctions for preset links so no administrator rights are needed. Both routes drop the bundled AGENTS.md into ~/.dsh/AGENTS.md, but only when that file does not already exist; an existing file is never overwritten, and the installer prints how to switch to the bundled version manually.

The README gives a five-step manual check that takes about two minutes. Open http://127.0.0.1:3080 and confirm the roster lists ten modes. In any session, ask the model to call gates_list and confirm it returns the professional-mode gate schema. In pentest, attack-defense, cloud-security, ctf-solver and asset-mapping sessions, scanning tools such as nuclei_scan should be visible and should be absent elsewhere, which is the signal that preset planes are wired correctly. After starting a task, a [route-boost] mode=... phase=... envelope snapshot should appear. Finally, writing into reports/ before passing the report gate should be blocked by sec-enforce with a pointer to the right path.

Where the design gets in your way

The gate layer is the main cost. Thirty-two structural gates across eight modes, a separate semantic reviewer and double sign-off on key findings add turns to every task. On a small piece of work that is friction with no payoff, and the README's own advice is to use the general redteam mode for ordinary questions. If you want a single prompt answered, this is the wrong tool.

The tool-plane story is another constraint. The README describes a detection-first approach with three fallbacks: a detected local tool, then MCP, then installation after approval. dsh-semgrep-audit will not install semgrep automatically and runs with --metrics=off, and dsh-scanner-tools has a six-step ladder from local binary to script. That is deliberate, but it means a fresh machine with none of nmap, nuclei, httpx, ffuf, jadx, frida or mingw produces degraded modes until you install them. Cross-harness review depends on the claude or codex CLI being present; without them the double sign-off channel is unavailable.

There are also installation sharp edges. The README states that host-plane plugin changes require restarting dsh web, and that modes live in the global .agent-presets of the current DSH_HOME, shared across profiles under that home. The manager backs up declarations before writing to a profile and restores package.json and lockfile on failure, but uninstalling a sub-plugin removes only the runtime declaration and leaves the source in place. The README does not document rollback of a mode deployment itself.

How this differs from a scanner or a plain agent config

The obvious alternative is a security-focused Linux distribution such as Kali, or a scanner suite driven by hand. Those tools execute; they do not decide what to do next, and they do not enforce that a report gate was passed. dsh-redteam-model does not replace them. It wraps them: dsh-scanner-tools declares thirteen tools including nmap, masscan, subfinder, gau, whatweb, wafw00f, dirsearch, sqlmap, nikto, hydra, impacket, netexec and crackmapexec, plus nuclei, httpx and ffuf, and calls out to whatever is installed.

A second alternative is hand-written agent instructions: a CLAUDE.md or AGENTS.md that tells the model how to behave. That is the same textual layer this project ships, and it is genuinely simpler. The difference is enforcement. A markdown file cannot block a write to reports/ or force a gate verdict to be a tool call, and it cannot record injection volume or keep a trace vault. If you only need the text, the project's own AGENTS.md is the part you would copy.

A third option is building your own DSH presets. The README anticipates this and points at the AttackAtlas plugin, which has a custom work methodology panel and a capability library where you can add main and sub classes and then compose your own methodology. It also notes the source layer can be edited directly. The author's position is that a methodology only works when its owner is fluent in it, so adaptation is expected rather than discouraged.

Maintenance, licence and what upgrades cost

The repository is not archived, and the last push was on 2026-09-16, so the codebase is being touched right now. There are no retrieved releases, which means upgrade tracking happens through the git history and the package version rather than through tagged artefacts. The package.json version is 1.1.1 and the name is @dsh-external/dsh-redteam-model.

The licence is MIT, declared both in the repository root and in package.json, and the README grants permission for secondary development, including replacing a mode's methodology at the source layer. That is permissive in the ordinary sense, but MIT says nothing about how you may use the tool against a target; the README's own prohibition on illegal use is the operative constraint, and the authorized-testing boundary is a policy question rather than a licence one. Nothing here is legal advice.

The upgrade cost is concentrated in the DSH peer range. package.json pins @deepseek-ai/dsh-settings to ^0.1.0-rc.6 || ^0.1.1-rc.0 and the README says the settings-page route needs dsh web 0.1.0-rc.6 or later, verified on 0.1.1-rc.2. Because the collection is a DSH bundle with a cordis.patch.yml and a client inject list, a DSH release that changes those extension points is the event that forces work. The README also states that plugin dependency and bundle declarations are written only to the current profile, while modes live in the global .agent-presets, so a profile-scoped upgrade can leave mode copies shared across profiles.

Editorial conclusion

Adopt it if you already run DSH web 0.1.0-rc.6 or later and want gate-checked workflows instead of free-form prompting; skip it if you need a standalone scanner or a tool that works without DeepSeek Harness. Before trusting a mode, run gates_list in a session and confirm the scanner tools are visible only in the five modes the README lists, since that visibility is the check that preset planes are wired correctly.

Frequently asked questions

Official sources

1. Issues
2. License: MIT
3. README
4. SeaOf0/dsh-redteam-model on GitHub