Plugin Data APIs

Machine-readable plugin data, split by concern — security certification, install certification, registry index and the trending boards. All static, cached and free to reuse with attribution. Built for AI agents and tooling.

8 APIs15 EndpointsCC BY 4.0No API KeyCORS enabled1h CDN cacheMCP + Skill

Quick start

# Fetch a plugin's security certification result
curl https://www.dsh.so/artifact/@dsh-so/dsh-code-security.json

# Install certification status (@author/plugin addressing)
curl https://www.dsh.so/data/install/@dsh-so/dsh-plugin-finder.json

# Full registry index
curl https://www.dsh.so/plugins-index.json

# Weekly npm download ranking
curl https://www.dsh.so/data/npm-downloads.json

# Star leaderboard (plugin / eco plugin / eco app boards)
curl https://www.dsh.so/data/stars.json

Data APIs · WeChatScan to connect — Q&A and update noticesPlease note "dsh.so" in your request

01 APIs at a glance

API 01

Security Certification Data APIPer plugin

Static security review record for a single plugin: verdict badge, finding counts by severity, findings, and the scanned commit / release binding.

/artifact/@author/plugin.jsonDaily 01:10 Beijing API 02

Install Certification Data APIPer plugin

Single-plugin install-verification query (L5 smoke preferred, L4 fallback): passed / failed / unknown / stale / untested with a verified flag and environment metadata.

/data/install/@author/plugin.jsonPer verification run API 03

Plugin Index Data APIRegistry-wide

Lightweight registry summary: every collected plugin with verification level, security status, risk level and counts — no per-finding detail.

/plugins-index.jsonRebuilt on every deploy API 04

Plugin Record Data APIPer plugin

Canonical per-plugin fact sheet: verification per dsh version (L5-first), security summary, install, health and evidence pointers — one record for agent decision-making.

/plugin/@author/plugin.jsonRebuilt on every deploy API 05

Star Leaderboard Data APIRegistry-wide

GitHub star leaderboard split by the three artifact classes — dsh plugins / eco plugins / eco apps — top 100 by stars each. The upstream harness itself is absent; the ecoPlugin board admits install-verified entries only.

/data/stars.jsonRebuilt on deploy API 06

npm Downloads Data APIRegistry-wide

Weekly npm download ranking of DSH plugins (npm last-week window): the top-100 ranking behind the homepage board — rank, package, week downloads, cumulative total, stars.

/data/npm-downloads.jsonDaily snapshot API 07

Star Trend Board Data APIRegistry-wide

GitHub star riser ranking over a 1-week window: the top-100 plugins by star gain, with baseline and current star counts.

/data/star-trend.jsonDaily snapshot API 08

npm Popular Downloads Data APIRegistry-wide

All-time npm downloads popularity ranking: the top-100 plugins by cumulative downloads, with weekly downloads as context.

/data/npm-popular.jsonDaily snapshot

02 Endpoint explorer

{
  "id": "dsh-code-security-3",
  "badge": { "state": "passed", "level": "passed", "detailUrl": "https://www.dsh.so/artifact/dsh-code-security-3/" },
  "commitSha": "ec266465d104202e8fc07f7d8faeeb15760aef07",
  "latestCommitSha": "ec266465d104202e8fc07f7d8faeeb15760aef07",
  "pkgVersion": "0.2.2",
  "pkgDsh": true,
  "latestReleaseTag": null,
  "counts": { "critical": 0, "warning": 0, "info": 0 },
  "criticalByCategory": {},
  "filesScanned": 15,
  "scannedAt": "2026-09-21T20:04:36.213Z",
  "scannerVersion": "dsh-static:73b7d4a8",
  "rulesChecked": 31,
  "findings": [],
  "plugin": { "name": "dsh-code-security", "repository": "https://github.com/dsh-so/dsh-code-security" },
  "license": { "spdx": "CC-BY-4.0", "attribution": "dsh.so" }
}

{
  "title": "SecurityScanRecord",
  "type": "object",
  "required": ["id", "badge", "counts", "scannedAt"],
  "properties": {
    "badge": { "badge.state": "passed | warn | fail | ..." },
    "counts": { "critical": 0, "warning": 0, "info": 0 },
    "findings": { "maxItems": 12, "items": "ruleId / severity / file / line" },
    "commitSha": "scanned revision binding",
    "scannedAt": "date-time"
  }
}

{
  "id": "dsh-plugin-finder-2",
  "name": "@dsh-so/dsh-plugin-finder",
  "installTest": {
    "state": "passed",
    "level": "L5",
    "verdict": "passed",
    "verified": true,
    "channel": "npm",
    "profileId": "l3-fullscan",
    "checkedAt": "2026-09-20T05:40:02.244Z",
    "sourceRecordId": "dsh-plugin-advisor-3@0.2.1@dsh0.1.6-alpha.2",
    "environment": { "dshVersion": "0.1.6-alpha.2", "dshCliVersion": "0.1.6-alpha.2", "os": "win32", "arch": "x64", "adapterId": "none" }
  },
  "links": {
    "plugin": "https://www.dsh.so/artifact/dsh-plugin-finder-2/",
    "badgeVersioned": { "0.1.6-alpha.2": "https://www.dsh.so/badge/install/dsh-plugin-finder-2@0.1.6-alpha.2.svg" },
    "verificationLevels": "https://www.dsh.so/verification/"
  },
  "license": { "spdx": "CC-BY-4.0", "attribution": "dsh.so" }
}

{
  "title": "InstallTestRecord",
  "type": "object",
  "required": ["id", "installTest"],
  "properties": {
    "installTest.state": "passed | failed | unknown | stale | untested",
    "installTest.level": "L4 | L5",
    "installTest.verified": "boolean",
    "installTest.checkedAt": "date-time",
    "installTest.environment": "dsh / os / arch of the run"
  }
}

{
  "generated": "2026-09-21",
  "generatedAt": "2026-09-21T15:58:37.604Z",
  "count": 16441,
  "plugins": [
    {
      "id": "dsh-plugin-finder",
      "name": "dsh-plugin-finder",
      "description": "Find and audit DSH plugins inside the agent — live dsh-plugin topic search + source audit with trial-to-production install plans.",
      "stars": 3,
      "install": "dsh plugin --profile web add github:meme-dog/dsh-plugin-finder#v0.3.0",
      "url": "https://www.dsh.so/artifact/dsh-plugin-finder/",
      "verification": { "level": 5, "lastVerifiedAt": "2026-09-20T05:40:02.244Z" },
      "security": { "status": "audited", "riskLevel": "low", "scannedAt": "2026-09-18T19:11:09.827Z" },
      "installBadge": { "level": "L5", "status": "passed", "verified": true, "stale": false },
      "capability": { "declaredCount": 3, "samples": ["developer", "github", "code-review"] }
    }
  ],
  "license": { "spdx": "CC-BY-4.0", "attribution": "dsh.so" }
}

{
  "title": "PluginsIndex",
  "type": "object",
  "required": ["generatedAt", "count", "plugins"],
  "properties": {
    "count": "integer",
    "plugins[]": "id / name / stars / install / verification / security / evidence",
    "verification.level": "1-5",
    "security.status": "passed | warning | high-risk | critical | pending"
  }
}

{
  "schemaVersion": "1",
  "id": "dsh-code-security-3",
  "generatedAt": "2026-09-22T03:07:33.427Z",
  "registry": {
    "name": "dsh-code-security",
    "repository": "https://github.com/dsh-so/dsh-code-security",
    "installSource": "npm",
    "status": "unverified"
  },
  "verification": {
    "level": 5,
    "label": "L5 · Run tested",
    "lastVerifiedAt": "2026-09-20T05:40:02.244Z",
    "byDshVersion": [
      { "version": "0.1.6-alpha.2", "current": true, "level": "L5", "status": "passed", "verified": true }
    ]
  },
  "security": { "status": "audited", "riskLevel": "low", "scannedAt": "2026-09-21T20:04:36.213Z", "counts": { "critical": 0, "warning": 0, "info": 0 } },
  "install": { "command": "dsh plugin --profile web add @dsh-so/dsh-code-security@0.2.2" },
  "health": { "stars": 0, "forks": 0, "lastCommitAt": "2026-09-10T12:48:23Z" },
  "evidence": {
    "latestVerificationRecordId": "dsh-code-security-3@0.2.2@dsh0.1.6-alpha.2",
    "installSourceRecordIds": ["dsh-code-security-3@0.2.2@dsh0.1.6-alpha.2", "dsh-code-security-3@0.2.2@dsh0.1.6-alpha.1"]
  },
  "license": { "spdx": "CC-BY-4.0", "attribution": "dsh.so" }
}

{
  "title": "PluginRecord",
  "type": "object",
  "required": ["schemaVersion", "id", "verification", "security"],
  "properties": {
    "verification.byDshVersion[]": "per-dsh-version L4/L5 records",
    "security": "status / riskLevel / counts",
    "install": "state / level / verified / channel",
    "health": "repo status / stars / lastPushAt",
    "evidence": "pointers to record / scan / install data"
  }
}

{
  "schema": "https://www.dsh.so/data/stars.schema.json",
  "generatedAt": "2026-09-21T15:56:55.142Z",
  "scope": { "listableOnly": true, "upstreamCoreExcluded": true, "ecoPluginInstallVerifiedOnly": true, "classes": ["plugin", "ecoPlugin", "ecoApp"] },
  "limit": 100,
  "boards": {
    "plugin": {
      "count": 100,
      "items": [
        { "rank": 1, "id": "modlens", "name": "modlens", "stars": 3912, "url": "https://www.dsh.so/artifact/modlens/" },
        { "rank": 2, "id": "dsh-better-sidebar", "name": "DSH-better-sidebar", "stars": 3421, "url": "https://www.dsh.so/artifact/dsh-better-sidebar/" }
      ]
    },
    "ecoPlugin": { "count": 100, "items": [ { "rank": 1, "id": "open-design", "name": "open-design", "stars": 94779, "url": "https://www.dsh.so/artifact/open-design/" } ] },
    "ecoApp": { "count": 100, "items": [ { "rank": 1, "id": "ruflo", "name": "ruflo", "stars": 71521, "url": "https://www.dsh.so/artifact/ruflo/" }, { "rank": 2, "id": "reactive-resume", "name": "reactive-resume", "stars": 42305, "url": "https://www.dsh.so/artifact/reactive-resume/" } ] }
  },
  "license": { "spdx": "CC-BY-4.0", "attribution": "dsh.so" }
}

{
  "title": "StarsFeed",
  "type": "object",
  "required": ["generatedAt", "limit", "boards", "license"],
  "properties": {
    "scope": "listableOnly / upstreamCoreExcluded / ecoPluginInstallVerifiedOnly",
    "limit": 100,
    "boards.plugin[]": "rank / id / name / stars / url",
    "boards.ecoPlugin[]": "rank / id / name / stars / url",
    "boards.ecoApp[]": "rank / id / name / stars / url"
  }
}

{
  "schema": "https://www.dsh.so/data/npm-downloads.schema.json",
  "generatedAt": "2026-09-21T15:56:54.701Z",
  "snapshotDate": "2026-09-18",
  "window": { "days": 7, "start": "2026-09-11", "end": "2026-09-18" },
  "scope": { "listableOnly": true, "ecosystemAppsExcluded": true, "newlyIndexedExcludedDays": 7 },
  "limit": 100,
  "count": 100,
  "items": [
    { "rank": 1, "id": "dsh-market", "name": "dsh-market", "packageName": "dshmarket", "week": 112918, "total": null, "stars": 3407, "url": "https://www.dsh.so/artifact/dsh-market/" },
    { "rank": 2, "id": "dsh-better-sidebar", "name": "DSH-better-sidebar", "packageName": "dsh-better-sidebar", "week": 92307, "total": 385169, "stars": 3421, "url": "https://www.dsh.so/artifact/dsh-better-sidebar/" }
  ],
  "license": { "spdx": "CC-BY-4.0", "attribution": "dsh.so" }
}

{
  "title": "NpmDownloadsFeed",
  "type": "object",
  "required": ["generatedAt", "snapshotDate", "window", "count", "items"],
  "properties": {
    "window": { "days": 7 },
    "scope": "listableOnly / ecosystemAppsExcluded / newlyIndexedExcludedDays",
    "limit": 100,
    "items[]": "rank / id / packageName / week / total / stars / url"
  }
}

{
  "schema": "https://www.dsh.so/data/star-trend.schema.json",
  "generatedAt": "2026-09-21T15:56:55.072Z",
  "snapshotDate": "2026-09-18",
  "baselineDate": "2026-09-11",
  "window": { "days": 7, "start": "2026-09-11", "end": "2026-09-18" },
  "scope": { "listableOnly": true, "ecosystemAppsExcluded": true, "newlyIndexedExcluded": true, "pulseFiltered": true },
  "limit": 100,
  "count": 100,
  "items": [
    { "rank": 1, "id": "dsh-infinite-gen-2", "name": "dsh-infinite-gen-2", "fromStars": 293, "toStars": 1730, "deltaStars": 1437, "url": "https://www.dsh.so/artifact/dsh-infinite-gen-2/" },
    { "rank": 2, "id": "dsh-market", "name": "dsh-market", "fromStars": 3407, "toStars": 4143, "deltaStars": 736, "url": "https://www.dsh.so/artifact/dsh-market/" }
  ],
  "license": { "spdx": "CC-BY-4.0", "attribution": "dsh.so" }
}

{
  "title": "StarTrendFeed",
  "type": "object",
  "required": ["generatedAt", "snapshotDate", "window", "count", "items"],
  "properties": {
    "baselineDate": "window start snapshot",
    "scope": "listableOnly / newlyIndexedExcluded / pulseFiltered",
    "limit": 100,
    "items[]": "rank / id / fromStars / toStars / deltaStars / url"
  }
}

{
  "schema": "https://www.dsh.so/data/npm-popular.schema.json",
  "generatedAt": "2026-09-21T15:56:54.723Z",
  "totalsAsOf": "2026-09-17",
  "scope": { "listableOnly": true, "ecosystemAppsExcluded": true, "packagesWithBaselineOnly": true },
  "limit": 100,
  "count": 100,
  "items": [
    { "rank": 1, "id": "dsh-better-sidebar", "name": "DSH-better-sidebar", "packageName": "dsh-better-sidebar", "total": 385169, "totalAsOf": "2026-09-17", "week": 92307, "stars": 3421, "url": "https://www.dsh.so/artifact/dsh-better-sidebar/" },
    { "rank": 2, "id": "modlens", "name": "modlens", "packageName": "@liustack/modlens", "total": 197635, "totalAsOf": "2026-09-17", "week": 20898, "stars": 3912, "url": "https://www.dsh.so/artifact/modlens/" }
  ],
  "license": { "spdx": "CC-BY-4.0", "attribution": "dsh.so" }
}

{
  "title": "NpmPopularFeed",
  "type": "object",
  "required": ["generatedAt", "totalsAsOf", "count", "items"],
  "properties": {
    "totalsAsOf": "as-of date of the cumulative totals",
    "scope": "listableOnly / packagesWithBaselineOnly",
    "limit": 100,
    "items[]": "rank / id / packageName / total / week / stars / url"
  }
}

03 Agent integrations

MCP

MCP server · @dsh-so/mcp

Structured tools for Claude Code / ZCode / Cursor: registry search, plugin records, security scans, install status and the boards. Zero-install via npx, no API key — the server just reads these static endpoints.

search_pluginsget_plugin_recordget_security_scanget_install_statusget_npm_downloadsget_star_trenddata_freshness

mcp config

{
  "mcpServers": {
    "dsh-so": {
      "command": "npx",
      "args": [
        "-y",
        "@dsh-so/mcp"
      ]
    }
  }
}

SKILL

Agent skill · dsh-plugin-data

A SKILL.md that teaches any agent when and how to query the data — verify the security verdict and install-verified status before recommending a plugin. Works without MCP: it points the agent straight at these static endpoints.

endpoint tablefield semanticsdecision rulesCC BY 4.0

install skill

# install into the cross-agent skills directory (~/.agents/skills)
mkdir -p ~/.agents/skills/dsh-plugin-data
curl https://www.dsh.so/skills/dsh-plugin-data/SKILL.md \
  -o ~/.agents/skills/dsh-plugin-data/SKILL.md

04 All endpoints

URL	API	Description
`/data/security-scan.schema.json`	Security	JSON Schema for the per-plugin scan-record format
`/artifact/@author/plugin.json`	Security	Per-plugin JSON — scan badge + counts + findings + version binding
`/data/install/@author/plugin.json`	Install	Single-plugin install-verification result (L5-preferring, L4 fallback)
`/plugins-index.json`	Index	Registry summary — every plugin's status / risk level / counts
`/plugin/@author/plugin.json`	Record	Canonical per-plugin fact sheet — verification, security, health, evidence
`/data/plugin-record.schema.json`	Record	JSON Schema for the plugin record endpoint
`/data/install.schema.json`	Install	JSON Schema for the install endpoint
`/data/stars.json`	Star Leaderboard	GitHub star leaderboard — plugin / eco plugin / eco app boards, top 100 each
`/data/stars.schema.json`	Star Leaderboard	JSON Schema for the star leaderboard feed
`/data/npm-downloads.json`	npm Downloads	Top-100 weekly npm download ranking — the homepage board as a feed
`/data/npm-downloads.schema.json`	npm Downloads	JSON Schema for the npm downloads feed
`/data/star-trend.json`	Star Trend Board	Top-100 GitHub star gainers over a 1-week window
`/data/star-trend.schema.json`	Star Trend Board	JSON Schema for the star trend feed
`/data/npm-popular.json`	npm Downloads	Top-100 all-time npm downloads popularity ranking
`/data/npm-popular.schema.json`	npm Downloads	JSON Schema for the npm popularity feed

JSON endpoints allow cross-origin reads: Access-Control-Allow-Origin: *. No API key or registration is required.

05 Conventions

One way to address. Single-plugin endpoints are addressed only as /artifact/@author/plugin.json (likewise /data/install/@author/plugin.json and /plugin/@author/plugin.json) — the @ author part is the plugin author's npm scope or GitHub username; the id inside every JSON stays the canonical slug. Bare-slug .json addresses are no longer issued.

Static & cached. Prerendered JSON with Cache-Control: public, max-age=3600 and cross-origin headers.

Append-only fields. Existing fields are never removed or renamed; new fields ship with a schema update.

Provenance-bearing. Records quote their source verbatim — no invented defaults (honesty principle).

Attribution. Free to reuse with attribution to dsh.so — the link embeds a utm_source marker, please keep it so we can track reuse traffic; each API page documents its update cadence.

License. All feeds are CC BY 4.0 — redistribution must preserve freshness markers (generatedAt / asOf / checkedAt).

Disputes. Plugin authors can contest a scan result — see Dispute a scan result.

Security scan data and install-test states are aggregated from public GitHub repositories and append-only verification records by the dsh.so pipelines. Sample responses above are excerpts; field shapes follow the live endpoints. Check changelog for additions.