It’s unsafe to load it alongside your own credentials: dsh-our-free-model, an independent plugin for DeepSeek Harness that promises free frontier models, no account and no API key, gets those models from the free tiers of other providers: it impersonates another company’s official client, operates account pools against 13 AI coding tools and automatically solves one of those providers’ captchas. The plugin is not affiliated with DeepSeek, and when a provider reacts, the consequences fall on whoever installed it.
I found it this week while preparing to thoroughly test DeepSeek Harness. The README was convincing enough that I read the code before installing it, and I’m glad I did. This is what we found in that reading, and the checklist I’d use with any repository that promises something for nothing.
How We Reviewed It. Static read-only: we cloned the repository into an isolated folder and read the README, the manifest, and the source code. We didn’t install or run the plugin, so everything I say about network behavior describes what the code is written to do, not traffic we observed. Everything that follows refers to commit 49171b9 (October 19, 2026, version 2.5.6). The repository changes almost daily, so later versions may differ.
What does this free AI models plugin promise?
DeepSeek V4.1 Flash, Kimi K3 and other frontier models, completely free, with no usage limit, no login, no registration and no API key. You install it inside DeepSeek Harness, DeepSeek’s agent runtime, and the models appear in the selector.
The README goes further than most. It has a privacy section that lists every destination the plugin contacts, and claims: “No account pool, no relay, no reseller”. It closes with a clear disclaimer: the project is independent and not affiliated with, endorsed by, or sponsored by any model provider, DeepSeek included. The repository was created in late September 2026 and hit GitHub Trending within weeks; the README shows trending badges that we didn’t verify.
What does the code actually do?
The privacy section and the code don’t match. On every startup with the desktop app, index.js imports a packaged “channel pack” (vendor/channel-pack/pack.js, 2.9 MB). No setting controls that import.
The comment preceding it is explicit. It lists the channels — Huawei Cloud’s CodeArts, Tencent’s CodeBuddy and WorkBuddy, Youdao’s LobsterAI, Qoder, ByteDance’s TRAE, Cline, Xunfei’s Loomy, SenseTime’s Raccoon, MiniMax Code, Zhipu’s ZCode and Google’s Gemini — and says that mounting the pack keeps each login flow, account pool and credit claim working. It calls them 白嫖 channels. Báipiáo is internet slang in Chinese for “mooching”: taking advantage of something paid without paying for it. The pack’s own description in package.json lists the same 13 account channels alongside “login, account pool, credit claim”.
The pack also contacts hosts that the README’s “full list” doesn’t mention: Huawei Cloud, Tencent, Youdao, Qoder, TRAE, a Google Cloud Code API host, WeChat OAuth and others, plus an IP query over plain HTTP (ip-api.com, not HTTPS).
There are two details that make it harder to audit than it appears. The pack is a vendorized copy of another project, dsh-codearts-auth, hosted on Gitee. And what actually runs is the 2.9 MB bundle in a single file, not the TypeScript sources sitting next to it, so whoever reviews has to trust that both match or recompile it.
How does it get free models without an API key?
By impersonating someone else’s client. The free channel sends the OpenCode gateway the exact User-Agent of the official OpenCode CLI (opencode/latest/2.0.26/cli) along with its identifying x-opencode-* headers. A code comment describes those headers as what the gateway uses to recognize a genuine client, aligned “element by element with the official client”.
Another comment logs the history: as of October 14, 2026, OpenCode rejects the plugin’s earlier impersonation by name, and the plugin updated to impersonate the newer client. It’s a provider actively blocking it, and the plugin adapting to get back in. (If you’re wondering whether OpenCode is free when used legitimately, we covered it in our OpenCode article.)
The README acknowledges that the free channel identifies clients by fingerprint and measures usage by session. Then its disclaimer puts the outcome in your hands: the throttling, blocks and other consequences of violating a provider’s terms are yours.
The only setting for this channel, hideFreeModels, hides the models from the selector. It doesn’t stop catalog updates or availability probes running in the background.
Why does it automatically solve a captcha?
To claim daily credits that the provider deliberately protects. In the ZCode (Zhipu) code, the authors document their own testing of the endpoints in September: model inference doesn’t ask for a captcha, but the daily credit claim endpoint always does. The pack generates that captcha response on its own, using a Chromium browser it controls, and then claims the day’s credits for each account in the pool.
A captcha placed specifically in front of a credit claim endpoint is a control against abuse. This code exists to automatically bypass it. Of everything in the repository, it’s the clearest answer to the question of who pays for the “free”.
Is it a supply chain security risk?
Yes, because it runs with the harness’s access. The channel pack is mounted with the harness’s credentials, commands and llm services and runs in the same process as your own logins to providers, including your DeepSeek account login. Our review didn’t track whether the pack reads anything that isn’t its own, and I’m not claiming it does. The point is the exposure: 2.9 MB of packaged code, from a third-party source, alongside your credentials. It’s the type of risk discussed as supply chain security: you don’t need an exploit if you install the code yourself.
The maintainer, moreover, has a permanent channel to each installation:
- Announcements, downloaded from the repository every 30 minutes by default; those marked as “urgent” open a full-screen modal.
- Auto-updates, which replace the plugin code and hot-reload it inside the harness with one click.
To be fair: update manifests must carry an Ed25519 signature against a pinned key, files are verified by hash and failures revert. That protects you from a tampered mirror. It doesn’t protect you from the maintainer: whoever has the key can send any code to every installation. A distribution setting managed disables the updater and announcements, but it comes disabled by default.
Is there anything legitimate in the plugin?
Yes, and it’s worth saying. The Kilo channel identifies honestly, with its own User-Agent, against Kilo’s public free pool (whose models, according to the README, may log prompts at the origin provider). The “aggregate” channel uses your own API keys for 75 providers, which is standard bring-your-own-key behavior. The local compatible gateway listens only on loopback and requires a generated key. Some of the engineering is careful: signed updates and an XSS test corpus for announcements.
The problem isn’t technical competence. It’s what its main functions are built for.
Free DeepSeek? What DeepSeek Harness does without third-party plugins
Most of what’s legitimate, natively. According to the documentation that comes with the desktop app (version 0.2.1-rc.2):
- DeepSeek, two ways. One route that uses your DeepSeek account logged in against the official endpoint, and another separate route that uses a DeepSeek API key. They’re independent: if you logged in with your account, you don’t need a key to use DeepSeek models. What we didn’t verify is whether that account usage deducts from your developer platform balance or from a separate allocation; your account usage page shows it.
- Other providers. A built-in multi-provider adapter covers Anthropic, OpenAI, Google Gemini, OpenRouter, Mistral, Groq, Kimi/Moonshot and others, plus any OpenAI-compatible gateway as a custom route. That’s also the honest way to use Kilo: with your own Kilo key. Keys are resolved from the harness’s credential store, not written to config.
One caveat about that adapter: it can also log in with consumer chat subscriptions. In Claude’s case, Anthropic’s documentation is clear: third-party developers can’t route requests through Free, Pro or Max plan credentials or offer Claude.ai login in their own apps; use an API key. For other providers, check their current terms before using subscription login.
Our coverage of DeepSeek Harness at launch explains the plugin model on which these routes are built.
How to review a GitHub repository before installing it?
This one took us about thirty minutes of reading. The checklist works for any case:
- Ask who pays the account. Frontier models cost money per token. If a project gives them away for free, no key and no limit, find out who pays and if they agreed.
- Compare the README with the package description and code comments. Here the privacy section and the
package.jsoncontradicted each other. Developers write comments for themselves, and comments are usually honest. - Make a list of hosts. Look for domains in the code and in the bundles, and compare them to what the README declares.
- Look for unconditional imports and opaque bundles. Code that loads without a setting, from a huge generated file, is code you can’t turn off or easily read.
- Look for impersonation. A User-Agent and headers from another provider hardcoded in the code are a red flag on their own.
- Check what auto-updates. Auto-updaters and announcement feeds are a permanent channel from the maintainer to your machine. Find the switch before you need it.
- Read the disclaimer as a description of the risk. When it says blocks are on your account, believe it.
- Look for the native route first. Most harnesses already support the providers you need with your own keys.
None of this requires running the code. That’s the point: you can know almost everything important before anything runs on your machine.
What about you? What’s the first thing you check in a repository before installing it?
- Read only the README
- Skim through the code
- Look at stars and repo activity
- Prefer another option (tell us which)
Comment below or, if this article reached you by email, reply directly to the email: your response gets published here.
Related: DeepSeek Harness: What Happens When Even the Agent Loop Becomes a Plugin