Introduction

In DeepSeek Harness (DSH), tool invocation involves more than just the question of “whether it can execute.” Once built-in tools, third-party tools, and MCP tools enter the same runtime path, deployment operators often need unified constraints based on tool names and parameters: allowing certain read-only tools, requiring approval for specific shell or external tools, and directly rejecting certain deletion-type tools.

dsh-tool-policy is a community plugin for DSH designed to insert a declarative policy layer before tool invocation execution. It is not an official component maintained by DeepSeek AI, nor does it equate to the official DSH capability sandbox. Below is an introduction to its capabilities, installation method, and typical configuration.

What is it

One-sentence definition: dsh-tool-policy allows, asks, or denies DeepSeek Harness tool invocations, and this happens before tool execution.

It targets a single tool invocation, not a session-level authorization, nor a runtime isolation of a set of capabilities. It provides a deny-by-default policy layer: default to denial, only entering corresponding handling if an explicit rule is matched. It covers built-in tools, third-party tools, and MCP tools, matching observable tool names and optional parameter patterns before the tool implementation runs.

Verified basic information is as follows:

  • Repository: Drifter-yh/dsh-tool-policy
  • License: MIT
  • Runtime Environment: Node >=22.19
  • peer dependencies:
  • @deepseek-ai/cordis >=4.0.1 <5
  • @deepseek-ai/dsh-tools >=0.1.0-rc.5 <0.2.0

Core Features

The functionality of dsh-tool-policy is relatively focused:

  1. Apply allow, ask, or deny rules before tool invocation execution.
  2. Provide a deny-by-default policy layer for built-in tools, third-party tools, and MCP tools.
  3. Match observable tool names and optionally match parameter patterns.
  4. Use a rule model where the first matched rule takes effect.
  5. Support anchored tool name patterns and allow a wildcard *.
  6. Use JSON Pointer to describe parameter conditions.
  7. Support trace: true, outputting decision traces without parameter values via the Cordis logger.

The “policy” here mainly targets the tool invocation itself: it judges whether a specific invocation is allowed, requires approval, or is directly rejected. It is not responsible for capability sandboxes, parameter rewriting, or tool implementation execution.

Installation and Enablement

The installation command provided in the documentation is as follows:

pnpm add dsh-tool-policy @deepseek-ai/cordis @deepseek-ai/dsh-tools

After installation, you can enable this plugin in the DSH configuration. It is recommended to start with default denial, and then gradually add allow, ask, or deny rules based on tool names.

A minimal configuration snippet is as follows:

defaultDecision: deny
rules:
  - tool: 'read_*'
    decision: allow
  - tool: 'bash'
    decision: ask
    reason: 'Shell execution requires approval.'

This configuration snippet expresses two intents:

  • Tool invocations that do not match any rule are denied by default.
  • Tool invocations matching read_* are allowed to proceed.
  • Tool invocations matching bash enter the path requiring approval.

If an operator needs to troubleshoot why a certain invocation was allowed, asked, or denied, they can enable decision tracing:

trace: true

Once enabled, the plugin outputs decision traces via the Cordis logger. These traces do not contain parameter values and are suitable as clues for troubleshooting “why a specific rule was not matched.”

Typical Usage

Below is a more complete policy configuration snippet. It covers read-only tools, shell tools, MCP tools, and deletion-type tools simultaneously:

defaultDecision: deny
rules:
  - tool: 'read_*'
    decision: allow
  - tool: 'bash'
    decision: ask
    reason: 'Shell execution requires approval.'
  - tool: 'mcp__*'
    decision: ask
    reason: 'External tool calls require approval.'
  - tool: 'delete_*'
    decision: deny
    reason: 'Delete operations are disabled in this deployment.'

This configuration snippet expresses four common intents:

  1. read_*: Allow matched read-only tool invocations.
  2. bash: Shell execution requires approval.
  3. mcp__*: External tool calls require approval.
  4. delete_*: Disable delete operations in the current deployment.

The order of rules affects the result. The plugin uses a rule model where the first matched rule takes effect; therefore, if a single invocation could match multiple rules, more specific rules should be placed first.

Applicable Scenarios and Caveats

dsh-tool-policy is suitable for these scenarios:

  • Running a deny-by-default whitelist of tool invocations in unattended tasks.
  • Requiring approval for external tool calls like mcp__*.
  • Rejecting known deletion-type tool invocations before execution.
  • Using unified rules for built-in tools, third-party tools, and MCP tools within the same DSH deployment.

Several boundaries need to be observed in usage:

  1. It is a per-call policy layer, not a sandbox. Capability execution still relies on DSH’s runtime isolation and sandbox configuration.
  2. It does not implement sandboxing, capability enforcement, shell semantic analysis, or equivalent operation detection.
  3. A deny rule making a matched tool invocation unavailable does not equal completely prohibiting destructive behaviors in the system.
  4. It does not rewrite parameters, nor does it execute the tool implementation.
  5. It runs with the permissions of the current dsh process. Before installation, check the source code, license, and dependency versions to ensure it meets the deployment party’s security requirements.
  6. In production environments, policy routing should be used in conjunction with a stricter DSH sandbox, rather than replacing it.

Repository URL:

https://github.com/Drifter-yh/dsh-tool-policy

If you wish to continue evaluation, start with the default stance of defaultDecision: deny. First, set high-risk tools to ask or deny, and then gradually allow read-only and low-risk tools.