Introduction

The core design philosophy of DeepSeek Harness is “everything is a plugin,” extending the capability boundaries of agents by decoupling functional modules. When local inference models (such as Qwen 2.5/3.8 27B or DeepSeek R1/V3) run locally and face limited context windows (32k–90k tokens), direct web scraping often leads to token flooding and diluted model attention. dsh-webstack aims to address online access needs in locally deployed scenarios by encapsulating SearXNG and Scrapling, providing enterprise-level metasearch and stealth scraping capabilities for DeepSeek Harness.

Plugin Positioning

This plugin is maintained by QuantumKuba and belongs to the “web tools” category. It is an advanced capability package designed for DeepSeek Harness (ctx.web), primarily addressing two pain points when local models obtain external information: first, context pollution, and second, security and anti-scraping. It does not directly expose complex HTTP details; instead, it interacts with the Cordis ctx.web Runtime through standardized Provider interfaces.

Core Capabilities

The plugin mainly includes the following technical implementations:

  1. Search and scraping integration
    Integrates SearXNG for metasearch and Scrapling for content retrieval with anti-scraping resistance. Models invoke them through the native web_search and web_fetch modes without needing to be aware of underlying differences.

  2. Multi-tier fetching pipeline
    For target websites of different complexity levels, the system automatically selects the optimal scraping strategy:

    • Tier 1 (default): Uses curl_cffi to emulate Chrome TLS fingerprints, targeting static or simple pages such as documentation, APIs, and blogs (average latency 531 ms).
    • Tier 2 (dynamic): Uses Playwright Headless Chrome to handle client-side rendered SPAs (average latency 2,088 ms).
    • Tier 3 (stealth): Uses StealthyFetcher to handle advanced anti-scraping challenges such as Cloudflare Turnstile (average latency 1,669 ms).

  3. SSRF security protection
    Executes strict pre-check logic before initiating network requests to ensure security:

    • DNS pre-check: Verifies the legitimacy of target addresses.
    • Private subnet interception: Blocks loopback addresses, RFC 1918 private addresses, and cloud metadata endpoints.
    • Same-origin redirect lock: Strictly restricts cross-domain/cross-protocol redirection.
      Security checks take < 0.2 ms and can intercept risky requests before an actual connection is initiated.

  4. Context optimization
    Raw HTML contains a large amount of redundant code. The plugin uses Harness’s Turndown pipeline to convert content into GitHub-Flavored Markdown (GFM). A 73.1% token savings rate means that HTML which originally required 32.6k tokens can now express complete semantics with approximately 8.8k tokens, enabling local large models to process more documents.

  5. Anti-crawler countermeasures
    Integrates an automatic Cloudflare Turnstile solver, injects Chromium canvas noise, suppresses WebRTC leakage, and simulates real browser behavior to pass fingerprint detection.

Installation and Dependencies

Based on verified facts, the plugin does not provide an explicit installation command. Before use, ensure the environment meets the following requirements:

  • Node.js version: >= 22.18.0
  • Peer Dependencies:
    • @deepseek-ai/cordis (version range >=4.0.0 <5)
    • @deepseek-ai/dsh-web (version ^0.1.5-rc.2)

To obtain it, refer to the plugin directory or GitHub repository: github.com/QuantumKuba/dsh-webstack

Usage

The plugin interacts with providers through the Cordis ctx.web Runtime. Model developers do not need to modify code; they only need to enable the corresponding provider in the Harness configuration.

  • Search: Use the searxng provider.
  • Fetch: Use the scrapling provider.

After configuration is complete, the model can continue using DeepSeek Harness’s native web_search and web_fetch modes, while the underlying layer automatically invokes the multi-tier pipeline described above.

Notes

  • Output limit: The maximum character limit for a single fetch is 50,000 to prevent context overflow.
  • Runtime permissions: The plugin runs with the permissions of the current DeepSeek Harness process. Before installing and using it, it is recommended to review the source code and license (MIT).
  • Ecosystem background: This plugin is a project listed in a community directory and has no direct affiliation with DeepSeek or the official Huanfang team.

Summary

dsh-webstack addresses efficiency and security issues for local models in online scenarios through its multi-tier pipeline and strict SSRF protection. Combined with a 73.1% token savings optimization, it provides a reliable “external brain” for local large models running within limited context windows.