In the development of DeepSeek Harness (DSH), tool calls often involve passing arguments or URLs to external services. If the model echoes specific data or markers during execution, that information may be exposed. The dsh-canary plugin addresses this detection-and-blocking problem by planting a unique marker in the context and intercepting any tool call or URL that echoes the marker.

Plugin Overview

This is a DeepSeek Harness plugin. The plugin is maintained by jwilson411, classified as admin-security, and licensed under MIT. It focuses on detecting and rejecting tool arguments or URLs that echo a planted canary string.

Core Features

The plugin provides the following core capabilities:

  1. Plant a canary string: Plant a unique marker in model-visible context.
  2. Detect echoes: Detect whether tool arguments or URLs contain the canary string.
  3. Reject calls: Intercept and reject calls containing the canary before tool execution.
  4. Log incidents: Record incident logs when an echo is detected.
  5. Register tools: Register the canary_context and canary_status tools for viewing plant status and statistics.
  6. Provide library APIs: Provide library-level APIs such as plantCanary, wrapExecute, and CanaryTripError for direct use by developers.

Installation and Enablement

Installing the plugin requires the official install command. The plugin depends on a specific version of the DSH toolkit.

dsh plugin --profile default add github:jwilson411/dsh-canary

Typical Usage

Developers can use the plugin’s library APIs to implement canary planting and protection logic.

Planting and Wrapping Execution

First call plantCanary() to generate plant state, then use wrapExecute to wrap a tool’s execution function. Catch CanaryTripError during execution to handle interception events.

import { plantCanary, wrapExecute, CanaryTripError } from 'dsh-canary'

const state = plantCanary()
const guarded = wrapExecute(tool.execute, state, { tool: tool.name })

try {
  await guarded(argsFromTheModel, exec)
} catch (error) {
  if (error instanceof CanaryTripError) {
    // 错误处理：记录拦截事件，但不再传递 canary 值
    log.warn({ code: error.code, where: error.where, tool: error.tool })
    return
  }
  throw error
}

Narrow Entry Points

If the host has different call sites, you can use assertNoCanary or assertNoCanaryInUrl to perform checks. These functions throw exceptions on a hit but do not write logs.

import { assertNoCanary, assertNoCanaryInUrl } from 'dsh-canary'

assertNoCanary(requestBody, state, { tool: 'http' })   // 检查参数
assertNoCanaryInUrl(candidate, state, { tool: 'fetch' }) // 检查 URL

Applicable Scenarios and Notes

Applicable Scenarios

  • Need to detect whether the model echoes a specific marker into tool call arguments or URLs.
  • Need to intercept execution before tool execution to prevent leakage of sensitive information or test markers.

Notes

  • Version requirement: The plugin requires DSH RC 0.1.1-rc.2.
  • Error code: The error code when an echo is detected is always 'CANARY_TRIP'.
  • Return value safety: Return values (including error messages) do not contain the canary value itself, only the prefix.
  • Feature positioning:
    • Not a prompt-injection detector.
    • Not a red team product.
    • Not a classifier.
    • Not covert control.
    • Not data loss prevention (DLP).

Conclusion

The dsh-canary plugin provides a concrete means to verify whether the model leaks specific context markers in tool calls or URLs. Through the strict installation command and library APIs, developers can integrate it into existing DSH workflows to monitor and block echo behavior.

Plugin Directory
GitHub Repository