DeepSeek Harness (DSH) allows users to extend functionality through plugins, connecting large models to system tools. However, granting AI direct tool-call access to system command lines or file system permissions can introduce security risks. The dsh-plugin-tool-guard plugin aims to provide DSH with a runtime security guard layer that blocks dangerous operations and limits access scope without modifying Agent business code.

Plugin Overview

This plugin is maintained by zhaoxuejie and belongs to the admin-security category. Through a built-in rule engine and a human approval mechanism, it intercepts, allows, or audits every tool call.

Core Features

The plugin provides the following core capabilities:

  • Dangerous command blacklist: Built-in regular expressions directly block dangerous commands such as rm -rf, mkfs, dd, and shutdown.
  • Sensitive file blacklist: Uses glob patterns (such as .env, *.pem, and id_rsa) to prevent AI from reading sensitive files.
  • Path whitelist: Restricts AI to operating only in specified directories (the current working directory by default), preventing bypasses via ../.
  • Write protection and human approval: Overwriting existing files or deleting files requires human approval, while creating new files is usually allowed.
  • Audit logs: Records the timestamp, session, sanitized input parameters, and decision result of each call, and supports session isolation.
  • Three security levels: Supports loose (lenient), standard (standard, default), and strict (strict) modes.
  • Management tools: Provides guard_* series tools, HTTP endpoints, and a GUI panel for unified management.

Installation and Enablement

This plugin is a native DSH plugin and must be installed into a specific profile to take effect. The installation command is as follows:

dsh plugin --profile web add dsh-plugin-tool-guard

After installation, restart DSH or reload the profile. To uninstall, use:

dsh plugin --profile web remove dsh-plugin-tool-guard

Typical Usage

Once installed and enabled, the plugin will intercept requests that do not conform to the configured rules:

  • Blocking sensitive files: If AI requests “read the .env in the project,” it will be denied (sensitive file blacklist hit).
  • Blocking dangerous commands: If AI requests “run rm -rf D:,” it will be denied (dangerous command blacklist hit).
  • Path restriction: If AI requests to read a file outside the workspace (such as C:\Windows\win.ini), it will be denied.
  • Human approval: Under the strict level, if AI requests “write a new file demo.txt,” an approval card will appear and require human confirmation.

Notes

  • Zero intrusion: This plugin does not modify Agent business code. It takes effect when installed and becomes inactive when uninstalled.
  • Audit logs: By default, audit logs are stored only in memory. If audit.keepAfterUnload: true is configured, logs can be archived to the ~/.deepseek-harness/audit/ directory upon uninstallation.
  • Permission limitation: The plugin runs with the permissions of the current DSH process. Review the source code and license before installation.

References

  • GitHub repository: https://github.com/zhaoxuejie/dsh-plugin-tool-guard
  • Community catalog: https://www.skillhub.cn/plugins/zhaoxuejie/dsh-plugin-tool-guard