Introduction

The native web_fetch HTTP provider in DeepSeek Harness rejects all non-public addresses by default, forming an important SSRF security boundary. However, in the following scenarios, a target may be clearly trusted yet still be blocked prematurely: transparent proxies (such as Clash or Mihomo) in Fake-IP mode resolve public domain names to reserved address ranges; an Agent needs to read an enterprise intranet documentation site, a self-hosted knowledge base, or other trusted private-network services. The dsh-web-fetch-enhanced plugin allows administrators to explicitly configure two layers of exceptions, expanding the controllable network scope while keeping the model-side usage of web_fetch unchanged.

Plugin Overview

This plugin is maintained by Yurzi and is licensed under the MIT License. It provides secure and controllable enhanced web-fetching capabilities for DeepSeek Harness. By default, the plugin rejects non-public targets, and only explicitly matched CIDR exceptions are allowed to pass.

Core Features

  • Fully compatible with the native tool: It does not add new model tools; the Agent continues to call web_fetch.
  • Immediate Web-based configuration: Edit the allowlist in DSH Web settings; after saving, the next fetch immediately uses the new rules.
  • Two-layer allowlist mechanism:
    • CIDR allowlist: Configure the allowed IPv4 / IPv6 network ranges.
    • Domain allowlist (optional): Acts as a second factor to further restrict accessible network ranges to exact domains or wildcard domains.
  • DNS validation and connection pinning: All resolved results must be compliant, and connections use only validated addresses.
  • Hop-by-hop redirect revalidation: Only same-origin redirects are followed, and every hop re-resolves, validates, and pins the address.
  • Restricted anonymous requests: Sends only GET requests without Cookies, Authorization headers, or URL credentials.
  • Resource limit control: Limits URL length, response bytes, decoded characters, redirect count, and timeouts.
  • IPv4 / IPv6 protection: Covers IPv4-mapped IPv6 and checks active DNS64 / NAT64 targets.
  • Global outbound proxy coordination: Works seamlessly with DSH global HTTP proxy routing while strictly preventing non-public IP literals from unauthorized proxy use.
  • Dynamic system prompt coordination: When non-public allowlists are configured, it automatically injects an explicit authorization statement into the model system prompt.

Installation and Enablement

It is recommended to use DSH plugin management commands. The installation package applies the bundled cordis.patch.yml as a Profile patch layer:

dsh plugin --profile web add dsh-web-fetch-enhanced

If the Web Profile is already running, restart the corresponding Host process according to your deployment method so that the new plugin and Client face are fully loaded.

Configure the Allowlist

Open DSH Web and go to Plugins → dsh-web-fetch-enhanced. The detail page directly displays the allowlist form.

  1. Configure CIDRs: Enter one network range per line in “Allowed CIDRs”. For example, a common Fake-IP configuration for Clash / Mihomo:
    198.18.0.0/15
  1. Configure domains (optional): If you want only specific websites to use the above exception, also fill in “Allowed domains”:
    api.example.com
    *.docs.example.com
  1. Save: Click “Save”, and the next web_fetch call will use the new rules. There is no need to restart the Profile.

Usage Examples

  • Read intranet documentation: Read https://wiki.corp.example/guide and summarize the deployment steps.
  • Configure a specific network range: Configure the allowed CIDR to 10.20.0.0/16.
  • Configure a specific network range: Configure the allowed CIDR to 198.18.0.0/15.

Security Considerations

  • The allowlist expands the outbound network scope for HTTP requests that the Agent can initiate. Allow only the minimal targets you understand and trust.
  • Do not add 0.0.0.0/0 or ::/0.
  • Do not add cloud metadata addresses, such as 169.254.169.254/32.
  • Do not add the entire 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16 ranges unless they are necessary.
  • Do not add network ranges jointly controlled by untrusted proxies, DNS, or tenants.
  • Even when an allowlist is configured, the Host still re-performs full CIDR, domain, DNS, and provider identity validation.

Version and Compatibility

  • Minimum supported DSH version: 0.2.0-rc.2 (supported range >=0.2.0-rc.2 <0.3.0-0).
  • Version support policy: This plugin only supports RC (Release Candidate) candidate release versions of DeepSeek Harness and subsequent stable official releases. Because Alpha or development snapshot versions change frequently and lack stable API guarantees, this plugin no longer maintains or adapts to non-RC stage versions such as Alpha versions.

Conclusion

Through fine-grained allowlist control, this plugin enables DeepSeek Harness to handle complex proxy environments and intranet access requirements while maintaining security boundaries. For more details, refer to the GitHub repository.