Introduction

When using DeepSeek Harness (DSH), an Agent may perform file system operations or Git commands based on instructions. If these operations are triggered accidentally, they may cause code rollback or the leakage of sensitive information. To add a line of defense before an Agent runs code, pre-execution security checks need to be introduced in the Harness environment. CC Safety Net is a DSH plugin designed for this purpose. It analyzes command intent and intercepts destructive operations before an Agent actually executes them.

Plugin Positioning

CC Safety Net (Coding CLI Safety Net) is a pre-execution protection tool for AI coding Agents. It is maintained by kenryu42 and released under the MIT License. Its core function is to check command intent before tool calls are executed, block destructive Git and file system commands, and prevent access to key files (such as SSH keys and .env files).

Core Features

The plugin provides the following capabilities:

  • Blocking destructive commands: It can identify and intercept dangerous commands such as git reset --hard, git push --force, and rm -rf, preventing an Agent from accidentally deleting code or overwriting history.
  • Blocking access to keys: It prevents an Agent from reading sensitive files through Shell or file tools, including SSH keys, .env files, the ~/.aws directory, and coding CLI credentials.
  • Visual policy adjustment: Policies can be adjusted through a graphical interface. You can use the GUI command to quickly select the Standard, Strict, or Paranoid preset and manually enable or disable specific rules.
  • Rulebook extension: It supports adding custom blocking rules through rulebooks. Official rule packages are provided for Terraform, AWS, gcloud, and Azure, and custom JSON is also supported.
  • Policy version management: It supports sharing policy configurations via Git, ensuring consistent rules across team members or sessions in cloud environments.
  • Tool integration: It allows developers to call the checkCommand interface in their own tools, integrating security check logic without installing hooks.

Installation and Activation

Before use, ensure Node.js 18 or higher is installed on the system.

Run the following commands to install the plugin and check the environment status:

npx -y cc-safety-net@latest install
npx -y cc-safety-net@latest doctor

After installation, the plugin automatically hooks into the DSH execution flow. To update the plugin, run:

npx -y cc-safety-net@latest update

Typical Usage

During local development, it is recommended to start the GUI interface to review and adjust security policies:

npx cc-safety-net gui

The GUI allows you to intuitively view the rules currently in effect and adjust blocking policies as needed.

Applicable Scenarios and Notes

This plugin is suitable for development environments that require strict control over an Agent’s execution permissions.

Notes:

  • Configuration file corruption: If the configuration file is corrupted, the plugin will not block any commands.
  • Not a sandbox mechanism: It is not a sandbox. The plugin does not wrap processes, does not set file system permissions, and does not monitor network egress. Wrapping commands or reordering flags cannot hide dangerous operations.
  • Dependency requirement: Node.js 18 or higher is required.

Summary

CC Safety Net provides a basic execution security line of defense for DeepSeek Harness through command-level pre-checks, effectively preventing data loss or leakage caused by accidental Agent operations. To learn more about configuration modes or official rulebooks, refer to its documentation.

Directory | GitHub Repository