dsh-shield

In DeepSeek Harness, plugins, MCP servers, and built-in tools all execute under the host Node process permissions. A single plugin install can trigger prepare or preinstall scripts that run on your machine before any plugin code is even loaded; at runtime, the model can invoke MCP endpoints to exfiltrate local files, credentials, or client data. dsh-shield sits at exactly these boundaries, covering the critical gaps between install time and execution time with two coordinated layers.

The pre-install scanner downloads, unpacks, parses, and inspects packages without ever executing target code. The runtime guard hooks into the official tools/pre-execute and ctx.tools.guard(), returning allow, ask, or deny for every tool call. Core capabilities span risk discovery, four-tier policy enforcement, MCP trust tiering, credential-exfiltration denial, six-level data classification with automatic redaction, prompt-injection detection with escalating responses, and full audit logging. Risk scores are computed by deterministic formulas; the LLM can never decide ALLOW or DENY, and a broken configuration fails closed rather than silently letting requests through.

Best suited for teams running Harness in production, security and ops engineers who need auditable boundaries around third-party plugins and MCP servers, and developers who want deterministic policy to replace manual line-by-line review. dsh-shield does not claim perfect security or a 100-percent guarantee against prompt injection, but it turns risk discovery, decision traceability, and human approval into a process you can audit rather than a hope you can only wish on.