dsh-crw: A DeepSeek Harness Network Request Plugin Based on fastCRW

Introduction¶

DeepSeek Harness (DSH) defines network access as a capability boundary (ctx.web) and supports pluggable providers. The base layer enables search (web_search), but disables fetching (web_fetch) by default, citing the lack of SSRF protection and security risks. dsh-crw registers two providers (crw), using the fastCRW backend for server-side validation and content fetching, thereby allowing the fetch feature to be enabled safely and addressing modern anti-scraping walls such as Cloudflare.

Plugin Overview¶

Name: dsh-crw
Maintainer: fastcrw
Positioning: Provides fastCRW-based web_search and web_fetch providers for DeepSeek Harness (ctx.web).

The basic HTTP fetch provider runs fetch() directly in the Harness process, without blocking private IP ranges (such as 169.254.169.254) or performing DNS checks, potentially allowing the model to access cloud metadata endpoints. fastCRW performs server-side resolution and validation of target servers, rejects private ranges, and ensures that the Harness process does not open connections selected by the model. In addition, this plugin addresses access issues with modern walls such as Cloudflare and can handle complex challenges at the browser layer.

Core Features¶

• web_search: Provides web search capability.
• web_fetch: Enables fetching with security protections.
• SSRF protection: Blocks access to private IPs, loopback addresses, link-local addresses, or multicast ranges.
• Markdown format: Returns fetched content in Markdown format.
• Self-hosting support: Supports running the fastCRW engine locally.

Installation and Enablement¶

Installing this plugin requires first obtaining a fastCRW API key, then adding it to the DSH configuration.

1. Obtain the API key:

    export CRW_API_KEY=...

(Note: fastcrw.com offers a one-time free quota of 500 credits, no credit card required.)

2. Install the plugin:

    dsh plugin --profile default add dsh-crw

3. Configure the providers:
   In the configuration file (such as cordis.patch.yml), point the search and fetch providers to crw. By default, the base layer disables fetching; this plugin fixes this by enabling it and adding SSRF protection.

    - id: web
      config:
        searchProvider: crw
        fetchProvider: crw

Typical Usage¶

By pointing the providers to crw, the model can use the same web_search and web_fetch tools as the built-in tools, but with a different backend.

# 设置 API 密钥
export CRW_API_KEY=your_api_key_here

# 安装插件
dsh plugin --profile default add dsh-crw

# 启动 Harness
dsh --profile default

Applicable Scenarios and Notes¶

• Applicable scenarios: Scenarios that require reliable web content fetching (in Markdown format), especially targets with Cloudflare or JS challenges. Scenarios that require secure fetching (SSRF protection) to prevent the model from accessing internal resources.
• Notes:
  • By default, the DSH base layer disables fetching. This plugin enables it.
  • Cloud endpoints require CRW_API_KEY. Self-hosted endpoints do not.
  • This plugin handles Cloudflare and JS challenges, but interactive challenges may sometimes still fail.
  • It is under the MIT license.

Conclusion¶

dsh-crw provides secure, Markdown-based web fetching capabilities for DeepSeek Harness. By handling SSRF protection and anti-scraping walls on the server side, it allows the model to access the open web safely.

• GitHub repository
• Plugin directory