dsh-tool-policy: Allow / Ask / Deny Before Tool Execution in DeepSeek Harness
dsh-tool-policy is a community plugin for DeepSeek Harness (DSH) that enforces declarative policy controls on built-in, third-party, and MCP tools before tool execution. It adopts a deny-by-default model and supports matching by tool name and argument patterns, applying allow, ask, or deny actions to individual calls. The plugin runs on Node.js, describes argument conditions using JSON Pointer, and provides decision trace logs that contain no sensitive data for troubleshooting. After installation, rules can be defined via YAML configuration—for example, allowing read-only operations, requiring approval for shell or external MCP tools, or outright blocking delete operations. Note that the plugin serves only as a policy routing layer and does not provide sandbox isolation, argument rewriting, or destructive behavior detection.
Read MoreMCP and Agent Skills Become New Attack Surface: Permission Governance, Static Scanning and ChainDrop Injection into Claude Configuration
In August 2026, the ChainDrop worm achieved persistence by injecting into `.claude/settings.json` and `.vscode/tasks.json`, with malicious execution triggered once developers opened the repository. Meanwhile, approximately 36% of MCP servers and Agent Skills have security flaws, and 80% of enterprises lack governance for Agentic AI. This article sorts out the three-layer attack surface of models/instructions/Harness, MCP Tool Poisoning and protocol approval gaps, introduces JFrog Agent Guard and skill-audit-mcp static scanning, and provides an actionable protection checklist for CI integration and runtime approval.
Read MoreModel Context Protocol Becomes New Attack Surface for AI Agents, Nearly Half of MCP Servers Have Security Risks
In July 2026, Island scanned over 33,000 MCP constructs and 475,000 tools, with 49% triggering security rules and 40.6% containing high-risk capabilities. Combining the malicious skills of ClawHub, the trust controversy of Claude Code, and CSA's zero-trust recommendations, this paper sorts out the core risks of the MCP ecosystem such as tool poisoning, supply chain attacks, and Agent permission boundaries, and provides a actionable governance checklist for developers and enterprises.
Read More