dsh-netguard：出网护栏（SSRF 防护）
`dsh-netguard` 是 DeepSeek Harness (DSH) 插件，旨在通过 `netguard` 服务和 `fetch_url` 工具防止 SSRF 攻击。该插件提供严格的出网安全防护，包括只允许公网访问、DNS 解析检查、重定向逐跳复查、流式大小限制、超时控制及端口黑名单等功能。文章详细介绍了其安装配置、典型用法（支持 JS 调用及模型工具调用），并指出了其在 DNS 重绑定、代理感知及内容安全等方面的局限性。
Read Moredsh-safe-web-fetch: SSRF Protection WebFetch Plugin for DeepSeek Harness
`dsh-safe-web-fetch` is a DeepSeek Harness (DSH) plugin designed to mitigate SSRF security risks associated with `web_fetch`. It provides restricted network access without disrupting existing systems through strict DNS validation, connection isolation, redirect control, and content filtering. The plugin supports configuring request size limits, rate limits, and allowlists, making it suitable for developing intelligent agents in restricted environments. Developers can install and configure the plugin at the Profile layer to enable these security protections.
Read Moredsh-fetch-third-party: Safe Third-Party Web Fetch for DeepSeek Harness
The `dsh-fetch-third-party` plugin addresses SSRF security risks in web scraping with DeepSeek Harness (DSH) through a “courier mode.” It delegates requests to user-configured third-party services instead of making direct local connections, thereby eliminating the attack surface. The plugin supports multiple providers, including Tavily and Jina Reader, as well as a custom Crawl4AI stack, and features secure credential storage, session-level budget limits, scraping caching, and structured output, ensuring safe and efficient retrieval of web content in DSH environments.
Read More