CharlotteN7/dsh-netguard

README excerpt

dsh-netguard An egress policy for DeepSeek Harness: a host allowlist on the web fetch and web search tools, checked at connect time, built as an out-of-repo plugin. It ships in audit mode, where nothing is refused. Every decision is recorded and every request goes through, including the ones the policy would deny; mode: enforce is what turns the records into refusals. It governs those two tools and nothing else — the model channel and a vendor search provider's own transport are harness-originated HTTP that this package never sees. The harness has no network control of any kind. Its sandbox governs file effects only — packages/shell/bash-sandbox/README.md:85 says network and process visibility are outside its vocabulary — and web fetch is described in-source as an SSRF primitive with private-network protection "not implemented". This package adds the part that is achievable from an ordinary mounted plugin. Read this first: what it does not do It is not an egress firewall. It governs web fetch and web search . It does not see one byte sent by bash , run code , a terminal session, an MCP server, or a delegated external agent. Governing those needs confinement at the sandbox or networ…

Category