dsh-risk-guard
A DeepSeek Harness plugin that locally audits tool calls, scores operational risk, and blocks a defined set of catastrophic commands.
Install
$ dsh plugin --profile web add dsh-risk-guardPlugin Overview & Capabilities
AI-assisted organization based on the public repository snapshot. The content must be grounded in source evidence and does not replace compatibility or security verification.
Key Capabilities
- Records tool-call audit data including tool name, redacted arguments, result, risk tags, and explainable score.
- Uses deterministic, local risk scoring with no LLM calls or stated extra cost.
- Adds the `/risk-guard` command for current-session, last-turn, historical, date-filtered, and JSON reports.
- Optionally blocks specified catastrophic operations before execution through an insurance fuse.
- Stores audit records under `<DSH_HOME>/risk-guard/`, with monthly JSONL archival and configurable retention.
- Redacts documented secret-shaped values before storage and states that it makes no network calls or sends telemetry.
Useful For
- Review what an agent did during a DeepSeek Harness session.
- Identify high-risk tool activity and the reasons behind assigned risk scores.
- Prevent configured categories of irreversible deletion, disk formatting, protected force-pushes, and credential-file exfiltration attempts.
- Keep local, redacted operational audit records for later inspection.
Who It Fits
- DeepSeek Harness users who run agents with tool access.
- Developers seeking local audit trails for agent tool calls.
- Teams or individuals wanting guardrails around destructive shell and Git operations.
Documented Limitations
- Fuse blocking is limited to the documented v1 command patterns; other operations run untouched.
- The fuse can be disabled with `fuseEnabled: false`.
- The README states testing for dsh `0.1.0-rc.6` and the `web` profile; `headless` works with conditional command registration.
- Requires an existing DeepSeek Harness installation.
- Audit records are written asynchronously, so newly generated records may not appear immediately.
DSH Compatibility
Version-specific runtime evidence collected by DSH Plugin. A missing result means we have not tested that combination yet.
Security Signals
Objective signals discovered from package metadata and source inspection. These are not a guarantee that a plugin is safe.
package.json declares 1 runtime, 13 development, 5 peer, and 0 optional dependencies.
package.json declares DSH bundle metadata.
GitHub reports the repository license as MIT.
A root package.json was captured and can be inspected by the registry.
Public GitHub source metadata is available for this registry snapshot.
Source & Registry Notes
Public provenance, Registry classification, and the latest source check for this entry, kept separate from runtime verification.
- Source repository
- shuxue6662-a11y/dsh-risk-guard
- Registry source
- GitHub · dsh-plugin topic
- Registry classification
- Plugin
- Source checked
- 790bda5 · 2026-08-18
This project is independently indexed from public source information. DSH Plugin is not affiliated with DeepSeek or the plugin author. Always check the author repository before installation.
Repository Activity
- GitHub stars
- 0GitHub stars
- Forks
- 0
- Open issues
- 0
- Last commit
- 2026-08-17
- Last release
- No release detected
Related DSH Plugins
Ranked by overlapping capabilities, use cases, plugin type, categories, and DSH profile.
DSH undo and crash-recovery plugin with snapshots, rollback, Safe Mode, and offline Windows tools.
View plugin →Vision routing and pixel-level visual tool suite for DeepSeek Harness agents with built-in free fallbacks.
View plugin →Second-model AI auto-review for DeepSeek Harness approval requests with fail-closed safety and session audit.
View plugin →Local-first AI agent runtime and DSH plugin bundle providing sandboxed sessions, MCP tools, audit logs, and session replay.
View plugin →