dsh-egress-gate
Deterministic network egress gate for
DeepSeek Harness (dsh).
Content scanning (dsh-read-guard) guards what enters the model; this
guards where data may leave to. web_fetch / web_search calls are
checked against a destination allowlist in tools/pre-execute and denied
before they run. Shell commands are scanned for fetch-verb URLs —
observation by default, enforcement opt-in, honest about precision. Zero LLM
calls in the trust path.
Family: read · write · do · call · leave-behind · egress (where data may
flow).
Why now (checked 2026-10-12)
Empty lane. Five keyword searches (network allowlist, egress firewall,
url filter, web fetch restrict, …) return nothing on GitHub; the awesome
list has no entry gating destinations. Neighbours are all different axes:
content-pattern secret rules (dsh-defend), LLM-judged commands
(dsh-jev-guard), proxy configuration (official network-proxy docs). For
teams, "which hosts may the agent reach" is the first compliance question —
and the deterministic answer was unowned.
Policy
- Deny always wins; a non-empty
allow list means "only these hosts"
(example.com covers api.example.com; *.example.com is the explicit
form).
- Web tools are enforced at full precision — the URL is in the arguments.
- Shell: URLs following
curl / wget / Invoke-WebRequest /
Invoke-RestMethod / fetch / http on the same command segment. This
cannot see through scripts, variables, or proxies — so it warns by
default and denies only when you opt into shellMode: 'enforce'.
Install
dsh plugin --profile default add github:zhengqiuyang/dsh-egress-gate
Prebuilt lib/ ships in the repo — git installs need no build step and no
allowBuilds authorization.
Configure
- id: dsh-egress-gate
name: dsh-egress-gate
config:
webTools: [web_fetch, web_search]
shellTool: bash # '' disables the shell scan
allow: [docs.deepseek.com, github.com]
deny: [pastebin.example]
shellMode: observe # observe | enforce
Develop
npm install && npm test
Kill criteria
If dsh ships first-party destination policy, or proxy-layer plugins add
per-host rules, this freezes at its last working version with a postmortem
here.
