DeepSeek Harness Plugin Hub

Publish and manage complete Harness Profiles. Discover Plugins for your next setup.

Explore

PluginsPresetsDocsNews

Community

Publish a pluginContactReport an issue

Resources

Plugin Hub on GitHubDeepSeek HarnessSystem statusPrivacy notice
© 2026 DeepSeek Harness Plugin HubPowered byPaxTech

Independent and unofficial. Not affiliated with, authorized by, or endorsed by DeepSeek.

Web Fetch Allowlist — DSH Plugin for DeepSeek Harness
← Plugins
W

dsh-web-fetch-allowlist

Web Fetch Allowlist

DSH web fetch provider with configurable non-public CIDR allowlist (thin wrapper over @deepseek-ai/dsh-web-fetch-http, for Clash fake-ip etc.). Pure JS, no build.

The plugin will be installed here. Keep web if you are unsure.

npx -y @deepseek-ai/dsh plugin --profile web add github:xfqz86/dsh-web-fetch-allowlist#b9ee276675cd861b71d685e54b09960917307849
READMECompatibilityVersions

Compatibility and provenance

Web Fetch Allowlist is published as dsh-web-fetch-allowlist and currently resolves to version 0.1.0. The Hub verifies its manifest and preserves the exact installation source for reproducible installs.

DSH compatibility
*
Runtime surfaces
any
Release source
github
Registry updated
9/29/2026

Versions

0.1.0stable
9/29/2026

Related plugins

Loading related plugins…

Latest
0.1.0
DSH
*
HMR
Process restart
Tree shaking
Safe tree shaking not declared
Unpacked size
Unavailable
Files
Unavailable
Surface
any
License
MIT
Source
github
GitHub
★ 0
Weekly downloads
0
Last push
9/29/2026
View source ↗
README badge

Click the badge to copy Markdown for your README.

Do you maintain this Plugin?Claim benefit · Priority security scan

Verify the GitHub repository declared in package.json to manage this listing. After you claim it, Hub will prioritize a security scan of the current version and publish the result when it passes.

Claim this Plugin →
Report an issue
DeepSeek Harness Plugin Hub
ProfilesPluginsCategoriesNewsDocsSign inManage Profiles
ProfilesPluginsCategoriesNewsDocsSign in

Related plugins

More verified plugins in search-research.

Weknora@wxg-prc-cpg/dsh-weknoraWeKnora knowledge retrieval tools for DeepSeek Harness (dsh): semantic search, document reading and RAG/agent answers over your own knowledge bases.Free Searchdsh-free-searchFree web search for DeepSeek Harness: 24 engines (Bing/DuckDuckGo/AnySearch/SearXNG/Exa/Tavily/Keenable/Firecrawl/Parallel keyless; Zhihu global/site via MCP and Perplexity/SerpBase/DeepSeek/You.com/Baidu/Kimi/Aliyun/Doubao with key; OpenAI/Gemini/Claude Dejadsh-dejadeja-vu memory for DeepSeek Harness: the session history of forty other coding agents, searchable and recalled before each step — a local index, no LLM.Builtin Browserdsh-builtin-browserShared real browser plugin for DeepSeek Harness: install-and-use — a visible native browser the human can take over, driven by the agent over CDP. DOM-level interaction (React/Vue safe), per-task session isolation, cookie persistence (dsh_browser_auth), C

README

dsh-web-fetch-allowlist

DSH 的白名单网页抓取 provider 插件（服务端 Host，无浏览器端，纯 JS 无构建）。

在 ctx.web 注册 http-allowlist 抓取 provider：薄套壳，复用官方 @deepseek-ai/dsh-web-fetch-http 的传输/重定向/钉扎/解码，仅注入白名单 DNS 解析，用于 Clash fake-ip 等本地覆写场景。

结构：lib/allowlist.js（CIDR 白名单）+ lib/resolver.js（注入官方的 DNS 校验）+ lib/index.js（换 id 注册）。lib/ 即源码，直接推 GitHub；验证只跑 pnpm test。

安全模型（没有抛弃校验）

白名单是“窄例外”，其余校验全部保留：

  • URL 层：仅 http:/https:、禁内嵌凭据、长度 ≤2048。
  • DNS 层：单次解析、任一答案非公网即拒绝整个答案集；白名单命中才放行；连接钉扎到已校验地址集（防 TOCTOU）；IPv6 做 DNS64/NAT64 翻译复核；IP 字面量同样校验。
  • 传输层：仅跟随同源重定向并逐跳重校验；超时、字节/字符上限；Content-Type 仅解码文本系；charset 显式解码。
  • 代理层：复用 proxyRouteFor 同一路由答案；白名单外 IP 字面量不走代理快捷路径。

默认白名单（开箱即用，可覆盖）：

  • 198.18.0.0/16（Clash fake-ip IPv4）
  • 2001:2::/48（被劫持的 fake IPv6 AAAA）
  • fd00::/8（Clash fake-ip IPv6 ULA）

0.0.0.0/0、::/0 等宽条目会显著弱化 SSRF 防护，仅限可信环境。

安装（标准 cordis.patch 模式）

dsh plugin --profile web add "link:<本目录>"

cordis.patch.yml 已自带挂载与切换（web.fetchProvider: http-allowlist），改动后服务端需重启 dsh。卸载：

dsh plugin --profile web remove dsh-web-fetch-allowlist

配置

全部可选，patch 的 config 字段：

字段默认说明
maxResponseBytes5000000响应体最大字节数
maxBodyChars100000解码后最大字符数
timeoutMs30000抓取超时
maxRedirects5同源重定向跳数
userAgentdsh-web-fetch-allowlist/0.1.0请求头
allowedNonPublicCidrs上述三段被视为公网的额外 CIDR；[] 即严格公网策略