Skip to content
dsh marketplace

dsh-correctover

Verified

dsh-correctover · v1.0.2 · LicenseRef-Proprietary

Correctover runtime security for DeepSeek Harness (DSH): CCS 7-dimension verification, command-injection/SSRF/credential-exfil blocking, Ed25519 receipts, audit-first. Install with `dsh plugin add dsh-correctover`.

Install

dsh plugin add dsh-correctover

Confirm the layer applied with dsh --profile default --dump-config — see the install guide.

Source

Published to npm without a public repository. Inspect the package contents before installing.

Tags

Readme

dsh-correctover

Runtime security for DeepSeek Harness (DSH) — CCS 7-dimension verification, command-injection / SSRF / credential-exfiltration blocking, Ed25519 receipts, audit-first.

Install

dsh plugin add dsh-correctover

Or with npm directly:

npm install dsh-correctover

What it does

Once installed in a DSH profile, the plugin auto-mounts and registers:

  • ccs_status model tool — report current policy and live stats
  • ccs_audit model tool — run a security audit on installed plugins
  • tools/pre-execute hook — block dangerous tool calls
  • tools/post-execute hook — scan outputs for leaked secrets / prompt injection
  • subprocess spawn wrapper — block command injection and credential exposure
  • web fetch wrapper — block SSRF to private / link-local networks

It is audit-first: by default it observes and logs, never blocks. Switch to enforce mode when you have tuned rules against real traffic.

CCS standard

CCS (Correctover Conformance Shape) is a 7-dimension runtime verification standard for AI agents: Structure, Schema, Latency, Cost, Identity, Integrity, Security. Published as IETF Internet-Draft draft-correctover-ccs.

Links