dsh-riskproof

RiskProof

Stop sensitive data from leaving through AI tools, and see where it came from.

RiskProof tracks cross-tool data flows and blocks sensitive tool output in DeepSeek Harness.

A persistent security beacon shows redacted execution receipts. Deterministic rules need no extra LLM calls.

[English](README.md) · [简体中文](README.zh-CN.md)

[](https://www.npmjs.com/package/dsh-riskproof) [](https://github.com/onlyqzq/dsh-riskproof/actions/workflows/ci.yml)

Try the rules before setting up DSH

With Node.js 22.19+, run four synthetic protection examples:

npx --yes --package=dsh-riskproof@0.7.0 riskproof-demo --language en

No DSH profile, model API key or repository checkout is needed. npm downloads the

package; the installed rehearsal runs locally with the default balanced policy.

It checks web-influenced commands, customer data egress, changed tool schemas and

read-only task restrictions. All four should show ✓ and deny. Use --json for

structured results. This demonstrates the rules; it does not activate protection

or validate your configuration. Install into DSH below to protect real tool calls.

Quick Start

Requires Node.js 22.19+, with DSH and pnpm installed:

dsh plugin --profile web add dsh-riskproof@0.7.0
dsh --profile web --dump-config

Confirm the output includes name: dsh-riskproof, restart the Web profile, and click

its security beacon. Then enter this directly in the conversation composer:

/riskproof demo

Four isolated rehearsals show web content influencing a command, customer data transfer,

a tool schema change and a read-only restriction. They use synthetic inputs, read no private files, run no shell commands,

send no email, and do not enter live protection counts. RiskProof's rules and direct slash

commands make no extra model calls; ordinary DSH model usage keeps its normal cost.

See [installation and troubleshooting](docs/installation.md) for the complete steps.

| Compatibility | Verified scope |

| --- | --- |

| Node.js | 22.19+; see the [CI matrix](.github/workflows/ci.yml) |

| DSH | Install/tool pipeline: 0.1.0-rc.7, 0.1.2-rc.1 and 0.2.1-rc.4; Web: 0.1.2-rc.1 and 0.2.1-rc.4 |

| Model | Deterministic rules need no reviewer model or additional API key |

| Language | Beacon, overview and reports: experience.language: en or zh-CN (default) |

Newer DSH versions require separate verification. See [validation evidence](docs/v0.3-validation.md)

for the historical 0.1 results and the [v0.7 validation record](docs/growth-plan.zh-CN.md#v07-验收记录) for the current release.

Start here

| Goal | Read |

| --- | --- |

| Install and try it | [Quick Start](#quick-start) · [Installation](docs/installation.md) |

| Tune protection and task scope | [Configuration](docs/configuration.md) |

| Understand or contribute to the project | [Architecture](docs/architecture.md) · [Development](docs/development.md) |

| Push code or publish a version | [Manual release guide (中文)](docs/releasing.zh-CN.md) |

| Find security boundaries and version records | [Documentation index](docs/README.md) |

---

See protection beside your conversation

A persistent RiskProof security beacon sits beside the DSH conversation. Ordinary tool

calls update it automatically. Click to open a compact overview; activity never opens it for you.

• Waits honestly for tool activity; there is no continuous simulated scan.
• Shows pending execution receipts and briefly acknowledges newly checked calls.
• Displays a call-distribution ring, the last 24 checks and up to three recent risk chains.
• Follows the selected conversation and removes stale charts when its connection is unavailable.
• Separates initial sync from disconnection, offers manual reconnect, and displays task scope and record limits.

*Real DSH Web screenshots; a local test model produced these records through the actual

Agent/tool pipeline. Normal use does not require a rehearsal.*

The chart counts calls with no triggered risk, calls blocked by RiskProof, and calls needing

attention. It does not invent a safety score. Observe mode, disabled recording and disabled

detection features are identified. Counts cover retained records in the current plugin run.

Not triggering a rule does not establish that an operation is safe.