12 Sandbox Backend Plugins for DeepSeek Harness

Process-confinement seam: consumers hand over the exact argv, backends wrap it under a per-call policy and report enforcement. Local backends cover Linux/macOS; Windows ACL is a partial-enforcement rung.

What DeepSeek Harness defines at this extension point

Official slot: packages/sandbox
Extension kind: seam
ctx keys (2): ctx.sandboxctx.sandboxPolicy
Official built-ins: DeepSeek ships 1 implementation heresandbox-local, sandbox-windows-acl
Gap: largehow much of this seam the official taxonomy grades as still open
Audience: developer
Artifact kind: cordis-plugin
Seams: 1

Every field above is read from the DeepSeek Harness (DSH) source tree — deepseek-ai/deepseek-harness — not from our own guesswork about what these projects do. Same data as a live filter: browse this category in the full plugin list.

12 Sandbox Backend Plugins indexed here

Sandbase Harness

sandbaseai

Open-source CMA-compatible agent runtime for any model, with MCP tools, sandboxed sessions, audit, replay, and a local console. Includes a native DeepSeek Harness bundle over stdio MCP.

InstallableBundle584

Axern

cofy-x

Open-source sandboxes for AI agents, untrusted code execution, and durable services.

Not a plugin164

Dsh Tensorlake Sandbox

tensorlakeai

A deepseek harness plugin for tensorlake sandbox

Not checked5

Deepseek Harness Handbook

sandbaseai

Agent-first, multilingual handbook for DeepSeek Harness: quickstarts, architecture, safety, troubleshooting, and production recipes.

Not checked5

Dsh Yolo Mode

SeverusZh

dsh-yolo-mode - an LLM-powered auto-approval plugin for DeepSeek Harness sandbox escalations (built-in presets + custom permission levels, fail-closed)

Not checked3

Sandbox Nono

omdsh-dev

nono沙盒支持

Not checked3

Dsh Auto Review

PerryLink

Second-model AI auto-review for DeepSeek Harness approval requests: a read-only reviewer subagent returns structured allow/deny verdicts with reasons, fail-closed by default, fully auditable from the session log (approval/asked -> autoReview/verdict -> approval/decided).

Not checked3