What it may solve
DeepSeek Harness plugin: a deployment deny list of filesystem roots the model may never touch - fences read, write, search, and shell tool calls at tools/pre-execute
Imported third-party catalog description; not a Registry verification conclusion.