dsh-cn-mlps: A Static MLPS Compliance Checker for DeepSeek Harness

What Does It Do?

MLPS Compliance Check is a DSH plugin for DeepSeek Harness that finds statically detectable classified-protection items in code and configuration according to GB/T 22239-2019. It solves the problem of issues that developers could fix before an assessment but usually only hear about during one, surfacing default credentials, weak password hashing, plaintext transport, leftover debug switches, and error messages that leak internal details. Maintained by feely0208 under the MIT license and written in Shell, it is designed as a CI gate rather than a replacement for a formal MLPS evaluation.

Core Features

• High-severity detection: flags default credentials and MD5/SHA1 password storage, mapped to the identity authentication, access control, and data confidentiality sections of the secure computing environment.
• Medium-severity detection: catches http:// plaintext transport, leftover debug switches, and error messages exposing internal details, mapped to secure communication network and intrusion prevention.
• Section-name citations only: rule sources cite verifiable section names instead of clause numbers the author cannot confirm line by line.
• Rule listing: exposes every rule together with its basis so you can check it against the standard text.
• Report output: produces HTML reports and a demo mode for reviewing detection results in a pipeline.

How to Use This Plugin?

After enabling it in DSH, run the check against a target codebase to get a severity-grouped list of classified-protection items. Use demo mode to preview what it catches, list the rules to verify each basis, and generate an HTML report when you need an artifact for review. It fits well as a CI gate: if a rule ever contains a clause number in the form digits.digits.digits, the test fails by design. Know the boundaries — it does not cover physical environment, boundary devices, security management center, policies, or personnel, and it makes no gap determination, so "nothing found" does not mean "compliant"; log retention requirements live in a companion plugin.

How to Troubleshoot This Plugin?

A rule validation failure usually means a rule file contains a clause number in the digits.digits.digits form; this is an intentional CI gate, so replace it with a confirmed section name. If a scan returns nothing, confirm the target really is code and configuration rather than a deployed system and its operations, which are outside the scope by design.