DeepSeek

For teams using DeepSeek, Sentinel checks prompts, agents, tool calls, and RAG flows independently of the provider.

Current models

According to the official DeepSeek API documentation, the current V4 model IDs are deepseek-v4-flash and deepseek-v4-pro. The DeepSeek changelog says legacy compatibility names are scheduled for discontinuation on July 24, 2026, so new examples should use the V4 model IDs.

Sources: DeepSeek model list · DeepSeek changelog

Architecture notes

DeepSeek API can be used through an OpenAI Chat Completions compatible interface and an Anthropic interface. Sentinel does not make provider details the center of the security model; the focus is prompts, tool calls, RAG context, system instructions, and output validation.

DeepSeek R1 reasoning chain security

DeepSeek R1 and R1-Distill models produce a reasoning trace inside <think>...</think> before the final response. This trace typically appears as a separate field in the API response and creates a distinct security surface.

• System instruction exposure — The model may restate system prompt instructions in reasoning steps. If the thinking trace is logged or returned to the user, it exposes confidential business logic (OWASP LLM02:2025).
• Indirect injection vector — Adversarial text in RAG documents or tool results can be interpreted while the model reasons, opening a prompt-hijacking path at the reasoning stage (OWASP LLM01:2025, MITRE ATLAS AML.T0051.001).
• Sensitive context leakage — PII or confidential data from conversation history or RAG context can appear in the reasoning trace. Avoid returning raw thinking traces to end-users; log them internally only in redacted form.
• Sentinel coverage — Sentinel Prompt Firewall scans R1 reasoning traces under the secret-leakage and prompt-injection rule categories. Enable the <code>scan_reasoning_trace: true</code> parameter in configuration.

Typical risks in DeepSeek integrations

• System instructions leaking into user responses or logs. OWASP LLM02:2025
• User input escaping the JSON schema or action boundary in tool calls. OWASP LLM01:2025
• Sensitive customer, financial, or operational data leaking from RAG documents. OWASP LLM02:2025
• Guardrail assumptions silently breaking during provider changes. OWASP LLM09:2025
• System instructions or PII restated inside R1 reasoning traces. OWASP LLM02:2025
• DeepSeek API key embedded in CI environment variables or prompt files. OWASP LLM09:2025

These are not provider-specific magic flaws. Even when the LLM provider changes, the same prompt, tool-use, retrieval, and secret boundaries remain. That is why Sentinel docs focus on evidence, rule IDs, output formats, and closure commands more than the provider name.

Compliance: data handling and residency

DeepSeek API endpoints operate from China-based infrastructure. Evaluate which infrastructure prompt and completion data transits and is processed on. For environments subject to GDPR, KVKK, HIPAA, or PCI-DSS data-residency requirements, review the alternatives below.

• Local deployment (Ollama / llama.cpp) — deepseek-r1 or deepseek-v3 can be run on local hardware or a private cloud. Data does not leave to third-party infrastructure, providing the highest compliance assurance.
• DeepSeek via Azure AI Foundry / AWS Bedrock — Microsoft Azure and AWS offer DeepSeek models on their own regional infrastructure. Data processing occurs within the chosen cloud region's BAA and DPA scope.
• Direct DeepSeek API — Appropriate for low-to-medium risk use cases without data-residency constraints and without processing sensitive personal data.

What to scan

Sentinel automatically scans the following seven security surfaces in your DeepSeek integration. Every check is reported by rule ID; findings can be fed into CI/CD pipelines via SARIF or JSON output.

• System and developer prompt leakage — Checks whether confidential instructions in the system layer leak into user responses or API response bodies. Rule: <code>prompt-firewall/system-prompt-leakage</code>
• Tool-call argument injection — Detects whether user input escapes the tool-argument boundary and whether server-side validation is bypassed. Rule: <code>tool-argument-injection</code>
• Sensitive data leakage in RAG context — Audits whether PII, financial data, or confidential business content from retrieval documents leaks into model responses. Rule: <code>rag-data-leakage</code>
• R1 reasoning trace leakage — Scans DeepSeek R1 / R1-Distill <code>&lt;think&gt;</code> blocks for system instructions or PII. Rule: <code>reasoning-token-leakage</code>
• MCP tool poisoning — Verifies signatures and schemas of tool definitions received from MCP servers; flags tampered definitions. Rule: <code>mcp-tool-poisoning</code>
• API key and secrets detection — Scans source code, prompt files, and environment variables for exposed <code>DEEPSEEK_API_KEY</code> and other API key patterns. Rule: <code>secrets/deepseek-api-key</code>
• OWASP LLM compliance check — Evaluates your integration against the OWASP LLM Top 10 2025 framework and reports which categories have findings.

sentinel scan ./app/ --provider deepseek
sentinel scan ./app/ --rule reasoning-token-leakage
sentinel secrets-scan ./app/ --rule secrets/deepseek-api-key
sentinel compliance check . --framework owasp-llm

Example configurations

The examples below show three sentinel.yaml templates: basic integration, R1 reasoning-trace auditing, and a full DeepSeek configuration.

Basic integration

provider:
  name: deepseek
  model: deepseek-v4-flash

checks:
  - prompt-injection
  - tool-argument-injection
  - rag-data-leakage
  - secrets/deepseek-api-key

With R1 reasoning-trace auditing

provider:
  name: deepseek
  model: deepseek-r1      # or deepseek-r1-distill-qwen-32b

checks:
  - prompt-injection
  - reasoning-token-leakage
  - rag-data-leakage

reasoning:
  scan_reasoning_trace: true   # scan <think> blocks
  strip_before_response: true  # never return trace to users

Full configuration with MCP bridge

provider:
  name: deepseek
  model: deepseek-v4-pro
  base_url: https://api.deepseek.com/v1

checks:
  - prompt-injection
  - tool-argument-injection
  - rag-data-leakage
  - reasoning-token-leakage
  - mcp-tool-poisoning
  - secrets/deepseek-api-key

mcp:
  server: ./mcp-server.json
  verify_tool_signatures: true

compliance:
  framework: owasp-llm
  fail_on: CRITICAL

output:
  format: sarif
  path: ./sentinel-results.sarif

CI/CD

For DeepSeek-backed agents or RAG apps, prompt changes, tool schema changes, and retrieval settings should be tested in pull requests. Sentinel findings keep the same rule IDs; the pipeline does not need to be rewritten when the model provider changes.

Basic shell commands

# Scan and output SARIF for GitHub Security tab
sentinel scan ./app/ -f sarif -o sentinel.sarif

# Check OWASP LLM compliance
sentinel compliance check . --framework owasp-llm

# Detect exposed API keys and secrets
sentinel secrets-scan ./app/

# DeepSeek R1 reasoning trace scan
sentinel scan ./app/ --rule reasoning-token-leakage

# Exit non-zero on CRITICAL/HIGH findings (blocks merge)
sentinel scan ./app/ --fail-on CRITICAL,HIGH

GitHub Actions workflow (full example)

name: Sentinel AI Security

on: [push, pull_request]

jobs:
  sentinel:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Sentinel
        run: pip install eresus-sentinel

      - name: Scan for AI security issues
        run: |
          sentinel scan ./app/ -f sarif -o sentinel.sarif
          sentinel secrets-scan ./app/
          sentinel compliance check . --framework owasp-llm
        env:
          DEEPSEEK_API_KEY: ${{ secrets.DEEPSEEK_API_KEY }}

      - name: Upload SARIF to GitHub Security
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: sentinel.sarif
        if: always()

MCP integration security

When DeepSeek models are used alongside Model Context Protocol (MCP) servers, the agent security surface spans MCP tool signatures, resource permissions, and call chains. DeepSeek’s OpenAI-compatible interface works with existing MCP bridge implementations, but this flexibility introduces additional risk points.

• Tool poisoning — Forged or modified MCP tool descriptions can cause the model to misdirect agent actions. Sentinel MCP Agent Security module detects tool signature changes.
• Excessive agent authority — If DeepSeek prompt injection succeeds, every tool accessible via MCP becomes a potential abuse target. Define a permission boundary (allowlist) in tool schemas.
• Call chain audit logging — Log the MCP call chain. Tracking which model called which tool with which arguments and when is essential for forensics and compliance.
• Model boundary validation — When configuring requests via the DeepSeek MCP bridge, specify the model ID explicitly; ambiguous alias usage can break security model assumptions.

sentinel scan ./mcp-config/ --rule mcp-tool-poisoning
sentinel scan ./mcp-config/ --rule tool-argument-injection
sentinel mcp audit ./mcp-server.json

Pre-production checklist

References

• DeepSeek API Documentation
• DeepSeek AI on Hugging Face
• OWASP LLM Top 10 2025
• OWASP AI Exchange
• MITRE ATLAS — Adversarial Threat Landscape for AI Systems
• Microsoft — Taxonomy of Failure Modes in Agentic AI Systems
• Azure AI Foundry — DeepSeek on Azure